CHORE: add mock TDS FedAuth regression test + CI install for deferred access-token UAF (#594/#596)

eng/pipelines/pr-validation-pipeline.yml

@@ -234,6 +234,10 @@ jobs:
     parameters:
       platform: windows
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: windows
+
   # Run tests for LocalDB
   - script: |
       python -m pytest -v --junitxml=test-results-localdb.xml --cov=. --cov-report=xml:coverage-localdb.xml --capture=tee-sys --cache-clear
@@ -543,6 +547,10 @@ jobs:
     parameters:
       platform: unix
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: unix
+
   - script: |
       echo "Build successful, running tests now"
       python -m pytest -v --junitxml=test-results.xml --cov=. --cov-report=xml --capture=tee-sys --cache-clear
@@ -799,6 +807,12 @@ jobs:
       containerName: test-container-$(distroName)
       venvActivate: 'source /opt/venv/bin/activate'
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: container
+      containerName: test-container-$(distroName)
+      venvActivate: 'source /opt/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-$(distroName) bash -c "
@@ -1124,6 +1138,12 @@ jobs:
       containerName: test-container-$(distroName)-$(archName)
       venvActivate: 'source /opt/venv/bin/activate'
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: container
+      containerName: test-container-$(distroName)-$(archName)
+      venvActivate: 'source /opt/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-$(distroName)-$(archName) bash -c "
@@ -1338,6 +1358,12 @@ jobs:
       containerName: test-container-rhel9
       venvActivate: 'source myvenv/bin/activate'
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: container
+      containerName: test-container-rhel9
+      venvActivate: 'source myvenv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-rhel9 bash -c "
@@ -1563,6 +1589,12 @@ jobs:
       containerName: test-container-rhel9-arm64
       venvActivate: 'source myvenv/bin/activate'
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: container
+      containerName: test-container-rhel9-arm64
+      venvActivate: 'source myvenv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-rhel9-arm64 bash -c "
@@ -1796,6 +1828,12 @@ jobs:
       containerName: test-container-alpine
       venvActivate: 'source /workspace/venv/bin/activate'
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: container
+      containerName: test-container-alpine
+      venvActivate: 'source /workspace/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests to use bundled libraries
       docker exec test-container-alpine bash -c "
@@ -2047,6 +2085,12 @@ jobs:
       containerName: test-container-alpine-arm64
       venvActivate: 'source /workspace/venv/bin/activate'
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: container
+      containerName: test-container-alpine-arm64
+      venvActivate: 'source /workspace/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests to use bundled libraries
       docker exec test-container-alpine-arm64 bash -c "
@@ -2398,6 +2442,10 @@ jobs:
     parameters:
       platform: unix
 
+  - template: steps/install-test-dependencies.yml
+    parameters:
+      platform: unix
+
   - script: |
       # Generate unified coverage (Python + C++)
       chmod +x ./generate_codecov.sh

eng/pipelines/steps/install-test-dependencies.yml

@@ -0,0 +1,66 @@
+# Step template: Install integration-test dependencies from the public
+# mssql-rs_Public Azure Artifacts PyPI feed via eng/requirements-integration-tests.txt.
+#
+# These deps are required for the integration tests, notably
+# tests/test_024_mock_tds_fedauth.py (guards the deferred
+# SQL_COPT_SS_ACCESS_TOKEN use-after-free fix, PR #596 / issue #594), which
+# needs the in-process mssql-mock-tds server. The install fails the leg if no
+# compatible wheel is available: the package versions and feed are pinned in
+# eng/requirements-integration-tests.txt.
+#
+# Usage:
+#   # Windows (host)
+#   - template: steps/install-test-dependencies.yml
+#     parameters:
+#       platform: windows
+#
+#   # macOS / Linux (host)
+#   - template: steps/install-test-dependencies.yml
+#     parameters:
+#       platform: unix
+#
+#   # Inside a Docker container
+#   - template: steps/install-test-dependencies.yml
+#     parameters:
+#       platform: container
+#       containerName: test-container-$(distroName)
+#       venvActivate: 'source /opt/venv/bin/activate'
+
+parameters:
+  - name: platform
+    type: string
+    values: [windows, unix, container]
+
+  - name: containerName
+    type: string
+    default: ''
+
+  - name: venvActivate
+    type: string
+    default: 'source /opt/venv/bin/activate'
+
+  - name: displaySuffix
+    type: string
+    default: ''
+
+steps:
+# Windows host
+- ${{ if eq(parameters.platform, 'windows') }}:
+  - script: |
+      python -m pip install -r eng/requirements-integration-tests.txt
+    displayName: 'Install test dependencies${{ parameters.displaySuffix }}'
+
+# Unix host (macOS, Linux without container)
+- ${{ if eq(parameters.platform, 'unix') }}:
+  - script: |
+      python -m pip install -r eng/requirements-integration-tests.txt
+    displayName: 'Install test dependencies${{ parameters.displaySuffix }}'
+
+# Inside a Docker container
+- ${{ if eq(parameters.platform, 'container') }}:
+  - script: |
+      docker exec ${{ parameters.containerName }} bash -c "
+        ${{ parameters.venvActivate }}
+        python -m pip install -r eng/requirements-integration-tests.txt
+      "
+    displayName: 'Install test dependencies in ${{ parameters.containerName }}${{ parameters.displaySuffix }}'

eng/requirements-integration-tests.txt

@@ -0,0 +1,20 @@
+# Integration-test dependencies sourced from the public mssql-rs_Public Azure
+# Artifacts feed (no auth required). These are installed only on the CI legs
+# that run the integration tests and are kept separate from the top-level
+# requirements.txt, which holds the ordinary build/test dependencies from
+# public PyPI. Add feed-sourced integration-test dependencies here; put plain
+# PyPI dependencies in the top-level requirements.txt instead.
+#
+# mssql-mock-tds: in-process TDS server used by
+#   tests/test_024_mock_tds_fedauth.py (guards the deferred
+#   SQL_COPT_SS_ACCESS_TOKEN use-after-free fix, PR #596 / issue #594).
+# cryptography: used by that test to mint the throwaway TLS identity the mock
+#   server needs.
+#
+# The mock package ships wheels for linux glibc (x86_64/aarch64),
+# musllinux/Alpine (x86_64/aarch64), macOS universal2, and Windows
+# (amd64/arm64). This file is installed with `pip install -r` and fails the
+# leg if no compatible wheel is available.
+--extra-index-url https://pkgs.dev.azure.com/sqlclientdrivers/public/_packaging/mssql-rs_Public/pypi/simple/
+mssql-mock-tds==0.1.0.dev20260702159138
+cryptography