Restructured code to be testable and configurable

app.py

@@ -7,12 +7,14 @@ from flask import Flask, session, request, redirect, abort, url_for, Response
 
 from requests_oauthlib import OAuth2Session
 
+def create_app(test_config=None):
 	app = Flask(__name__)
-app.secret_key = b'my secret'
-app.config['SESSION_COOKIE_NAME'] = 'oauth-session'
-app.config['OAUTH2_AUTH_URL'] = 'http://localhost:5001/oauth2/authorize'
-app.config['OAUTH2_TOKEN_URL'] = 'http://localhost:5001/oauth2/token'
-app.config['OAUTH2_USERINFO_URL'] = 'http://localhost:5001/oauth2/userinfo'
+	app.config['SECRET_KEY'] = secrets.token_hex(128)
+	app.config.from_pyfile('default_config.py')
+	if not test_config:
+		app.config.from_pyfile('config.py', silent=True)
+	else:
+		app.config.from_mapping(test_config)
 
 	@app.route("/auth")
 	def auth():
@@ -41,7 +43,9 @@ def login():
 	@app.route("/callback")
 	def callback():
 		client = get_oauth(state=session.pop('state'))
-	token = client.fetch_token(app.config['OAUTH2_TOKEN_URL'], client_secret=request.headers['X-CLIENT-SECRET'], authorization_response=request.url, verify=(not app.debug))
+		token = client.fetch_token(app.config['OAUTH2_TOKEN_URL'],
+			client_secret=request.headers['X-CLIENT-SECRET'],
+			authorization_response=request.url, verify=(not app.debug))
 		userinfo = client.get(app.config['OAUTH2_USERINFO_URL']).json()
 		session['user_id'] = userinfo['id'] # (usually numeric) unique user id
 		session['user_name'] = userinfo['name'] # display name
@@ -82,7 +86,10 @@ a valid redirect_uri for the client_id.
 		resp.mimetype = 'text/plain; charset=utf-8'
 		return resp
 
+	return app
+
 if __name__ == '__main__':
 	# oauthlib enforces the OAuth2.0 requirement to use HTTPS, when this is not set
 	os.environ['OAUTHLIB_INSECURE_TRANSPORT'] = '1' # Don't do that in production!
+	app = create_app()
 	app.run(debug=True, host='localhost', port=5002)

default_config.py

+# OAuthProxy will usually served from the same domain as the services that
+# use it for OAuth integration, so make sure that the session cookie does
+# not conflict with any other cookies!
+SESSION_COOKIE_NAME = 'oauth-session'
+
+# URLs of the OAuth2-based identity provider
+OAUTH2_AUTH_URL = 'http://localhost:5001/oauth2/authorize'
+OAUTH2_TOKEN_URL = 'http://localhost:5001/oauth2/token'
+OAUTH2_USERINFO_URL = 'http://localhost:5001/oauth2/userinfo'
+