pjdev-gitlab 5.2.0__tar.gz → 5.3.0__tar.gz

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pjdev-gitlab
-Version: 5.2.0
+Version: 5.3.0
 Project-URL: Documentation, https://gitlab.purplejay.io/keystone/python/-/tree/main/pjdev-gitlab/README.md
 Project-URL: Issues, https://gitlab.purplejay.io/keystone/python/-/issues
 Project-URL: Source, https://gitlab.purplejay.io/keystone/python
@@ -94,8 +94,70 @@ TOKEN="$(uvx --from 'pjdev-gitlab' pjdev-gitlab-auth \
 The library is instance-agnostic: `--client-id` (or `GL_OAUTH_CLIENT_ID`) is
 required and the host defaults to `https://gitlab.com` (override with
 `--gitlab-url` / `GL_GITLAB_URL`). Other flags: `--client-secret`,
-`--redirect-port`, `--scopes`, `--force` (each with a `GL_OAUTH_*` env
-equivalent).
+`--redirect-port`, `--scopes`, `--admin-mode`, `--force` (each with a
+`GL_OAUTH_*` env equivalent).
+
+### Admin mode (instance admin API)
+
+GitLab gates its instance admin API behind **admin mode**: `/license`, the admin
+projection of `/users` (the one carrying `email` and `external`),
+`/users/:id/memberships` and friends answer `403` — or, worse, answer `200` with
+a *narrower* record — unless the credential itself was granted the `admin_mode`
+scope. Being an administrator is not enough; the token has to carry it.
+
+```python
+token = oauth_service.get_access_token(
+    gitlab_url="https://gitlab.example.com",
+    client_id="<client id>",
+    admin_mode=True,          # -> requests "api admin_mode"
+)
+```
+
+```bash
+pjdev-gitlab-auth --gitlab-url https://gitlab.example.com \
+  --client-id <id> --admin-mode          # or GL_OAUTH_ADMIN_MODE=1
+```
+
+Two things this handles that are easy to get wrong:
+
+- **The cache is scope-aware.** Tokens are cached per host, so a previously
+  minted `api` token would otherwise be handed straight back to an
+  `admin_mode` request and then 403 on every admin call. A cached token whose
+  recorded grant does not cover what is being asked for is rejected and the
+  browser flow re-runs. (Refreshing cannot widen a grant either, so that path is
+  skipped too.)
+- **A silently narrowed grant is an error.** GitLab issues whatever the
+  *application registration* allows, so an app registered for `api` alone
+  answers an `api admin_mode` request with an `api` token and no complaint.
+  `get_access_token` compares the granted scopes against the requested ones and
+  raises `OAuthError` naming the missing scope, instead of letting you discover
+  it as a 403 later.
+
+The OAuth application must therefore be registered with **both** `api` and
+`admin_mode`. A personal access token works too — select both scopes when
+creating it, and initialize with `auth_scheme="private-token"`.
+
+#### `users_service` — the admin user API
+
+```python
+from pjdev_gitlab import config_service, users_service
+
+config_service.init(token=token, gitlab_url=..., auth_scheme="bearer")
+
+external = await users_service.list_external_users()
+for user in external:
+    print(user.username, user.email)
+```
+
+`list_users`, `get_user` and `list_external_users` all verify that GitLab
+actually returned the admin projection and raise
+`users_service.AdminModeRequired` when it did not. That check exists because the
+public projection *omits* `email` and `external` rather than erroring, so
+`row.get("external")` reads as `None` and a naive caller concludes "no external
+users" — a confident wrong answer. `list_external_users` also filters on the
+`external` field of each returned record rather than trusting the server-side
+`external=true` parameter, so a silently ignored filter cannot shorten the list.
+`list_memberships` wraps the admin-only `/users/:id/memberships`.
 
 #### `pjdev-gitlab-sync` console script
 

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/README.md

@@ -66,8 +66,70 @@ TOKEN="$(uvx --from 'pjdev-gitlab' pjdev-gitlab-auth \
 The library is instance-agnostic: `--client-id` (or `GL_OAUTH_CLIENT_ID`) is
 required and the host defaults to `https://gitlab.com` (override with
 `--gitlab-url` / `GL_GITLAB_URL`). Other flags: `--client-secret`,
-`--redirect-port`, `--scopes`, `--force` (each with a `GL_OAUTH_*` env
-equivalent).
+`--redirect-port`, `--scopes`, `--admin-mode`, `--force` (each with a
+`GL_OAUTH_*` env equivalent).
+
+### Admin mode (instance admin API)
+
+GitLab gates its instance admin API behind **admin mode**: `/license`, the admin
+projection of `/users` (the one carrying `email` and `external`),
+`/users/:id/memberships` and friends answer `403` — or, worse, answer `200` with
+a *narrower* record — unless the credential itself was granted the `admin_mode`
+scope. Being an administrator is not enough; the token has to carry it.
+
+```python
+token = oauth_service.get_access_token(
+    gitlab_url="https://gitlab.example.com",
+    client_id="<client id>",
+    admin_mode=True,          # -> requests "api admin_mode"
+)
+```
+
+```bash
+pjdev-gitlab-auth --gitlab-url https://gitlab.example.com \
+  --client-id <id> --admin-mode          # or GL_OAUTH_ADMIN_MODE=1
+```
+
+Two things this handles that are easy to get wrong:
+
+- **The cache is scope-aware.** Tokens are cached per host, so a previously
+  minted `api` token would otherwise be handed straight back to an
+  `admin_mode` request and then 403 on every admin call. A cached token whose
+  recorded grant does not cover what is being asked for is rejected and the
+  browser flow re-runs. (Refreshing cannot widen a grant either, so that path is
+  skipped too.)
+- **A silently narrowed grant is an error.** GitLab issues whatever the
+  *application registration* allows, so an app registered for `api` alone
+  answers an `api admin_mode` request with an `api` token and no complaint.
+  `get_access_token` compares the granted scopes against the requested ones and
+  raises `OAuthError` naming the missing scope, instead of letting you discover
+  it as a 403 later.
+
+The OAuth application must therefore be registered with **both** `api` and
+`admin_mode`. A personal access token works too — select both scopes when
+creating it, and initialize with `auth_scheme="private-token"`.
+
+#### `users_service` — the admin user API
+
+```python
+from pjdev_gitlab import config_service, users_service
+
+config_service.init(token=token, gitlab_url=..., auth_scheme="bearer")
+
+external = await users_service.list_external_users()
+for user in external:
+    print(user.username, user.email)
+```
+
+`list_users`, `get_user` and `list_external_users` all verify that GitLab
+actually returned the admin projection and raise
+`users_service.AdminModeRequired` when it did not. That check exists because the
+public projection *omits* `email` and `external` rather than erroring, so
+`row.get("external")` reads as `None` and a naive caller concludes "no external
+users" — a confident wrong answer. `list_external_users` also filters on the
+`external` field of each returned record rather than trusting the server-side
+`external=true` parameter, so a silently ignored filter cannot shorten the list.
+`list_memberships` wraps the admin-only `/users/:id/memberships`.
 
