Fix auth bugs, improve error handling, and add integration tests by fede-kamel · Pull Request #10 · oracle-samples/oci-genai-auth-python

fede-kamel · 2026-04-12T14:31:23Z

Summary

Fix 401 retry silently dropping responses — when token refresh fails during a 401 retry, the generator previously ended without yielding, causing the caller to receive no response at all. Now the generator ends gracefully and the original 401 is returned to the caller.
Fix incorrect return type on OciSessionAuth._load_private_key (str → Any). The OCI SDK returns a cryptography key object, not a string.
Add OciAuthRefreshError exception with cause tracking and elapsed time since last successful refresh.
Track refresh failures via _last_refresh_error attribute for callers to inspect auth health.
Reduce logging noise — init and routine refresh checks moved from INFO to DEBUG. Scheduled refresh failures log at WARNING. 401 retry failures log at ERROR with actionable context.
Expand unit tests from 9 to 20 covering signing, refresh, error handling, and all auth subclasses.
Add integration test infrastructure — conftest.py with env-based config, tests/.env.example template, and requires_oci skip marker.
Add 4 live integration tests — sync/async Responses API, raw httpx signing, and header stripping verification.

Test plan

All 20 unit tests pass (pytest tests/test_auth.py)
All 4 integration tests pass against live OCI endpoint (pytest tests/integration/test_auth_live.py)
Integration tests skip cleanly without OCI_GENAI_* env vars
No changes to existing public API — only additions (OciAuthRefreshError)

How to validate

# Unit tests (no credentials needed)
pytest tests/test_auth.py -v

# Integration tests (copy tests/.env.example to tests/.env, fill in values)
pytest tests/integration/test_auth_live.py -v

Fixes #12

Bug fixes: - Fix 401 retry silently dropping responses when refresh fails. The generator now ends gracefully and the caller receives the original 401 instead of no response at all. - Fix incorrect return type on OciSessionAuth._load_private_key (str -> Any). The OCI SDK returns a cryptography key object, not a string. Improvements: - Add OciAuthRefreshError exception with cause tracking and elapsed time since last successful refresh, for better diagnostics. - Track refresh failures via _last_refresh_error attribute (cleared on success, set on failure) so callers can inspect auth health. - Reduce logging noise: init and routine refresh checks moved from INFO to DEBUG. Only actual refresh completions stay at INFO. Scheduled refresh failures log at WARNING (not silent exception). 401 retry failures log at ERROR with actionable context. Testing: - Expand unit tests from 9 to 20 covering: signing path with header stripping, POST body signing, 401 retry behavior, non-401 passthrough, refresh failure tracking, error clearing on success, OciAuthRefreshError formatting, session auth missing key_file, config reload on refresh. - Add integration test infrastructure: conftest.py with env-based config loading, session-scoped fixtures, and requires_oci skip marker. - Add tests/.env.example template for integration test configuration. - Add 4 live integration tests: sync/async Responses API, raw httpx signing, and header stripping verification. Signed-off-by: Federico Kamelhar <federico.kamelhar@oracle.com>

- Fix SIM105: replace try/except StopIteration/pass with contextlib.suppress(StopIteration) - Fix B011: replace assert False with pytest.raises - Apply isort + ruff format to all changed files - Ensure isort → ruff format → ruff check --fix produces stable output Signed-off-by: Federico Kamelhar <federico.kamelhar@oracle.com>

- Remove dependency on model echoing exact text -- assertions now verify non-empty responses and HTTP 200 status instead of specific content, since model output is non-deterministic. - Expand .env.example with prerequisites: how to create a GenAI Project, which models are known to work/not work on /openai/v1, and auth setup instructions. Signed-off-by: Federico Kamelhar <federico.kamelhar@oracle.com>

fede-kamel · 2026-04-12T14:47:57Z

@shenoyvvarun Would appreciate your review on this. Fixes a bug where the 401 retry path silently drops responses, improves logging levels, adds OciAuthRefreshError for refresh diagnostics, and expands test coverage from 9 to 20 unit tests plus 4 integration tests.

fede-kamel · 2026-04-24T19:35:53Z

Friendly ping — this PR has been open for ~11 days without a review. Happy to address feedback or rebase further if needed. Let me know if there's anything I can clarify. Thanks!

shenoyvvarun · 2026-04-24T22:38:04Z

 OciAuthSigner: TypeAlias = oci.signer.AbstractBaseSigner


+class OciAuthRefreshError(Exception):


Delete this.

Done — removed the class, its export from __init__.py, and the two tests that constructed it.

