CHORE: add mock TDS FedAuth regression test + CI install for deferred access-token UAF (#594/#596)

eng/pipelines/pr-validation-pipeline.yml

@@ -234,6 +234,10 @@ jobs:
     parameters:
       platform: windows
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: windows
+
   # Run tests for LocalDB
   - script: |
       python -m pytest -v --junitxml=test-results-localdb.xml --cov=. --cov-report=xml:coverage-localdb.xml --capture=tee-sys --cache-clear
@@ -543,6 +547,10 @@ jobs:
     parameters:
       platform: unix
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: unix
+
   - script: |
       echo "Build successful, running tests now"
       python -m pytest -v --junitxml=test-results.xml --cov=. --cov-report=xml --capture=tee-sys --cache-clear
@@ -799,6 +807,12 @@ jobs:
       containerName: test-container-$(distroName)
       venvActivate: 'source /opt/venv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-$(distroName)
+      venvActivate: 'source /opt/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-$(distroName) bash -c "
@@ -1124,6 +1138,12 @@ jobs:
       containerName: test-container-$(distroName)-$(archName)
       venvActivate: 'source /opt/venv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-$(distroName)-$(archName)
+      venvActivate: 'source /opt/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-$(distroName)-$(archName) bash -c "
@@ -1338,6 +1358,12 @@ jobs:
       containerName: test-container-rhel9
       venvActivate: 'source myvenv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-rhel9
+      venvActivate: 'source myvenv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-rhel9 bash -c "
@@ -1563,6 +1589,12 @@ jobs:
       containerName: test-container-rhel9-arm64
       venvActivate: 'source myvenv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-rhel9-arm64
+      venvActivate: 'source myvenv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-rhel9-arm64 bash -c "
@@ -1796,6 +1828,12 @@ jobs:
       containerName: test-container-alpine
       venvActivate: 'source /workspace/venv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-alpine
+      venvActivate: 'source /workspace/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests to use bundled libraries
       docker exec test-container-alpine bash -c "
@@ -2047,6 +2085,12 @@ jobs:
       containerName: test-container-alpine-arm64
       venvActivate: 'source /workspace/venv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-alpine-arm64
+      venvActivate: 'source /workspace/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests to use bundled libraries
       docker exec test-container-alpine-arm64 bash -c "
@@ -2398,6 +2442,10 @@ jobs:
     parameters:
       platform: unix
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: unix
+
   - script: |
       # Generate unified coverage (Python + C++)
       chmod +x ./generate_codecov.sh

eng/pipelines/steps/install-mock-tds.yml

@@ -0,0 +1,69 @@
+# Step template: Install mssql-mock-tds (in-process mock TDS server) from the
+# public mssql-rs_Public Azure Artifacts PyPI feed.
+#
+# This is required for tests/test_024_mock_tds_fedauth.py, which guards the
+# deferred SQL_COPT_SS_ACCESS_TOKEN use-after-free fix (PR #596 / issue #594).
+# Without the package the test skips. The backing scripts are best-effort: if a
+# compatible wheel is ever missing or the sandbox feed is unavailable, they emit
+# a pipeline warning and succeed, so the test simply skips on those legs.
+#
+# Usage:
+#   # Windows (host)
+#   - template: steps/install-mock-tds.yml
+#     parameters:
+#       platform: windows
+#
+#   # macOS / Linux (host)
+#   - template: steps/install-mock-tds.yml
+#     parameters:
+#       platform: unix
+#
+#   # Inside a Docker container
+#   - template: steps/install-mock-tds.yml
+#     parameters:
+#       platform: container
+#       containerName: test-container-$(distroName)
+#       venvActivate: 'source /opt/venv/bin/activate'
+
+parameters:
+  - name: platform
+    type: string
+    values: [windows, unix, container]
+
+  - name: containerName
+    type: string
+    default: ''
+
+  - name: venvActivate
+    type: string
+    default: 'source /opt/venv/bin/activate'
+
+  - name: displaySuffix
+    type: string
+    default: ''
+
+steps:
+# Windows: run the PowerShell script directly on the host
+- ${{ if eq(parameters.platform, 'windows') }}:
+  - task: PowerShell@2
+    displayName: 'Install mssql-mock-tds${{ parameters.displaySuffix }}'
+    inputs:
+      targetType: 'filePath'
+      filePath: 'eng/scripts/install-mock-tds.ps1'
+
+# Unix host (macOS, Linux without container)
+- ${{ if eq(parameters.platform, 'unix') }}:
+  - script: |
+      chmod +x eng/scripts/install-mock-tds.sh
+      ./eng/scripts/install-mock-tds.sh
+    displayName: 'Install mssql-mock-tds${{ parameters.displaySuffix }}'
+
+# Inside a Docker container
+- ${{ if eq(parameters.platform, 'container') }}:
+  - script: |
+      docker exec ${{ parameters.containerName }} bash -c "
+        ${{ parameters.venvActivate }}
+        chmod +x eng/scripts/install-mock-tds.sh
+        ./eng/scripts/install-mock-tds.sh
+      "
+    displayName: 'Install mssql-mock-tds in ${{ parameters.containerName }}${{ parameters.displaySuffix }}'

