Address PR review feedback: Fix timezone handling, improve error handling, and add auth tests

[Copilot]

• Fix datetime.now() calls to use UTC timezone (pyoverkiz/auth/strategies.py lines 203, 406; pyoverkiz/auth/base.py line 24)
• Handle 204 No Content responses properly in strategies.py line 123
• Add error handling for OAuth token exchange responses in strategies.py line 396
• Remove duplicate enum conversion logic in utils.py create_server_config function
• Fix SSL_CONTEXT_LOCAL_API mutation issue by creating a copy per client instance
• Add test coverage for authentication module (strategies.py, factory.py, credentials.py)
• Revert SSL context creation to avoid blocking I/O at runtime
• Add TODO fix comment for mypy type ignore workaround

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• astral.sh
  • Triggering command: /usr/bin/curl curl -LsSf REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[iMicknl]

This will be a blocking call that should not happen here during runtime, that is the reason why it is moved out of this. can you revert this change?

[iMicknl]

@copilot This will be a blocking call that should not happen here during runtime, that is the reason why it is moved out of this. can you revert this change?

[Copilot]

Reverted in commit 33afeeb. The SSL context is now created from the shared SSL_CONTEXT_LOCAL_API again to avoid blocking I/O during runtime.

[iMicknl]

Add a #todo fix here

[iMicknl]

@copilot Add a #todo fix here

[Copilot]

Added TODO fix comment in commit 33afeeb.

[Copilot]

Pull request overview

This PR addresses multiple code quality and robustness improvements to the authentication and client modules, primarily focusing on timezone handling, error handling, and SSL context management. The changes include fixes for UTC timezone usage in datetime operations, proper handling of HTTP 204 responses, enhanced OAuth error handling, code simplification in utils.py, SSL context mutation prevention, and comprehensive test coverage for the authentication module.

• Fixes timezone-naive datetime.now() calls to use datetime.now(datetime.UTC)
• Adds proper error handling for OAuth token exchange and HTTP 204 No Content responses
• Prevents SSL context mutation by creating per-client instances
• Simplifies enum conversion logic and adds explanatory TODO comments
• Adds comprehensive test coverage for authentication strategies and factory functions

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_auth.py	New comprehensive test suite covering authentication contexts, credentials, factory functions, and strategy implementations
pyoverkiz/utils.py	Simplified enum conversion by removing duplicate logic and added TODO comment explaining type ignore requirements
pyoverkiz/client.py	Modified SSL context initialization to create per-client instances instead of using shared global context
pyoverkiz/auth/strategies.py	Fixed timezone-naive datetime calls, added 204 No Content handling, and improved OAuth error handling for Rexel authentication
pyoverkiz/auth/base.py	Fixed timezone-naive datetime.now() call in AuthContext.is_expired() method

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Creating an SSLContext with only the protocol doesn't preserve the security defaults from create_default_context(). The original SSL_CONTEXT_LOCAL_API used ssl.create_default_context() which sets important defaults like check_hostname, verify_mode, and other security settings.

Instead of ssl.SSLContext(SSL_CONTEXT_LOCAL_API.protocol), use ssl.create_default_context(cafile=...) to create a properly configured context for each client instance.

Suggested change

	# Create a copy of the SSL context to avoid mutating the shared global context
	self._ssl = ssl.SSLContext(SSL_CONTEXT_LOCAL_API.protocol)
	self._ssl.load_verify_locations(
	cafile=os.path.dirname(os.path.realpath(__file__))
	+ "/overkiz-root-ca-2048.crt"
	)
	# Create a dedicated SSL context with secure defaults for this client instance
	ca_file = (
	os.path.dirname(os.path.realpath(__file__))
	+ "/overkiz-root-ca-2048.crt"
	)
	self._ssl = ssl.create_default_context(cafile=ca_file)