CHORE: add mock TDS FedAuth regression test + CI install for deferred access-token UAF (#594/#596)

eng/pipelines/pr-validation-pipeline.yml

@@ -234,6 +234,10 @@ jobs:
     parameters:
       platform: windows
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: windows
+
   # Run tests for LocalDB
   - script: |
       python -m pytest -v --junitxml=test-results-localdb.xml --cov=. --cov-report=xml:coverage-localdb.xml --capture=tee-sys --cache-clear
@@ -543,6 +547,10 @@ jobs:
     parameters:
       platform: unix
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: unix
+
   - script: |
       echo "Build successful, running tests now"
       python -m pytest -v --junitxml=test-results.xml --cov=. --cov-report=xml --capture=tee-sys --cache-clear
@@ -799,6 +807,12 @@ jobs:
       containerName: test-container-$(distroName)
       venvActivate: 'source /opt/venv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-$(distroName)
+      venvActivate: 'source /opt/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-$(distroName) bash -c "
@@ -1124,6 +1138,12 @@ jobs:
       containerName: test-container-$(distroName)-$(archName)
       venvActivate: 'source /opt/venv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-$(distroName)-$(archName)
+      venvActivate: 'source /opt/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-$(distroName)-$(archName) bash -c "
@@ -1338,6 +1358,12 @@ jobs:
       containerName: test-container-rhel9
       venvActivate: 'source myvenv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-rhel9
+      venvActivate: 'source myvenv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-rhel9 bash -c "
@@ -1563,6 +1589,12 @@ jobs:
       containerName: test-container-rhel9-arm64
       venvActivate: 'source myvenv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-rhel9-arm64
+      venvActivate: 'source myvenv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests
       docker exec test-container-rhel9-arm64 bash -c "
@@ -1796,6 +1828,12 @@ jobs:
       containerName: test-container-alpine
       venvActivate: 'source /workspace/venv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-alpine
+      venvActivate: 'source /workspace/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests to use bundled libraries
       docker exec test-container-alpine bash -c "
@@ -2047,6 +2085,12 @@ jobs:
       containerName: test-container-alpine-arm64
       venvActivate: 'source /workspace/venv/bin/activate'
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: container
+      containerName: test-container-alpine-arm64
+      venvActivate: 'source /workspace/venv/bin/activate'
+
   - script: |
       # Uninstall ODBC Driver before running tests to use bundled libraries
       docker exec test-container-alpine-arm64 bash -c "
@@ -2398,6 +2442,10 @@ jobs:
     parameters:
       platform: unix
 
+  - template: steps/install-mock-tds.yml
+    parameters:
+      platform: unix
+
   - script: |
       # Generate unified coverage (Python + C++)
       chmod +x ./generate_codecov.sh

eng/pipelines/steps/install-mock-tds.yml

@@ -0,0 +1,64 @@
+# Step template: Install mssql-mock-tds (in-process mock TDS server) from the
+# public mssql-rs_Public Azure Artifacts PyPI feed via eng/requirements-mock-tds.txt.
+#
+# This is required for tests/test_024_mock_tds_fedauth.py, which guards the
+# deferred SQL_COPT_SS_ACCESS_TOKEN use-after-free fix (PR #596 / issue #594).
+# The install fails the leg if no compatible wheel is available: the package
+# version and feed are pinned in eng/requirements-mock-tds.txt.
+#
+# Usage:
+#   # Windows (host)
+#   - template: steps/install-mock-tds.yml
+#     parameters:
+#       platform: windows
+#
+#   # macOS / Linux (host)
+#   - template: steps/install-mock-tds.yml
+#     parameters:
+#       platform: unix
+#
+#   # Inside a Docker container
+#   - template: steps/install-mock-tds.yml
+#     parameters:
+#       platform: container
+#       containerName: test-container-$(distroName)
+#       venvActivate: 'source /opt/venv/bin/activate'
+
+parameters:
+  - name: platform
+    type: string
+    values: [windows, unix, container]
+
+  - name: containerName
+    type: string
+    default: ''
+
+  - name: venvActivate
+    type: string
+    default: 'source /opt/venv/bin/activate'
+
+  - name: displaySuffix
+    type: string
+    default: ''
+
+steps:
+# Windows host
+- ${{ if eq(parameters.platform, 'windows') }}:
+  - script: |
+      python -m pip install -r eng/requirements-mock-tds.txt
+    displayName: 'Install mssql-mock-tds${{ parameters.displaySuffix }}'
+
+# Unix host (macOS, Linux without container)
+- ${{ if eq(parameters.platform, 'unix') }}:
+  - script: |
+      python -m pip install -r eng/requirements-mock-tds.txt
+    displayName: 'Install mssql-mock-tds${{ parameters.displaySuffix }}'
+
+# Inside a Docker container
+- ${{ if eq(parameters.platform, 'container') }}:
+  - script: |
+      docker exec ${{ parameters.containerName }} bash -c "
+        ${{ parameters.venvActivate }}
+        python -m pip install -r eng/requirements-mock-tds.txt
+      "
+    displayName: 'Install mssql-mock-tds in ${{ parameters.containerName }}${{ parameters.displaySuffix }}'

eng/requirements-mock-tds.txt

@@ -0,0 +1,15 @@
+# Install requirements for the mssql-mock-tds in-process TDS server used by
+# tests/test_024_mock_tds_fedauth.py (guards the deferred
+# SQL_COPT_SS_ACCESS_TOKEN use-after-free fix, PR #596 / issue #594).
+#
+# cryptography is used by the test to mint the throwaway TLS identity the mock
+# server needs.
+#
+# The package is published on the public mssql-rs_Public Azure Artifacts feed
+# (no auth required). It ships wheels for linux glibc (x86_64/aarch64),
+# musllinux/Alpine (x86_64/aarch64), macOS universal2, and Windows
+# (amd64/arm64). This file is installed with `pip install -r` and fails the
+# leg if no compatible wheel is available.
+--extra-index-url https://pkgs.dev.azure.com/sqlclientdrivers/public/_packaging/mssql-rs_Public/pypi/simple/
+mssql-mock-tds==0.1.0.dev20260702159138
+cryptography