docs(test-plans): add DCM CLI OIDC auth e2e test plan (FLPATH-4477) by chadcrum · Pull Request #34 · dcm-project/utilities

chadcrum · 2026-08-05T16:12:02Z

Summary

Add the FLPATH-4477 DCM CLI OIDC authentication e2e test plan under test-plans/
Relocate it from dcm-project/cli because the cases need a live Keycloak/control-plane stack

Related PRs

Spec: docs(ai): add OIDC auth spec and decisions (FLPATH-4477) cli#30
Implementation: feat(auth): add OIDC device authorization flow for CLI authentication cli#29

Move the e2e-oriented OIDC login/logout plan into utilities alongside other DCM stack test plans. Includes TC-19 refresh-failure setup fix (invalidate JWT access_token), TC-17 login steps, and FileStore inaccessible-path unit coverage notes from sealusa12 execution. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

gabriel-farache

could you maybe reorganize by priority order? Or what this order chose for a particular reason?

gciavarrini

Since this is a markdown test plan written for AI agents, I used AI to help review it too.

gciavarrini · 2026-08-06T09:27:06Z

+
+### References
+
+- [DCM CLI OIDC Authentication Spec](https://github.com/dcm-project/cli/blob/main/.ai/specs/dcm-cli-oidc-auth.spec.md) - requirements and acceptance criteria validated by this plan (lives in dcm-project/cli)


nit: This link 404s today (spec is still in cli#30)

@gciavarrini yeah, that 404s until cli#30 merges. I'd rather leave the main link so it stays correct once that lands — ok with you?

Match the CLI login success message and force access-token expiry in TC-03 instead of sleeping for Keycloak's 5m TTL. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Rewrite TC-07 so a bad static token failing after a successful stored-token call asserts precedence hard. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Keep the clear commands as prereq how-to and start steps at the actual policy list call. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Move token-store clear how-to under Prerequisites and start steps at logout. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Assert flags beat env and env beats config for DCM_ISSUER_URL / --issuer-url. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Clarify that the empty env prefix forces Linux keyring probe failure and file-store fallback. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

login now saves via ConfigPath, so --config / DCM_CONFIG are respected. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

chadcrum · 2026-08-10T19:00:06Z

could you maybe reorganize by priority order? Or what this order chose for a particular reason?

@gabriel-farache order is dependency / execution flow (see the dependency graph), not priority. Priority tags are for AC severity. Left the TC order as-is so Requires chains stay readable.

## Summary - Trim auth test plan E2E gaps to **TC-36 – TC-42** (CLI and JWT-negative cases removed from this plan) - Block SP / instance happy path on [FLPATH-4622](https://redhat.atlassian.net/browse/FLPATH-4622); UI path on [FLPATH-4645](https://redhat.atlassian.net/browse/FLPATH-4645) - Fix `POST /catalog-item-instances` (HTTP 201), provider `health_status`, port convention (`:8080` local / `:9080` Ecosystem Jenkins) - Add subsystem + E2E checklist tables with ❗ markers; document Jenkins dead `--auth-enabled` on `run-e2e.sh` - Clarify TC-08 as control-plane API only ## Out of scope here - CLI auth → [utilities#34](#34) / [cli#29](dcm-project/cli#29) - Wrong audience / `alg:none` → ❗ should cover on TC-14/TC-15 (subsystem) ## Test plan - [x] Review feedback addressed (Gloria / Chad) - [ ] Confirm sanitization notice still holds - [ ] Optional: pipeline fix for dead `--auth-enabled`; subsystem wrong-aud / alg:none follow-ups Signed-off-by: Vladislav Kolodny <vkolodny@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

…#29) ## Summary OIDC device authorization for the DCM CLI - `dcm login` / `dcm logout`, token storage (keyring with file fallback), authenticated HTTP transport with refresh, and a `DCM_TOKEN` / `--token` bypass for CI. Split into three commits for easier review: 1. `feat(auth):` core code - auth / commands / config 2. `test(auth):` all test files 3. `chore(auth):` go.mod / go.sum + CLAUDE.md / README.md ## Related PRs - Spec: #30 - E2E test plan: dcm-project/utilities#34 Closes https://issues.redhat.com/browse/FLPATH-4477 --------- Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude <noreply@anthropic.com>

