feat(auth): prendre en charge le PIN de compte Pronote

tests/unit/test_pronote_client.py

@@ -674,8 +674,10 @@ def test_connect_password_mode_unchanged(
     assert mock_client_class.call_count == 1
 
 
+@pytest.mark.parametrize("account_pin", [None, "account-pin-42"])
 def test_connect_qr_token_with_persisted_creds(
     mocker: pytest_mock.MockerFixture,
+    account_pin: str | None,
 ) -> None:
     """Vérifie le login par token persisté en mode qr_token.
 
@@ -683,6 +685,7 @@ def test_connect_qr_token_with_persisted_creds(
     ``token_login`` et le token rotate est resauvegardé.
 
     :param mocker: Fixture pytest-mock pour le mocking.
+    :param account_pin: PIN de second facteur facultatif.
     :return: None
     """
     creds = {
@@ -707,23 +710,29 @@ def test_connect_qr_token_with_persisted_creds(
         ent=None,
         account_type="parent",
         auth_mode="qr_token",
+        account_pin=SecretStr(account_pin) if account_pin is not None else None,
     )
     client = PronoteClient(settings, auth_state=auth_state)
     connected = client._connect()
 
     assert connected is mock_client
-    pronotepy.ParentClient.token_login.assert_called_once_with(**creds)  # type: ignore[attr-defined]
+    pronotepy.ParentClient.token_login.assert_called_once_with(  # type: ignore[attr-defined]
+        **creds, account_pin=account_pin
+    )
     auth_state.save.assert_called_once_with(rotated_creds)
 
 
+@pytest.mark.parametrize("account_pin", [None, "account-pin-42"])
 def test_connect_qr_token_no_creds_with_qr_code(
     mocker: pytest_mock.MockerFixture,
     tmp_path: Path,
+    account_pin: str | None,
 ) -> None:
     """Vérifie l'enrôlement initial par QR code quand aucun token n'est persisté.
 
     :param mocker: Fixture pytest-mock pour le mocking.
     :param tmp_path: Répertoire temporaire de test.
+    :param account_pin: PIN de second facteur facultatif.
     :return: None
     """
     qr_file = tmp_path / "qr_code.json"
@@ -760,6 +769,7 @@ def test_connect_qr_token_no_creds_with_qr_code(
         auth_mode="qr_token",
         qr_code_file=str(qr_file),
         qr_pin=SecretStr("123456"),
+        account_pin=SecretStr(account_pin) if account_pin is not None else None,
     )
     client = PronoteClient(settings, auth_state=auth_state)
     connected = client._connect()
@@ -769,6 +779,7 @@ def test_connect_qr_token_no_creds_with_qr_code(
     qrcode_login.assert_called_once()  # type: ignore[attr-defined]
     kwargs = qrcode_login.call_args.kwargs  # type: ignore[attr-defined]
     assert kwargs["pin"] == "123456"
+    assert kwargs["account_pin"] == account_pin
     assert kwargs["qr_code"] == {
         "login": "testuser",
         "jeton": "qr-jeton",
@@ -1167,6 +1178,7 @@ def test_no_raw_secrets_in_logs(
     sentinel_token = "SENTINEL_RAW_TOKEN_ALPHA"
     sentinel_pin = "SENTINEL_RAW_PIN_BRAVO"
     sentinel_jeton = "SENTINEL_RAW_JETON_CHARLIE"
+    sentinel_account_pin = "SENTINEL_RAW_ACCOUNT_PIN_DELTA"
 
     qr_file = tmp_path / "qr_code.json"
     qr_file.write_text(
@@ -1190,7 +1202,8 @@ def test_no_raw_secrets_in_logs(
     mocker.patch(
         "pronotepy.ParentClient.token_login",
         side_effect=pronotepy.PronoteAPIError(
-            f"login refusé {sentinel_token} puis {sentinel_pin} puis {sentinel_jeton}"
+            f"login refusé {sentinel_token} puis {sentinel_pin} puis {sentinel_jeton} "
+            f"puis {sentinel_account_pin}"
         ),
     )
 
@@ -1203,6 +1216,7 @@ def test_no_raw_secrets_in_logs(
         auth_mode="qr_token",
         qr_code_file=str(qr_file),
         qr_pin=SecretStr(sentinel_pin),
+        account_pin=SecretStr(sentinel_account_pin),
     )
     client = PronoteClient(settings, auth_state=auth_state)
 
@@ -1214,10 +1228,12 @@ def test_no_raw_secrets_in_logs(
     assert sentinel_token not in message
     assert sentinel_pin not in message
     assert sentinel_jeton not in message
+    assert sentinel_account_pin not in message
     assert caplog.text
     assert sentinel_token not in caplog.text
     assert sentinel_pin not in caplog.text
     assert sentinel_jeton not in caplog.text
+    assert sentinel_account_pin not in caplog.text
 
 
 # --- Persistence of credentials after data operations ---