Only cache the h-card version of the profile

If we update the profile cache with the server response profile fields,
this might violate the expectations of someone who logs out and in again
with a reduced scope.

authl/handlers/indieauth.py

@@ -177,7 +177,7 @@ def get_profile(id_url: str,
 
     if id_url in _PROFILE_CACHE:
         LOGGER.debug("Reusing %s profile from cache", id_url)
-        profile = _PROFILE_CACHE[id_url]
+        profile = _PROFILE_CACHE[id_url].copy()
     else:
         profile = {}
 
@@ -197,6 +197,11 @@ def get_profile(id_url: str,
 
             profile.update({k: v for k, v in items.items() if v and k not in profile})
 
+    # Only stash the version without the IndieAuth server profile addons, in case
+    # the user logs in again without the profile/email scopes
+    LOGGER.debug("Stashing %s profile", id_url)
+    _PROFILE_CACHE[id_url] = profile.copy()
+
     if server_profile:
         # The IndieAuth server also provided a profile, which should supercede the h-card
         for in_key, out_key in (('name', 'name'),
@@ -211,8 +216,6 @@ def get_profile(id_url: str,
     if endpoints:
         profile['endpoints'] = endpoints
 
-    LOGGER.debug("Stashing %s profile", id_url)
-    _PROFILE_CACHE[id_url] = profile
     return profile
 
 

tests/handlers/test_indieauth.py

@@ -467,7 +467,19 @@ def test_server_profile(requests_mock):
         'photo': 'https://placekitten.com/1280/1024'
     }
 
-    profile_blob = {
+    hcard_blob = {
+        'avatar': "http://server.example/plop.jpg",
+        'bio': "I'm Larry. And you're not. he/him or whatever",
+        'email': "larry@example.foo",
+        'name': "larry",
+        'pronouns': "he/him",
+        'homepage': "https://example.foo/~user/",
+        'endpoints': {
+            'authorization_endpoint': 'https://endpoint.example/',
+        },
+    }
+
+    composite_blob = {
         'avatar': "https://placekitten.com/1280/1024",
         'bio': "I'm Larry. And you're not. he/him or whatever",
         'email': "larry-forreals@example.foo",
@@ -482,14 +494,15 @@ def test_server_profile(requests_mock):
     profile_mock = requests_mock.get('http://server.example', text=profile_html)
 
     # prefill the cache without the server response
-    indieauth.get_profile('http://server.example')
+    profile = indieauth.get_profile('http://server.example')
+    assert profile == hcard_blob
 
     # actually set the response profile, make sure it updates
     profile = indieauth.get_profile('http://server.example', server_profile=identity_profile)
-    assert profile == profile_blob
+    assert profile == composite_blob
 
-    # check to make sure it's still in the cache
+    # check to make sure it's still in the cache (but only the hcard version)
     profile = indieauth.get_profile('http://server.example')
-    assert profile == profile_blob
+    assert profile == hcard_blob
 
     assert profile_mock.call_count == 1