style: ruff autofix (auto)

Author: autofix-ci[bot]

src/connectors/google_drive/oauth.py

@@ -38,6 +38,7 @@ def _verify_id_token(id_token: str | None) -> dict | None:
     logger.debug("Google ID token verified, email=%s", claims.get("email"))
     return claims
 
+
 _REFRESH_TIMEOUT_SECONDS = 30
 
 

src/connectors/onedrive/oauth.py

@@ -8,9 +8,7 @@
 logger = logging.getLogger(__name__)
 
 
-def _verify_access_token(
-    access_token: str | None, tenant_id: str | None = None
-) -> dict | None:
+def _verify_access_token(access_token: str | None, tenant_id: str | None = None) -> dict | None:
     """
     Verify Microsoft access token signature, expiry, audience, and issuer domain.
 

src/connectors/sharepoint/oauth.py

@@ -8,9 +8,7 @@
 logger = logging.getLogger(__name__)
 
 
-def _verify_access_token(
-    access_token: str | None, tenant_id: str | None = None
-) -> dict | None:
+def _verify_access_token(access_token: str | None, tenant_id: str | None = None) -> dict | None:
     """
     Verify Microsoft access token signature, expiry, audience, and issuer domain.
 
@@ -154,7 +152,11 @@ async def load_credentials(self) -> bool:
                 logger.debug(f"Found {len(accounts)} accounts in MSAL cache")
                 if accounts:
                     self._current_account = accounts[0]
-                    username = self._current_account.get('username', 'no username') if self._current_account else 'no username'
+                    username = (
+                        self._current_account.get("username", "no username")
+                        if self._current_account
+                        else "no username"
+                    )
                     logger.debug(f"Set current account: {username}")
 
                     if needs_upgrade:
@@ -216,7 +218,11 @@ async def _refresh_from_json_token(self, token_data: dict) -> bool:
                 logger.debug(f"After refresh, found {len(accounts)} accounts")
                 if accounts:
                     self._current_account = accounts[0]
-                    username = self._current_account.get('username', 'no username') if self._current_account else 'no username'
+                    username = (
+                        self._current_account.get("username", "no username")
+                        if self._current_account
+                        else "no username"
+                    )
                     logger.debug(f"Set current account after refresh: {username}")
                 return True
 

src/services/auth_service.py

@@ -287,6 +287,7 @@ async def handle_oauth_callback(
             # Raises JWTVerificationError on any validation failure — connection is rejected.
             if connector_type == "google_drive":
                 from connectors.google_drive.oauth import _verify_id_token
+
                 _verify_id_token(token_data.get("id_token"))
                 logger.debug("[AUTH] Google ID token verification completed for OAuth callback")
 

src/utils/env_utils.py

@@ -35,6 +35,7 @@ def get_env_float(key: str, default: float | None = None) -> float | None:
     """Get an environment variable as a float."""
     return safe_float(os.getenv(key), default)
 
+
 def get_env_set(key: str) -> set[str] | None:
     """Return a set of non-empty strings from a comma-separated env var.
 

src/utils/jwt_verification.py

@@ -151,9 +151,7 @@ def verify_google_id_token(token: str, client_id: str) -> dict[str, Any]:
         JWTVerificationError: For other verification failures
     """
     if not client_id:
-        raise JWTVerificationError(
-            "client_id is required for Google ID token verification"
-        )
+        raise JWTVerificationError("client_id is required for Google ID token verification")
 
     try:
         # Fetch JWKS
@@ -243,8 +241,7 @@ def _validate_ms_issuer(issuer: str, token_tid: str, signing_key_issuer: str) ->
     )
     if tid_in_iss and tid_in_iss != token_tid:
         raise InvalidIssuerError(
-            f"Tenant ID in issuer URL {tid_in_iss!r} does not match "
-            f"tid claim {token_tid!r}"
+            f"Tenant ID in issuer URL {tid_in_iss!r} does not match tid claim {token_tid!r}"
         )
 
 
@@ -300,9 +297,7 @@ def verify_microsoft_access_token(
         JWTVerificationError:  Any other verification failure.
     """
     if not client_id:
-        raise JWTVerificationError(
-            "client_id is required for Microsoft access token verification"
-        )
+        raise JWTVerificationError("client_id is required for Microsoft access token verification")
 
     try:
         # Decode without verification to inspect claims and pick the JWKS endpoint.
@@ -356,9 +351,7 @@ def verify_microsoft_access_token(
         if not kid:
             raise JWTVerificationError("Token header missing 'kid' field")
 
