Pin the accepted Google issuers with literals, not the module's own constant
Some checks failed
file length / file-length (push) Waiting to run
palette drift / palette (push) Waiting to run
crdt-sync pre-commit / pre-commit (push) Has been cancelled
crdt-sync tests / test (3.10) (push) Has been cancelled
crdt-sync tests / test (3.11) (push) Has been cancelled
crdt-sync tests / test (3.12) (push) Has been cancelled

While trimming that file under the cap I had rewritten the parametrize as
`[*lg._EXPECTED_ISSUERS]`, which asserts only that the module agrees with
itself: deleting a spelling from _EXPECTED_ISSUERS would have removed the case
that tests it and left the suite green.

Confirmed by mutation rather than by inspection -- dropping the bare
"accounts.google.com" from the module now fails
test_both_google_issuer_spellings_are_accepted[accounts.google.com], where
before it would have passed. Google uses both forms, so accepting both is a
real contract worth pinning.

432 passed, still 100%, verified with HOME redirected at a temp directory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CFSGeWxHPY5rHUGrPqhcmG
This commit is contained in:
Krzysztof Rudnicki 2026-08-22 16:55:00 +02:00
parent 7637e46c6f
commit c89fee20ec

View File

@ -49,7 +49,9 @@ def test_a_token_from_another_issuer_is_rejected() -> None:
lg.describe_google_token(_google_token(iss="https://login.example.com"))
@pytest.mark.parametrize("issuer", [*lg._EXPECTED_ISSUERS])
@pytest.mark.parametrize(
"issuer", ["https://accounts.google.com", "accounts.google.com"]
)
def test_both_google_issuer_spellings_are_accepted(issuer: str) -> None:
"""Google uses both forms; rejecting either would be a false alarm."""
assert "person@gmail.com" in lg.describe_google_token(_google_token(iss=issuer))