security: fail closed on bearer endpoint credentials

tests/test_api_token_repair_cycle8.py

@@ -0,0 +1,94 @@
+"""Cycle-8 regressions for bearer provider-auth session repair."""
+
+import json
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+
+import core.database as cdb
+
+
+_CODEX_BASE = "https://chatgpt.com/backend-api/codex"
+
+
+def _provider_db(monkeypatch):
+    from routes import chat_helpers
+    from src import chatgpt_subscription
+
+    engine = create_engine("sqlite:///:memory:")
+    cdb.Base.metadata.create_all(bind=engine)
+    test_session_local = sessionmaker(bind=engine, autoflush=False)
+    monkeypatch.setattr(chat_helpers, "SessionLocal", test_session_local)
+    monkeypatch.setattr(
+        chatgpt_subscription,
+        "_database_handles",
+        lambda: (cdb.ProviderAuthSession, test_session_local, cdb.utcnow_naive),
+    )
+
+    db = test_session_local()
+    db.add(cdb.ProviderAuthSession(
+        id="auth-1",
+        provider="chatgpt-subscription",
+        owner="alice",
+        base_url=_CODEX_BASE,
+        access_token="cached-access-token",
+        refresh_token="refresh-token",
+        auth_mode="chatgpt",
+    ))
+    db.add(cdb.ModelEndpoint(
+        id="endpoint-1",
+        name="ChatGPT Subscription",
+        base_url=_CODEX_BASE,
+        api_key=None,
+        provider_auth_id="auth-1",
+        owner="alice",
+        is_enabled=True,
+        endpoint_kind="api",
+        cached_models=json.dumps(["gpt-5.5"]),
+        pinned_models=json.dumps(["gpt-5.5"]),
+    ))
+    db.commit()
+    db.close()
+    return test_session_local
+
+
+def _registered_session():
+    return SimpleNamespace(
+        endpoint_url=f"{_CODEX_BASE}/responses",
+        model="gpt-5.5",
+        model_endpoint_id="endpoint-1",
+        endpoint_provenance="registered",
+        headers={"Authorization": "Bearer stale-token"},
+    )
+
+
+def test_bearer_validator_uses_owner_cached_provider_auth_without_refresh(monkeypatch):
+    from routes.chat_helpers import _validate_bearer_session_model
+    from src import chatgpt_subscription
+
+    _provider_db(monkeypatch)
+    monkeypatch.setattr(chatgpt_subscription, "access_token_is_expiring", lambda token: False)
+    monkeypatch.setattr(
+        chatgpt_subscription,
+        "refresh_oauth_tokens",
+        lambda *args, **kwargs: pytest.fail("bearer validation refreshed provider credentials"),
+    )
+
+    session = _registered_session()
+    assert _validate_bearer_session_model(session, owner="alice") == "gpt-5.5"
+    assert session.headers["Authorization"] == "Bearer cached-access-token"
+
+
+def test_bearer_validator_rejects_provider_auth_when_cache_is_unusable(monkeypatch):
+    from routes.chat_helpers import _validate_bearer_session_model
+    from src import chatgpt_subscription
+
+    _provider_db(monkeypatch)
+    monkeypatch.setattr(chatgpt_subscription, "access_token_is_expiring", lambda token: True)
+
+    with pytest.raises(HTTPException) as exc:
+        _validate_bearer_session_model(_registered_session(), owner="alice")
+    assert exc.value.status_code == 401