-        signing_key_entry = next(
-            (k for k in jwks.get("keys", []) if k.get("kid") == kid), None
-        )
+        signing_key_entry = next((k for k in jwks.get("keys", []) if k.get("kid") == kid), None)
         if signing_key_entry is None:
             raise JWTVerificationError(f"Signing key with kid '{kid}' not found in JWKS")
 
@@ -429,4 +422,5 @@ def clear_jwks_cache():
     _jwks_cache.clear()
     logger.debug("JWKS cache cleared")
 
+
 # Made with Bob

tests/unit/utils/test_jwt_verification.py

@@ -45,7 +45,6 @@
     verify_microsoft_access_token,
 )
 
-
 # ─────────────────────────────────────────────────────────────────────────────
 # Shared helpers
 # ─────────────────────────────────────────────────────────────────────────────
@@ -64,8 +63,10 @@ def _generate_rsa_key_pair():
     public_key = private_key.public_key()
 
     # Build a minimal JWK for the public key (PyJWT RSAAlgorithm.from_jwk accepts this).
-    from jwt.algorithms import RSAAlgorithm
     import json
+
+    from jwt.algorithms import RSAAlgorithm
+
     jwk_str = RSAAlgorithm.to_jwk(public_key)
     jwk_dict = json.loads(jwk_str)
     jwk_dict["kid"] = KID
@@ -136,10 +137,11 @@ def _clear_cache():
 # _resolve_ms_jwks_url
 # ─────────────────────────────────────────────────────────────────────────────
 
+
 class TestResolveMsJwksUrl:
     def test_v2_token_uses_v2_endpoint(self):
         url = _resolve_ms_jwks_url(TENANT_ID, "2.0")
-        assert f"/discovery/v2.0/keys" in url
+        assert "/discovery/v2.0/keys" in url
         assert TENANT_ID in url
 
     def test_v1_token_uses_v1_endpoint(self):
@@ -157,6 +159,7 @@ def test_unknown_version_defaults_to_v2(self):
 # _validate_ms_issuer
 # ─────────────────────────────────────────────────────────────────────────────
 
+
 class TestValidateMsIssuer:
     def test_v2_exact_match_passes(self):
         """Signing key issuer exactly matches token iss — should pass."""
@@ -194,6 +197,7 @@ def test_issuer_without_guid_segment_skips_tid_url_check(self):
 # verify_microsoft_access_token
 # ─────────────────────────────────────────────────────────────────────────────
 
+
 class TestVerifyMsAccessToken:
     """Tests for verify_microsoft_access_token()."""
 
@@ -222,9 +226,12 @@ def test_graph_token_tenant_allow_list_enforced(self):
         token = _make_ms_token(self.private_key, aud=MS_GRAPH_AUD)
 
         with patch("utils.jwt_verification._fetch_jwks"):
-            with pytest.raises(InvalidIssuerError, match="not in the configured allowed tenant list"):
+            with pytest.raises(
+                InvalidIssuerError, match="not in the configured allowed tenant list"
+            ):
                 verify_microsoft_access_token(
-                    token, CLIENT_ID,
+                    token,
+                    CLIENT_ID,
                     allowed_tenant_ids={"ffffffff-ffff-ffff-ffff-ffffffffffff"},
                 )
 
@@ -235,7 +242,8 @@ def test_graph_token_allowed_tenant_passes(self):
 
         with patch("utils.jwt_verification._fetch_jwks"):
             claims = verify_microsoft_access_token(
-                token, CLIENT_ID,
+                token,
+                CLIENT_ID,
                 allowed_tenant_ids={TENANT_ID},
             )
         assert claims["tid"] == TENANT_ID
@@ -331,9 +339,12 @@ def test_tenant_allow_list_rejects_unlisted_tenant(self):
         token = _make_ms_token(self.private_key)
 
         with patch("utils.jwt_verification._fetch_jwks", return_value=self.jwks):
-            with pytest.raises(InvalidIssuerError, match="not in the configured allowed tenant list"):
+            with pytest.raises(
+                InvalidIssuerError, match="not in the configured allowed tenant list"
+            ):
                 verify_microsoft_access_token(
-                    token, CLIENT_ID,
+                    token,
+                    CLIENT_ID,
                     allowed_tenant_ids={"ffffffff-ffff-ffff-ffff-ffffffffffff"},
                 )
 
