OpenHands / OpenHands/software-agent-sdk

Isolate MCP OAuth settings persistence in agent-server tests

Open Beginner friendly
#4,604 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug mcp priority:medium ready-for-dev security testing
Dominant language
Python
Stars
1.1k
Forks
539
Avg merge
1d 19h
Merged PRs (30d)
137

Description

The MCP OAuth settings-store tests should keep persistence inside their pytest temporary directory by setting OH_PERSISTENCE_DIR.

Actual Behavior

In tests/agent_server/test_mcp_oauth_store.py, the affected tests create configurations using tmp_path but call get_settings_store() without setting OH_PERSISTENCE_DIR. The settings store therefore falls back to the user default ~/.openhands persistence directory, allowing encrypted MCP OAuth state to be written outside the pytest sandbox.

Reproduce with:

uv run pytest tests/agent_server/test_mcp_oauth_store.py -q

Before this change, the tests did not redirect OH_PERSISTENCE_DIR to tmp_path.

Acceptance Criteria
  • Each affected MCP OAuth settings-store test sets OH_PERSISTENCE_DIR to its pytest tmp_path.
  • The focused test suite passes with uv run pytest tests/agent_server/test_mcp_oauth_store.py -q.
  • Test execution does not write settings or encrypted OAuth state to the user default persistence directory.

This issue was created and updated by an AI agent (OpenHands) on behalf of the user.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in tests/agent_server/test_mcp_oauth_store.py and run uv run pytest tests/agent_server/test_mcp_oauth_store.py -q. Inspect each affected test that uses tmp_path and get_settings_store(), then ensure OH_PERSISTENCE_DIR points to that temporary directory. Done means the focused suite passes and no settings or encrypted OAuth state is written under the user default persistence directory.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
testing-qa
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.