 #### `pjdev-gitlab-sync` console script
 

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/src/pjdev_gitlab/__about__.py

@@ -1,4 +1,4 @@
 # SPDX-FileCopyrightText: 2026-present Chris O'Neill <chris@purplejay.io>
 #
 # SPDX-License-Identifier: MIT
-__version__ = "5.2.0"
+__version__ = "5.3.0"

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/src/pjdev_gitlab/__init__.py

@@ -17,5 +17,6 @@ __all__ = [
     "oauth_service",
     "packages_service",
     "repo_files_service",
+    "users_service",
     "work_items_service",
 ]

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/src/pjdev_gitlab/models.py

@@ -90,6 +90,33 @@ class Author(GitlabBase):
     email: Optional[str] = None
 
 
+class User(GitlabBase):
+    """An instance user as returned by ``GET /users``.
+
+    The admin-only fields (``email``, ``external``, ``is_admin``, ...) are
+    optional because GitLab omits them from the public projection; see
+    :mod:`pjdev_gitlab.users_service`, which refuses to hand back records that
+    are missing them rather than letting ``external=None`` read as "not
+    external".
+    """
+
+    id: int
+    username: str
+    name: Optional[str] = None
+    state: Optional[str] = None
+    web_url: Optional[str] = None
+    public_email: Optional[str] = None
+    created_at: Optional[datetime] = None
+    bot: bool = False
+    # Admin projection only.
+    email: Optional[str] = None
+    external: Optional[bool] = None
+    is_admin: Optional[bool] = None
+    last_sign_in_at: Optional[datetime] = None
+    last_activity_on: Optional[str] = None
+    using_license_seat: Optional[bool] = None
+
+
 class Label(GitlabBase):
     id: Optional[int] = None
     name: str

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/src/pjdev_gitlab/oauth_cli.py

@@ -22,6 +22,11 @@ Usage::
 The registered OAuth application must be a non-confidential (PKCE) app with the
 requested scope (default ``api``) and Redirect URI exactly
 ``http://localhost:<redirect-port>/callback``.
+
+Pass ``--admin-mode`` (or ``GL_OAUTH_ADMIN_MODE=1``) to also request the
+``admin_mode`` scope that GitLab requires for the instance admin API -- the
+application registration must include it, or the flow fails with a clear error
+rather than handing back a token that 403s on every admin endpoint.
 """
 
 from __future__ import annotations
@@ -31,6 +36,7 @@ import os
 import sys
 
 from pjdev_gitlab.oauth_service import (
+    ADMIN_MODE_SCOPE,
     DEFAULT_REDIRECT_PORT,
     DEFAULT_SCOPES,
     OAuthError,
@@ -71,6 +77,16 @@ def main() -> int:
         default=None,
         help=f'space-separated scopes (or GL_OAUTH_SCOPES; default "{DEFAULT_SCOPES}")',
     )
+    parser.add_argument(
+        "--admin-mode",
+        action="store_true",
+        default=None,
+        help=(
+            f"also request the {ADMIN_MODE_SCOPE!r} scope, required by the instance "
+            "admin API (or GL_OAUTH_ADMIN_MODE=1). The OAuth application must be "
+            "registered with that scope."
+        ),
+    )
     parser.add_argument(
         "--force",
         action="store_true",
@@ -89,6 +105,12 @@ def main() -> int:
         return 2
     client_secret = args.client_secret or os.environ.get("GL_OAUTH_CLIENT_SECRET") or None
     scopes = args.scopes or os.environ.get("GL_OAUTH_SCOPES") or DEFAULT_SCOPES
+    admin_mode = (
+        args.admin_mode
+        if args.admin_mode is not None
+        else os.environ.get("GL_OAUTH_ADMIN_MODE", "").strip().lower()
+        in ("1", "true", "yes", "on")
+    )
 
     port_raw = (
         args.redirect_port
@@ -108,6 +130,7 @@ def main() -> int:
             client_secret=client_secret,
             redirect_port=redirect_port,
             scopes=scopes,
+            admin_mode=admin_mode,
             force=args.force,
         )
     except OAuthError as exc:

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/src/pjdev_gitlab/oauth_service.py

@@ -48,6 +48,12 @@ import httpx
 
 DEFAULT_REDIRECT_PORT = 7331
 DEFAULT_SCOPES = "api"
+# GitLab gates the instance admin API (/license, /users admin view,
+# /users/:id/memberships, ...) behind "admin mode". A token only carries it when
+# the credential itself was granted this scope, and the OAuth application must
+# be registered with it -- an app registered for "api" alone will hand back an
+# api-only token no matter what the authorize request asked for.
+ADMIN_MODE_SCOPE = "admin_mode"
 # Treat a token as expired this many seconds early to avoid racing the clock.
 EXPIRY_SKEW_SECONDS = 60
 # How long to wait for the browser redirect before giving up.
@@ -96,7 +102,36 @@ def save_cache(path: Path, data: dict[str, Any]) -> None:
     tmp.replace(path)
 
 
-def token_if_valid(cache: Optional[dict[str, Any]]) -> Optional[str]:
+def parse_scopes(value: Optional[str]) -> set[str]:
+    """Split a scope string ("api admin_mode" or "api,admin_mode") into a set."""
+    if not value:
+        return set()
+    return {scope for scope in value.replace(",", " ").split() if scope}
+
+
+def scopes_satisfy(granted: Optional[str], required: Optional[str]) -> bool:
+    """True when every required scope appears in ``granted``."""
+    return parse_scopes(required) <= parse_scopes(granted)
+
+
+def with_admin_mode(scopes: str = DEFAULT_SCOPES) -> str:
+    """Return ``scopes`` with :data:`ADMIN_MODE_SCOPE` added. Idempotent."""
+    requested = parse_scopes(scopes) | {ADMIN_MODE_SCOPE}
+    # "api" first, then the rest alphabetically, so the string is stable.
+    return " ".join(sorted(requested, key=lambda scope: (scope != "api", scope)))
+
+
+def token_if_valid(
+    cache: Optional[dict[str, Any]], required_scopes: Optional[str] = None
+) -> Optional[str]:
+    """Return the cached access token when it is still usable.
+
+    The cache is keyed by host only, so a token minted earlier for a *narrower*
+    scope set would otherwise be handed back to a caller that has since asked
+    for more -- e.g. reusing an ``api`` token for an ``api admin_mode`` request,
+    which then 403s on every admin endpoint. Passing ``required_scopes`` rejects
+    that token so the caller re-authorizes instead.
+    """
     if not cache:
         return None
     token = cache.get("access_token")
@@ -105,6 +140,14 @@ def token_if_valid(cache: Optional[dict[str, Any]]) -> Optional[str]:
         return None
     if time.time() >= expires_at - EXPIRY_SKEW_SECONDS:
         return None
+    if required_scopes:
+        # A cache entry written before scopes were recorded has an *unknown*
+        # grant, not an empty one. Every token this library has ever minted
+        # asked for DEFAULT_SCOPES, so assume that much -- enough to keep
+        # existing caches working, never enough to satisfy a wider request.
+        granted = cache["scope"] if "scope" in cache else DEFAULT_SCOPES
+        if not scopes_satisfy(granted, required_scopes):
+            return None
     return token
 
 
@@ -292,6 +335,7 @@ def get_access_token(
     client_secret: Optional[str] = None,
     redirect_port: int = DEFAULT_REDIRECT_PORT,
     scopes: str = DEFAULT_SCOPES,
+    admin_mode: bool = False,
     force: bool = False,
     cache_dir: Optional[Path] = None,
     on_status: Optional[StatusFn] = None,
@@ -306,6 +350,11 @@ def get_access_token(
     reported via ``on_status`` (defaults to printing to stderr). Raises
     :class:`OAuthError` on any unrecoverable failure.
 
