fix: persist Gitea credentials across AI sessions

tests/test_credential_win_oauth.py

@@ -0,0 +1,42 @@
+import contextlib
+import importlib.util
+import io
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+
+
+SCRIPT = Path(__file__).resolve().parents[1] / "skills" / "updating-gitea-repositories" / "scripts" / "credential_win_oauth.py"
+spec = importlib.util.spec_from_file_location("credential_win_oauth_unit_test", SCRIPT)
+vault = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(vault)
+
+
+class VaultHelperTest(unittest.TestCase):
+    def setUp(self):
+        self.namespace = "gitea-oauth-" + "a" * 32
+        self.fields = {"protocol": "https", "host": "example.invalid", "username": "oauth2",
+                       "password": "fake-access", "password_expiry_utc": "9999999999", "oauth_refresh_token": "fake-refresh"}
+
+    def test_empty_namespace_cannot_get_or_store_unverified_identity(self):
+        with patch.object(vault, "credential_lock", return_value=contextlib.nullcontext()), \
+             patch.object(vault, "read_record", return_value=None), \
+             patch.object(vault, "write_record") as write:
+            for operation in ("get", "store"):
+                with self.subTest(operation=operation), self.assertRaises(vault.VaultError):
+                    vault.run(self.namespace, operation, self.fields, io.BytesIO())
+            write.assert_not_called()
+
+    def test_refuses_cross_site_refresh_endpoint_before_sending_token(self):
+        with patch.object(vault, "oauth_setting", side_effect=["client", "https://other.invalid/token"]), \
+             patch.object(vault, "build_opener") as opener, self.assertRaises(vault.VaultError):
+            vault.refresh_record("https", "example.invalid", self.fields)
+        opener.assert_not_called()
+
+    def test_missing_context_fails_closed(self):
+        with self.assertRaises(vault.VaultError):
+            vault.run(self.namespace, "get", {"protocol": "https", "host": "example.invalid"}, io.BytesIO())
+
+
+if __name__ == "__main__":
+    unittest.main()