autonomic-bot
a1a6790c9b
Some checks are pending
continuous-integration/drone/push Build is running
test_oidc_login_via_keycloak and test_create_doc_and_read_back authenticated with 'Authorization: Bearer <password-grant JWT>'; impress v5.4.0 removed Bearer/JWT auth on the API (SessionAuthentication only), so both went RED with 401 on the v5.4.1 upgrade. Updated to the successor auth path: a new recipe-local _oidc_session.py drives the real OIDC authorization-code flow (app -> keycloak login form -> callback -> Django session cookie, with CSRF headers on unsafe methods). - test_oidc_login: still asserts the unauth challenge redirect; NOW also asserts a raw Bearer JWT is REJECTED (401/403 - the v5.4.0 hardening, asserted as the new correct behavior); then asserts the session-authenticated whoami returns the provisioned user. No assertion weakened - the auth proof is stronger than before. - test_create_doc: same create+read-back round-trip assertions, now over the session-authenticated API. Stale-test fix for recipe PR recipe-maintainers/lasuite-docs#7 (carry-over from /upgrade-all 2026-07-24).