+    ``admin_mode=True`` adds the ``admin_mode`` scope, which GitLab requires for
+    the instance admin API. A cached token granted only the narrower scopes is
+    *not* reused for such a request -- it would 403 on every admin endpoint --
+    so the browser flow runs again to re-consent.
+
     The returned token is an OAuth access token: send it as a Bearer credential,
     e.g. ``config_service.init(token=<token>, auth_scheme="bearer")``.
     """
@@ -314,18 +363,33 @@ def get_access_token(
     status = on_status or _default_status
     cache_dir = cache_dir or default_cache_dir()
     redirect_uri = f"http://localhost:{redirect_port}/callback"
+    if admin_mode:
+        scopes = with_admin_mode(scopes)
 
     path = cache_path(cache_dir, gitlab_url)
     cache = None if force else load_cache(path)
 
-    # 1. Reuse a still-valid cached access token.
-    token = token_if_valid(cache)
+    # 1. Reuse a still-valid cached access token, but only if it was granted at
+    #    least the scopes being asked for now.
+    token = token_if_valid(cache, scopes)
     if token:
         status("Reusing cached access token.")
         return token
 
-    # 2. Silently refresh an expired token if we have a refresh token.
-    if cache and cache.get("refresh_token"):
+    # 2. Silently refresh an expired token if we have a refresh token. A refresh
+    #    preserves the original grant's scopes, so it cannot widen them -- when
+    #    the caller now wants more, skip straight to re-consent.
+    cached_scope = cache.get("scope", DEFAULT_SCOPES) if cache else None
+    if (
+        cache
+        and cache.get("refresh_token")
+        and not scopes_satisfy(cached_scope, scopes)
+    ):
+        status(
+            f"Cached token was granted {cached_scope or 'no'} scope(s) but "
+            f"{scopes!r} is required; re-authorizing."
+        )
+    elif cache and cache.get("refresh_token"):
         status("Access token expired; refreshing silently ...")
         payload = refresh_access_token(
             gitlab_url=gitlab_url,
@@ -334,7 +398,8 @@ def get_access_token(
             refresh_value=cache["refresh_token"],
         )
         if payload:
-            return store_token_response(path, payload, scopes)
+            # A refresh keeps the original grant; record that, not the request.
+            return store_token_response(path, payload, cached_scope or scopes)
         status("Refresh failed; falling back to browser sign-in.")
 
     # 3. Full browser flow.
@@ -350,5 +415,20 @@ def get_access_token(
         timeout_seconds=timeout_seconds,
     )
     token = store_token_response(path, payload, scopes)
+
+    # GitLab silently narrows the grant to whatever the application is
+    # registered for, so an app registered for "api" alone answers an
+    # "api admin_mode" request with an api-only token. Fail loudly here rather
+    # than let the caller discover it as a 403 on the first admin endpoint.
+    granted = payload.get("scope", scopes)
+    if not scopes_satisfy(granted, scopes):
+        missing = " ".join(sorted(parse_scopes(scopes) - parse_scopes(granted)))
+        raise OAuthError(
+            f"the OAuth application granted scope(s) {granted!r} but {scopes!r} "
+            f"was requested (missing: {missing}). Add the missing scope(s) to the "
+            f"application registration at {gitlab_url.rstrip('/')}/-/user_settings/applications "
+            "(or Admin area -> Applications for an instance-wide app), then retry."
+        )
+
     status("Authenticated. Short-lived token obtained.")
     return token

pjdev_gitlab-5.3.0/src/pjdev_gitlab/users_service.py

@@ -0,0 +1,167 @@
+"""Instance user administration: the admin projection of ``GET /users``.
+
+GitLab answers ``GET /users`` for any authenticated caller, but the *shape* of
+the response depends on the credential. A plain ``api`` token gets the public
+projection -- username, name, avatar, web_url. Only a credential carrying the
+``admin_mode`` scope (see :mod:`pjdev_gitlab.oauth_service`) gets the admin
+projection, which adds ``email``, ``external``, ``is_admin``, ``last_sign_in_at``
+and the rest.
+
+The failure mode this module exists to prevent: the public projection simply
+*omits* those keys rather than erroring, so naive code reads
+``row.get("external")`` as ``None``, concludes "no external users", and reports
+a confident wrong answer. Every entry point here checks for the admin-only keys
+first and raises :class:`AdminModeRequired` instead.
+"""
+
+from typing import Any, Optional
+
+from httpx import AsyncClient
+
+from pjdev_gitlab.api_utilities import (
+    async_retry_http,
+    encode_path_segment,
+    http_client,
+    paginate,
+)
+from pjdev_gitlab.models import User
+
+_IGNORE_4XX = [400, 401, 403, 404]
+
+# Keys present only in the admin projection of a user record. Their absence is
+# how we detect a credential that never entered admin mode.
+ADMIN_ONLY_USER_FIELDS = ("email", "external", "is_admin")
+
+
+class AdminModeRequired(RuntimeError):
+    """The credential lacks admin mode, so admin-only user fields are invisible.
+
+    Mint a token with the ``admin_mode`` scope -- ``oauth_service`` accepts
+    ``admin_mode=True`` (``pjdev-gitlab-auth --admin-mode``), and a personal
+    access token needs ``api`` plus ``admin_mode`` selected at creation.
+    """
+
+
+def assert_admin_projection(row: dict[str, Any]) -> None:
+    """Raise :class:`AdminModeRequired` if ``row`` is the public projection."""
+    missing = [field for field in ADMIN_ONLY_USER_FIELDS if field not in row]
+    if missing:
+        raise AdminModeRequired(
+            "GitLab returned the public user projection, without "
+            f"{', '.join(missing)}. The token is not in admin mode: mint one "
+            "with the 'admin_mode' scope (pjdev-gitlab-auth --admin-mode, or a "
+            "PAT created with both 'api' and 'admin_mode')."
+        )
+
+
+@async_retry_http(status_codes_to_ignore=_IGNORE_4XX)
+async def _fetch_user_rows(
+    params: dict[str, Any], client: Optional[AsyncClient]
+) -> list[dict[str, Any]]:
+    async def _exec(_client: AsyncClient) -> list[dict[str, Any]]:
+        return await paginate(_client, "/users", params=params)
+
+    if client is None:
+        async with http_client() as _client:
+            return await _exec(_client)
+    return await _exec(client)
+
+
+async def list_users(
+    *,
+    active: Optional[bool] = None,
+    blocked: Optional[bool] = None,
+    external: Optional[bool] = None,
+    exclude_internal: Optional[bool] = None,
+    without_project_bots: Optional[bool] = None,
+    search: Optional[str] = None,
+    extra_params: Optional[dict[str, Any]] = None,
+    client: Optional[AsyncClient] = None,
+) -> list[User]:
+    """List instance users via the admin projection of ``GET /users``.
+
+    Requires admin mode; raises :class:`AdminModeRequired` otherwise. The
+    boolean filters map to GitLab's query parameters, which it accepts only as
+    the string ``"true"`` -- passing ``False`` omits the parameter rather than
+    sending ``false``, matching GitLab's own semantics.
+    """
+    params: dict[str, Any] = dict(extra_params or {})
+    for name, value in (
+        ("active", active),
+        ("blocked", blocked),
+        ("external", external),
+        ("exclude_internal", exclude_internal),
+        ("without_project_bots", without_project_bots),
+    ):
+        if value:
+            params[name] = "true"
+    if search:
+        params["search"] = search
+
+    # The projection check runs outside the retry decorator on purpose: that
+    # decorator funnels every exception into an ExceptionGroup, which would bury
+    # the one message the caller actually needs to read.
+    rows = await _fetch_user_rows(params, client)
+    if rows:
+        assert_admin_projection(rows[0])
+    return [User.model_validate(row) for row in rows]
+
+
+async def list_external_users(
+    *,
+    active_only: bool = True,
+    include_bots: bool = False,
+    client: Optional[AsyncClient] = None,
+) -> list[User]:
+    """List users flagged ``external`` on the instance.
+
+    Filtering happens client-side on the ``external`` field rather than through
+    GitLab's ``external=true`` parameter, so a silently ignored or renamed
+    parameter cannot turn into a falsely short list -- the flag on each returned
+    record is the authority.
+    """
+    users = await list_users(active=active_only or None, client=client)
+    return [user for user in users if user.external and (include_bots or not user.bot)]
+
+
+@async_retry_http(status_codes_to_ignore=_IGNORE_4XX)
+async def _fetch_user_row(
+    user_id: Any, client: Optional[AsyncClient]
+) -> dict[str, Any]:
+    async def _exec(_client: AsyncClient) -> dict[str, Any]:
+        r = await _client.get(f"/users/{encode_path_segment(user_id)}")
+        r.raise_for_status()
+        return r.json()
+
+    if client is None:
+        async with http_client() as _client:
+            return await _exec(_client)
+    return await _exec(client)
+
+
+async def get_user(user_id: Any, *, client: Optional[AsyncClient] = None) -> User:
+    """Fetch one user via ``GET /users/:id``, requiring the admin projection."""
+    row = await _fetch_user_row(user_id, client)
+    assert_admin_projection(row)
+    return User.model_validate(row)
+
+
+@async_retry_http(status_codes_to_ignore=_IGNORE_4XX)
+async def list_memberships(
+    user_id: Any, *, client: Optional[AsyncClient] = None
+) -> list[dict[str, Any]]:
+    """List a user's direct group and project memberships.
+
+    ``GET /users/:id/memberships`` is admin-only and 403s without admin mode, so
+    the error is surfaced by the request itself rather than a projection check.
+    """
+
+    async def _exec(_client: AsyncClient) -> list[dict[str, Any]]:
+        return await paginate(
+            _client, f"/users/{encode_path_segment(user_id)}/memberships"
+        )
+
+    if client is None:
+        async with http_client() as _client:
+            return await _exec(_client)
+    return await _exec(client)