eng/scripts/install-mock-tds.ps1

@@ -0,0 +1,62 @@
+<#
+.SYNOPSIS
+    Installs the mssql-mock-tds in-process TDS server (plus cryptography, used to
+    mint the throwaway TLS identity it needs) from the public mssql-rs_Public
+    Azure Artifacts PyPI feed so that tests/test_024_mock_tds_fedauth.py runs in
+    CI instead of skipping.
+
+.DESCRIPTION
+    The package is currently published only as a dev pre-release on a sandbox
+    feed. To keep pipeline legs green where no compatible wheel exists, a failed
+    install is reported as a pipeline *warning* (not an error): the test then
+    skips cleanly.
+
+    The package version is read from eng/versions/mssql-mock-tds.version.
+
+.PARAMETER FeedUrl
+    The PyPI-format index URL for the mssql-rs_Public feed. Public -- no auth.
+#>
+
+param(
+    [string]$FeedUrl = "https://pkgs.dev.azure.com/sqlclientdrivers/public/_packaging/mssql-rs_Public/pypi/simple/"
+)
+
+# Best-effort install: never fail the pipeline leg over a sandbox-feed dependency.
+$ErrorActionPreference = 'Continue'
+$ScriptDir = $PSScriptRoot
+$RepoRoot = (Get-Item "$ScriptDir\..\..").FullName
+
+function Write-PipelineWarning([string]$Message) {
+    # Surface as an Azure DevOps pipeline warning while keeping the leg green.
+    Write-Host "##vso[task.logissue type=warning]$Message"
+    Write-Host "WARNING: $Message"
+}
+
+$versionFile = Join-Path $RepoRoot "eng\versions\mssql-mock-tds.version"
+if (-not (Test-Path $versionFile)) {
+    Write-PipelineWarning "Version file not found: $versionFile -- skipping mssql-mock-tds install."
+    exit 0
+}
+$packageVersion = (Get-Content $versionFile -Raw).Trim()
+if (-not $packageVersion) {
+    Write-PipelineWarning "Version file is empty: $versionFile -- skipping mssql-mock-tds install."
+    exit 0
+}
+
+Write-Host "=== Install mssql-mock-tds ($packageVersion) from $FeedUrl ==="
+
+& python -m pip install --extra-index-url $FeedUrl "mssql-mock-tds==$packageVersion" cryptography
+if ($LASTEXITCODE -ne 0) {
+    Write-PipelineWarning "Could not install mssql-mock-tds==$packageVersion (no compatible wheel on this platform or feed unavailable) -- the mock TDS test will skip."
+    exit 0
+}
+
+Write-Host "Verifying import..."
+& python -c "import mssql_mock_tds; print('mssql_mock_tds import OK')"
+if ($LASTEXITCODE -ne 0) {
+    Write-PipelineWarning "mssql-mock-tds installed but failed to import -- the mock TDS test will skip."
+    exit 0
+}
+
+Write-Host "=== mssql-mock-tds installed successfully ==="
+exit 0

eng/scripts/install-mock-tds.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Installs the mssql-mock-tds in-process TDS server (plus cryptography, used to
+# mint the throwaway TLS identity it needs) from the public mssql-rs_Public
+# Azure Artifacts PyPI feed so that tests/test_024_mock_tds_fedauth.py runs in CI
+# instead of skipping.
+#
+# The package is currently published as a dev pre-release on a sandbox feed and
+# ships wheels for linux glibc (x86_64/aarch64), musllinux/Alpine
+# (x86_64/aarch64), macOS universal2, and Windows (amd64/arm64). To keep
+# pipeline legs green if a compatible wheel is ever missing or the sandbox feed
+# is unavailable, a failed install is reported as a pipeline *warning* (not an
+# error): the test then skips cleanly.
+#
+# The package version is read from eng/versions/mssql-mock-tds.version (required).
+#
+# Usage:
+#   ./install-mock-tds.sh [--feed-url URL]
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PYTHON="${PYTHON:-$(command -v python || command -v python3)}"
+
+# Public PyPI-format index for the mssql-rs_Public feed (no auth required).
+FEED_URL="${FEED_URL:-https://pkgs.dev.azure.com/sqlclientdrivers/public/_packaging/mssql-rs_Public/pypi/simple/}"
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --feed-url) FEED_URL="$2"; shift 2 ;;
+        *) echo "Unknown argument: $1"; exit 1 ;;
+    esac
+done
+
+warn() {
+    # Surface as an Azure DevOps pipeline warning while keeping the leg green.
+    echo "##vso[task.logissue type=warning]$1"
+    echo "WARNING: $1"
+}
+
+version_file="$REPO_ROOT/eng/versions/mssql-mock-tds.version"
+if [ ! -f "$version_file" ]; then
+    warn "Version file not found: $version_file -- skipping mssql-mock-tds install."
+    exit 0
+fi
+PACKAGE_VERSION=$(tr -d '[:space:]' < "$version_file")
+if [ -z "$PACKAGE_VERSION" ]; then
+    warn "Version file is empty: $version_file -- skipping mssql-mock-tds install."
+    exit 0
+fi
+
+echo "=== Install mssql-mock-tds ($PACKAGE_VERSION) from $FEED_URL ==="
+
+if "$PYTHON" -m pip install \
+        --extra-index-url "$FEED_URL" \
+        "mssql-mock-tds==$PACKAGE_VERSION" \
+        cryptography; then
+    echo "Verifying import..."
+    if "$PYTHON" -c "import mssql_mock_tds; print('mssql_mock_tds import OK')"; then
+        echo "=== mssql-mock-tds installed successfully ==="
+        exit 0
+    fi
+    warn "mssql-mock-tds installed but failed to import -- the mock TDS test will skip."
+    exit 0
+fi
+
+warn "Could not install mssql-mock-tds==$PACKAGE_VERSION (no compatible wheel on this platform or feed unavailable) -- the mock TDS test will skip."
+exit 0

eng/versions/mssql-mock-tds.version

@@ -0,0 +1 @@
+0.1.0.dev20260701159015