From 43b81bbb2b917604e24333f4efcb0c4186bf626f Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Sat, 3 Oct 2026 12:02:53 +0100 Subject: [PATCH] Exercise curl header removal and explicit empty roles separately The first complete authentication-help proof exposed a fixture expectation error: curl removes a colon-only header rather than sending an empty value. Preserve that case and add the semicolon form, checking the exact transmitted value across success, denial and redirect controls. Documentation and runtime behaviour are unchanged. Contract-Neutral: Executable documentation control correction only; no authentication, authorisation, frontend or runtime contract delta. Change-source: pulse-maintainer --- scripts/tests/test_authentication_diagnostic_docs.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/scripts/tests/test_authentication_diagnostic_docs.py b/scripts/tests/test_authentication_diagnostic_docs.py index 7323dad5e3..b3b129fcfc 100644 --- a/scripts/tests/test_authentication_diagnostic_docs.py +++ b/scripts/tests/test_authentication_diagnostic_docs.py @@ -167,7 +167,14 @@ class AuthenticationDiagnosticDocsTest(unittest.TestCase): def test_proxy_probe_preserves_roles_reports_status_only_and_never_follows_redirects(self): for status in (200, 401, 403, 302): with proxy_server(status) as (port, requests): - for role in ("X-Proxy-Roles: none\n", "", "X-Proxy-Roles:\n"): + # curl's colon-only form removes a header. A semicolon sends + # an explicitly empty header; cover both as well as omission. + for role, expected_role in ( + ("X-Proxy-Roles: none\n", "none"), + ("", None), + ("X-Proxy-Roles:\n", None), + ("X-Proxy-Roles;\n", ""), + ): with self.subTest(status=status, role=role), tempfile.TemporaryDirectory() as temporary: before = len(requests) result = self.exercise_proxy(Path(temporary), port, role) @@ -179,7 +186,7 @@ class AuthenticationDiagnosticDocsTest(unittest.TestCase): self.assertEqual((method, path), ("GET", "/api/system/settings")) self.assertEqual(headers["X-Proxy-Secret"], TEST_TOKEN) self.assertEqual(headers["X-Authentik-Username"], "testuser") - self.assertEqual(headers.get("X-Proxy-Roles"), None if not role else ("none" if "none" in role else "")) + self.assertEqual(headers.get("X-Proxy-Roles"), expected_role) for unexpected in ("X-API-Token", "Authorization", "Cookie", "X-Curlrc-Injected"): self.assertNotIn(unexpected, headers)