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/test_report_pjdev-gitlab.txt

@@ -5,119 +5,134 @@ rootdir: /builds/keystone/python/pjdev-gitlab
 configfile: pyproject.toml
 plugins: anyio-4.14.2, respx-0.23.1, asyncio-1.4.0
 asyncio: mode=Mode.AUTO, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function
-collecting ... collected 112 items
+collecting ... collected 127 items
 
 tests/tests_for_api_utilities.py::test_build_auth_defaults_to_private_token PASSED [  0%]
 tests/tests_for_api_utilities.py::test_build_auth_selects_bearer_for_oauth PASSED [  1%]
 tests/tests_for_api_utilities.py::test_bearer_scheme_sends_authorization_header PASSED [  2%]
 tests/tests_for_api_utilities.py::test_encode_path_segment PASSED        [  3%]
-tests/tests_for_api_utilities.py::test_paginate_consumes_x_next_page PASSED [  4%]
-tests/tests_for_api_utilities.py::test_async_retry_http_aborts_on_ignored_status PASSED [  5%]
-tests/tests_for_api_utilities.py::test_async_retry_http_retries_on_5xx PASSED [  6%]
-tests/tests_for_api_utilities.py::test_upload_to_project_returns_markdown PASSED [  7%]
-tests/tests_for_git_sync_service.py::test_build_remote_url[https://gitlab.example.com-g/s/n-https://gitlab.example.com/g/s/n.git] PASSED [  8%]
-tests/tests_for_git_sync_service.py::test_build_remote_url[https://gitlab.example.com/-/g/n/-https://gitlab.example.com/g/n.git] PASSED [  8%]
-tests/tests_for_git_sync_service.py::test_build_remote_url[https://gitlab.example.com-g/n.git-https://gitlab.example.com/g/n.git] PASSED [  9%]
-tests/tests_for_git_sync_service.py::test_build_remote_url_empty_repo_errors PASSED [ 10%]
-tests/tests_for_git_sync_service.py::test_default_target_dir[developers/claude-skills-claude-skills] PASSED [ 11%]
-tests/tests_for_git_sync_service.py::test_default_target_dir[g/s/name.git-name] PASSED [ 12%]
-tests/tests_for_git_sync_service.py::test_default_target_dir[solo-solo] PASSED [ 13%]
-tests/tests_for_git_sync_service.py::test_clone_when_target_missing PASSED [ 14%]
-tests/tests_for_git_sync_service.py::test_clone_passes_token_via_askpass_env_only PASSED [ 15%]
-tests/tests_for_git_sync_service.py::test_clone_with_branch PASSED       [ 16%]
-tests/tests_for_git_sync_service.py::test_update_when_target_is_repo PASSED [ 16%]
-tests/tests_for_git_sync_service.py::test_update_with_existing_branch_checks_out_and_ff PASSED [ 17%]
-tests/tests_for_git_sync_service.py::test_update_with_new_branch_creates_from_fetch_head PASSED [ 18%]
-tests/tests_for_git_sync_service.py::test_update_adds_origin_when_absent PASSED [ 19%]
-tests/tests_for_git_sync_service.py::test_update_detached_head_errors PASSED [ 20%]
-tests/tests_for_git_sync_service.py::test_clone_failure_removes_partial_target PASSED [ 21%]
-tests/tests_for_git_sync_service.py::test_target_exists_but_not_a_repo_errors PASSED [ 22%]
-tests/tests_for_git_sync_service.py::test_missing_token_errors PASSED    [ 23%]
-tests/tests_for_git_sync_service.py::test_ff_only_failure_propagates PASSED [ 24%]
-tests/tests_for_issues_service.py::test_search_issues_paginates PASSED   [ 25%]
-tests/tests_for_issues_service.py::test_create_issue_with_image_uploads_first_then_creates PASSED [ 25%]
-tests/tests_for_issues_service.py::test_set_issue_state PASSED           [ 26%]
-tests/tests_for_issues_service.py::test_set_issue_labels_modes PASSED    [ 27%]
-tests/tests_for_issues_service.py::test_aggregate_issues_by_label PASSED [ 28%]
-tests/tests_for_issues_service.py::test_comment_on_issue PASSED          [ 29%]
-tests/tests_for_issues_service.py::test_list_issue_notes_delegates_to_notes_service PASSED [ 30%]
-tests/tests_for_merge_requests_service.py::test_get_merge_request PASSED [ 31%]
-tests/tests_for_merge_requests_service.py::test_comment_on_merge_request PASSED [ 32%]
-tests/tests_for_merge_requests_service.py::test_inline_diff_comment_payload_shape PASSED [ 33%]
-tests/tests_for_merge_requests_service.py::test_approve_and_unapprove PASSED [ 33%]
-tests/tests_for_merge_requests_service.py::test_list_merge_request_notes_delegates_to_notes_service PASSED [ 34%]
-tests/tests_for_models.py::test_config_api_base_url_strips_trailing_slash PASSED [ 35%]
-tests/tests_for_models.py::test_issue_extra_fields_ignored PASSED        [ 36%]
-tests/tests_for_models.py::test_merge_request_basic PASSED               [ 37%]
-tests/tests_for_models.py::test_config_env_loading PASSED                [ 38%]
-tests/tests_for_notes_service.py::test_list_notes_for_merge_request PASSED [ 39%]
-tests/tests_for_notes_service.py::test_list_notes_for_issue_uses_the_issue_path PASSED [ 40%]
-tests/tests_for_notes_service.py::test_list_notes_can_drop_system_notes PASSED [ 41%]
-tests/tests_for_notes_service.py::test_list_notes_forwards_sort_and_order_by PASSED [ 41%]
-tests/tests_for_notes_service.py::test_get_note PASSED                   [ 42%]
-tests/tests_for_notes_service.py::test_list_discussions_groups_notes_into_threads PASSED [ 43%]
-tests/tests_for_notes_service.py::test_list_discussions_dropping_system_notes_drops_emptied_threads PASSED [ 44%]
-tests/tests_for_notes_service.py::test_get_discussion PASSED             [ 45%]
-tests/tests_for_notes_service.py::test_reply_to_discussion_posts_to_the_thread PASSED [ 46%]
-tests/tests_for_notes_service.py::test_reply_to_note_resolves_the_containing_thread PASSED [ 47%]
-tests/tests_for_notes_service.py::test_reply_to_note_raises_when_the_note_is_not_there PASSED [ 48%]
-tests/tests_for_notes_service.py::test_find_discussion_for_note_returns_none_when_absent PASSED [ 49%]
