fix: close HTTPError on 401/403, remove _VALID_AUTH_SCHEMES, catch TimeoutExpired, skip POSIX test on Windows, remove unused import

Agent-Logs-Url: https://github.com/github/spec-kit/sessions/a1e29737-dd6e-4287-96c1-509e0c96fb21

Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com>

Author: Copilot

src/specify_cli/authentication/azure_devops.py

@@ -76,7 +76,7 @@ def _acquire_via_az_cli() -> str | None:
             payload = _json.loads(result.stdout)
             token = payload.get("accessToken", "").strip()
             return token or None
-        except (OSError, _json.JSONDecodeError, KeyError):
+        except (OSError, subprocess.TimeoutExpired, _json.JSONDecodeError, KeyError):
             return None
 
     @staticmethod

src/specify_cli/authentication/config.py

@@ -30,14 +30,6 @@ class AuthConfigEntry:
     client_secret_env: str | None = None
 
 
-_VALID_AUTH_SCHEMES = frozenset({
-    "bearer",
-    "basic-pat",
-    "azure-cli",
-    "azure-ad",
-})
-
-
 def _default_config_path() -> Path:
     """Return ``~/.specify/auth.json``."""
     return Path.home() / ".specify" / "auth.json"
@@ -106,11 +98,6 @@ def load_auth_config(
         auth = entry_raw.get("auth", "")
         if not isinstance(auth, str) or not auth:
             raise ValueError(f"providers[{i}]: 'auth' must be a non-empty string")
-        if auth not in _VALID_AUTH_SCHEMES:
-            raise ValueError(
-                f"providers[{i}]: unsupported auth scheme {auth!r}; "
-                f"valid: {sorted(_VALID_AUTH_SCHEMES)}"
-            )
 
         token = entry_raw.get("token")
         token_env = entry_raw.get("token_env")

src/specify_cli/authentication/http.py

@@ -131,6 +131,7 @@ def _make_req(auth_headers: dict[str, str]) -> urllib.request.Request:
             return opener.open(req, timeout=timeout)
         except urllib.error.HTTPError as exc:
             if exc.code in (401, 403):
+                exc.close()
                 continue  # try next entry
             raise
 

src/specify_cli/integrations/catalog.py

@@ -232,7 +232,6 @@ def _fetch_single_catalog(
     ) -> Dict[str, Any]:
         """Fetch one catalog, with per-URL caching."""
         import urllib.error
-        import urllib.request
 
         url_hash = hashlib.sha256(entry.url.encode()).hexdigest()[:16]
         cache_file = self.cache_dir / f"catalog-{url_hash}.json"

tests/test_authentication.py

@@ -15,6 +15,7 @@
 
 import base64
 import json
+import os
 
 import pytest
 
@@ -198,7 +199,7 @@ def test_unsupported_auth_scheme_raises(self, tmp_path):
         cfg.write_text(json.dumps({
             "providers": [{"hosts": ["github.com"], "provider": "github", "auth": "ntlm", "token_env": "X"}]
         }))
-        with pytest.raises(ValueError, match="unsupported"):
+        with pytest.raises(ValueError, match="does not support"):
             load_auth_config(cfg)
 
     def test_bearer_without_token_raises(self, tmp_path):
@@ -243,6 +244,7 @@ def test_incompatible_provider_scheme_raises(self, tmp_path):
         with pytest.raises(ValueError, match="does not support"):
             load_auth_config(cfg)
 
+    @pytest.mark.skipif(os.name == "nt", reason="POSIX permission bits not supported on Windows")
     def test_world_readable_warns(self, tmp_path):
         import stat