d10009d639
Open-source Grok free registration CLI, xai_enroller auth pipeline, local auth service, tests and docs.
80 lines
2.3 KiB
Python
80 lines
2.3 KiB
Python
import asyncio
|
|
import json
|
|
|
|
import httpx
|
|
|
|
from xai_enroller.models import OAuthCredential
|
|
from xai_enroller.sinks import CPAAuthFileSink, SinkError
|
|
|
|
|
|
def credential():
|
|
return OAuthCredential(
|
|
access_token="access",
|
|
refresh_token="refresh",
|
|
id_token="id-token",
|
|
token_type="Bearer",
|
|
expires_in=3600,
|
|
expires_at="2026-07-11T00:00:00Z",
|
|
last_refresh="2026-07-11T00:00:00Z",
|
|
subject="subject",
|
|
token_endpoint="https://auth.x.ai/oauth2/token",
|
|
)
|
|
|
|
|
|
def test_cpa_sink_builds_pinned_document_and_safe_name():
|
|
requests = []
|
|
|
|
def handler(request):
|
|
requests.append(request)
|
|
return httpx.Response(201)
|
|
|
|
sink = CPAAuthFileSink(
|
|
"https://cpa.example",
|
|
"management-secret",
|
|
httpx.AsyncClient(transport=httpx.MockTransport(handler)),
|
|
name_secret=b"name-secret",
|
|
)
|
|
receipt = asyncio.run(sink.store(credential()))
|
|
assert requests[0].url.path == "/v0/management/auth-files"
|
|
assert requests[0].headers["authorization"] == "Bearer management-secret"
|
|
assert requests[0].url.params["name"].startswith("xai-")
|
|
assert requests[0].url.params["name"].endswith(".json")
|
|
assert json.loads(requests[0].content) == {
|
|
"type": "xai",
|
|
"access_token": "access",
|
|
"refresh_token": "refresh",
|
|
"id_token": "id-token",
|
|
"token_type": "Bearer",
|
|
"expires_in": 3600,
|
|
"expired": "2026-07-11T00:00:00Z",
|
|
"last_refresh": "2026-07-11T00:00:00Z",
|
|
"sub": "subject",
|
|
"base_url": "https://api.x.ai/v1",
|
|
"token_endpoint": "https://auth.x.ai/oauth2/token",
|
|
"auth_kind": "oauth",
|
|
}
|
|
assert "access" not in repr(receipt)
|
|
|
|
|
|
def test_cpa_sink_maps_non_2xx_without_retry_or_secret_leak():
|
|
count = 0
|
|
|
|
def handler(request):
|
|
nonlocal count
|
|
count += 1
|
|
return httpx.Response(500, text="access")
|
|
|
|
sink = CPAAuthFileSink(
|
|
"https://cpa.example",
|
|
"management-secret",
|
|
httpx.AsyncClient(transport=httpx.MockTransport(handler)),
|
|
name_secret=b"name-secret",
|
|
)
|
|
try:
|
|
asyncio.run(sink.store(credential()))
|
|
except SinkError as error:
|
|
assert "access" not in str(error)
|
|
else:
|
|
raise AssertionError("expected SinkError")
|
|
assert count == 1
|