Reject failed OpenID discovery responses before caching

[jdotc1]

A JSON error response from the OpenID discovery endpoint is currently parsed and returned by the cached open_id_configuration helper. For example, a JSON 503 response can be retained as discovery configuration instead of allowing a later request to retry.

Call raise_for_status() before JSON parsing, matching the adjacent public-key fetcher. Failed HTTP responses now raise before the cache receives a value; successful discovery responses retain the existing behavior.

Validation: retained focused before/after evidence used real Requests responses and cachetools with mocked transport: a JSON 503 raises, and a subsequent 200 retry is fetched successfully. This evidence was reused without rerunning unchanged checks. Full package, integration and live identity-provider tests were not run. This change does not alter JWT, issuer, audience, redirect or token-algorithm policy.

Summary by CodeRabbit

• Bug Fixes
  • OpenID configuration requests now report unsuccessful HTTP responses as errors rather than attempting to parse them as valid configuration data.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c65896b1-50e5-422e-bf60-21e7b35d6f58

📥 Commits

Reviewing files that changed from the base of the PR and between 0b1ee41 and f5adaff.

📒 Files selected for processing: 1

• monailabel/endpoints/user/auth.py

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

Walkthrough

The OpenID configuration endpoint now checks the HTTP response status before parsing the response JSON.

Changes

OpenID configuration

Layer / File(s)	Summary
Validate response status monailabel/endpoints/user/auth.py	open_id_configuration calls raise_for_status() before parsing the response JSON.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to f5ada

Failed discovery responses are rejected before token requests, while successful discovery remains unchanged; no material merge risk is evident.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: rejecting failed OpenID discovery responses before caching.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}