fix: validate host patterns, cache auth config per-process

Agent-Logs-Url: https://github.com/github/spec-kit/sessions/889b58a7-7f8c-47e2-8056-931ebcc671cc

Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com>

Author: Copilot

src/specify_cli/authentication/config.py

@@ -36,6 +36,22 @@ def _default_config_path() -> Path:
     return Path.home() / ".specify" / "auth.json"
 
 
+def _is_valid_host_pattern(pattern: str) -> bool:
+    """Return True for safe host patterns: exact hostnames or ``*.suffix`` only.
+
+    Rejects patterns like ``*github.com`` (which would match
+    ``github.com.evil.com``) or multi-wildcard forms.  Only these two
+    forms are accepted:
+
+    * ``example.com``         — exact hostname
+    * ``*.example.com``       — single leading wildcard for one sub-domain level
+    """
+    if "*" not in pattern:
+        return True  # exact hostname — already validated as non-empty
+    # Only *.suffix is allowed; no other wildcard positions
+    return pattern.startswith("*.") and "*" not in pattern[2:]
+
+
 def load_auth_config(
     path: Path | None = None,
 ) -> list[AuthConfigEntry]:
@@ -92,6 +108,14 @@ def load_auth_config(
             raise ValueError(f"providers[{i}]: each host must be a non-empty string")
         # Normalize hosts: strip whitespace and lowercase
         hosts = [h.strip().lower() for h in hosts]
+        # Reject dangerous wildcard forms (e.g. *github.com matches github.com.evil.com)
+        for h in hosts:
+            if not _is_valid_host_pattern(h):
+                raise ValueError(
+                    f"providers[{i}]: invalid host pattern {h!r}. "
+                    "Only exact hostnames or '*.suffix' forms are allowed "
+                    "(e.g. 'github.com' or '*.visualstudio.com')."
+                )
 
         provider = entry_raw.get("provider", "")
         if not isinstance(provider, str) or not provider:

src/specify_cli/authentication/http.py

@@ -21,14 +21,22 @@
 
 
 _config_override: list[AuthConfigEntry] | None = None
+_config_cache: list[AuthConfigEntry] | None = None  # None = not yet loaded
 
 
 def _load_config() -> list[AuthConfigEntry]:
-    """Load auth config, using override if set (for testing)."""
+    """Load auth config, using override if set (for testing).
+
+    The result is cached per-process so ``auth.json`` is read at most once,
+    and any warning about a malformed file fires only once.
+    """
+    global _config_cache
     if _config_override is not None:
         return _config_override
+    if _config_cache is not None:
+        return _config_cache
     try:
-        return load_auth_config()
+        _config_cache = load_auth_config()
     except (ValueError, OSError) as exc:
         import warnings
         config_path = _default_config_path()
@@ -38,7 +46,8 @@ def _load_config() -> list[AuthConfigEntry]:
             UserWarning,
             stacklevel=2,
         )
-        return []
+        _config_cache = []
+    return _config_cache
 
 
 def _hostname_in_hosts(hostname: str, hosts: tuple[str, ...]) -> bool:

tests/conftest.py

@@ -78,3 +78,6 @@ def _isolate_auth_config(monkeypatch):
     """Ensure no test reads the real ~/.specify/auth.json."""
     from specify_cli.authentication import http as _auth_http
     monkeypatch.setattr(_auth_http, "_config_override", [])
+    # Also clear the per-process cache so tests that unset _config_override
+    # won't see a previously cached real-file result.
+    monkeypatch.setattr(_auth_http, "_config_cache", None)

tests/test_authentication.py

@@ -244,6 +244,30 @@ def test_incompatible_provider_scheme_raises(self, tmp_path):
         with pytest.raises(ValueError, match="does not support"):
             load_auth_config(cfg)
 
