test(ui): exercise the conformance self-fetch under every auth mode - #445
Open
angela-helios wants to merge 1 commit into
Open
test(ui): exercise the conformance self-fetch under every auth mode#445angela-helios wants to merge 1 commit into
angela-helios wants to merge 1 commit into
Conversation
Two e2e legs join the browser suite (#320): auth enabled with a provisioned outbound service token — the conformance pages render real registry data through the authenticated self-call, while anonymous API calls stay 401 — and auth enabled without one, where the pages degrade to their warning state and the failed fetch is retried, not cached. boot.mjs grows the whole IdP surface the server needs: a throwaway RSA key served as a JWKS from a local HTTP server, and locally-minted RS256 tokens with the two conformance read scopes. The service token carries no tenant claim on purpose — the claim is authoritative when present, and the self-fetch scopes each call with X-Tenant-ID. The compartments page previously answered an empty definitions fetch with a 404; it now renders the shell with a warning like the SearchParameter page, in the three locales. The book documents the supported modes (off / static bearer / IdP-issued) and the planned JwtAssertionOutboundAuthProvider follow-up. Closes #320
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #320
The UI self-fetches
GET /SearchParameterandGET /CompartmentDefinitionover HTTP, and that call must honor whatever auth mode the server runs in — no carve-outs. The browser suite now proves it:Two new e2e legs (Playwright projects
authandauth-degraded, each with its own server): boot.mjs grows aHFS_E2E_AUTHmode that stands up the entire IdP surface the server needs with zero external dependencies — a throwaway RSA keypair served as a JWKS from a local HTTP server, and RS256 tokens minted in-process. Databases are per-port now, so the three servers coexist.auth—HFS_AUTH_ENABLED=true+ a mintedHFS_OUTBOUND_BEARER_TOKENcarryingsystem/SearchParameter.rs system/CompartmentDefinition.rs(and deliberately no tenant claim: the claim is authoritative when present, and the self-fetch scopes each call withX-Tenant-ID). The conformance pages render real registry data, and a control test pins that an anonymous API call is still 401 — the pages work because the self-call authenticates, not because auth grew a loophole.auth-degraded— auth on, no outbound token. The pages degrade to their warning state; the failed fetch is served degraded for that request only and re-attempted on the next.One UI fix the legs flushed out: the compartments page answered an empty definitions fetch with a 404; it now renders the shell with a warning (three locales), like the SearchParameter page always did. Covered by a router test too.
Book: new chapter Web UI Self-Calls and Authentication — the supported modes (off / static bearer / IdP-issued), the no-tenant-claim guidance, the degraded/heal-without-restart behavior, and the planned
JwtAssertionOutboundAuthProviderfollow-up fromcrates/hfs/src/main.rs.Scope note: the issue's Keycloak smoke moved to its own issue (#444 — it needs a sibling container on the remote Docker daemon, so it belongs in a manual/nightly job, not per-PR).
Screenshots — degraded state (auth on, no outbound token)
Tests
6 new e2e (2×3), one new router test; full local suite 104 passed including both new legs;
router_http33/33.