fix: tighten oauth and source resource handling

src/wf_api/auth.py

@@ -5,7 +5,7 @@ from collections.abc import Mapping
 from dataclasses import dataclass, field
 from typing import Annotated, Any, Literal, Protocol
 
-from pydantic import AnyUrl, BaseModel, Field
+from pydantic import AnyUrl, BaseModel, Field, ValidationError
 
 AUTH_ID_PATTERN = r"^[A-Za-z0-9_][A-Za-z0-9_.-]*$"
 
@@ -149,17 +149,23 @@ def auth_record_from_compat(
             )
             if not isinstance(client_id, str) or not client_id:
                 raise ValueError("oauth_refresh_token client_id is required")
-            if not isinstance(client_secret, str):
+            if not isinstance(client_secret, str) or not client_secret:
                 raise ValueError("oauth_refresh_token client_secret is required")
             if not isinstance(refresh_token, str) or not refresh_token:
                 raise ValueError("oauth_refresh_token refresh_token is required")
             if not isinstance(token_url, str) or not token_url:
                 raise ValueError("oauth_refresh_token token_url is required")
+            try:
+                validated_token_url = AnyUrl(token_url)
+            except ValidationError as exc:
+                raise ValueError(
+                    f"oauth_refresh_token token_url is invalid: {exc}"
+                ) from exc
             auth = OAuthRefreshTokenAuth(
                 client_id=client_id,
                 client_secret=client_secret,
                 refresh_token=refresh_token,
-                token_url=AnyUrl(token_url),
+                token_url=validated_token_url,
                 scopes=scopes,
             )
         case _:

src/wf_api/source_admin.py

@@ -1,11 +1,14 @@
 from __future__ import annotations
 
+import logging
 from typing import Any, Protocol
 
 from wf_platform import page_items
 
 from .operation_context import WorkflowOperationContext
 
+logger = logging.getLogger(__name__)
+
 
 class WorkflowSourceDiagnosticsProvider(Protocol):
     """Optional source-specific diagnostics provider.
@@ -63,7 +66,12 @@ class WorkflowSourceAdminApi:
         if self.diagnostics is not None:
             try:
                 payload["diagnostics"] = self.diagnostics.diagnose_source(source_id)
-            except Exception:
+            except Exception as exc:
+                logger.exception(
+                    "Source diagnostics failed for source_id=%s: %s",
+                    source_id,
+                    exc,
+                )
                 payload["diagnostics"] = {
                     "status": "error",
                     "message": "Diagnostics unavailable",

src/wf_api/source_helpers.py

@@ -41,11 +41,10 @@ async def read_resource(
     contents = payload.get("contents", [])
     first = contents[0] if isinstance(contents, list) and contents else {}
     text = first.get("text") if isinstance(first, dict) else None
+    upstream_truncated = payload.get("truncated") is True
+    truncated = upstream_truncated or (isinstance(text, str) and len(text) > max_chars)
     if isinstance(text, str) and len(text) > max_chars:
         text = text[:max_chars]
-        truncated = True
-    else:
-        truncated = False
     mime_type: str | None = None
     if isinstance(first, dict) and isinstance(first.get("mimeType"), str):
         mime_type = first["mimeType"]