Add first-class Okta application-INI values to deployment_utils

[willronchetti]

What

Adds first-class Okta values to dcicutils.deployment_utils, so a portal container can materialize Okta settings into production.ini during its existing one-time startup configuration step — the same path Auth0 already takes — instead of the running Pyramid application making its own Secrets Manager call.

build_ini_file_from_template and build_ini_stream_from_template now accept four new keyword arguments, bound to four new template substitutions:

argument	environment input	substitution
okta_issuer	ENCODED_OKTA_ISSUER	OKTA_ISSUER
okta_client	ENCODED_OKTA_CLIENT	OKTA_CLIENT
okta_scopes	ENCODED_OKTA_SCOPES	OKTA_SCOPES
okta_require_email_verified	ENCODED_OKTA_REQUIRE_EMAIL_VERIFIED	OKTA_REQUIRE_EMAIL_VERIFIED

Precedence matches Auth0: explicit argument, then the ENCODED_* environment variable, then a safe default.

Defaults, deliberately chosen

• OKTA_SCOPES defaults to empty, so the line is omitted and the consuming application applies its own scopes (openid email profile). Nothing is hardcoded upstream.
• OKTA_REQUIRE_EMAIL_VERIFIED is omitted unless a boolean is actually supplied. This is a real tri-state, not truthiness: an explicit False argument does not fall through to the environment variable, and an absent, empty, or unparseable value renders as the empty string, which IniFileManager.omittable drops from the output entirely — so the application's secure default (require a verified email) applies. Unparseable input is omitted rather than raising, so a typo in configuration cannot break .ini generation at container startup. IniFileManager.okta_require_email_verified_setting encodes this and is directly tested.

No Okta secret

There is deliberately no okta_secret argument and no OKTA_SECRET substitution. The portal's Okta integration is a public SPA using the Authorization Code flow with PKCE, which has no client secret. A test asserts against the signature that no okta-prefixed parameter other than the four above exists, and that a template referencing ${OKTA_SECRET} is left unexpanded rather than being filled from the environment.

Backward compatibility

All four arguments default to None, so every existing caller is unaffected. Auth0 resolution, bindings, and generated output are untouched; a test renders the same template with and without Okta values and asserts the auth0.* lines are identical. main()/argparse is intentionally not changed — the consumer here is the container's assume_identity.py, which sets ENCODED_* variables and calls the builder directly.

Tests

Seven new tests in test/test_deployment_utils.py cover explicit arguments, environment-derived values, argument-over-environment precedence (including explicit False), all four substitutions in a rendered template, omission when Okta is absent or partial, Auth0 output unchanged, and the absence of any secret field.

Verification

• pytest test/test_deployment_utils.py (CI marker selection): 32 passed, 1 skipped
• static lane pytest -m "static and not last": 4 passed, 1 xfailed
• flake8 dcicutils and flake8 test --exclude=data_files: clean

Run in this repository's Poetry virtualenv (Python 3.12). The local utils311 pyenv environment could not be used: it has setuptools 83, so pkg_resources is absent and deployment_utils will not import there. Remaining failures in the broader local suite are all expired-AWS-SSO / credential errors in test_ff_utils, test_s3_utils, test_validation_utils etc., unrelated to this change; none of those modules import deployment_utils.

Version set to the beta 8.19.0.1b1 with a matching changelog heading, and published to PyPI as a pre-release from a tag on this branch's head so the portal can consume it before 8.20.0 is cut. This PR is not merged by that release.

🤖 Generated with Claude Code

[coveralls]

Coverage Report for CI Build 33664603284

Coverage increased (+0.03%) to 74.667%

Details

• Coverage increased (+0.03%) from the base build.
• Patch coverage: 14 of 14 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	15628
Covered Lines:	11669
Line Coverage:	74.67%
Coverage Strength:	0.75 hits per line

---

💛 - Coveralls