fix: guard unconfigured oauth calls; add missing test coverage; clean imports

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hbd/server/oauth.py

@@ -71,6 +71,8 @@ def is_enabled(config: dict) -> bool:
 def authorization_url(config: dict, state: str, redirect_uri: str) -> str:
     """Return the Gitea OAuth2 authorization URL to redirect the browser to."""
     g = _gitea_cfg(config)
+    if not (g.get("url") and g.get("client_id") and g.get("client_secret")):
+        raise OAuthError("Gitea OAuth2 is not configured")
     params = urllib.parse.urlencode({
         "client_id": g["client_id"],
         "redirect_uri": redirect_uri,
@@ -87,6 +89,8 @@ async def exchange_code(config: dict, code: str, redirect_uri: str) -> str:
     Returns the access token string.  Raises OAuthError on any failure.
     """
     g = _gitea_cfg(config)
+    if not (g.get("url") and g.get("client_id") and g.get("client_secret")):
+        raise OAuthError("Gitea OAuth2 is not configured")
     url = f"{g['url'].rstrip('/')}/login/oauth/access_token"
     payload = {
         "client_id": g["client_id"],
@@ -103,11 +107,11 @@ async def exchange_code(config: dict, code: str, redirect_uri: str) -> str:
                     text = await resp.text()
                     raise OAuthError(f"Token exchange failed ({resp.status}): {text}")
                 data = await resp.json()
+                token = data.get("access_token")
+                if not token:
+                    raise OAuthError(f"No access_token in response: {data}")
     except aiohttp.ClientError as exc:
         raise OAuthError(f"Token exchange network error: {exc}") from exc
-    token = data.get("access_token")
-    if not token:
-        raise OAuthError(f"No access_token in response: {data}")
     return token
 
 
@@ -118,6 +122,8 @@ async def fetch_user(config: dict, token: str) -> dict:
     Raises OAuthError on any failure.
     """
     g = _gitea_cfg(config)
+    if not (g.get("url") and g.get("client_id") and g.get("client_secret")):
+        raise OAuthError("Gitea OAuth2 is not configured")
     url = f"{g['url'].rstrip('/')}/api/v1/user"
     timeout = aiohttp.ClientTimeout(total=10)
     try: