Reject failed OpenID discovery responses before caching

[jdotc1]

A JSON error response from the OpenID discovery endpoint is currently parsed and returned by the cached open_id_configuration helper. For example, a JSON 503 response can be retained as discovery configuration instead of allowing a later request to retry.

Call raise_for_status() before JSON parsing, matching the adjacent public-key fetcher. Failed HTTP responses now raise before the cache receives a value; successful discovery responses retain the existing behavior.

Validation: retained focused before/after evidence used real Requests responses and cachetools with mocked transport: a JSON 503 raises, and a subsequent 200 retry is fetched successfully. This evidence was reused without rerunning unchanged checks. Full package, integration and live identity-provider tests were not run. This change does not alter JWT, issuer, audience, redirect or token-algorithm policy.

Summary by CodeRabbit

• Bug Fixes
  • OpenID configuration requests now verify that the discovery service returned a successful HTTP response before using its data. Unsuccessful responses are surfaced as errors instead of being treated as configuration data, and are not cached, so a later request can retry. This prevents error responses from being parsed as valid configuration and allows recovery when the service becomes available again.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a8462747-4485-4e68-82bb-a457d09b46c9

📥 Commits

Reviewing files that changed from the base of the PR and between f5adaff and 015dc99.

📒 Files selected for processing: 1

• monailabel/endpoints/user/auth.py

🚧 Files skipped from review as they are similar to previous changes: 1

• monailabel/endpoints/user/auth.py

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

Walkthrough

open_id_configuration now checks the OpenID discovery response status before parsing its JSON. Its docstring states that failed responses are not cached and later calls can retry.

Changes

OpenID discovery

Layer / File(s)	Summary
Validate discovery response monailabel/endpoints/user/auth.py	open_id_configuration calls raise_for_status() before parsing response JSON. The docstring states that failed responses are not cached and later calls can retry.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 015dc

Failed discovery responses are rejected rather than cached, allowing a later request to retry. No merge-blocking issue was identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: rejecting failed OpenID discovery responses before caching them.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jdotc1]

Added a focused docstring to open_id_configuration in 015dc99, describing cached discovery configuration and propagation of HTTP errors before JSON parsing.

This follow-up adds five documentation lines. Removing them restores the exact prior file bytes and executable AST. Python syntax/compile checks and the repository-pinned Black, isort, and Flake8 checks passed. CodeRabbit's refreshed review on this commit now reports 100.00% docstring coverage.