chore: refacotring http auth

[itsoyou]

SYN-99

---

Note

Medium Risk
Changes auth config parsing and error types for OAuth introspection/notify HTTP auth, which could break misconfigured deployments that relied on empty types or empty credentials.

Overview
Refactors HTTP auth configuration parsing: NoAuth, BasicAuth, and BearerAuth move from Pydantic BaseModel to pydantic.dataclasses, with min_length=1 on username, password, and token so empty credentials fail validation.

parse_dict_auth and parse_list_auth are removed; dict and list shapes are handled in a single parse_auth, with an AUTH_TYPES map for basic / bearer. Parse failures now raise ValueError with a consistent Auth configuration error: prefix (optional config context in logs and messages), instead of generic Exception / HttpAuth wording.

Behavior tightening: only type: null (or list [null]) yields NoAuth; an empty string type is treated as unknown, not no-auth. Dict configs with extra keys are accepted (extras ignored); list configs still reject extra positional args. pydantic is added as a runtime dependency and pydantic.mypy is enabled in tooling.

^{Reviewed by Cursor Bugbot for commit 6d5b978. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

❌ Patch coverage is 95.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.34%. Comparing base (88e4ff0) to head (6d5b978).

Files with missing lines	Patch %	Lines
synapse_token_authenticator/http_auth.py	95.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #100      +/-   ##
==========================================
- Coverage   76.67%   76.34%   -0.33%     
==========================================
  Files           9        9              
  Lines         763      761       -2     
  Branches      130      126       -4     
==========================================
- Hits          585      581       -4     
- Misses        124      125       +1     
- Partials       54       55       +1     

Files with missing lines	Coverage Δ
synapse_token_authenticator/http_auth.py	96.42% <95.00%> (-3.58%)	⬇️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 88e4ff0...6d5b978. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[FrenchGithubUser]

shouldn't this already be done by pydantic?

[itsoyou]

ahh good point.

[FrenchGithubUser]

same here for pydantic

[FrenchGithubUser]

This already includes {context}: {HTTP_AUTH_CONFIGURATION_ERROR} prefix, but the except (…, TypeError) below re-wraps it with the same prefix (then appears twice in the logs). Maybe you can raise the bare message here (raise TypeError("Auth parsing failed, expected list or dict")) and let the except add the prefix once.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6d5b978. Configure here.}

[cursor]

Dict extras silently ignored

Medium Severity

BasicAuth and BearerAuth dropped extra="forbid" in the move from BaseModel to pydantic dataclasses, so unknown dict keys are discarded instead of failing config load. List-form extras still error via auth(*args), so the same typo is accepted or rejected depending on config shape.

Additional Locations (1)

• synapse_token_authenticator/http_auth.py#L81-L83

 

^{Reviewed by Cursor Bugbot for commit 6d5b978. Configure here.}