StarPunk/TODO_TEST_UPDATES.md

Test Updates Required for ADR-019 Implementation

Overview

The following tests need to be updated to reflect the PKCE implementation and removal of OAuth metadata/h-app features.

Changes Made

1. _verify_state_token() now returns Optional[str] (code_verifier) instead of bool
2. initiate_login() now generates and stores PKCE parameters
3. handle_callback() now accepts iss parameter and validates PKCE
4. OAuth metadata endpoint removed from /. well-known/oauth-authorization-server
5. H-app microformats removed from templates
6. IndieAuth metadata link removed from HTML head

Tests That Need Updating

tests/test_auth.py

State Token Verification Tests

• test_verify_valid_state_token - should check for code_verifier string return
• test_verify_invalid_state_token - should check for None return
• test_verify_expired_state_token - should check for None return
• test_state_tokens_are_single_use - should check for code_verifier string return

Fix: Change assertions from is True/is False to check for string/None

Initiate Login Tests

• test_initiate_login_success - needs to check for PKCE parameters in URL
• test_initiate_login_stores_state - needs to check code_verifier stored in DB

Fix: Update assertions to check for code_challenge and code_challenge_method=S256 in URL

Handle Callback Tests

• test_handle_callback_success - needs to mock with code_verifier
• test_handle_callback_unauthorized_user - needs to mock with code_verifier
• test_handle_callback_indielogin_error - needs to mock with code_verifier
• test_handle_callback_no_identity - needs to mock with code_verifier
• test_handle_callback_logs_http_details - needs to check /token endpoint

Fix:

• Add code_verifier to auth_state inserts in test setup
• Pass iss parameter to handle_callback calls
• Check that /token endpoint is called (not /auth)

tests/test_routes_public.py

OAuth Metadata Endpoint Tests (ALL SHOULD BE REMOVED)

• test_oauth_metadata_endpoint_exists
• test_oauth_metadata_content_type
• test_oauth_metadata_required_fields
• test_oauth_metadata_optional_fields
• test_oauth_metadata_field_values
• test_oauth_metadata_redirect_uris_is_array
• test_oauth_metadata_cache_headers
• test_oauth_metadata_valid_json
• test_oauth_metadata_uses_config_values

Fix: Delete entire TestOAuthMetadataEndpoint class

IndieAuth Metadata Link Tests (ALL SHOULD BE REMOVED)

• test_indieauth_metadata_link_present
• test_indieauth_metadata_link_points_to_endpoint
• test_indieauth_metadata_link_in_head

Fix: Delete entire TestIndieAuthMetadataLink class

tests/test_templates.py

H-app Microformats Tests (ALL SHOULD BE REMOVED)

• test_h_app_microformats_present
• test_h_app_contains_url_and_name_properties
• test_h_app_contains_site_url
• test_h_app_is_hidden
• test_h_app_is_aria_hidden

Fix: Delete entire TestIndieAuthClientDiscovery class

tests/test_routes_dev_auth.py

Dev Mode Configuration Test

• test_dev_mode_requires_dev_admin_me - May need update if it tests auth flow

Fix: Review and update if it tests the auth callback flow

New Tests to Add

1. PKCE Integration Tests - Test full auth flow with PKCE
2. Issuer Validation Tests - Test iss parameter validation
3. Endpoint Tests - Verify /authorize and /token endpoints are used
4. Code Verifier Storage Tests - Verify code_verifier is stored and retrieved

Priority

HIGH: Update core auth tests (state verification, handle_callback) MEDIUM: Remove obsolete tests (OAuth metadata, h-app) LOW: Add new comprehensive integration tests

Notes

• All PKCE unit tests in tests/test_auth_pkce.py are passing
• The implementation is correct, just need to update the tests to match new behavior
• The failing tests are testing OLD behavior that we intentionally changed

When to Complete

These test updates should be completed before merging to main, but can be done in a follow-up commit on the feature branch.