8cd72fd78d
All checks were successful
continuous-integration/drone/push Build is passing
a) compose.ccci.yml is FIRST-CLASS: the harness auto-copies tests/<recipe>/ compose.ccci.yml into the run's recipe checkout (ABRA_DIR-aware, lifecycle. provide_ccci_overlay) and auto-chaoses the pinned base deploy on its presence (kills the R7 implicit coupling). ghost/discourse install_steps.sh (copy-only boilerplate) deleted; CHAOS_BASE_DEPLOY removed from both metas + the registry. b) install-time deps wiring is the ONLY mode: deps with DEPS provision BEFORE the single deploy; legacy post-deploy provisioning + the setup_custom_tests.sh invocation machinery deleted. lasuite-docs migrated to install_steps.sh OIDC wiring (same env names/values as the old hook — only the timing moved); lasuite-drive's remaining post-deploy MinIO bucket one-shot moved to ops.py pre_install; both setup_custom_tests.sh files deleted; OIDC_AT_INSTALL removed from drive/meet metas + the registry. c) SKIP_GENERIC meta key deleted (zero users). Env form CCCI_SKIP_GENERIC* stays as the documented dev-only escape hatch; when active in a drone CI run the orchestrator prints a loud !! warning (manifest embedding lands in P5). d) conftest cleanup: dead pre-deploy-once fixtures deployed/deployed_app deleted (zero users), app_domain + _short + _wait_healthy dropped (only users were the deleted fixtures); deps_apps+deps_creds consolidated into ONE deps fixture (entries expose .domain etc. as attributes; dict access intact); the 6 lasuite test files renamed deps_creds->deps (fixture name only — assertions and flows byte-identical). requires_deps marker + F2-11 skip-report plumbing unchanged. Registry is now exactly the 14 final keys; docs §4 table regenerated. Stale setup_custom_tests/OIDC_AT_INSTALL prose in docstrings/comments/assert MESSAGES updated (no assert logic or expected value touched). Verified on cc-ci: cc-ci-run -m pytest tests/unit -q -> 175 passed; scripts/lint.sh -> PASS.
95 lines
3.9 KiB
Python
95 lines
3.9 KiB
Python
"""lasuite-docs — parity port of recipe-maintainer's oidc_login.py (Phase 2 P2).
|
|
|
|
SOURCE: references/recipe-maintainer/recipe-info/lasuite-docs/tests/oidc_login.py
|
|
|
|
End-to-end flow:
|
|
1. GET `/api/v1.0/users/me/` without auth → asserts the response REDIRECTS to the dep
|
|
keycloak's realm auth endpoint (the recipe is correctly configured to challenge
|
|
unauthenticated callers — wired via install_steps.sh).
|
|
2. Obtain an OIDC token from the dep keycloak via password grant
|
|
(the test user provisioned by the orchestrator's realm setup).
|
|
3. Call `/api/v1.0/users/me/` with `Authorization: Bearer <jwt>` → asserts 200 and the
|
|
returned user's email matches the provisioned test user.
|
|
|
|
Marked @pytest.mark.requires_deps — skips with `deps-not-ready` if dep provisioning failed.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import ssl
|
|
import sys
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
import pytest
|
|
|
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
|
|
from harness import http as harness_http # noqa: E402
|
|
from harness import sso
|
|
|
|
_CTX = ssl.create_default_context()
|
|
_CTX.check_hostname = False
|
|
_CTX.verify_mode = ssl.CERT_NONE
|
|
|
|
|
|
class _NoFollow(urllib.request.HTTPRedirectHandler):
|
|
def redirect_request(self, req, fp, code, msg, headers, newurl):
|
|
raise urllib.error.HTTPError(newurl, code, msg, headers, fp)
|
|
|
|
|
|
def _get_no_redirect(url: str) -> tuple[int, str]:
|
|
"""GET without auto-following redirects. Returns (status, redirect_url-or-body)."""
|
|
opener = urllib.request.build_opener(_NoFollow, urllib.request.HTTPSHandler(context=_CTX))
|
|
try:
|
|
with opener.open(url, timeout=15) as resp:
|
|
return resp.status, resp.read().decode(errors="replace")
|
|
except urllib.error.HTTPError as e:
|
|
if e.code in (301, 302, 303, 307, 308):
|
|
return e.code, e.headers.get("Location", "")
|
|
return e.code, ""
|
|
|
|
|
|
@pytest.mark.requires_deps
|
|
def test_oidc_login_via_keycloak(live_app, deps):
|
|
"""Anonymous → redirect to keycloak; password-grant token → 200 from /api/v1.0/users/me/."""
|
|
kc = deps["keycloak"]
|
|
|
|
# Step 1: unauthenticated GET → 302 to keycloak realm's auth endpoint
|
|
status, redirect = _get_no_redirect(f"https://{live_app}/api/v1.0/users/me/")
|
|
expected_prefix = f"https://{kc['domain']}/realms/{kc['realm']}/protocol/openid-connect/auth"
|
|
# Some configurations return 401 with WWW-Authenticate (an OIDC challenge) rather than a
|
|
# 302 redirect. Both are valid "auth-required" indicators — accept either, but if a
|
|
# redirect is returned it must point at the dep keycloak realm.
|
|
if status in (301, 302, 303, 307, 308):
|
|
assert expected_prefix in (
|
|
redirect or ""
|
|
), f"Docs redirected to {redirect!r}, expected to start with {expected_prefix!r}"
|
|
else:
|
|
assert status in (401, 403), (
|
|
f"GET /api/v1.0/users/me/ unauth: HTTP {status}; expected redirect to keycloak "
|
|
f"OR 401/403. (200 would be an auth leak.)"
|
|
)
|
|
|
|
# Step 2: obtain an OIDC token via password grant against the dep keycloak
|
|
creds = {
|
|
"client_id": kc["client_id"],
|
|
"client_secret": kc["client_secret"],
|
|
"user": kc["user"],
|
|
"password": kc["password"],
|
|
"token_url": kc["token_url"],
|
|
}
|
|
access_token = sso.oidc_password_grant(creds)
|
|
assert isinstance(access_token, str) and access_token.count(".") == 2, "expected JWT"
|
|
|
|
# Step 3: call the protected API with the Bearer token; assert 200 + user email
|
|
status, body = harness_http.http_get(
|
|
f"https://{live_app}/api/v1.0/users/me/",
|
|
headers={"Authorization": f"Bearer {access_token}"},
|
|
)
|
|
assert status == 200, f"GET /api/v1.0/users/me/ with token HTTP {status}: {body!r}"
|
|
assert isinstance(body, dict), f"unexpected response: {body!r}"
|
|
assert (
|
|
body.get("email") == kc["email"]
|
|
), f"unexpected user email: got {body.get('email')!r}, expected {kc['email']!r}"
|