400 error on certain PNGs due to OIDC rerouting...?

boxes/tests.py

@@ -1,14 +1,31 @@
+from types import SimpleNamespace
+
 from django.contrib.admin.sites import AdminSite
 from django.contrib.auth.models import User
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.db import IntegrityError
-from django.test import Client, TestCase
+from django.test import Client, RequestFactory, SimpleTestCase, TestCase
 from django.urls import reverse
+from mozilla_django_oidc.middleware import SessionRefresh
 
 from .admin import BoxAdmin, BoxTypeAdmin, ThingAdmin
 from .models import Box, BoxType, Facet, Tag, Thing, ThingFile, ThingLink
 
 
+class OIDCSessionRefreshTests(SimpleTestCase):
+    """Tests for OIDC session refresh routing exclusions."""
+
+    def test_media_urls_do_not_trigger_oidc_session_refresh(self):
+        """Uploaded files should be served directly, not redirected through OIDC."""
+        request = RequestFactory().get('/media/things/files/251/diag_6606.png')
+        request.user = SimpleNamespace(is_authenticated=True)
+        request.session = {}
+
+        middleware = SessionRefresh(lambda request: None)
+
+        self.assertFalse(middleware.is_refreshable_url(request))
+
+
 class AuthTestCase(TestCase):
     """Base test case that provides authenticated client."""