You're right that it's dead code: nothing in the production path actually raises it. The two failure sites both swallow + log:

scheduled refresh in _refresh_if_needed stores the raw exc on self._last_refresh_error and keeps serving the previous signer (graceful degradation)

401-retry refresh logs and lets the original 401 bubble up to the caller

So the class was unreachable. I'd originally added it thinking we might want a structured error (with last_success elapsed time) for observability/metrics, but since we never raise it, it just bloats the public API. Dropping it.

Looks like it still exists... Maybe missed commit push?

You're right — sorry, the deletion commit landed on my framework-helpers branch by mistake. Just cherry-picked it onto fix/auth-improvements (a3523ce) and pushed. Should be gone now.

fede-kamel · 2026-04-25T16:26:32Z

Integration test results (post-fix)

Ran the full integration suite (tests/integration/) against live OCI GenAI in us-chicago-1 after removing OciAuthRefreshError:

tests/integration/test_auth_live.py::TestOciAuthSigningLive::test_sync_responses_api PASSED
tests/integration/test_auth_live.py::TestOciAuthSigningLive::test_async_responses_api PASSED
tests/integration/test_auth_live.py::TestOciAuthSigningLive::test_raw_httpx_request PASSED
tests/integration/test_auth_live.py::TestOciAuthSigningLive::test_auth_headers_stripped PASSED
tests/integration/test_langchain.py::TestLangChain::test_build_langchain_chat PASSED
tests/integration/test_openai_sdk.py::TestOpenAISDK::test_build_openai_client PASSED
tests/integration/test_openai_sdk.py::TestOpenAISDK::test_build_openai_async_client PASSED
tests/integration/test_openai_sdk.py::TestOpenAIAgentsSDK::test_configure_openai_agents PASSED
tests/integration/test_pydantic_ai.py::TestPydanticAI::test_build_pydantic_ai_model PASSED

9 passed in 11.14s

Coverage:

Sync + async OpenAI /responses calls signed by OciSessionAuth and OciUserPrincipalAuth (both auth types verified end-to-end against live OCI)
Raw httpx POST through HttpxOciAuth.auth_flow returns 200 from the GenAI inference endpoint
SDK-injected Authorization / X-Api-Key headers correctly stripped before OCI signing
LangChain ChatOpenAI, OpenAI Agents SDK, and Pydantic-AI all complete real model calls through the framework helpers

Plus 33/33 unit tests pass and ruff/isort are clean.

The class was never raised — both refresh failure paths swallow the raw exception and store it on _last_refresh_error. Drop the class, its public re-export, and the two tests that constructed it directly.

shenoyvvarun

LGTM. Thanks for making the change.

oracle-contributor-agreement Bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Apr 12, 2026

fede-kamel added 2 commits April 12, 2026 10:40

This was referenced Apr 12, 2026

Add framework helpers for LangChain, PydanticAI, and OpenAI Agents SDK #11

Closed

401 retry silently drops response when token refresh fails #12

Closed

shenoyvvarun requested changes Apr 24, 2026

View reviewed changes

fede-kamel requested a review from shenoyvvarun April 26, 2026 07:04

Remove unused OciAuthRefreshError class

a3523ce

The class was never raised — both refresh failure paths swallow the raw exception and store it on _last_refresh_error. Drop the class, its public re-export, and the two tests that constructed it directly.

shenoyvvarun approved these changes May 4, 2026

View reviewed changes

shenoyvvarun merged commit 4b9bfb3 into oracle-samples:main May 4, 2026
5 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix auth bugs, improve error handling, and add integration tests#10

Fix auth bugs, improve error handling, and add integration tests#10
shenoyvvarun merged 4 commits into
oracle-samples:mainfrom
fede-kamel:fix/auth-improvements

fede-kamel commented Apr 12, 2026 •

edited

Loading

Uh oh!

fede-kamel commented Apr 12, 2026

Uh oh!

fede-kamel commented Apr 24, 2026

Uh oh!

shenoyvvarun Apr 24, 2026

Uh oh!

fede-kamel Apr 25, 2026 •

edited

Loading

Uh oh!

shenoyvvarun Apr 27, 2026

Uh oh!

fede-kamel Apr 27, 2026

Uh oh!

fede-kamel commented Apr 25, 2026

Uh oh!

shenoyvvarun left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		OciAuthSigner: TypeAlias = oci.signer.AbstractBaseSigner


		class OciAuthRefreshError(Exception):

Conversation

fede-kamel commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

How to validate

Uh oh!

fede-kamel commented Apr 12, 2026

Uh oh!

fede-kamel commented Apr 24, 2026

Uh oh!

shenoyvvarun Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

fede-kamel Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shenoyvvarun Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

fede-kamel Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

fede-kamel commented Apr 25, 2026

Integration test results (post-fix)

Uh oh!

shenoyvvarun left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fede-kamel commented Apr 12, 2026 •

edited

Loading

fede-kamel Apr 25, 2026 •

edited

Loading