## Summary - Add FLPATH-4477 OIDC auth `.ai` spec and design decisions - Point `dcm-cli.spec.md` at the new OIDC auth spec and remove auth from out-of-scope - Split docs from the CLI implementation so review can land independently ## Related PRs - Implementation: #29 - E2E test plan: dcm-project/utilities#34 --------- Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>

chadcrum mentioned this pull request Aug 5, 2026

docs(ai): add OIDC auth spec and decisions (FLPATH-4477) dcm-project/cli#30

Merged

chadcrum force-pushed the flpath-4477-move-cli-oidc-test-plan branch from d0f6693 to e3367e3 Compare August 5, 2026 16:42

chadcrum mentioned this pull request Aug 5, 2026

feat(auth): add OIDC device authorization flow for CLI authentication dcm-project/cli#29

Merged

chadcrum marked this pull request as ready for review August 5, 2026 23:04

chadcrum requested review from a team as code owners August 5, 2026 23:04

chadcrum requested review from gabriel-farache, gciavarrini, jenniferubah, jordigilh and machacekondra August 5, 2026 23:04

gabriel-farache reviewed Aug 6, 2026

View reviewed changes

gciavarrini reviewed Aug 6, 2026

View reviewed changes

vkolodny mentioned this pull request Aug 6, 2026

docs(test-plans): FLPATH-3254 E2E gap TCs (TC-36–TC-42) #35

Merged

3 tasks

chadcrum requested a review from vkolodny August 7, 2026 14:54

chadcrum and others added 7 commits August 10, 2026 11:56

fix(test-plans): align TC-01 login string and speed up TC-03 refresh

d778334

Match the CLI login success message and force access-token expiry in TC-03 instead of sleeping for Keycloak's 5m TTL. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

fix(test-plans): prove DCM_TOKEN precedence without log inspection

e5b3bcb

Rewrite TC-07 so a bad static token failing after a successful stored-token call asserts precedence hard. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

fix(test-plans): fold TC-09 clear-auth setup into prerequisites

239cdde

Keep the clear commands as prereq how-to and start steps at the actual policy list call. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

fix(test-plans): fold TC-10 token clear into prerequisites

ca4c82a

Move token-store clear how-to under Prerequisites and start steps at logout. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

fix(test-plans): add issuer URL config precedence coverage to TC-12

edb6384

Assert flags beat env and env beats config for DCM_ISSUER_URL / --issuer-url. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

docs(test-plans): explain DBUS_SESSION_BUS_ADDRESS empty prefix in TC-13

72328e2

Clarify that the empty env prefix forces Linux keyring probe failure and file-store fallback. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

docs(test-plans): drop outdated SaveConfig custom-path risk note

3195d94

login now saves via ConfigPath, so --config / DCM_CONFIG are respected. Signed-off-by: Chad Crum <ccrum@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

chadcrum requested review from gabriel-farache and gciavarrini August 10, 2026 19:00

chadcrum self-assigned this Aug 10, 2026

gciavarrini approved these changes Aug 11, 2026

View reviewed changes

testetson22 approved these changes Aug 11, 2026

View reviewed changes

chadcrum merged commit e6d80ad into dcm-project:main Aug 11, 2026
2 checks passed

Navigation Menu

Uh oh!

docs(test-plans): add DCM CLI OIDC auth e2e test plan (FLPATH-4477) - #34

docs(test-plans): add DCM CLI OIDC auth e2e test plan (FLPATH-4477)#34
chadcrum merged 8 commits into
dcm-project:mainfrom
chadcrum:flpath-4477-move-cli-oidc-test-plan

chadcrum commented Aug 5, 2026 •

edited

Loading

Uh oh!

gabriel-farache left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gciavarrini left a comment

Uh oh!

gciavarrini Aug 6, 2026

Uh oh!

chadcrum Aug 6, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chadcrum commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		### References

		- [DCM CLI OIDC Authentication Spec](https://github.com/dcm-project/cli/blob/main/.ai/specs/dcm-cli-oidc-auth.spec.md) - requirements and acceptance criteria validated by this plan (lives in dcm-project/cli)

Uh oh!

Conversation

chadcrum commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related PRs

Uh oh!

gabriel-farache left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gciavarrini left a comment

Choose a reason for hiding this comment

Uh oh!

gciavarrini Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

chadcrum Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chadcrum commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

chadcrum commented Aug 5, 2026 •

edited

Loading