fix(e2e): adopt the provider's key defaults and the verifier's resource grammar - #10
Merged
Merged
Conversation
…ce grammar auth.provider#282 made EdDSA the signing default, removed the HS256 fallback, and put a >=32-byte floor on the decoded secret; the suite's 19-char shared secret and implicit HS256 both stopped working. The E2E stays on HS256 rather than moving to a published JWKS: auth.policy-verifier#109 requires https for a JWKS URI with an http carve-out only for loopback, and here the verifier would reach the provider at http://provider:3000 — a compose service name, not loopback. Widening that carve-out to make a test pass would weaken the fix. The secret now has ONE definition, in the Makefile, interpolated into the containers and exported to the test processes. Two definitions is what broke first: tests/shared/oauthFlow.js fell back to the old literal, so every hand-minted ABAC token failed as a 401 that read like a policy failure. The fallback is gone — the suite now refuses to run without it. auth.policy-verifier#117 stopped rewriting the resource-type separator, so project:1.member:2 derives project.member rather than project_member; the fixture scope follows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the cross-component E2E suite to align with upstream contract changes in auth.provider (JWT signing defaults/secret requirements) and auth.policy-verifier (resource-type derivation grammar), so the suite can run against siblings’ default branches again.
Changes:
- Remove the in-test JWT secret fallback and require
OAUTH_JWT_SECRETto be provided consistently across test processes and containers. - Configure the provider container to explicitly sign with
HS256and inject a >=32-byte (decoded) shared secret from a single Makefile definition. - Update ABAC scope fixtures to use
read:project.memberto match the verifier’s updated resource-type derivation.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/shared/oauthFlow.js | Requires OAUTH_JWT_SECRET via requireEnv to prevent drift between tests and containers. |
| tests/provider/clients.yaml | Updates allowed scope name to read:project.member. |
| tests/docker-compose.yml | Injects shared secret via env interpolation and pins provider signing algorithm to HS256. |
| tests/abac/index.test.js | Updates ABAC scope usage/docs to match the new resource grammar. |
| Makefile | Defines and exports a single shared OAUTH_JWT_SECRET for compose + test processes. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+36
to
+38
| throw new Error( | ||
| `${name} is not set. Run the suite through \`make test-e2e\`, which exports it from tests/docker-compose.yml.`, | ||
| ); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two sibling contract changes landed today and this suite clones siblings from their default branches, so it broke on both.
What changed upstream
auth.provider#282 made EdDSA the signing default, removed the HS256 fallback entirely, and put a >=32-byte floor on the decoded secret. The suite's
test-secret-for-e2eis 14 decoded bytes, and it relied on the implicit HS256 default — so both halves stopped working.auth.policy-verifier#117 stopped rewriting the resource-type separator, so
project:1.member:2now derivesproject.memberrather thanproject_member.What this does
OAUTH_JWT_ALGORITHM=HS256) and moves both services to a 32-byte secret.httpsfor a JWKS URI, with anhttpcarve-out only for loopback. Here the verifier would reach the provider athttp://provider:3000— a compose service name, not loopback — so a JWKS-based E2E would fail the verifier's boot check. Widening that carve-out to make a test pass would weaken the fix it belongs to.The bug this surfaced in the suite itself
tests/shared/oauthFlow.jshadprocess.env.OAUTH_JWT_SECRET || 'test-secret-for-e2e', and the Makefile never exported that variable — so the ABAC tests, which mint their own tokens, were always using the fallback. They agreed with the containers only because the containers used the same literal. Changing the compose value made every negative ABAC case fail as a 401 that reads like a policy failure rather than a key mismatch.The fallback is now gone: the suite refuses to run without the variable and says how to supply it. A second definition is exactly how this drifts again.
Verification
make test-e2efrom clean: 20 token-flow + 12 abac = 32 passed. Confirmed against provider and verifier default branches carrying #282, #117, #109 and #140.🤖 Generated with Claude Code