From 7cf2a5882aeaacce28a03cf970b5a635441918a7 Mon Sep 17 00:00:00 2001 From: Brian Krabach Date: Sat, 28 Mar 2026 21:25:16 -0700 Subject: [PATCH] style(auth): apply code quality suggestions from review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - auth.py: replace 'import os as _os' with plain 'import os' inside authenticate_pam() — the alias convention is for module-level private names, not function-scoped imports - test_auth.py: move 'import pwd' from two test functions to module-level imports, consistent with existing 'import os' placement - test_auth.py: make wrong-user test robust against running as root — derives 'wrong_user' dynamically so the test holds in Docker CI environments where the runner may be root --- muxplex/auth.py | 4 ++-- muxplex/tests/test_auth.py | 11 ++++++----- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/muxplex/auth.py b/muxplex/auth.py index 008339d..13246f1 100644 --- a/muxplex/auth.py +++ b/muxplex/auth.py @@ -114,12 +114,12 @@ def pam_available() -> bool: def authenticate_pam(username: str, password: str) -> bool: """Authenticate via PAM. Username must match the running process owner.""" - import os as _os + import os import pwd import pam - running_user = pwd.getpwuid(_os.getuid()).pw_name + running_user = pwd.getpwuid(os.getuid()).pw_name if username != running_user: return False return pam.authenticate(username, password, service="login") diff --git a/muxplex/tests/test_auth.py b/muxplex/tests/test_auth.py index c9e8126..31da6f3 100644 --- a/muxplex/tests/test_auth.py +++ b/muxplex/tests/test_auth.py @@ -1,6 +1,7 @@ """Tests for muxplex/auth.py — authentication module.""" import os +import pwd import stat from pathlib import Path @@ -205,8 +206,6 @@ def test_pam_available_returns_false_on_import_error(monkeypatch): def test_authenticate_pam_success(monkeypatch): """authenticate_pam() returns True when PAM succeeds for the running user.""" - import pwd - from muxplex.auth import authenticate_pam running_user = pwd.getpwuid(os.getuid()).pw_name @@ -216,8 +215,6 @@ def test_authenticate_pam_success(monkeypatch): def test_authenticate_pam_wrong_password(monkeypatch): """authenticate_pam() returns False when PAM rejects credentials.""" - import pwd - from muxplex.auth import authenticate_pam running_user = pwd.getpwuid(os.getuid()).pw_name @@ -229,6 +226,10 @@ def test_authenticate_pam_wrong_user_rejected(monkeypatch): """authenticate_pam() rejects a different username even if PAM would accept it.""" from muxplex.auth import authenticate_pam + # Pick a wrong user that is guaranteed to differ from whoever is running the tests + running_user = pwd.getpwuid(os.getuid()).pw_name + wrong_user = "nobody" if running_user == "root" else "root" + # Mock PAM to always return True — but wrong username should still fail monkeypatch.setattr("pam.authenticate", lambda u, p, service="login": True) - assert authenticate_pam("root", "any-password") is False + assert authenticate_pam(wrong_user, "any-password") is False