ruff

Author: tino097

mindsdb/integrations/utilities/handlers/auth_utilities/oauth2/client_credentials.py

@@ -58,12 +58,7 @@ def _ip_in_forbidden_range(ip: ipaddress._BaseAddress) -> Optional[str]:
 
 
 def _validate_token_url(token_url: str) -> None:
-    """Raise ValueError if token_url violates SSRF safety rules.
-
-    Rejects: non-http(s) schemes, localhost/aliases, IP literals or DNS-resolved
-    hosts in private/loopback/link-local/multicast/reserved ranges. Logs a
-    WARNING when scheme is http (allowed for staging/internal setups).
-    """
+    """Raise ValueError if token_url violates SSRF safety rules."""
     if not isinstance(token_url, str) or not token_url:
         raise ValueError("token_url must be a non-empty string")
 
@@ -153,8 +148,6 @@ def __init__(
         self._memory_cache: Optional[dict] = None
         self._missing_expires_in_logged = False
 
-    # ------------------------------------------------------------------ public
-
     def get_token(self) -> str:
         """Return a valid access token, refreshing if needed."""
         cached = self._read_cache()
@@ -200,8 +193,6 @@ def current_secrets(self) -> list:
                 return [token]
         return []
 
-    # -------------------------------------------------------- request handling
-
     def _request_token(self) -> dict:
         body: dict = {"grant_type": "client_credentials"}
 
@@ -226,7 +217,7 @@ def _request_token(self) -> dict:
         if self.token_auth_method == "client_secret_post":
             body["client_id"] = self.client_id
             body["client_secret"] = self.client_secret
-        else:  # client_secret_basic
+        else:
             credentials = f"{self.client_id}:{self.client_secret}".encode("utf-8")
             headers["Authorization"] = "Basic " + base64.b64encode(credentials).decode("ascii")
 
@@ -351,8 +342,6 @@ def _read_capped(self, response: requests.Response) -> bytes:
             ) from self._sanitize_exception(exc)
         return b"".join(chunks)
 
-    # ----------------------------------------------------------------- caching
-
     def _read_cache(self) -> Optional[dict]:
         if self.handler_storage is not None:
             try:
@@ -392,8 +381,6 @@ def _is_expired(cached: dict) -> bool:
             return True
         return time.time() >= expires_at
 
-    # ------------------------------------------------------------- diagnostics
-
     def _safe_host(self) -> str:
         try:
             return urlparse(self.token_url).hostname or "<unknown>"

tests/unit/utilities/handlers/auth_utilities/oauth2/test_client_credentials.py

@@ -22,11 +22,6 @@
 CLIENT_SECRET = "client-secret-xyz"
 
 
-# ---------------------------------------------------------------------------
-# Helpers
-# ---------------------------------------------------------------------------
-
-
 class FakeResponse:
     """Minimal stand-in for requests.Response used by token-request tests."""
 
@@ -105,11 +100,6 @@ def fake_getaddrinfo(host, *args, **kwargs):
     monkeypatch.setattr(cc_module.socket, "getaddrinfo", fake_getaddrinfo)
 
 
-# ---------------------------------------------------------------------------
-# Construction validation
-# ---------------------------------------------------------------------------
-
-
 class TestConstructionValidation:
     def test_unsupported_auth_method_raises(self, monkeypatch):
         _bypass_dns(monkeypatch)
@@ -184,11 +174,6 @@ def test_https_url_accepted_no_warning(self, monkeypatch, caplog):
         assert not any(r.levelno == logging.WARNING for r in caplog.records)
 
 
-# ---------------------------------------------------------------------------
-# Request shape
-# ---------------------------------------------------------------------------
-
-
 class TestRequestShape:
     def _provider(self, monkeypatch, **kwargs):
         _bypass_dns(monkeypatch)
@@ -398,11 +383,6 @@ def test_invalid_expires_in_defaults_to_300(self, monkeypatch, caplog, expires_i
             assert any("expires_in" in r.message for r in caplog.records)
 
 
-# ---------------------------------------------------------------------------
-# Caching
-# ---------------------------------------------------------------------------
-
-
 class TestCaching:
     def _provider(self, monkeypatch, **kwargs):
         _bypass_dns(monkeypatch)
@@ -475,11 +455,6 @@ def fake_post(*a, **kw):
         assert calls["n"] == 2
 
 
-# ---------------------------------------------------------------------------
-# Concurrency — double-checked locking
-# ---------------------------------------------------------------------------
-
-
 class TestConcurrency:
     def test_concurrent_get_token_makes_single_http_call(self, monkeypatch):
         """Two threads call get_token() with empty cache simultaneously.
@@ -545,11 +520,6 @@ def worker(idx):
         )
 
 
-# ---------------------------------------------------------------------------
-# Storage
-# ---------------------------------------------------------------------------
-
-
 class TestStorage:
     def test_token_persists_across_provider_instances(self, monkeypatch):
         _bypass_dns(monkeypatch)
@@ -647,11 +617,6 @@ def test_cache_does_not_contain_credentials(self, monkeypatch):
         assert "https://api.example.com" not in as_text
 
 
-# ---------------------------------------------------------------------------
-# current_secrets
-# ---------------------------------------------------------------------------
-
-
 class TestCurrentSecrets:
     def _provider(self, monkeypatch):
         _bypass_dns(monkeypatch)
@@ -687,11 +652,6 @@ def test_after_invalidate_returns_empty(self, monkeypatch):
         assert provider.current_secrets() == []
 
 
-# ---------------------------------------------------------------------------
-# Error sanitization
-# ---------------------------------------------------------------------------
-
-
 class TestErrorSanitization:
     def _provider(self, monkeypatch):
         _bypass_dns(monkeypatch)
@@ -751,7 +711,7 @@ def test_401_includes_provider_error_fields(self, monkeypatch):
         assert "invalid_client" in msg
         assert "Client authentication failed" in msg
         assert CLIENT_SECRET not in msg
-        assert CLIENT_ID in msg or "client_id" in msg  # client_id is not a secret
+        assert CLIENT_ID in msg or "client_id" in msg
 
     def test_redirect_response_treated_as_error(self, monkeypatch):
         provider = self._provider(monkeypatch)