-tests/tests_for_notes_service.py::test_quick_action_only_reply_raises_a_useful_error PASSED [ 50%]
-tests/tests_for_notes_service.py::test_notes_paginate_across_pages PASSED [ 50%]
-tests/tests_for_oauth_cli.py::test_missing_client_id_errors PASSED       [ 51%]
-tests/tests_for_oauth_cli.py::test_success_prints_only_token PASSED      [ 52%]
-tests/tests_for_oauth_cli.py::test_reads_config_from_env PASSED          [ 53%]
-tests/tests_for_oauth_cli.py::test_bad_redirect_port_errors PASSED       [ 54%]
-tests/tests_for_oauth_cli.py::test_oauth_error_returns_one PASSED        [ 55%]
-tests/tests_for_oauth_service.py::test_make_pkce_challenge_is_s256_of_verifier PASSED [ 56%]
-tests/tests_for_oauth_service.py::test_cache_path_is_per_host_and_private PASSED [ 57%]
-tests/tests_for_oauth_service.py::test_token_if_valid_expiry PASSED      [ 58%]
-tests/tests_for_oauth_service.py::test_store_token_response_roundtrip PASSED [ 58%]
-tests/tests_for_oauth_service.py::test_store_token_response_requires_access_token PASSED [ 59%]
-tests/tests_for_oauth_service.py::test_refresh_access_token_success PASSED [ 60%]
-tests/tests_for_oauth_service.py::test_refresh_access_token_returns_none_on_error PASSED [ 61%]
-tests/tests_for_oauth_service.py::test_get_access_token_reuses_valid_cache PASSED [ 62%]
-tests/tests_for_oauth_service.py::test_get_access_token_refreshes_expired_cache PASSED [ 63%]
-tests/tests_for_oauth_service.py::test_get_access_token_requires_client_id PASSED [ 64%]
-tests/tests_for_packages_service.py::test_upload_generic_package_url_shape PASSED [ 65%]
-tests/tests_for_packages_service.py::test_download_generic_package PASSED [ 66%]
-tests/tests_for_packages_service.py::test_list_packages PASSED           [ 66%]
-tests/tests_for_repo_files_service.py::test_get_file_url_encoded PASSED  [ 67%]
-tests/tests_for_repo_files_service.py::test_download_file_writes_to_dest PASSED [ 68%]
-tests/tests_for_repo_files_service.py::test_download_directory_walks_tree PASSED [ 69%]
-tests/tests_for_sync_cli.py::test_missing_repo_errors PASSED             [ 70%]
-tests/tests_for_sync_cli.py::test_missing_client_id_errors PASSED        [ 71%]
-tests/tests_for_sync_cli.py::test_success_prints_path_and_forwards_args PASSED [ 72%]
-tests/tests_for_sync_cli.py::test_reads_config_from_env PASSED           [ 73%]
-tests/tests_for_sync_cli.py::test_oauth_error_returns_one PASSED         [ 74%]
-tests/tests_for_sync_cli.py::test_sync_error_returns_one PASSED          [ 75%]
-tests/tests_for_sync_cli.py::test_bad_redirect_port_errors PASSED        [ 75%]
-tests/tests_for_work_items_service.py::test_make_work_item_gid_passthrough_and_coerce PASSED [ 76%]
-tests/tests_for_work_items_service.py::test_work_item_from_node_flattens_widgets PASSED [ 77%]
-tests/tests_for_work_items_service.py::test_graphql_raises_on_errors PASSED [ 78%]
-tests/tests_for_work_items_service.py::test_paginate_graphql_follows_end_cursor PASSED [ 79%]
-tests/tests_for_work_items_service.py::test_get_work_item_by_global_id PASSED [ 80%]
-tests/tests_for_work_items_service.py::test_get_work_item_by_project_path_and_iid_uses_namespace_lookup PASSED [ 81%]
-tests/tests_for_work_items_service.py::test_get_work_item_omits_the_status_widget_by_default PASSED [ 82%]
-tests/tests_for_work_items_service.py::test_get_work_item_include_status_selects_the_widget_and_lifts_it PASSED [ 83%]
-tests/tests_for_work_items_service.py::test_get_work_item_missing_raises PASSED [ 83%]
-tests/tests_for_work_items_service.py::test_get_work_item_status_by_project_path_and_iid PASSED [ 84%]
-tests/tests_for_work_items_service.py::test_get_work_item_status_by_global_id_skips_the_iid_lookup PASSED [ 85%]
-tests/tests_for_work_items_service.py::test_get_work_item_status_returns_none_when_no_status_is_assigned PASSED [ 86%]
-tests/tests_for_work_items_service.py::test_get_work_item_status_missing_item_raises PASSED [ 87%]
-tests/tests_for_work_items_service.py::test_search_work_items_paginates_and_translates_state PASSED [ 88%]
-tests/tests_for_work_items_service.py::test_search_work_items_group_scope_uses_group_field PASSED [ 89%]
-tests/tests_for_work_items_service.py::test_search_work_items_include_status_selects_the_widget PASSED [ 90%]
-tests/tests_for_work_items_service.py::test_search_work_items_requires_one_scope PASSED [ 91%]
-tests/tests_for_work_items_service.py::test_set_work_item_state_closes_via_workItemUpdate PASSED [ 91%]
-tests/tests_for_work_items_service.py::test_set_work_item_state_mutation_errors_raise PASSED [ 92%]
-tests/tests_for_work_items_service.py::test_list_work_item_notes_filters_system_notes PASSED [ 93%]
-tests/tests_for_work_items_service.py::test_comment_on_work_item_creates_note PASSED [ 94%]
-tests/tests_for_work_items_service.py::test_reply_to_work_item_discussion_threads_via_discussion_id PASSED [ 95%]
+tests/tests_for_api_utilities.py::test_paginate_consumes_x_next_page PASSED [  3%]
+tests/tests_for_api_utilities.py::test_async_retry_http_aborts_on_ignored_status PASSED [  4%]
+tests/tests_for_api_utilities.py::test_async_retry_http_retries_on_5xx PASSED [  5%]
+tests/tests_for_api_utilities.py::test_upload_to_project_returns_markdown PASSED [  6%]
+tests/tests_for_git_sync_service.py::test_build_remote_url[https://gitlab.example.com-g/s/n-https://gitlab.example.com/g/s/n.git] PASSED [  7%]
+tests/tests_for_git_sync_service.py::test_build_remote_url[https://gitlab.example.com/-/g/n/-https://gitlab.example.com/g/n.git] PASSED [  7%]
