tests.test_token module

Tests for repomatic.github.token.

tests.test_token.test_validate_gh_api_access_returns_the_headers()

The headers are the one part of the answer the scope check reads.

tests.test_token.test_validate_gh_api_access_names_the_refusal(body, fragment)

An error status names the status, and the API’s own message when it has one.

tests.test_token.test_validate_gh_api_access_names_an_unreachable_api()

A network failure says the API could not be reached at all.

tests.test_token.test_validate_classic_pat_scope(headers, error)

Only a classic token holding the scope passes.

tests.test_token.test_validate_notifications_token_warns_on_extra_scopes(caplog, scopes, warned)

A token holding more than the notifications scope gets a warning.

tests.test_token.test_validate_notifications_token_propagates()

A validation failure propagates to the CLI entry point.

tests.test_token.test_unsubscribe_threads_runs_the_notifications_validator()

unsubscribe-threads stops on the validator of this module, and says why.

tests.test_token.test_pat_permission_probe_pass(probe)

Pass with the probe’s success message when the API call succeeds.

tests.test_token.test_pat_permission_probe_fail_403(probe)

Fail with the missing-permission message when the API call 403s.

tests.test_token.test_pat_vulnerability_alerts_permission_404()

A 404 is reported as ‘alerts not enabled’, not as a missing permission.

tests.test_token.test_pat_check_non_403_surfaces_raw_error()

A 401 from an upstream incident surfaces the raw stderr, not a scope hint.

tests.test_token.test_pat_check_annotates_with_github_status_incident()

An active githubstatus.com incident is appended to the failure message.

tests.test_token.test_pat_probe_name_drops_the_access_level(probe, name)

A probe’s name is its permission as GitHub’s PAT form labels it.

tests.test_token.test_pat_permission_results_map_each_probe_field()

Every probe answers with the shared result type, under its own field.

tests.test_token.test_pat_permission_results_name_the_failed_fields()

failed() pairs each failing field with its message, in probe order.

tests.test_token.REFUSED = 'Resource not accessible by personal access token (HTTP 403)'

What gh reports when a token asks a repository it does not cover.

tests.test_token.test_pat_repository_scope_probes_an_endpoint_only_its_token_reads()

The probe is the Administration row, and no other row can replace it.

A public repository answers the contents, issues, pull requests and workflows endpoints to any caller, so a 2xx from one of them on another repository says nothing about the token.

tests.test_token.test_pat_repository_scope_probes_other_repositories(answers, passed, fragment)

The probes of other repositories decide the scope.

Only a repository that answers fails the check: a refusal passes it, and anything else leaves it undecided. The repository under check is never one of the others, however the listing spells its name.

tests.test_token.test_pat_repository_scope_probes_the_most_recently_pushed_repositories()

The listing is sorted by push date, and the probes stop at the limit.

tests.test_token.test_pat_repository_scope_skips_an_unreadable_listing()

A listing that fails leaves the check undecided.