[dpage]

Oauth2LoginMockTestCase (the PKCE case) still asserted that client_kwargs['verify'] defaults to True, but since #10699 OAuth2Authentication uses get_ca_file() or True, so the test failed whenever certifi's bundle was found. The code is correct; the test was stale.

The test now patches pgadmin.authenticate.oauth2.get_ca_file and checks both branches: a bundle path is passed through as verify, and None falls back to True.

Test plan

• regression/runtests.py --pkg browser.tests.test_oauth2_with_mocking passes locally (31 tests, PostgreSQL 18)
• pycodestyle clean

Closes #10721

Summary by CodeRabbit

• Tests
  • Expanded OAuth authentication test coverage to verify certificate handling with and without a configured CA bundle.
  • Retained checks for PKCE, response type, and scope settings.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The PKCE registration test now checks OAuth client verification with a configured CA bundle and when no CA bundle is available. It retains the existing PKCE method, response type, and scope assertions.

Changes

OAuth2 PKCE test

Layer / File(s)	Summary
PKCE verification assertions web/pgadmin/browser/tests/test_oauth2_with_mocking.py	The test checks that client_kwargs['verify'] matches the CA bundle path when configured and is True when no CA bundle is available. It retains the PKCE method, response type, and scope assertions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other · Severity of issue fixed: Low

Possibly related PRs

• pgadmin-org/pgadmin4#10699: This PR changed OAuth2 verification to use get_ca_file() or True; this change tests both outcomes.

Suggested reviewers: albundy83, asheshv

Merge Risk: Minimal · up to 437e7

The test now covers both CA-bundle outcomes. No merge-blocking issue was identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the change in the test: it fixes the OAuth2 PKCE registration test so it matches the new default where verify uses the CA bundle. The raw summary says the test now checks both a config…
Linked Issues check		Issue #10721 requires that the PKCE registration test in web/pgadmin/browser/tests/test_oauth2_with_mocking.py patch pgadmin.authenticate.oauth2.get_ca_file and check both outcomes. The diff at head d…
Out of Scope Changes check		The whole-PR diff against the merge base 4e23e81 changes only web/pgadmin/browser/tests/test_oauth2_with_mocking.py, as reported in the raw summary (+28/-16). The edit…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…

Full details: Title check

Explanation

The title names the change in the test: it fixes the OAuth2 PKCE registration test so it matches the new default where verify uses the CA bundle. The raw summary says the test now checks both a configured CA bundle and no bundle, with verify set to the CA path or True. The title is specific to the main change and does not list files. It is a concise, single sentence.

Full details: Linked Issues check

Explanation

Issue #10721 requires that the PKCE registration test in web/pgadmin/browser/tests/test_oauth2_with_mocking.py patch pgadmin.authenticate.oauth2.get_ca_file and check both outcomes. The diff at head does this in _test_oauth2_authentication_with_pkce. A loop runs two cases: ('/path/to/ca-bundle.pem', '/path/to/ca-bundle.pem') and (None, True). Each case patches get_ca_file in the oauth2 module namespace, then asserts client_kwargs['verify'] equals the expected value. The existing assertions for code_challenge_method S256, response_type code, and scope 'openid email profile' remain. The reviewed head implementation in web/pgadmin/authenticate/oauth2.py sets verify = get_ca_file() or True when OAUTH2_SSL_CERT_VERIFICATION is True. It calls get_ca_file through the module-level import, so the patch takes effect. The test therefore matches the current code behavior that #10721 describes as intended. The PR description reports a local run of the test module (31 tests), but I did not execute the tests. This assessment rests on source reading.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff against the merge base 4e23e81 changes only web/pgadmin/browser/tests/test_oauth2_with_mocking.py, as reported in the raw summary (+28/-16). The edits stay within the PKCE registration test method: a docstring note on the default verify value, the patch of get_ca_file, the two-case loop, and line re-wrapping of the assertions and the OAuth2Authentication import. All of these support the objective in #10721. No production code, configuration, or unrelated tests changed. I did not see a separate file list for the whole PR, so this result relies on the diff and the raw summary.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: pgadmin-org/pgadmin4
• Branch: master
• File: .coderabbit.yaml
• Commit: 4e23e81
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8b139712-3fde-44ce-b48f-4b7f68e5b17c

Commits

Reviewing files that changed from the base of the PR and between 4e23e81 and 437e728.

Files selected for processing: 1

• web/pgadmin/browser/tests/test_oauth2_with_mocking.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

[dpage]

Merged as 7815c9d.