+    def test_dangerous_wildcard_host_raises(self, tmp_path):
+        cfg = tmp_path / "auth.json"
+        cfg.write_text(json.dumps({
+            "providers": [{"hosts": ["*github.com"], "provider": "github", "auth": "bearer", "token_env": "X"}]
+        }))
+        with pytest.raises(ValueError, match="invalid host pattern"):
+            load_auth_config(cfg)
+
+    def test_multi_wildcard_host_raises(self, tmp_path):
+        cfg = tmp_path / "auth.json"
+        cfg.write_text(json.dumps({
+            "providers": [{"hosts": ["*.*.example.com"], "provider": "github", "auth": "bearer", "token_env": "X"}]
+        }))
+        with pytest.raises(ValueError, match="invalid host pattern"):
+            load_auth_config(cfg)
+
+    def test_valid_star_dot_host_accepted(self, tmp_path):
+        cfg = tmp_path / "auth.json"
+        cfg.write_text(json.dumps({
+            "providers": [{"hosts": ["*.visualstudio.com"], "provider": "azure-devops", "auth": "basic-pat", "token_env": "X"}]
+        }))
+        entries = load_auth_config(cfg)
+        assert entries[0].hosts == ("*.visualstudio.com",)
+
     @pytest.mark.skipif(os.name == "nt", reason="POSIX permission bits not supported on Windows")
     def test_world_readable_warns(self, tmp_path):
         import stat
@@ -658,6 +682,71 @@ def test_timeout_propagates(self, monkeypatch):
                 open_url("https://example.com/file")
 
 
+# ---------------------------------------------------------------------------
+# _load_config caching
+# ---------------------------------------------------------------------------
+
+
+class TestLoadConfigCaching:
+    def test_config_cached_after_first_load(self, monkeypatch):
+        """_load_config() should call load_auth_config only once per process."""
+        from unittest.mock import patch
+        from specify_cli.authentication import http as _mod
+        from specify_cli.authentication.config import AuthConfigEntry
+        # Allow the real load path (no override)
+        monkeypatch.setattr(_mod, "_config_override", None)
+        monkeypatch.setattr(_mod, "_config_cache", None)
+
+        entry = _github_entry()
+        call_count = 0
+
+        def fake_load(path=None):
+            nonlocal call_count
+            call_count += 1
+            return [entry]
+
+        with patch.object(_mod, "load_auth_config", side_effect=fake_load):
+            _mod._load_config()
+            _mod._load_config()
+            _mod._load_config()
+
+        assert call_count == 1
+
+    def test_cache_bypassed_by_override(self, monkeypatch):
+        """When _config_override is set, the cache is ignored entirely."""
+        from specify_cli.authentication import http as _mod
+        sentinel: list = [object()]  # type: ignore[list-item]
+        monkeypatch.setattr(_mod, "_config_override", sentinel)
+        monkeypatch.setattr(_mod, "_config_cache", None)
+
+        result = _mod._load_config()
+        assert result is sentinel
+        # Cache must not have been populated when override is active
+        assert _mod._config_cache is None
+
+    def test_failed_load_warns_once_and_caches_empty(self, monkeypatch):
+        """A bad auth.json emits exactly one warning and subsequent calls use cache."""
+        from unittest.mock import patch
+        from specify_cli.authentication import http as _mod
+        import warnings as _warnings
+        monkeypatch.setattr(_mod, "_config_override", None)
+        monkeypatch.setattr(_mod, "_config_cache", None)
+
+        def fail_load(path=None):
+            raise ValueError("bad config")
+
+        with patch.object(_mod, "load_auth_config", side_effect=fail_load):
+            with _warnings.catch_warnings(record=True) as w:
+                _warnings.simplefilter("always")
+                _mod._load_config()
+                _mod._load_config()
+                _mod._load_config()
+
+        user_warnings = [x for x in w if issubclass(x.category, UserWarning)]
+        assert len(user_warnings) == 1, "Expected exactly one warning"
+        assert _mod._config_cache == []
+
+
 # ---------------------------------------------------------------------------
 # Redirect stripping
 # ---------------------------------------------------------------------------