+tests/tests_for_git_sync_service.py::test_build_remote_url[https://gitlab.example.com-g/n.git-https://gitlab.example.com/g/n.git] PASSED [  8%]
+tests/tests_for_git_sync_service.py::test_build_remote_url_empty_repo_errors PASSED [  9%]
+tests/tests_for_git_sync_service.py::test_default_target_dir[developers/claude-skills-claude-skills] PASSED [ 10%]
+tests/tests_for_git_sync_service.py::test_default_target_dir[g/s/name.git-name] PASSED [ 11%]
+tests/tests_for_git_sync_service.py::test_default_target_dir[solo-solo] PASSED [ 11%]
+tests/tests_for_git_sync_service.py::test_clone_when_target_missing PASSED [ 12%]
+tests/tests_for_git_sync_service.py::test_clone_passes_token_via_askpass_env_only PASSED [ 13%]
+tests/tests_for_git_sync_service.py::test_clone_with_branch PASSED       [ 14%]
+tests/tests_for_git_sync_service.py::test_update_when_target_is_repo PASSED [ 14%]
+tests/tests_for_git_sync_service.py::test_update_with_existing_branch_checks_out_and_ff PASSED [ 15%]
+tests/tests_for_git_sync_service.py::test_update_with_new_branch_creates_from_fetch_head PASSED [ 16%]
+tests/tests_for_git_sync_service.py::test_update_adds_origin_when_absent PASSED [ 17%]
+tests/tests_for_git_sync_service.py::test_update_detached_head_errors PASSED [ 18%]
+tests/tests_for_git_sync_service.py::test_clone_failure_removes_partial_target PASSED [ 18%]
+tests/tests_for_git_sync_service.py::test_target_exists_but_not_a_repo_errors PASSED [ 19%]
+tests/tests_for_git_sync_service.py::test_missing_token_errors PASSED    [ 20%]
+tests/tests_for_git_sync_service.py::test_ff_only_failure_propagates PASSED [ 21%]
+tests/tests_for_issues_service.py::test_search_issues_paginates PASSED   [ 22%]
+tests/tests_for_issues_service.py::test_create_issue_with_image_uploads_first_then_creates PASSED [ 22%]
+tests/tests_for_issues_service.py::test_set_issue_state PASSED           [ 23%]
+tests/tests_for_issues_service.py::test_set_issue_labels_modes PASSED    [ 24%]
+tests/tests_for_issues_service.py::test_aggregate_issues_by_label PASSED [ 25%]
+tests/tests_for_issues_service.py::test_comment_on_issue PASSED          [ 25%]
+tests/tests_for_issues_service.py::test_list_issue_notes_delegates_to_notes_service PASSED [ 26%]
+tests/tests_for_merge_requests_service.py::test_get_merge_request PASSED [ 27%]
+tests/tests_for_merge_requests_service.py::test_comment_on_merge_request PASSED [ 28%]
+tests/tests_for_merge_requests_service.py::test_inline_diff_comment_payload_shape PASSED [ 29%]
+tests/tests_for_merge_requests_service.py::test_approve_and_unapprove PASSED [ 29%]
+tests/tests_for_merge_requests_service.py::test_list_merge_request_notes_delegates_to_notes_service PASSED [ 30%]
+tests/tests_for_models.py::test_config_api_base_url_strips_trailing_slash PASSED [ 31%]
+tests/tests_for_models.py::test_issue_extra_fields_ignored PASSED        [ 32%]
+tests/tests_for_models.py::test_merge_request_basic PASSED               [ 33%]
+tests/tests_for_models.py::test_config_env_loading PASSED                [ 33%]
+tests/tests_for_notes_service.py::test_list_notes_for_merge_request PASSED [ 34%]
+tests/tests_for_notes_service.py::test_list_notes_for_issue_uses_the_issue_path PASSED [ 35%]
+tests/tests_for_notes_service.py::test_list_notes_can_drop_system_notes PASSED [ 36%]
+tests/tests_for_notes_service.py::test_list_notes_forwards_sort_and_order_by PASSED [ 37%]
+tests/tests_for_notes_service.py::test_get_note PASSED                   [ 37%]
+tests/tests_for_notes_service.py::test_list_discussions_groups_notes_into_threads PASSED [ 38%]
+tests/tests_for_notes_service.py::test_list_discussions_dropping_system_notes_drops_emptied_threads PASSED [ 39%]
+tests/tests_for_notes_service.py::test_get_discussion PASSED             [ 40%]
+tests/tests_for_notes_service.py::test_reply_to_discussion_posts_to_the_thread PASSED [ 40%]
+tests/tests_for_notes_service.py::test_reply_to_note_resolves_the_containing_thread PASSED [ 41%]
+tests/tests_for_notes_service.py::test_reply_to_note_raises_when_the_note_is_not_there PASSED [ 42%]
+tests/tests_for_notes_service.py::test_find_discussion_for_note_returns_none_when_absent PASSED [ 43%]
+tests/tests_for_notes_service.py::test_quick_action_only_reply_raises_a_useful_error PASSED [ 44%]
+tests/tests_for_notes_service.py::test_notes_paginate_across_pages PASSED [ 44%]
+tests/tests_for_oauth_cli.py::test_missing_client_id_errors PASSED       [ 45%]
+tests/tests_for_oauth_cli.py::test_success_prints_only_token PASSED      [ 46%]
+tests/tests_for_oauth_cli.py::test_reads_config_from_env PASSED          [ 47%]
+tests/tests_for_oauth_cli.py::test_bad_redirect_port_errors PASSED       [ 48%]
+tests/tests_for_oauth_cli.py::test_oauth_error_returns_one PASSED        [ 48%]
+tests/tests_for_oauth_service.py::test_make_pkce_challenge_is_s256_of_verifier PASSED [ 49%]
+tests/tests_for_oauth_service.py::test_cache_path_is_per_host_and_private PASSED [ 50%]
+tests/tests_for_oauth_service.py::test_token_if_valid_expiry PASSED      [ 51%]
+tests/tests_for_oauth_service.py::test_store_token_response_roundtrip PASSED [ 51%]
+tests/tests_for_oauth_service.py::test_store_token_response_requires_access_token PASSED [ 52%]
+tests/tests_for_oauth_service.py::test_refresh_access_token_success PASSED [ 53%]
+tests/tests_for_oauth_service.py::test_refresh_access_token_returns_none_on_error PASSED [ 54%]
+tests/tests_for_oauth_service.py::test_get_access_token_reuses_valid_cache PASSED [ 55%]
