feat(platform): add organization parameter to OAuth authorization redirect

[santi698]

Summary

Add support for Auth0 organization-specific login flows via a new AIGNOSTICS_ORGANIZATION_ID environment variable.

When set, the organization parameter is included in the OAuth 2.0 PKCE authorization URL, enabling users to authenticate into a specific Auth0 organization (useful in development and staging environments).

Changes

• _settings.py: Added organization: str | None field, configurable via AIGNOSTICS_ORGANIZATION_ID env var
• _authentication.py: _perform_authorization_code_with_pkce_flow() now conditionally adds organization to the authorization URL parameters
• authentication_test.py: Added unit test verifying the organization parameter is correctly passed through the full PKCE flow

Usage

export AIGNOSTICS_ORGANIZATION_ID=<auth0_org_id>
uv run aignostics user login

Or via .env:

AIGNOSTICS_ORGANIZATION=my-org

[Copilot]

Pull request overview

Adds support for Auth0 organization-scoped interactive OAuth login by introducing an optional organization setting (via AIGNOSTICS_ORGANIZATION) and conditionally appending it to the PKCE authorization URL.

Changes:

• Add organization: str | None to platform settings (env-backed via the existing AIGNOSTICS_ prefix).
• Update PKCE authorization URL construction to include organization when configured.
• Add a unit test asserting the organization kwarg is passed to OAuth2Session.authorization_url.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/aignostics/platform/_settings.py	Introduces optional organization setting to control Auth0 org login behavior.
src/aignostics/platform/_authentication.py	Conditionally includes organization in the authorization URL parameters for PKCE.
tests/aignostics/platform/authentication_test.py	Adds coverage ensuring organization propagates into the authorization URL call.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

Files with missing lines	Coverage Δ
src/aignostics/platform/_authentication.py	78.31% <100.00%> (+0.39%)	⬆️
src/aignostics/platform/_settings.py	85.79% <100.00%> (+0.08%)	⬆️

... and 7 files with indirect coverage changes

[olivermeyer]

Thanks for the PR, some thoughts:

• This needs a CR as per this announcement - did you already create one, and if not could you?
• The SPEC-APPLICATION-SERVICE.md needs updating (at least here, maybe elsewhere too) - could you review and update wherever needed?
• SonarQube quality gate should pass
• Tests on window should pass if you rebase to catch these changes, however not strictly needed to merge

[santi698]

* The SPEC-APPLICATION-SERVICE.md needs updating (at least [here](https://github.com/aignostics/python-sdk/blob/main/specifications/SPEC-APPLICATION-SERVICE.md#62-environment-variables), maybe elsewhere too) - could you review and update wherever needed?

I think you mean SPEC_PLATFORM_SERVICE.md

[olivermeyer]

* The SPEC-APPLICATION-SERVICE.md needs updating (at least [here](https://github.com/aignostics/python-sdk/blob/main/specifications/SPEC-APPLICATION-SERVICE.md#62-environment-variables), maybe elsewhere too) - could you review and update wherever needed?

I think you mean SPEC_PLATFORM_SERVICE.md

You're right, seems like SPEC-APPLICATION-SERVICE only covers what happens once the token is acquired. So platform is the one 👍

[santi698]

This needs a CR as per this announcement - did you already create one, and if not could you?This needs a CR as per this announcement - did you already create one, and if not could you?

CR HERE: https://aignx.atlassian.net/browse/PYSDK-77

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

tests/aignostics/platform/authentication_test.py:372

• In _run_pkce_flow, AuthenticationResult is mocked with token pre-set to a non-None value. That means the success-path tests can pass even if the callback handler/server never sets the token (or handle_request() is never called), which weakens the test and can mask regressions in the PKCE flow. Consider initializing mock_auth_result.token to None and having the handle_request side effect set it (mirroring what the real OAuthCallbackHandler does), and/or asserting mock_server.handle_request was called.

        mock_auth_result = MagicMock()
        mock_auth_result.token = "pkce.token"  # noqa: S105 - Test credential
        mock_auth_result.error = None