Matt Mabrey
77f8f9f800
okta_login() and okta_callback() (T10.2) both crash with a 500 (AssertionError: SessionMiddleware must be installed to access request.session) against a real Okta client, because Authlib's authorize_redirect() and authorize_access_token() both store/read OIDC state and nonce in request.session. Never caught by T10.2's or T10.3's own verification because every prior test mocked authorize_redirect / authorize_access_token directly, bypassing Authlib's real implementation entirely. Found while starting T10.5 and reproducing the real flow. Adds starlette.middleware.sessions.SessionMiddleware, on its own cookie (wp_oauth_state, distinct from the app's real session cookie wp_session) with a short 10-minute lifetime and same_site=lax so it survives the top-level redirect back from Okta. This cookie carries nothing but ephemeral per-attempt OAuth state — no identity, no long-term secret — so it reuses auth.SECRET_KEY rather than adding a new required config knob. Reused in T10.5 to carry the post-login redirect target across the same round trip. Adds itsdangerous to requirements.txt — SessionMiddleware's hard dependency, not previously needed anywhere in this app. Verified: reproduced the crash against server.app with a fake (network- bypassed) Authlib client and no SessionMiddleware, confirmed the AssertionError, then confirmed the same request succeeds (302 to the authorize URL, wp_oauth_state cookie set) once the middleware is added. wave-10.md T10.2 (bug fix)
26 lines
1.6 KiB
Plaintext
26 lines
1.6 KiB
Plaintext
# Pinned to exact versions for reproducible builds — no silent dependency drift
|
|
# on every `docker compose up --build`. To update: bump a version here on purpose,
|
|
# run `pip-audit` against the result, and test. For supply-chain integrity, the
|
|
# next step is a hashed lockfile (`pip-compile --generate-hashes` → install with
|
|
# `pip install --require-hashes`).
|
|
fastapi==0.138.1
|
|
uvicorn[standard]==0.49.0
|
|
gunicorn==26.0.0
|
|
sqlalchemy==2.0.51
|
|
alembic==1.18.5 # database migrations
|
|
psycopg[binary]==3.3.4
|
|
pymssql==2.3.13 # read-only lookups against the Micron asset DB (SQL Server).
|
|
# Chosen over pyodbc because it ships self-contained wheels —
|
|
# pyodbc would also need msodbcsql18 + unixODBC installed in
|
|
# the image. To use pyodbc instead, add it here, install the
|
|
# Microsoft ODBC driver in the Dockerfile, and switch
|
|
# MICRON_DB_URL to mssql+pyodbc://…?driver=ODBC+Driver+18+for+SQL+Server
|
|
pydantic==2.13.4
|
|
python-dotenv==1.2.2
|
|
PyJWT==2.13.0 # signed session tokens
|
|
starlette==1.3.1 # pinned transitive (cookie / CORS handling — security-relevant)
|
|
Authlib==1.7.2 # Okta OIDC authorization-code flow (T10.1, wave 10 / D15)
|
|
httpx==0.28.1 # Authlib's OIDC client needs an HTTP client; explicit, not transitive
|
|
itsdangerous==2.2.0 # signs the OAuth-state cookie SessionMiddleware sets — required by
|
|
# Authlib's authorize_redirect/authorize_access_token, not optional
|