From af25c281bfd7839ce13788f0d01f8ffab55b4289 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Sat, 2 May 2026 18:32:19 +0200 Subject: [PATCH] fix(auth): use Settings for OIDC env vars in token revocation helper MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After merging master, _should_use_secure_cookies was refactored to read from Settings instead of os.getenv, which dropped `import os` from browser_oauth_routes.py — leaving _revoke_refresh_token_at_idp's four remaining os.getenv() calls undefined (CI ruff F821). Migrate the helper to the same Settings-based pattern: - oidc_discovery_url → settings.oidc_discovery_url - OIDC_CLIENT_ID → settings.oidc_client_id - OIDC_CLIENT_SECRET → settings.oidc_client_secret - NEXTCLOUD_HOST → settings.nextcloud_host Drive-by: the previous fallback read OIDC_CLIENT_ID, but the canonical env var per env.sample / docker-compose is NEXTCLOUD_OIDC_CLIENT_ID. The Settings layer handles this mapping via dynaconf, so the corrected name is now used automatically. Co-Authored-By: Claude Opus 4.7 (1M context) --- nextcloud_mcp_server/auth/browser_oauth_routes.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/nextcloud_mcp_server/auth/browser_oauth_routes.py b/nextcloud_mcp_server/auth/browser_oauth_routes.py index b603fa05..76c6949b 100644 --- a/nextcloud_mcp_server/auth/browser_oauth_routes.py +++ b/nextcloud_mcp_server/auth/browser_oauth_routes.py @@ -641,11 +641,13 @@ async def _revoke_refresh_token_at_idp(oauth_ctx: dict, refresh_token: str) -> N # starlette_lifespan). A flat shape is also accepted for tests and # historical callers. cfg = oauth_ctx.get("config") or oauth_ctx + settings = get_settings() try: - discovery_url = cfg.get("discovery_url") or os.getenv( - "OIDC_DISCOVERY_URL", - f"{os.getenv('NEXTCLOUD_HOST', '')}/.well-known/openid-configuration", - ) + discovery_url = cfg.get("discovery_url") or settings.oidc_discovery_url + if not discovery_url and settings.nextcloud_host: + discovery_url = ( + f"{settings.nextcloud_host}/.well-known/openid-configuration" + ) if not discovery_url: return @@ -658,8 +660,8 @@ async def _revoke_refresh_token_at_idp(oauth_ctx: dict, refresh_token: str) -> N logger.debug("IdP advertises no revocation_endpoint; skipping") return - client_id = cfg.get("client_id") or os.getenv("OIDC_CLIENT_ID") - client_secret = cfg.get("client_secret") or os.getenv("OIDC_CLIENT_SECRET") + client_id = cfg.get("client_id") or settings.oidc_client_id + client_secret = cfg.get("client_secret") or settings.oidc_client_secret if not (client_id and client_secret): logger.debug("No OIDC client credentials available for revocation") return