Merge branch 'dev' into flask-upgrade

.pre-commit-config.yaml

@@ -7,7 +7,7 @@ repos:
   #         - --py39-plus
 
   - repo: https://github.com/psf/black
-    rev: 23.12.1
+    rev: 24.1.0
     hooks:
       - id: black
         language_version: python3

news/1356.bug

@@ -0,0 +1 @@
+Only choose an IPA server that is in the config

noggin/security/ipa.py

@@ -130,8 +130,9 @@ def choose_server(app, session=None):
     server = None
     if session is not None:
         server = session.get('noggin_ipa_server_hostname', None)
-    if server is None:
-        server = random.choice(app.config['FREEIPA_SERVERS'])
+    available_servers = app.config['FREEIPA_SERVERS']
+    if server is None or server not in available_servers:
+        server = random.choice(available_servers)
     if session is not None:
         session['noggin_ipa_server_hostname'] = server
     return server

tests/unit/security/test_ipa.py

@@ -25,6 +25,9 @@ def ipa_call_error():
 
 
 def test_choose_server(client, mocker):
+    mocker.patch.dict(
+        current_app.config, {"FREEIPA_SERVERS": ["a.example.test", "b.example.com"]}
+    )
     random = mocker.patch("noggin.security.ipa.random")
     random.choice.side_effect = ["a.example.test", "b.example.test", "c.example.test"]
     with client.session_transaction() as sess:
@@ -48,6 +51,16 @@ def test_choose_server_no_session(client, mocker):
     assert random.choice.call_count == 2
 
 
+def test_choose_server_not_in_config(client, mocker):
+    mocker.patch.dict(current_app.config, {"FREEIPA_SERVERS": ["a.example.test"]})
+    with client.session_transaction() as sess:
+        sess['noggin_ipa_server_hostname'] = "b.example.test"
+    with client.session_transaction() as sess:
+        server = choose_server(current_app, sess)
+    # It should be the one from the config
+    assert server == "a.example.test"
+
+
 @pytest.mark.vcr
 def test_ipa_session_authed(client, logged_in_dummy_user):
     """Check maybe_ipa_session() when a user is logged in"""