recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

test(lasuite-meet): update stale meeting-flow test for meet v1.22.0+ API auth hardening #13

Merged
autonomic-bot merged 1 commits from test/lasuite-meet-stale-test-20260803 into main 2026-08-03 20:50:38 +00:00
Conversation 1 Commits 1 Files Changed 2 +201 -28
autonomic-bot commented 2026-08-03 20:46:06 +00:00
Owner
Copy Link

Stale-test fix: lasuite-meet meeting-flow test vs meet v1.22.0+ API auth hardening

Stale test: tests/lasuite-meet/custom/test_meeting_flow.py::test_create_room_get_livekit_token_and_read_back.

What changed upstream: meet v1.22.0 hardened API auth — the API rejects raw OIDC user
access tokens sent as Bearer credentials (release notes: "🛂(backend) reject user access tokens
on the API"). The test used a password-grant user token as Authorization: Bearer and went RED
with 401 "Authentication credentials were not provided" on the v1.24.0 upgrade (drone build
#1137; same diagnosis at v1.23.0 in build #1122).

The fix — successor auth path, no assertion weakened:

  • New recipe-local helper _oidc_session.py (same as the lasuite-docs one in cc-ci PR #12)
    drives the real OIDC authorization-code login (app → keycloak form → callback → session
    cookie; CSRF on unsafe methods). Promote to runner/harness if a third recipe needs it.
  • Adds an assertion that a raw OIDC Bearer token is now rejected (401/403 — the v1.22.0
    hardening as the new correct behavior).
  • The full meeting flow is unchanged and still fully asserted, now over the session-authenticated
    API: room create → 201 + LiveKit JWT with a video grant for the room, read-back → 200 with the
    same LiveKit room, DELETE → 204/200, best-effort 404 confirmation.

Paired recipe upgrade PR (the pair goes green together):
recipe-maintainers/lasuite-meet#8 (carry-over from
/upgrade-all 2026-07-24; also flagged 2026-07-31).

Lint: ruff check + ruff format --check clean on the changed files with the repo dev-shell
ruff (0.15.14).

Opened for visibility/historical record; merged directly once the paired verification is green
(the /cc-ci-tests-update invocation is the authorization).

## Stale-test fix: lasuite-meet meeting-flow test vs meet v1.22.0+ API auth hardening **Stale test:** `tests/lasuite-meet/custom/test_meeting_flow.py::test_create_room_get_livekit_token_and_read_back`. **What changed upstream:** meet **v1.22.0 hardened API auth — the API rejects raw OIDC user access tokens sent as Bearer credentials** (release notes: "🛂(backend) reject user access tokens on the API"). The test used a password-grant user token as `Authorization: Bearer` and went RED with `401 "Authentication credentials were not provided"` on the v1.24.0 upgrade (drone build #1137; same diagnosis at v1.23.0 in build #1122). **The fix — successor auth path, no assertion weakened:** - New recipe-local helper `_oidc_session.py` (same as the lasuite-docs one in cc-ci PR #12) drives the real OIDC authorization-code login (app → keycloak form → callback → session cookie; CSRF on unsafe methods). Promote to `runner/harness` if a third recipe needs it. - **Adds** an assertion that a raw OIDC Bearer token is now **rejected** (401/403 — the v1.22.0 hardening as the new correct behavior). - The full meeting flow is unchanged and still fully asserted, now over the session-authenticated API: room create → 201 + LiveKit JWT with a video grant for the room, read-back → 200 with the same LiveKit room, DELETE → 204/200, best-effort 404 confirmation. **Paired recipe upgrade PR (the pair goes green together):** https://git.autonomic.zone/recipe-maintainers/lasuite-meet/pulls/8 (carry-over from /upgrade-all 2026-07-24; also flagged 2026-07-31). **Lint:** `ruff check` + `ruff format --check` clean on the changed files with the repo dev-shell ruff (0.15.14). Opened for visibility/historical record; merged directly once the paired verification is green (the `/cc-ci-tests-update` invocation is the authorization).
autonomic-bot added 1 commit 2026-08-03 20:46:06 +00:00
test(lasuite-meet): update stale meeting-flow test for meet v1.22.0+ API auth hardening
Some checks failed
continuous-integration/drone/push Build is failing
Details
972f5ec4ad 
test_create_room_get_livekit_token_and_read_back authenticated with a raw OIDC user
access token as 'Authorization: Bearer'; meet v1.22.0 hardened API auth to reject
user access tokens (release notes: 'reject user access tokens on the API'), so the
test went RED with 401 on the v1.24.0 upgrade (drone build #1137; same at v1.23.0
in build #1122).

Updated to the successor auth path: recipe-local _oidc_session.py (same helper as
tests/lasuite-docs) drives the real OIDC authorization-code flow (app -> keycloak
login form -> callback -> Django session cookie, CSRF on unsafe methods).
- NEW assertion: a raw OIDC Bearer token is REJECTED (401/403) - the v1.22.0
  hardening asserted as the new correct behavior.
- The full meeting flow (create 201 + LiveKit JWT grant, read-back, DELETE) is
  unchanged, now over the session-authenticated API. No assertion weakened.

Stale-test fix for recipe PR
recipe-maintainers/lasuite-meet#8
(carry-over from /upgrade-all 2026-07-24).
autonomic-bot requested review from trav 2026-08-03 20:46:06 +00:00
autonomic-bot requested review from notplants 2026-08-03 20:46:06 +00:00
autonomic-bot commented 2026-08-03 20:50:37 +00:00
Author
Owner
Copy Link

Verified GREEN — cold full-suite ×1 against the paired recipe PR head (upgrade-52af111 @ 8aff5222), with this branch's tests applied on cc-ci:
install/upgrade/backup/restore/custom all pass (log: verify-lasuite-meet-20260803T204802Z.1.log).
The session-authenticated meeting flow (create + LiveKit grant + read-back + delete) works against the live v1.24.0 deploy, and the raw-Bearer rejection assertion confirms the v1.22.0 hardening.

Merging directly per policy: PR opened for visibility/historical record; the /cc-ci-tests-update invocation is the authorization.

**Verified GREEN** — cold full-suite ×1 against the paired recipe PR head (`upgrade-52af111` @ 8aff5222), with this branch's tests applied on cc-ci: install/upgrade/backup/restore/custom all pass (log: `verify-lasuite-meet-20260803T204802Z.1.log`). The session-authenticated meeting flow (create + LiveKit grant + read-back + delete) works against the live v1.24.0 deploy, and the raw-Bearer rejection assertion confirms the v1.22.0 hardening. Merging directly per policy: PR opened for visibility/historical record; the /cc-ci-tests-update invocation is the authorization.
autonomic-bot merged commit 04ae8f55c8 into main 2026-08-03 20:50:38 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
autonomic autonomic-bot notplants trav
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#13
No description provided.
Delete Branch "test/lasuite-meet-stale-test-20260803"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?