Chris CoutinhoandClaude Opus 4.7
d4760f64dc
Nextcloud installs without pretty URLs return a 301 from `/.well-known/openid-configuration` to `/index.php/.well-known/openid-configuration` (e.g. Hetzner StorageShare). `_get_cached_discovery` did not enable follow_redirects, so httpx raised HTTPStatusError on the 301 and the AS-proxy authorize handler returned 500, breaking client connections (e.g. claude.ai). Pass `follow_redirects=True` to the httpx client used for the discovery fetch only — downstream OIDC endpoints (token, userinfo, etc.) are absolute URLs read from the discovery doc and are unaffected. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
62 lines
2.1 KiB
Python
62 lines
2.1 KiB
Python
"""Unit tests for OIDC discovery fetch in oauth_routes."""
|
|
|
|
from unittest.mock import patch
|
|
|
|
import httpx
|
|
import pytest
|
|
|
|
from nextcloud_mcp_server.auth import oauth_routes
|
|
from nextcloud_mcp_server.auth.oauth_routes import _get_cached_discovery
|
|
|
|
pytestmark = pytest.mark.unit
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _clear_discovery_cache():
|
|
"""Reset the in-memory discovery cache between tests."""
|
|
oauth_routes._discovery_cache.clear()
|
|
yield
|
|
oauth_routes._discovery_cache.clear()
|
|
|
|
|
|
async def test_discovery_follows_redirect_to_index_php():
|
|
"""Discovery fetch must follow 301s.
|
|
|
|
Hetzner StorageShare and other Nextcloud installs without pretty URLs
|
|
redirect ``/.well-known/openid-configuration`` to
|
|
``/index.php/.well-known/openid-configuration``. Without follow_redirects
|
|
the OAuth authorize handler raises HTTPStatusError and returns 500
|
|
(see oauth_routes._get_cached_discovery).
|
|
"""
|
|
|
|
pretty_url = "https://nx.example.com/.well-known/openid-configuration"
|
|
rewritten_url = "https://nx.example.com/index.php/.well-known/openid-configuration"
|
|
discovery_doc = {
|
|
"issuer": "https://nx.example.com",
|
|
"authorization_endpoint": "https://nx.example.com/index.php/apps/oidc/authorize",
|
|
"token_endpoint": "https://nx.example.com/index.php/apps/oidc/token",
|
|
}
|
|
|
|
def handler(request: httpx.Request) -> httpx.Response:
|
|
if str(request.url) == pretty_url:
|
|
return httpx.Response(301, headers={"location": rewritten_url})
|
|
if str(request.url) == rewritten_url:
|
|
return httpx.Response(200, json=discovery_doc)
|
|
return httpx.Response(404)
|
|
|
|
transport = httpx.MockTransport(handler)
|
|
|
|
def fake_client(**kwargs):
|
|
kwargs["transport"] = transport
|
|
return httpx.AsyncClient(**kwargs)
|
|
|
|
with patch(
|
|
"nextcloud_mcp_server.auth.oauth_routes.nextcloud_httpx_client",
|
|
side_effect=fake_client,
|
|
) as factory:
|
|
result = await _get_cached_discovery(pretty_url)
|
|
|
|
assert result == discovery_doc
|
|
factory.assert_called_once()
|
|
assert factory.call_args.kwargs.get("follow_redirects") is True
|