autonomic-bot
6557197858
- recipe_meta: DEPS=[keycloak] enabled (base proven cold-green). - setup_custom_tests.sh: wire OIDC env (explicit keycloak realm endpoints) + insert oidc_rpcs secret at bumped version + clear FranceConnect eidas1 acr + in-place redeploy (adapted from the proven lasuite-docs hook). - functional/test_oidc_with_keycloak.py: SSO discovery + password grant + JWT claims vs dep keycloak realm 'lasuite-drive' (@requires_deps; F2-11 fails run on skip). - functional/test_minio_storage.py: §4.3 specific — drive-media-storage bucket present + real upload->list->download round-trip via mc inside the minio container. - PARITY.md: OIDC + MinIO rows landed; backup data-integrity (ci_marker) already real. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
90 lines
3.7 KiB
Python
90 lines
3.7 KiB
Python
"""lasuite-drive — Q3.2 SSO-flow test (operator-2026-05-28 SSO-dep plan).
|
|
|
|
Drive (La Suite Drive) is OIDC-required: login is gated by an external OpenID Connect provider.
|
|
Mirrors the proven lasuite-docs SSO model:
|
|
- The orchestrator deploys a per-run keycloak dep AFTER the generic tiers and provisions a fresh
|
|
realm/client/user via `harness.sso.setup_keycloak_realm`; `setup_custom_tests.sh` then wires the
|
|
OIDC env + client secret into the running drive app and redeploys. Creds land in `$CCCI_DEPS_FILE`
|
|
(read here via the `deps_creds` fixture).
|
|
- This test consumes those creds and exercises the real OIDC flow against the dep keycloak: discovery
|
|
endpoint advertises the realm, and a password grant yields a valid JWT with the expected claims.
|
|
- Marked `@pytest.mark.requires_deps` so if setup_custom_tests failed the test SKIPs with a clear
|
|
`deps-not-ready` reason — and (per F2-11) the orchestrator then fails the run rather than going
|
|
green on a skipped SSO test.
|
|
|
|
SOURCE: adapted from tests/lasuite-docs/functional/test_oidc_with_keycloak.py (Q2.4 acceptance).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import json
|
|
import os
|
|
import sys
|
|
import time
|
|
|
|
import pytest
|
|
|
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
|
|
from harness import sso # noqa: E402
|
|
|
|
|
|
def _b64url_decode(seg: str) -> bytes:
|
|
pad = "=" * ((4 - len(seg) % 4) % 4)
|
|
return base64.urlsafe_b64decode(seg + pad)
|
|
|
|
|
|
@pytest.mark.requires_deps
|
|
def test_oidc_password_grant_against_dep_keycloak(live_app, deps_creds):
|
|
"""The dep keycloak issues a JWT for the pre-provisioned test user via OIDC password grant."""
|
|
assert "keycloak" in deps_creds, (
|
|
f"keycloak creds not in deps_creds; got {list(deps_creds.keys())}. "
|
|
"setup_custom_tests should have populated this."
|
|
)
|
|
kc = deps_creds["keycloak"]
|
|
|
|
# Creds shape — orchestrator names the realm + client after the parent recipe.
|
|
assert kc["domain"]
|
|
assert kc["realm"] == "lasuite-drive"
|
|
assert kc["client_id"] == "lasuite-drive"
|
|
assert isinstance(kc["client_secret"], str) and len(kc["client_secret"]) >= 16
|
|
assert isinstance(kc["password"], str) and len(kc["password"]) >= 16
|
|
|
|
creds = {
|
|
"provider": "keycloak",
|
|
"provider_domain": kc["domain"],
|
|
"realm": kc["realm"],
|
|
"client_id": kc["client_id"],
|
|
"client_secret": kc["client_secret"],
|
|
"user": kc["user"],
|
|
"password": kc["password"],
|
|
"email": kc["email"],
|
|
"discovery_url": kc["discovery_url"],
|
|
"token_url": kc["token_url"],
|
|
"auth_url": kc["auth_url"],
|
|
"userinfo_url": kc["userinfo_url"],
|
|
}
|
|
|
|
# OIDC discovery endpoint advertises the realm
|
|
discovery = sso.assert_discovery_endpoint(creds)
|
|
expected_iss = f"https://{kc['domain']}/realms/{kc['realm']}"
|
|
assert discovery.get("issuer") == expected_iss
|
|
assert discovery.get("token_endpoint", "").startswith(expected_iss + "/")
|
|
assert discovery.get("authorization_endpoint", "").startswith(expected_iss + "/")
|
|
|
|
# Password grant → real JWT
|
|
token = sso.oidc_password_grant(creds)
|
|
assert isinstance(token, str) and token.count(".") == 2, (
|
|
f"access_token is not a JWT: {token!r}"
|
|
)
|
|
payload = json.loads(_b64url_decode(token.split(".")[1]))
|
|
assert payload.get("iss") == expected_iss, f"JWT iss={payload.get('iss')!r} != {expected_iss!r}"
|
|
assert payload.get("azp") == kc["client_id"], (
|
|
f"JWT azp={payload.get('azp')!r} != {kc['client_id']!r}"
|
|
)
|
|
assert payload.get("typ") == "Bearer", f"JWT typ={payload.get('typ')!r} != 'Bearer'"
|
|
exp = payload.get("exp")
|
|
assert isinstance(exp, int) and exp > time.time(), (
|
|
f"JWT exp={exp!r} not a future timestamp (now={time.time():.0f})"
|
|
)
|