Commit 7cfc9e95 authored by Dimitrios Gogos's avatar Dimitrios Gogos
Browse files

feat: handle IdentityProviderUnavailableError in session token verification

parent cb8ac89c

src/portal_service/api/dependencies.py

+5 −0
Changes for src/portal_service/api/dependencies.py: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -168,6 +168,11 @@ async def get_current_user(session: CurrentSessionDep, verifier: TokenVerifierDe 
    except AuthenticationError as exc:

        logger.info("session token no longer usable", error=str(exc))

        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Not authenticated") from exc

    except IdentityProviderUnavailableError as exc:

        logger.error("could not verify the session token", error=str(exc))

        raise HTTPException(

            status.HTTP_503_SERVICE_UNAVAILABLE, "Authentication service unavailable"

        ) from exc





CurrentUserDep = Annotated[TokenClaims, Depends(get_current_user)]

tests/unit/test_session_refresh.py

+19 −0
Changes for tests/unit/test_session_refresh.py: 19 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -9,10 +9,12 @@ disabled or the session ended there. 
from collections.abc import Callable, Iterator

from datetime import UTC, datetime, timedelta



import jwt

import pytest

from fastapi import FastAPI

from fastapi.testclient import TestClient



from portal_service.adapters.keycloak import token_verifier as token_verifier_module

from portal_service.api.dependencies import get_identity_provider, get_login_session_repo

from portal_service.application.session_crypto import (

    SessionCredentials,
@@ -226,6 +228,23 @@ def test_keycloak_being_down_keeps_the_session( 
    assert credentials.session_id_hash in sessions.rows





def test_signing_keys_being_unreachable_is_a_503(

    client: TestClient,

    sessions: FakeLoginSessionRepository,

    make_token: Callable[..., str],

    monkeypatch: pytest.MonkeyPatch,

) -> None:

    _open_session(client, sessions, make_token(), access_token_expires_in=timedelta(minutes=5))



    class _UnreachableKeys:

        def get_signing_key_from_jwt(self, token: str) -> None:

            raise jwt.PyJWKClientConnectionError("JWKS endpoint unreachable")



    monkeypatch.setattr(token_verifier_module, "_jwks_client_for", lambda _uri: _UnreachableKeys())



    assert client.get("/api/auth/me").status_code == 503





def test_a_session_without_a_refresh_token_cannot_be_renewed(

    client: TestClient,

    sessions: FakeLoginSessionRepository,