From 1d730c99bc0eb43178760bd652ccd610607dbfb6 Mon Sep 17 00:00:00 2001
From: Chris Coutinho <chris@coutinho.io>
Date: Fri, 29 May 2026 00:10:35 +0200
Subject: [PATCH] test: clear SonarCloud security false positives in new tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The new-code quality gate flagged test-only mock fixtures as security issues
(new_security_rating E):
- S2068 "hard-coded password" ×2: drop the unused "app_password" value from the
  get_app_password_with_scopes mocks (the code under test only reads truthiness
  + "scopes").
- S6418 "hard-coded token": NOSONAR on the Login Flow v2 poll-token test fixture.
- S5443 "publicly writable directory": NOSONAR on the /tmp debug screenshot path
  (matches this file's existing convention).

No behaviour change; all are test fixtures, not real credentials.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../test_astrolabe_multi_user_background_sync.py         | 2 +-
 tests/unit/test_login_flow.py                            | 2 +-
 tests/unit/test_oauth_tools_app_password_provisioning.py | 9 +++++----
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/tests/integration/test_astrolabe_multi_user_background_sync.py b/tests/integration/test_astrolabe_multi_user_background_sync.py
index af355ad6..8521aa74 100644
--- a/tests/integration/test_astrolabe_multi_user_background_sync.py
+++ b/tests/integration/test_astrolabe_multi_user_background_sync.py
@@ -129,7 +129,7 @@ async def enable_background_sync(page: Page, username: str) -> bool:
         logger.info("✓ Background indexing enabled for %s", username)
         return True
     except Exception:
-        screenshot_path = f"/tmp/astrolabe_enable_failed_{username}.png"
+        screenshot_path = f"/tmp/astrolabe_enable_failed_{username}.png"  # NOSONAR: test debug artifact, matches this file's convention
         await page.screenshot(path=screenshot_path)
         raise ValueError(
             f"Background indexing did not enable for {username}. "
diff --git a/tests/unit/test_login_flow.py b/tests/unit/test_login_flow.py
index 81052e71..e4bcc7d2 100644
--- a/tests/unit/test_login_flow.py
+++ b/tests/unit/test_login_flow.py
@@ -169,7 +169,7 @@ async def test_initiate_rewrites_login_url_to_public_host():
             "login": "https://nc-internal.test/login/v2/flow/tok123",
             "poll": {
                 "endpoint": "https://nc-internal.test/login/v2/poll",
-                "token": "secret-poll-token",
+                "token": "secret-poll-token",  # NOSONAR: test fixture, not a real secret
             },
         },
     )
diff --git a/tests/unit/test_oauth_tools_app_password_provisioning.py b/tests/unit/test_oauth_tools_app_password_provisioning.py
index c190d41d..81e96cdc 100644
--- a/tests/unit/test_oauth_tools_app_password_provisioning.py
+++ b/tests/unit/test_oauth_tools_app_password_provisioning.py
@@ -38,8 +38,11 @@ async def test_status_reports_provisioned_for_app_password_store(
     """A Login Flow v2 app password in storage => is_provisioned with the
     app_password credential type (was previously reported as not provisioned)."""
     storage = MagicMock()
+    # Only truthiness + "scopes" are read by _get_provisioning_status; omit the
+    # app_password value entirely (avoids a false-positive hard-coded-credential
+    # finding and keeps the mock to what the code under test actually uses).
     storage.get_app_password_with_scopes = AsyncMock(
-        return_value={"app_password": "tok", "scopes": ["notes.read"]}
+        return_value={"scopes": ["notes.read"]}
     )
     storage.get_refresh_token = AsyncMock(return_value=None)
     mocker.patch.object(
@@ -58,9 +61,7 @@ async def test_status_reports_provisioned_for_app_password_store(
 async def test_revoke_deletes_app_password(mocker, _no_astrolabe_settings):
     """Revoke must delete the app password from storage (not just refresh tokens)."""
     storage = MagicMock()
-    storage.get_app_password_with_scopes = AsyncMock(
-        return_value={"app_password": "tok", "scopes": None}
-    )
+    storage.get_app_password_with_scopes = AsyncMock(return_value={"scopes": None})
     storage.get_refresh_token = AsyncMock(return_value=None)
     storage.delete_app_password = AsyncMock(return_value=True)
     mocker.patch.object(