8cd72fd78d
All checks were successful
continuous-integration/drone/push Build is passing
a) compose.ccci.yml is FIRST-CLASS: the harness auto-copies tests/<recipe>/ compose.ccci.yml into the run's recipe checkout (ABRA_DIR-aware, lifecycle. provide_ccci_overlay) and auto-chaoses the pinned base deploy on its presence (kills the R7 implicit coupling). ghost/discourse install_steps.sh (copy-only boilerplate) deleted; CHAOS_BASE_DEPLOY removed from both metas + the registry. b) install-time deps wiring is the ONLY mode: deps with DEPS provision BEFORE the single deploy; legacy post-deploy provisioning + the setup_custom_tests.sh invocation machinery deleted. lasuite-docs migrated to install_steps.sh OIDC wiring (same env names/values as the old hook — only the timing moved); lasuite-drive's remaining post-deploy MinIO bucket one-shot moved to ops.py pre_install; both setup_custom_tests.sh files deleted; OIDC_AT_INSTALL removed from drive/meet metas + the registry. c) SKIP_GENERIC meta key deleted (zero users). Env form CCCI_SKIP_GENERIC* stays as the documented dev-only escape hatch; when active in a drone CI run the orchestrator prints a loud !! warning (manifest embedding lands in P5). d) conftest cleanup: dead pre-deploy-once fixtures deployed/deployed_app deleted (zero users), app_domain + _short + _wait_healthy dropped (only users were the deleted fixtures); deps_apps+deps_creds consolidated into ONE deps fixture (entries expose .domain etc. as attributes; dict access intact); the 6 lasuite test files renamed deps_creds->deps (fixture name only — assertions and flows byte-identical). requires_deps marker + F2-11 skip-report plumbing unchanged. Registry is now exactly the 14 final keys; docs §4 table regenerated. Stale setup_custom_tests/OIDC_AT_INSTALL prose in docstrings/comments/assert MESSAGES updated (no assert logic or expected value touched). Verified on cc-ci: cc-ci-run -m pytest tests/unit -q -> 175 passed; scripts/lint.sh -> PASS.
88 lines
3.6 KiB
Python
88 lines
3.6 KiB
Python
"""lasuite-docs — Q2 SSO-flow acceptance test (operator-2026-05-28 SSO-dep plan).
|
|
|
|
Refactored to the refined SSO-dep model:
|
|
- The orchestrator deploys a per-run keycloak dep AFTER generic tiers and provisions a fresh
|
|
realm/client/user via `harness.sso.setup_keycloak_realm`. The creds are written to
|
|
`$CCCI_DEPS_FILE` (read here via the `deps` fixture).
|
|
- This test no longer calls `setup_keycloak_realm` itself — that's the orchestrator's job in
|
|
the dep-provisioning step. We just consume the credentials and exercise the OIDC flow.
|
|
- Marked `@pytest.mark.requires_deps` so if dep provisioning failed, this test SKIPs with a
|
|
clear `deps-not-ready` reason rather than red-flagging a non-recipe failure.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import json
|
|
import os
|
|
import re
|
|
import sys
|
|
import time
|
|
|
|
import pytest
|
|
|
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
|
|
from harness import sso # noqa: E402
|
|
|
|
|
|
def _b64url_decode(seg: str) -> bytes:
|
|
pad = "=" * ((4 - len(seg) % 4) % 4)
|
|
return base64.urlsafe_b64decode(seg + pad)
|
|
|
|
|
|
@pytest.mark.requires_deps
|
|
def test_oidc_password_grant_against_dep_keycloak(live_app, deps):
|
|
"""The dep keycloak issues a JWT for the pre-provisioned test user via OIDC password grant."""
|
|
assert "keycloak" in deps, (
|
|
f"keycloak creds not in deps; got {list(deps.keys())}. "
|
|
"dep provisioning should have populated this."
|
|
)
|
|
kc = deps["keycloak"]
|
|
|
|
# Sanity-check the creds shape — orchestrator-written
|
|
assert kc["domain"]
|
|
# WC1: realm is per-run namespaced "<parent>-<6hex>" so concurrent dependents never collide.
|
|
assert re.fullmatch(
|
|
r"lasuite-docs-[0-9a-f]{6}", kc["realm"]
|
|
), f"realm {kc['realm']!r} not the per-run namespaced form lasuite-docs-<6hex>"
|
|
assert kc["client_id"] == "lasuite-docs"
|
|
assert isinstance(kc["client_secret"], str) and len(kc["client_secret"]) >= 16
|
|
assert isinstance(kc["password"], str) and len(kc["password"]) >= 16
|
|
|
|
# Build a creds dict in the shape sso.* primitives expect
|
|
creds = {
|
|
"provider": "keycloak",
|
|
"provider_domain": kc["domain"],
|
|
"realm": kc["realm"],
|
|
"client_id": kc["client_id"],
|
|
"client_secret": kc["client_secret"],
|
|
"user": kc["user"],
|
|
"password": kc["password"],
|
|
"email": kc["email"],
|
|
"discovery_url": kc["discovery_url"],
|
|
"token_url": kc["token_url"],
|
|
"auth_url": kc["auth_url"],
|
|
"userinfo_url": kc["userinfo_url"],
|
|
}
|
|
|
|
# OIDC discovery endpoint advertises the realm
|
|
discovery = sso.assert_discovery_endpoint(creds)
|
|
expected_iss = f"https://{kc['domain']}/realms/{kc['realm']}"
|
|
assert discovery.get("issuer") == expected_iss
|
|
assert discovery.get("token_endpoint", "").startswith(expected_iss + "/")
|
|
assert discovery.get("authorization_endpoint", "").startswith(expected_iss + "/")
|
|
|
|
# Password grant → real JWT
|
|
token = sso.oidc_password_grant(creds)
|
|
assert isinstance(token, str) and token.count(".") == 2, f"access_token is not a JWT: {token!r}"
|
|
payload = json.loads(_b64url_decode(token.split(".")[1]))
|
|
assert payload.get("iss") == expected_iss, f"JWT iss={payload.get('iss')!r} != {expected_iss!r}"
|
|
assert (
|
|
payload.get("azp") == kc["client_id"]
|
|
), f"JWT azp={payload.get('azp')!r} != {kc['client_id']!r}"
|
|
assert payload.get("typ") == "Bearer", f"JWT typ={payload.get('typ')!r} != 'Bearer'"
|
|
exp = payload.get("exp")
|
|
assert (
|
|
isinstance(exp, int) and exp > time.time()
|
|
), f"JWT exp={exp!r} not a future timestamp (now={time.time():.0f})"
|