fix: reject unknown providers, validate azure-ad fields, strip Authorization from extra_headers

- Reject unknown provider keys during auth.json load with clear error message
- Validate azure-ad tenant_id/client_id/client_secret_env as non-empty strings
- Strip Authorization from extra_headers in both build_request and open_url
  to prevent accidental or intentional bypass of provider-configured auth
- Add tests for unknown provider and incompatible scheme validation
- 1831 tests passing

Author: mnriem

src/specify_cli/authentication/config.py

@@ -122,7 +122,13 @@ def load_auth_config(
         # Validate provider+scheme compatibility
         from . import get_provider as _get_provider
         _prov = _get_provider(provider)
-        if _prov is not None and auth not in _prov.supported_auth_schemes:
+        if _prov is None:
+            from . import AUTH_REGISTRY
+            raise ValueError(
+                f"providers[{i}]: unknown provider {provider!r}; "
+                f"registered: {sorted(AUTH_REGISTRY.keys())}"
+            )
+        if auth not in _prov.supported_auth_schemes:
             raise ValueError(
                 f"providers[{i}]: provider {provider!r} does not support "
                 f"auth scheme {auth!r}; supported: {list(_prov.supported_auth_schemes)}"
@@ -143,6 +149,15 @@ def load_auth_config(
                     f"providers[{i}]: auth='azure-ad' requires "
                     "'tenant_id', 'client_id', and 'client_secret_env'"
                 )
+            for field_name, field_val in [
+                ("tenant_id", tenant_id),
+                ("client_id", client_id),
+                ("client_secret_env", client_secret_env),
+            ]:
+                if not isinstance(field_val, str) or not field_val.strip():
+                    raise ValueError(
+                        f"providers[{i}]: '{field_name}' must be a non-empty string"
+                    )
         # azure-cli needs no extra fields
 
         entries.append(

src/specify_cli/authentication/http.py

@@ -75,7 +75,8 @@ def build_request(url: str, extra_headers: dict[str, str] | None = None) -> urll
     """
     headers: dict[str, str] = {}
     if extra_headers:
-        headers.update(extra_headers)
+        # Strip Authorization from extra_headers to prevent bypass
+        headers.update({k: v for k, v in extra_headers.items() if k.lower() != "authorization"})
     # Auth headers applied last — cannot be overridden by extra_headers
     entries = find_entries_for_url(url, _load_config())
     for entry in entries:
@@ -105,7 +106,8 @@ def open_url(url: str, timeout: int = 10, extra_headers: dict[str, str] | None =
     def _make_req(auth_headers: dict[str, str]) -> urllib.request.Request:
         merged = {}
         if extra_headers:
-            merged.update(extra_headers)
+            # Strip Authorization from extra_headers to prevent bypass
+            merged.update({k: v for k, v in extra_headers.items() if k.lower() != "authorization"})
         # Auth headers applied last — cannot be overridden by extra_headers
         merged.update(auth_headers)
         return urllib.request.Request(url, headers=merged)

tests/test_authentication.py

@@ -222,6 +222,27 @@ def test_azure_ad_missing_fields_raises(self, tmp_path):
         with pytest.raises(ValueError, match="azure-ad"):
             load_auth_config(cfg)
 
+    def test_unknown_provider_raises(self, tmp_path):
+        cfg = tmp_path / "auth.json"
+        cfg.write_text(json.dumps({
+            "providers": [{"hosts": ["example.com"], "provider": "gitlab", "auth": "bearer", "token_env": "X"}]
+        }))
+        with pytest.raises(ValueError, match="unknown provider"):
+            load_auth_config(cfg)
+
+    def test_incompatible_provider_scheme_raises(self, tmp_path):
+        cfg = tmp_path / "auth.json"
+        cfg.write_text(json.dumps({
+            "providers": [{
+                "hosts": ["github.com"],
+                "provider": "github",
+                "auth": "basic-pat",
+                "token_env": "X",
+            }]
+        }))
+        with pytest.raises(ValueError, match="does not support"):
+            load_auth_config(cfg)
+
     def test_world_readable_warns(self, tmp_path):
         import stat