test(lasuite-meet): update stale meeting-flow test for meet v1.22.0+ API auth hardening

test_create_room_get_livekit_token_and_read_back authenticated with a raw OIDC user
access token as 'Authorization: Bearer'; meet v1.22.0 hardened API auth to reject
user access tokens (release notes: 'reject user access tokens on the API'), so the
test went RED with 401 on the v1.24.0 upgrade (drone build #1137; same at v1.23.0
in build #1122).

Updated to the successor auth path: recipe-local _oidc_session.py (same helper as
tests/lasuite-docs) drives the real OIDC authorization-code flow (app -> keycloak
login form -> callback -> Django session cookie, CSRF on unsafe methods).
- NEW assertion: a raw OIDC Bearer token is REJECTED (401/403) - the v1.22.0
  hardening asserted as the new correct behavior.
- The full meeting flow (create 201 + LiveKit JWT grant, read-back, DELETE) is
  unchanged, now over the session-authenticated API. No assertion weakened.

Stale-test fix for recipe PR
recipe-maintainers/lasuite-meet#8
(carry-over from /upgrade-all 2026-07-24).

tests/lasuite-meet/custom/test_meeting_flow.py

@@ -5,8 +5,14 @@ SOURCE: references/recipe-maintainer/recipe-info/lasuite-meet/tests/meeting_flow
 
 Meet's characteristic behavior is real-time meetings: a user creates a room and receives a LiveKit
 (SFU) join token for WebSocket signaling. This is the §4.3 create-an-object + read-it-back, plus the
-distinctive WebRTC-signaling feature (LiveKit token issuance) — not a health/200 stand-in. Flow:
-  1. OIDC password grant (the per-run keycloak user) → a Meet API bearer token.
+distinctive WebRTC-signaling feature (LiveKit token issuance) — not a health/200 stand-in.
+
+Updated for meet v1.22.0+ API auth hardening: the API now REJECTS raw OIDC user access tokens
+sent as Bearer credentials; authenticated calls run on the app's session cookie from the real
+OIDC authorization-code login (see _oidc_session.py). Flow:
+  1. OIDC password grant (the per-run keycloak user) → assert the API rejects it as Bearer
+     (the v1.22.0 hardening — a 2xx here would mean the hardening regressed); then log in via
+     the OIDC authorization-code flow → session cookie.
   2. POST /api/v1.0/rooms/ {name, access_level:public} → 201 with id/slug AND a LiveKit room+token.
   3. GET  /api/v1.0/rooms/{id}/ (read-it-back) → 200, again with a LiveKit token for the same room.
   4. Assert the LiveKit token is a real JWT carrying a video grant for that room (token issuance —
@@ -27,9 +33,11 @@ import sys
 
 import pytest
 
+sys.path.insert(0, os.path.dirname(__file__))
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
+from _oidc_session import OidcSession  # noqa: E402  (recipe-local helper, same dir)
 from harness import http as harness_http  # noqa: E402
-from harness import sso
+from harness import sso  # noqa: E402
 
 
 def _b64url(seg: str) -> bytes:
@@ -57,17 +65,28 @@ def _creds(deps: dict) -> dict:
 @pytest.mark.requires_deps
 def test_create_room_get_livekit_token_and_read_back(live_app, deps):
     assert "keycloak" in deps, f"keycloak creds missing; got {list(deps.keys())}"
+    kc = deps["keycloak"]
     base = f"https://{live_app}"
+
+    # meet v1.22.0+ hardening: a raw OIDC user access token must be REJECTED as Bearer.
     token = sso.oidc_password_grant(_creds(deps))
     assert isinstance(token, str) and token.count(".") == 2, "OIDC access token is not a JWT"
-    auth = {"Authorization": f"Bearer {token}"}
-
-    # --- create a room (the object) ---
     status, body = harness_http.http_post(
         f"{base}/api/v1.0/rooms/",
         data={"name": "ccci-meeting", "access_level": "public"},
-        headers=auth,
+        headers={"Authorization": f"Bearer {token}"},
     )
+    assert status in (401, 403), (
+        f"POST /api/v1.0/rooms/ with a raw OIDC Bearer token returned HTTP {status} — meet >= "
+        f"v1.22.0 must reject user access tokens on the API (body {body!r})"
+    )
+
+    # The successor auth path: session cookie via the real OIDC authorization-code login.
+    sess = OidcSession(base)
+    sess.login(kc["user"], kc["password"])
+
+    # --- create a room (the object) ---
+    status, body = sess.post("/api/v1.0/rooms/", {"name": "ccci-meeting", "access_level": "public"})
     assert status == 201, f"room create returned HTTP {status} (expected 201); body={body!r}"
     assert isinstance(body, dict), f"room create body not JSON: {body!r}"
     room_id = body.get("id")
@@ -75,36 +94,32 @@ def test_create_room_get_livekit_token_and_read_back(live_app, deps):
     lk_room = livekit.get("room")
     lk_token = livekit.get("token")
     assert room_id, f"room created but no id: {body!r}"
-    assert (
-        lk_token and isinstance(lk_token, str) and lk_token.count(".") == 2
-    ), f"room created but no LiveKit JWT token: {livekit!r}"
+    assert lk_token and isinstance(lk_token, str) and lk_token.count(".") == 2, (
+        f"room created but no LiveKit JWT token: {livekit!r}"
+    )
 
     try:
         # --- read it back (a fresh authenticated GET of the created room) ---
-        status, got = harness_http.http_request(
-            "GET", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth
-        )
+        status, got = sess.get(f"/api/v1.0/rooms/{room_id}/")
         assert status == 200, f"room read-back returned HTTP {status} (expected 200); body={got!r}"
-        assert (
-            isinstance(got, dict) and got.get("id") == room_id
-        ), f"read-back room id mismatch: {got!r}"
+        assert isinstance(got, dict) and got.get("id") == room_id, (
+            f"read-back room id mismatch: {got!r}"
+        )
         got_lk = got.get("livekit") or {}
         assert got_lk.get("token"), f"read-back room missing LiveKit token: {got!r}"
-        assert (
-            got_lk.get("room") == lk_room
-        ), f"read-back LiveKit room {got_lk.get('room')!r} != create-time {lk_room!r}"
+        assert got_lk.get("room") == lk_room, (
+            f"read-back LiveKit room {got_lk.get('room')!r} != create-time {lk_room!r}"
+        )
 
         # --- the LiveKit token is a real signaling grant for this room (WebRTC subset) ---
         payload = json.loads(_b64url(lk_token.split(".")[1]))
         video = payload.get("video") or {}
-        assert (
-            video.get("room") == lk_room or payload.get("room") == lk_room
-        ), f"LiveKit JWT does not grant the created room {lk_room!r}: {payload!r}"
+        assert video.get("room") == lk_room or payload.get("room") == lk_room, (
+            f"LiveKit JWT does not grant the created room {lk_room!r}: {payload!r}"
+        )
     finally:
         # --- delete the room (cleanup + a real DELETE mutation) ---
-        del_status, _ = harness_http.http_request(
-            "DELETE", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth
-        )
+        del_status, _ = sess.delete(f"/api/v1.0/rooms/{room_id}/")
         assert del_status in (
             204,
             200,
@@ -120,9 +135,7 @@ def test_create_room_get_livekit_token_and_read_back(live_app, deps):
 
     gone = False
     for _ in range(5):
-        status, _ = harness_http.http_request(
-            "GET", f"{base}/api/v1.0/rooms/{room_id}/", headers=auth
-        )
+        status, _ = sess.get(f"/api/v1.0/rooms/{room_id}/")
         if status == 404:
             gone = True
             break