fix: guard unconfigured oauth calls; add missing test coverage; clean imports

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_oauth.py

@@ -1,4 +1,6 @@
 import time as time_mod
+from unittest.mock import AsyncMock, MagicMock, patch
+from urllib.parse import urlparse, parse_qs
 
 import pytest
 
@@ -132,10 +134,6 @@ def test_provision_oauth_user_survives_config_reload():
     assert "oauthonly" in users_mod.users
 
 
-from unittest.mock import AsyncMock, MagicMock, patch
-from urllib.parse import urlparse, parse_qs
-
-
 def test_authorization_url_shape():
     state = "teststate"
     redirect_uri = "https://hbd.example.com/login/oauth/gitea/callback"
@@ -220,3 +218,44 @@ async def test_fetch_user_returns_profile():
         "full_name": "Alice Smith",
         "avatar_url": "https://git.example.com/avatars/alice.png",
     }
+
+
+@pytest.mark.asyncio
+async def test_exchange_code_raises_when_no_access_token():
+    redirect_uri = "https://hbd.example.com/login/oauth/gitea/callback"
+    mock_response = AsyncMock()
+    mock_response.status = 200
+    mock_response.json = AsyncMock(return_value={"error": "bad_request"})
+
+    mock_session = MagicMock()
+    mock_session.post = MagicMock(return_value=AsyncMock(
+        __aenter__=AsyncMock(return_value=mock_response),
+        __aexit__=AsyncMock(return_value=False),
+    ))
+
+    with patch("hbd.server.oauth.aiohttp.ClientSession", return_value=AsyncMock(
+        __aenter__=AsyncMock(return_value=mock_session),
+        __aexit__=AsyncMock(return_value=False),
+    )):
+        with pytest.raises(oauth.OAuthError):
+            await oauth.exchange_code(CFG_ON, "mycode", redirect_uri)
+
+
+@pytest.mark.asyncio
+async def test_fetch_user_raises_on_error_status():
+    mock_response = AsyncMock()
+    mock_response.status = 401
+    mock_response.text = AsyncMock(return_value="unauthorized")
+
+    mock_session = MagicMock()
+    mock_session.get = MagicMock(return_value=AsyncMock(
+        __aenter__=AsyncMock(return_value=mock_response),
+        __aexit__=AsyncMock(return_value=False),
+    ))
+
+    with patch("hbd.server.oauth.aiohttp.ClientSession", return_value=AsyncMock(
+        __aenter__=AsyncMock(return_value=mock_session),
+        __aexit__=AsyncMock(return_value=False),
+    )):
+        with pytest.raises(oauth.OAuthError):
+            await oauth.fetch_user(CFG_ON, "tok123")