+tests/tests_for_oauth_service.py::test_get_access_token_refreshes_expired_cache PASSED [ 55%]
+tests/tests_for_oauth_service.py::test_get_access_token_requires_client_id PASSED [ 56%]
+tests/tests_for_oauth_service.py::test_parse_scopes_accepts_space_and_comma_separated PASSED [ 57%]
+tests/tests_for_oauth_service.py::test_scopes_satisfy_is_subset_check PASSED [ 58%]
+tests/tests_for_oauth_service.py::test_with_admin_mode_is_idempotent_and_stable PASSED [ 59%]
+tests/tests_for_oauth_service.py::test_token_if_valid_rejects_narrower_cached_scope PASSED [ 59%]
+tests/tests_for_oauth_service.py::test_get_access_token_does_not_reuse_api_token_for_admin_mode PASSED [ 60%]
+tests/tests_for_oauth_service.py::test_get_access_token_reuses_cache_that_already_has_admin_mode PASSED [ 61%]
+tests/tests_for_oauth_service.py::test_get_access_token_rejects_a_grant_missing_the_requested_scope PASSED [ 62%]
+tests/tests_for_packages_service.py::test_upload_generic_package_url_shape PASSED [ 62%]
+tests/tests_for_packages_service.py::test_download_generic_package PASSED [ 63%]
+tests/tests_for_packages_service.py::test_list_packages PASSED           [ 64%]
+tests/tests_for_repo_files_service.py::test_get_file_url_encoded PASSED  [ 65%]
+tests/tests_for_repo_files_service.py::test_download_file_writes_to_dest PASSED [ 66%]
+tests/tests_for_repo_files_service.py::test_download_directory_walks_tree PASSED [ 66%]
+tests/tests_for_sync_cli.py::test_missing_repo_errors PASSED             [ 67%]
+tests/tests_for_sync_cli.py::test_missing_client_id_errors PASSED        [ 68%]
+tests/tests_for_sync_cli.py::test_success_prints_path_and_forwards_args PASSED [ 69%]
+tests/tests_for_sync_cli.py::test_reads_config_from_env PASSED           [ 70%]
+tests/tests_for_sync_cli.py::test_oauth_error_returns_one PASSED         [ 70%]
+tests/tests_for_sync_cli.py::test_sync_error_returns_one PASSED          [ 71%]
+tests/tests_for_sync_cli.py::test_bad_redirect_port_errors PASSED        [ 72%]
+tests/tests_for_users_service.py::test_assert_admin_projection_accepts_admin_row PASSED [ 73%]
+tests/tests_for_users_service.py::test_assert_admin_projection_names_the_missing_fields PASSED [ 74%]
+tests/tests_for_users_service.py::test_list_users_returns_admin_fields PASSED [ 74%]
+tests/tests_for_users_service.py::test_list_users_raises_without_admin_mode PASSED [ 75%]
+tests/tests_for_users_service.py::test_list_users_sends_only_true_filters PASSED [ 76%]
+tests/tests_for_users_service.py::test_list_external_users_filters_on_the_flag_not_the_query_param PASSED [ 77%]
+tests/tests_for_users_service.py::test_list_external_users_can_include_bots PASSED [ 77%]
+tests/tests_for_users_service.py::test_get_user_requires_admin_projection PASSED [ 78%]
+tests/tests_for_work_items_service.py::test_make_work_item_gid_passthrough_and_coerce PASSED [ 79%]
+tests/tests_for_work_items_service.py::test_work_item_from_node_flattens_widgets PASSED [ 80%]
+tests/tests_for_work_items_service.py::test_graphql_raises_on_errors PASSED [ 81%]
+tests/tests_for_work_items_service.py::test_paginate_graphql_follows_end_cursor PASSED [ 81%]
+tests/tests_for_work_items_service.py::test_get_work_item_by_global_id PASSED [ 82%]
+tests/tests_for_work_items_service.py::test_get_work_item_by_project_path_and_iid_uses_namespace_lookup PASSED [ 83%]
+tests/tests_for_work_items_service.py::test_get_work_item_omits_the_status_widget_by_default PASSED [ 84%]
+tests/tests_for_work_items_service.py::test_get_work_item_include_status_selects_the_widget_and_lifts_it PASSED [ 85%]
+tests/tests_for_work_items_service.py::test_get_work_item_missing_raises PASSED [ 85%]
+tests/tests_for_work_items_service.py::test_get_work_item_status_by_project_path_and_iid PASSED [ 86%]
+tests/tests_for_work_items_service.py::test_get_work_item_status_by_global_id_skips_the_iid_lookup PASSED [ 87%]
+tests/tests_for_work_items_service.py::test_get_work_item_status_returns_none_when_no_status_is_assigned PASSED [ 88%]
+tests/tests_for_work_items_service.py::test_get_work_item_status_missing_item_raises PASSED [ 88%]
+tests/tests_for_work_items_service.py::test_search_work_items_paginates_and_translates_state PASSED [ 89%]
+tests/tests_for_work_items_service.py::test_search_work_items_group_scope_uses_group_field PASSED [ 90%]
+tests/tests_for_work_items_service.py::test_search_work_items_include_status_selects_the_widget PASSED [ 91%]
+tests/tests_for_work_items_service.py::test_search_work_items_requires_one_scope PASSED [ 92%]
+tests/tests_for_work_items_service.py::test_set_work_item_state_closes_via_workItemUpdate PASSED [ 92%]
+tests/tests_for_work_items_service.py::test_set_work_item_state_mutation_errors_raise PASSED [ 93%]
+tests/tests_for_work_items_service.py::test_list_work_item_notes_filters_system_notes PASSED [ 94%]
+tests/tests_for_work_items_service.py::test_comment_on_work_item_creates_note PASSED [ 95%]
+tests/tests_for_work_items_service.py::test_reply_to_work_item_discussion_threads_via_discussion_id PASSED [ 96%]
 tests/tests_for_work_items_service.py::test_set_work_item_labels_add_passes_addLabelIds PASSED [ 96%]
 tests/tests_for_work_items_service.py::test_set_work_item_labels_remove_passes_removeLabelIds PASSED [ 97%]
 tests/tests_for_work_items_service.py::test_list_labels_for_project_includes_ancestor_groups PASSED [ 98%]
 tests/tests_for_work_items_service.py::test_create_label_passes_project_path_color_and_description PASSED [ 99%]
 tests/tests_for_work_items_service.py::test_create_label_group_scope_passes_group_path PASSED [100%]
 