@@ -343,7 +354,8 @@ def test_tenant_allow_list_accepts_listed_tenant(self):
 
         with patch("utils.jwt_verification._fetch_jwks", return_value=self.jwks):
             claims = verify_microsoft_access_token(
-                token, CLIENT_ID,
+                token,
+                CLIENT_ID,
                 allowed_tenant_ids={TENANT_ID},
             )
         assert claims["tid"] == TENANT_ID
@@ -392,8 +404,9 @@ def test_jwks_fetch_failure_raises(self):
         """Network failure during JWKS fetch propagates as JWTVerificationError."""
         token = _make_ms_token(self.private_key)
 
-        with patch("utils.jwt_verification._fetch_jwks",
-                   side_effect=JWTVerificationError("network error")):
+        with patch(
+            "utils.jwt_verification._fetch_jwks", side_effect=JWTVerificationError("network error")
+        ):
             with pytest.raises(JWTVerificationError):
                 verify_microsoft_access_token(token, CLIENT_ID)
 
@@ -430,6 +443,7 @@ def test_templated_jwks_key_issuer_accepted(self):
 # verify_google_id_token
 # ─────────────────────────────────────────────────────────────────────────────
 
+
 class TestVerifyGoogleIdToken:
     """Tests for verify_google_id_token()."""
 
@@ -523,44 +537,52 @@ def test_jwks_cached_between_calls(self):
 # get_env_set (env_utils helper)
 # ─────────────────────────────────────────────────────────────────────────────
 
+
 class TestGetEnvSet:
     """Tests for the get_env_set() helper used for MICROSOFT_ALLOWED_TENANT_IDS."""
 
     def test_unset_returns_none(self, monkeypatch):
         monkeypatch.delenv("MICROSOFT_ALLOWED_TENANT_IDS", raising=False)
         from utils.env_utils import get_env_set
+
         assert get_env_set("MICROSOFT_ALLOWED_TENANT_IDS") is None
 
     def test_empty_string_returns_none(self, monkeypatch):
         monkeypatch.setenv("MICROSOFT_ALLOWED_TENANT_IDS", "")
         from utils.env_utils import get_env_set
+
         assert get_env_set("MICROSOFT_ALLOWED_TENANT_IDS") is None
 
     def test_whitespace_only_returns_none(self, monkeypatch):
         monkeypatch.setenv("MICROSOFT_ALLOWED_TENANT_IDS", "   ")
         from utils.env_utils import get_env_set
+
         assert get_env_set("MICROSOFT_ALLOWED_TENANT_IDS") is None
 
     def test_single_value_returns_set(self, monkeypatch):
         monkeypatch.setenv("MICROSOFT_ALLOWED_TENANT_IDS", "aaaa-1111")
         from utils.env_utils import get_env_set
+
         result = get_env_set("MICROSOFT_ALLOWED_TENANT_IDS")
         assert result == {"aaaa-1111"}
 
     def test_multiple_values_returns_set(self, monkeypatch):
         monkeypatch.setenv("MICROSOFT_ALLOWED_TENANT_IDS", "aaaa-1111,bbbb-2222,cccc-3333")
         from utils.env_utils import get_env_set
+
         result = get_env_set("MICROSOFT_ALLOWED_TENANT_IDS")
         assert result == {"aaaa-1111", "bbbb-2222", "cccc-3333"}
 
     def test_values_are_stripped(self, monkeypatch):
         monkeypatch.setenv("MICROSOFT_ALLOWED_TENANT_IDS", " aaaa-1111 , bbbb-2222 ")
         from utils.env_utils import get_env_set
+
         result = get_env_set("MICROSOFT_ALLOWED_TENANT_IDS")
         assert result == {"aaaa-1111", "bbbb-2222"}
 
     def test_empty_segments_ignored(self, monkeypatch):
         monkeypatch.setenv("MICROSOFT_ALLOWED_TENANT_IDS", "aaaa-1111,,bbbb-2222,")
         from utils.env_utils import get_env_set
+
         result = get_env_set("MICROSOFT_ALLOWED_TENANT_IDS")
         assert result == {"aaaa-1111", "bbbb-2222"}