From 285f5174bded7f5221f1a9726291b2125025eb5e Mon Sep 17 00:00:00 2001
From: Chris Coutinho <chris@coutinho.io>
Date: Sun, 3 May 2026 22:52:45 +0200
Subject: [PATCH] fix(test): retry consent handling in
 login_flow_static_client_token
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The oidc app does a JS-driven re-authorize chain after login
(/apps/oidc/redirect → /apps/oidc/authorize → /apps/oidc/consent).
wait_for_load_state("networkidle") can fire during the brief gap before
the consent page renders, so a single _handle_oauth_consent_screen call
right after login often misses the consent div and the OAuth flow
deadlocks waiting for a callback that never arrives.

Move consent handling inside the callback-wait loop and poll for either
the consent page or the callback hit. Loop bound bumped to 60s to give
the JS-driven re-auth headroom.

Confirmed locally: integration test now passes against docker compose
--profile login-flow with the static OIDC client.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 tests/server/login_flow/conftest.py | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/tests/server/login_flow/conftest.py b/tests/server/login_flow/conftest.py
index f56d6aa7..900f02fc 100644
--- a/tests/server/login_flow/conftest.py
+++ b/tests/server/login_flow/conftest.py
@@ -1101,15 +1101,25 @@ async def login_flow_static_client_token(
             await page.fill('input[name="password"]', password)
             await page.click('button[type="submit"]')
             await page.wait_for_load_state("networkidle", timeout=60000)
-        try:
-            await _handle_oauth_consent_screen(page, username)
-        except Exception:
-            pass
 
+        # After login the oidc app issues a JS-driven re-authorize chain
+        # (/apps/oidc/redirect → /apps/oidc/authorize → /apps/oidc/consent).
+        # networkidle can fire during the gap before consent renders, so
+        # poll for either the consent page or the callback hit before
+        # bailing.
         start = time.time()
+        consent_handled = False
         while state not in auth_states:
-            if time.time() - start > 30:
+            if time.time() - start > 60:
                 raise TimeoutError("Timeout waiting for OAuth callback")
+            if not consent_handled:
+                try:
+                    handled = await _handle_oauth_consent_screen(page, username)
+                    if handled:
+                        consent_handled = True
+                except Exception as e:
+                    logger.warning("Consent screen handling raised: %s", e)
+                    consent_handled = True  # don't retry indefinitely
             await anyio.sleep(0.5)
         auth_code = auth_states[state]
     finally: