Add optional AI generation, MQTT, OAuth refresh and calendar recurrence

tests/test_oauth.py

@@ -0,0 +1,79 @@
+import json
+import time
+
+import pytest
+
+from pigway_frame_flow.errors import FlowError
+from pigway_frame_flow.providers.oauth import OAuthTokens
+
+
+@pytest.mark.parametrize("kind", ["google-drive", "alipan", "baidu"])
+def test_refresh_fixed_endpoint_private_persistence(
+    service, monkeypatch, tmp_path, kind
+):
+    calls = []
+
+    def fetch(url, **kwargs):
+        calls.append((url, kwargs))
+        return json.dumps(
+            {
+                "access_token": "new-private-token",
+                "refresh_token": "rotated-private-token",
+                "expires_in": 3600,
+            }
+        ).encode()
+
+    monkeypatch.setattr(service.assets, "fetch_url", fetch)
+    credentials = {
+        "access_token": "old-token",
+        "refresh_token": "refresh-private",
+        "client_id": "app",
+        "client_secret": "client-private",
+    }
+    path = tmp_path / "credentials.secret"
+    result = OAuthTokens(service.settings, service.assets).refresh(
+        kind, credentials, path
+    )
+    assert calls[0][0] == OAuthTokens.ENDPOINTS[kind]
+    assert result["expires_at"] > time.time() + 3500
+    assert json.loads(path.read_text())["refresh_token"] == "rotated-private-token"
+    assert path.stat().st_mode & 0o777 == 0o600
+    assert service.settings.sanitize("new-private-token") != "new-private-token"
+
+
+def test_refresh_failure_never_retries_or_exposes_secret(service, monkeypatch):
+    calls = []
+
+    def fetch(*args, **kwargs):
+        calls.append(args)
+        raise RuntimeError("private-secret")
+
+    monkeypatch.setattr(service.assets, "fetch_url", fetch)
+    with pytest.raises(FlowError) as exc:
+        OAuthTokens(service.settings, service.assets).refresh(
+            "baidu",
+            {
+                "refresh_token": "refresh",
+                "client_id": "app",
+                "client_secret": "private-secret",
+            },
+        )
+    assert len(calls) == 1
+    assert "private-secret" not in str(exc.value)
+
+
+def test_invalid_refresh_does_not_replace_existing_credentials(
+    service, monkeypatch, tmp_path
+):
+    path = tmp_path / "secret"
+    path.write_text("original")
+    monkeypatch.setattr(
+        service.assets, "fetch_url", lambda *a, **k: b'{"error":"invalid_grant"}'
+    )
+    with pytest.raises(FlowError):
+        OAuthTokens(service.settings, service.assets).refresh(
+            "google-drive",
+            {"refresh_token": "refresh", "client_id": "app", "client_secret": "secret"},
+            path,
+        )
+    assert path.read_text() == "original"