Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Revoke pesu-auth's PESU Academy tokens after each login

Aperta
  • Qualcosa non va?
#188 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
42/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
api, authentication, backend, documentation, testing

Direzione di ricerca

Start with authenticate, _upstream_call, close_client, _CLOSE_TASKS, and _close_client_quietly; read tests/unit/test_pesu.py and test_metrics_instrumentation.py for lifecycle and metrics expectations. Follow CONTRIBUTING.md for credential-based testing and inspect the README metrics documentation. Done means successful logins trigger a best-effort logout without changing responses or adding latency, failures are recorded, clients do not leak, and the live functional test passes.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

authentication enhancement pesuacademy

🔄 Updated for v5.0.0 (2026-10-08). 5.0.0 signs in through PESU Academy's mobile API (#241), so there is no web session or cookie to end any more: a login returns an access token (valid for 30 minutes) and a refresh token. The goal is the same, ending what pesu-auth started, but the investigation is now about the mobile app's logout or token revocation call, and the cleanup no longer goes through close_client, which is gone.

⚠️ PES University students only. This change sits in the login path and has to be tested end to end against PESU Academy with real PESU credentials (see "Tests that need credentials" in CONTRIBUTING.md). Run the whole suite with your credentials in .env and paste the summary line into your PR. Every run makes real logins to PESU Academy, so run it when you need it, not in a loop.

Summary

Every successful login through pesu-auth leaves a valid access token (30 minutes) and refresh token on PESU Academy's side. pesu-auth closes its HTTP client and never stores either token, but PESU still considers them live until they expire. If PESU's mobile API has a logout or revocation call, use it, as a best effort, once pesu-auth has finished with the login.

Why

  • Being a good client: pesu-auth logs in on behalf of many students and uses each login for a second or two. Leaving a live token pair behind for every one of them is wasteful, and PESU could reasonably object to it.
  • Less exposure: a revoked token is useless even if it leaked somehow. The refresh token in particular may live much longer than the access token.

Proposed change

  1. Find the logout request. pesu-auth's endpoints were read off the PESU Academy mobile app's own traffic (see the comment above the constants in app/pesu.py). Do the same for logging out:
    • log out in the mobile app with your own account and capture the request: its method, URL, headers (such as X-Client-Type: MOBILE and Authorization) and body;
    • it may be a dispatcher call with its own action/mode/menuId, like the profile call, or a separate endpoint; check, don't guess;
    • record it in the PR with no token values.
  2. Check what logout affects. pesu-auth has shown that PESU allows several sessions per account at once: two parallel logins both worked, and an older login's token still worked after a newer one. Check that revoking pesu-auth's token does not end the student's own app or browser session: log in on your phone, log in through a local pesu-auth with this change, then use the app. If it logs the student out everywhere, stop and report back in this issue before continuing, because that would be a regression for every user.
  3. Implement it as a best effort:
    • After a successful login, and after the profile call if one was requested, send the logout through _upstream_call(self._metrics, "logout"). This adds a third operation label value, which is bounded; update the README's metrics docs.
    • It must never change the response. Catch and log failures at WARNING (never the token); never raise.
    • It must not add latency. Run it in a background task that owns the client and closes it afterwards, holding a strong reference (see _CLOSE_TASKS and _close_client_quietly for the pattern). Move the close out of authenticate's finally only for this path; every other path still closes immediately.
    • On shutdown, finish or cancel these tasks so no client leaks. lifespan in app/app.py has no cleanup step since 5.0.0, so this adds one (for example a public PESUAcademy.aclose() that it awaits).
  4. Don't log out after a failed login: there's no token to revoke.

Tests

  • A successful login schedules exactly one logout with the right method, URL and headers, and the response is returned without waiting for it.
  • A logout failure (exception or non-200) is logged and counted, and the response is unaffected.
  • A failed login doesn't log out.
  • No token appears in any log line (caplog).
  • Every client is still closed exactly once, including when shutdown happens during a logout (the client-lifecycle tests in tests/unit/test_pesu.py and test_metrics_instrumentation.py).
  • The live suite passes. Add a functional test that a login followed by a logout succeeds.

Acceptance criteria

  • pesu-auth revokes its tokens after each successful login, or the issue is closed with evidence that the mobile API has no such call
  • It doesn't log students out of their own app or browser sessions (verified and written up in the PR)
  • No added latency, and no client leaks
  • Documented in the README (the flow and the metrics)

How to contribute

  • Wait until you're assigned. Comment to ask for this issue, then wait for a maintainer to assign it to you before writing any code. PRs for unassigned issues are closed without review.
  • Read CONTRIBUTING.md first. It covers forking, setting up with uv, and running the tests.
  • Branch from dev in your fork, and open the PR against dev with a Conventional Commit title and Closes #188 in the description.
  • Bump the minor version in pyproject.toml and run uv lock (CI checks this). uv run pre-commit run --all-files must pass, and coverage must stay at 100%.
  • Update the README, app/docs/ and comments in the same PR as the behaviour they describe.
  • Never log, print, store or echo a password or token, including in tests, PR descriptions and screenshots.
Lingua principale
Python
Stelle
22
Fork
29
Merge medio
1g 3h
PR unite (30g)
19

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di pesu-dev/auth

Tutte le issue di pesu-dev/auth

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.