[kdubb]

OAuth discovery and token responses previously permitted inconsistent parsing and contextual validation across runtimes. This change adds explicit validation, 123 wire fixtures and 34 matching HTTP classification fixtures, and managed interoperability tests while preserving existing public APIs and the public-client compatibility policy from #59 in sunday-kt.

Authlib 1.8.0 constructs protocol requests and authentication; Sunday keeps its borrowed HTTPX transport and strict response decoding. The adapter applies OAuth-required form encoding before Authlib Basic authentication. No HTTPX2 migration.

Native test infrastructure owns checksum/digest-pinned WireMock replay and Keycloak 26.2.5 live lifecycle. Replay is the default. On macOS CI, live tests select the official Java distribution without Docker discovery; other environments use the container. CI invokes standard test commands with replay for PRs and live on main.

Validation: Ruff, mypy, and 470 tests pass with 92.54% coverage. Managed live Keycloak acquisition/refresh passes through HTTPX using both the official Java distribution and pinned container. Failure tests cover cache integrity, readiness, cleanup, and zero Docker calls on macOS CI startup failure.

Acceptance follow-up: all five transports now assert exact HTTP error categories during acquisition and refresh; accepted wire cases assert token values and absolute expiry. Recognized discovery endpoint validation is aligned across runtimes. Native harness tests cover startup failure, readiness timeout, process cleanup, corrupt caches, and rejected downloads. Dependency footprint and license measurements are recorded in the evaluation report.

Local replay/full checks and live Keycloak acquisition/refresh pass using both the Java distribution and pinned container. Kotlin additionally prevents OkHttp from automatically replaying single-use token requests on 408 or immediate-retry 503 responses. No live Auth0 tenant was tested; Auth0-shaped fixtures are deterministic only. Current-head hosted checks and review remain the merge gates. This PR does not publish a beta.

Error classification tolerates empty advisory descriptions as a documented interoperability exception while rejecting wrong types. Fractional expiry values are checked before numeric rounding, with matching precision-boundary fixtures across runtimes. Python uses exact Decimal decoding before integer lifetime conversion. Startup failures retain sanitized diagnostics, and failed container removal is reported with retry state preserved. Confirmed auto-removal is accepted only after a successful Docker inventory query, preserving the original startup error.

Related implementation PRs: Kotlin #61, JavaScript #80, Python #7, Swift #73.

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds OAuth library dependency and test infrastructure.

The reviewed changes appear safe to merge.

What we checked:

• Failed Docker queries retain cleanup state: No. A failed or timed-out query returns false, so close() keeps the container name and reports the cleanup failure.

Summary

Adds Authlib-backed OAuth request construction, strict response checks, shared fixtures, and managed WireMock/Keycloak tests.

• The latest change confirms container absence before accepting a failed removal.
• Cleanup keeps retry state when Docker fails or the container still exists.
• All three supplied previous threads are addressed: empty descriptions are accepted, safe startup details survive cleanup, and automatic container removal no longer hides the startup error.
• No new actionable issues were found. Tests were inspected, not run.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Close provider] --> B{Container removal succeeds?}
  B -- Yes --> E[Clear owned container name]
  B -- No --> C[Query all matching containers]
  C --> D{Query succeeds and owned name is absent?}
  D -- Yes --> E
  D -- No --> F[Keep name for retry]
  E --> G[Stop process and remove local files]
  F --> G
  G --> H{Cleanup failed?}
  H -- Yes --> I[Report cleanup failure]
  H -- No --> J[Finish cleanup]

Loading

_{Reviews (3) · Last reviewed commit: "Treat confirmed container auto-removal a..."}