-============================= 112 passed in 2.66s ==============================
+============================= 127 passed in 2.72s ==============================

{pjdev_gitlab-5.2.0 → pjdev_gitlab-5.3.0}/tests/tests_for_oauth_service.py

@@ -13,9 +13,12 @@ from pjdev_gitlab.oauth_service import (
     get_access_token,
     load_cache,
     make_pkce,
+    parse_scopes,
     refresh_access_token,
+    scopes_satisfy,
     store_token_response,
     token_if_valid,
+    with_admin_mode,
 )
 
 
@@ -140,3 +143,113 @@ def test_get_access_token_requires_client_id(tmp_path):
             cache_dir=tmp_path,
             on_status=lambda _m: None,
         )
+
+
+# --------------------------------------------------------------------------- #
+# Admin mode / scope handling
+# --------------------------------------------------------------------------- #
+def test_parse_scopes_accepts_space_and_comma_separated():
+    assert parse_scopes("api admin_mode") == {"api", "admin_mode"}
+    assert parse_scopes("api,admin_mode") == {"api", "admin_mode"}
+    assert parse_scopes("") == set()
+    assert parse_scopes(None) == set()
+
+
+def test_scopes_satisfy_is_subset_check():
+    assert scopes_satisfy("api admin_mode", "api")
+    assert scopes_satisfy("api admin_mode", "api admin_mode")
+    assert not scopes_satisfy("api", "api admin_mode")
+    assert not scopes_satisfy(None, "api")
+
+
+def test_with_admin_mode_is_idempotent_and_stable():
+    assert with_admin_mode("api") == "api admin_mode"
+    assert with_admin_mode("api admin_mode") == "api admin_mode"
+    assert with_admin_mode("read_user api") == "api admin_mode read_user"
+
+
+def test_token_if_valid_rejects_narrower_cached_scope():
+    cache = {
+        "access_token": "cached",
+        "expires_at": time.time() + 3600,
+        "scope": "api",
+    }
+    # Unchanged behaviour when the caller does not care about scopes.
+    assert token_if_valid(cache) == "cached"
+    assert token_if_valid(cache, "api") == "cached"
+    # An api-only token must not be handed to an admin_mode request: it would
+    # 403 on every admin endpoint instead of failing here.
+    assert token_if_valid(cache, "api admin_mode") is None
+
+
+def test_get_access_token_does_not_reuse_api_token_for_admin_mode(tmp_path):
+    path = cache_path(tmp_path, "https://gitlab.example.com")
+    path.write_text(
+        json.dumps(
+            {"access_token": "cached", "expires_at": time.time() + 3600, "scope": "api"}
+        )
+    )
+    # No refresh token and no browser: reaching the flow at all is the failure
+    # we are asserting against, so a timeout of 0 makes it error out fast.
+    with pytest.raises(OAuthError):
+        get_access_token(
+            gitlab_url="https://gitlab.example.com",
+            client_id="cid",
+            cache_dir=tmp_path,
+            admin_mode=True,
+            open_browser=False,
+            timeout_seconds=0.01,
+            on_status=lambda _m: None,
+        )
+
+
+def test_get_access_token_reuses_cache_that_already_has_admin_mode(tmp_path):
+    path = cache_path(tmp_path, "https://gitlab.example.com")
+    path.write_text(
+        json.dumps(
+            {
+                "access_token": "cached-admin",
+                "expires_at": time.time() + 3600,
+                "scope": "api admin_mode",
+            }
+        )
+    )
+    token = get_access_token(
+        gitlab_url="https://gitlab.example.com",
+        client_id="cid",
+        cache_dir=tmp_path,
+        admin_mode=True,
+        on_status=lambda _m: None,
+    )
+    assert token == "cached-admin"
+
+
+@respx.mock
+def test_get_access_token_rejects_a_grant_missing_the_requested_scope(tmp_path):
+    """GitLab narrows the grant to what the app is registered for, silently."""
+    path = cache_path(tmp_path, "https://gitlab.example.com")
+    path.write_text(
+        json.dumps(
+            {
+                "access_token": "old",
+                "refresh_token": "rt",
+                "expires_at": time.time() - 10,
+                "scope": "api admin_mode",
+            }
+        )
+    )
+    respx.post("https://gitlab.example.com/oauth/token").mock(
+        return_value=httpx.Response(
+            200, json={"access_token": "narrow", "expires_in": 3600, "scope": "api"}
+        )
+    )
+    # The refresh path stores whatever came back; the caller asked for
+    # admin_mode, so a subsequent read of the cache must not satisfy it.
+    get_access_token(
+        gitlab_url="https://gitlab.example.com",
+        client_id="cid",
+        cache_dir=tmp_path,
+        admin_mode=True,
+        on_status=lambda _m: None,
+    )
+    assert token_if_valid(load_cache(path), "api admin_mode") is None

pjdev_gitlab-5.3.0/tests/tests_for_users_service.py

@@ -0,0 +1,101 @@
+import httpx
+import pytest
+import respx
+
+from pjdev_gitlab import users_service
+from pjdev_gitlab.users_service import AdminModeRequired
+
+# The admin projection: note `email`, `external` and `is_admin`.
+ADMIN_ROW = {
+    "id": 7,
+    "username": "contractor",
+    "name": "A Contractor",
+    "state": "active",
+    "email": "person@vendor.example",
+    "external": True,
+    "is_admin": False,
+    "bot": False,
+}
+# What a token without admin mode gets back instead -- same status code, fewer keys.
+PUBLIC_ROW = {
+    "id": 7,
+    "username": "contractor",
+    "name": "A Contractor",
+    "state": "active",
+    "web_url": "https://gitlab.example.com/contractor",
+}
+
+
+def test_assert_admin_projection_accepts_admin_row():
+    users_service.assert_admin_projection(ADMIN_ROW)
+
+
+def test_assert_admin_projection_names_the_missing_fields():
+    with pytest.raises(AdminModeRequired) as excinfo:
+        users_service.assert_admin_projection(PUBLIC_ROW)
+    message = str(excinfo.value)
+    assert "email" in message and "external" in message
+    assert "admin_mode" in message
+
+
+@respx.mock
+async def test_list_users_returns_admin_fields():
+    respx.get("https://gitlab.example.com/api/v4/users").mock(
+        return_value=httpx.Response(200, json=[ADMIN_ROW])
+    )
+    users = await users_service.list_users()
+    assert [u.username for u in users] == ["contractor"]
+    assert users[0].email == "person@vendor.example"
+    assert users[0].external is True
+
+
+@respx.mock
+async def test_list_users_raises_without_admin_mode():
+    """The public projection must not read as 'no external users'."""
+    respx.get("https://gitlab.example.com/api/v4/users").mock(
+        return_value=httpx.Response(200, json=[PUBLIC_ROW])
+    )
+    with pytest.raises(AdminModeRequired):
+        await users_service.list_users()
+
+
+@respx.mock
+async def test_list_users_sends_only_true_filters():
+    route = respx.get("https://gitlab.example.com/api/v4/users").mock(
+        return_value=httpx.Response(200, json=[ADMIN_ROW])
+    )
+    await users_service.list_users(active=True, blocked=False, search="contract")
+    params = route.calls.last.request.url.params
+    assert params.get("active") == "true"
+    assert "blocked" not in params
+    assert params.get("search") == "contract"
+
+
+@respx.mock
+async def test_list_external_users_filters_on_the_flag_not_the_query_param():
+    internal = {**ADMIN_ROW, "id": 1, "username": "staff", "external": False}
+    bot = {**ADMIN_ROW, "id": 2, "username": "a_bot", "bot": True}
+    respx.get("https://gitlab.example.com/api/v4/users").mock(
+        return_value=httpx.Response(200, json=[ADMIN_ROW, internal, bot])
+    )
+    users = await users_service.list_external_users()
+    assert [u.username for u in users] == ["contractor"]
+
+
+@respx.mock
+async def test_list_external_users_can_include_bots():
+    bot = {**ADMIN_ROW, "id": 2, "username": "a_bot", "bot": True}
+    respx.get("https://gitlab.example.com/api/v4/users").mock(
+        return_value=httpx.Response(200, json=[ADMIN_ROW, bot])
+    )
+    users = await users_service.list_external_users(include_bots=True)
+    assert sorted(u.username for u in users) == ["a_bot", "contractor"]
+
+
+@respx.mock
+async def test_get_user_requires_admin_projection():
+    respx.get("https://gitlab.example.com/api/v4/users/7").mock(
+        return_value=httpx.Response(200, json=PUBLIC_ROW)
+    )
+    with pytest.raises(AdminModeRequired):
+        await users_service.get_user(7)