Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)
* refactor(web): update OAuth E2E tests to use new authentication method - Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration. - Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs. - Ensured that the tests continue to validate the expected authorization URL after the change. Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process. * Guided-auth removal, OAuth smoke testing, and TUI/CLI support * Added CLI OAuth runner flags tests * Added clarifying comment on port 0 binding * README notes on TUI oauth callback port, prettier fixes for CLI tests * CIMD validation uses inline like EMA IdP * Fixed TUI test failures from merge * test: bring 5 OAuth files over the 90 per-file coverage gate The guided-auth-removal work added/touched several files that fell below the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run the gate (it's local-only), so validate + test:integration passed while these gaps slipped through. Bring them all back over the line: - core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the provably-dead guards (empty host, out-of-range port, String(err) fallback, pathname "/" fallback) -- all rejected by new URL() upstream -- with justified v8 ignore comments instead of lowering the gate. - core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return. - core/react/useClientSettingsDraft.ts: test the functional-updater path, the stale-onChange-after-close prev===null guard, and the timer-fires-after-close value===null guard. - ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear. - clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration kinds, the expired IdP session, and the configured-scope/empty-scope branches of formatScopes. npm run coverage now passes (exit 0) across web, cli, tui, launcher. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: cliffhall <cliff@futurescale.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Bob Dickinson
GitHub
parent
4a927d3978
commit
13dafe457b
6 changed files with 5702 additions and 4444 deletions
|
|
@ -1,7 +1,7 @@
|
|||
/**
|
||||
* Mock IdP and resource authorization servers for EMA integration tests.
|
||||
* Topology mirrors xaa.dev staging (separate IdP + resource AS) — see
|
||||
* test-servers/configs/xaa-ema-http.json and specification/v2_enterprise_managed_auth.md.
|
||||
* test-servers/configs/xaa-ema-http.json and specification/v2_auth_ema.md.
|
||||
*/
|
||||
|
||||
import {
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -244,7 +244,7 @@ describe("InspectorClient OAuth E2E with Remote Storage", () => {
|
|||
clientConfig,
|
||||
);
|
||||
|
||||
const authUrl = await client.runGuidedAuth();
|
||||
const authUrl = await client.authenticate();
|
||||
if (!authUrl) throw new Error("Expected authorization URL");
|
||||
expect(authUrl.href).toContain("/oauth/authorize");
|
||||
|
||||
|
|
@ -335,7 +335,7 @@ describe("InspectorClient OAuth E2E with Remote Storage", () => {
|
|||
clientConfig1,
|
||||
);
|
||||
|
||||
const authUrl = await client1.runGuidedAuth();
|
||||
const authUrl = await client1.authenticate();
|
||||
if (!authUrl) throw new Error("Expected authorization URL");
|
||||
const authCode = await completeOAuthAuthorization(authUrl);
|
||||
await client1.completeOAuthFlow(authCode);
|
||||
|
|
@ -495,7 +495,7 @@ describe("InspectorClient OAuth E2E with Remote Storage", () => {
|
|||
clientConfig,
|
||||
);
|
||||
|
||||
const authUrl = await client.runGuidedAuth();
|
||||
const authUrl = await client.authenticate();
|
||||
if (!authUrl) throw new Error("Expected authorization URL");
|
||||
expect(authUrl.href).toContain("/oauth/authorize");
|
||||
|
||||
|
|
|
|||
|
|
@ -199,7 +199,7 @@ describe("InspectorClient OAuth", () => {
|
|||
}
|
||||
});
|
||||
|
||||
it("should track auth fetches with category 'auth' during guided auth", async () => {
|
||||
it("should track auth fetches with category 'auth' during authenticate()", async () => {
|
||||
const staticClientId = "test-auth-fetch-client";
|
||||
const staticClientSecret = "test-auth-fetch-secret";
|
||||
|
||||
|
|
@ -253,9 +253,7 @@ describe("InspectorClient OAuth", () => {
|
|||
);
|
||||
|
||||
const fetchRequestLogState = new FetchRequestLogState(testClient);
|
||||
// beginGuidedAuth runs metadata_discovery, client_registration, authorization_redirect
|
||||
// (stops at authorization_code awaiting user). Produces auth fetches only (no connect yet).
|
||||
await testClient.beginGuidedAuth();
|
||||
await testClient.authenticate();
|
||||
|
||||
const fetchRequests = fetchRequestLogState.getFetchRequests();
|
||||
const authFetches = fetchRequests.filter(
|
||||
|
|
@ -293,7 +291,7 @@ describe("InspectorClient OAuth", () => {
|
|||
const staticClientId = "test-event-client";
|
||||
const staticClientSecret = "test-event-secret";
|
||||
|
||||
// Create test server with OAuth enabled and DCR support (for authenticate() normal mode)
|
||||
// Create test server with OAuth enabled and DCR support
|
||||
const serverConfig = {
|
||||
...getDefaultServerConfig(),
|
||||
serverType: "sse" as const,
|
||||
|
|
|
|||
|
|
@ -4939,7 +4939,7 @@ describe("InspectorClient", () => {
|
|||
);
|
||||
});
|
||||
|
||||
it("authenticate / runGuidedAuth / proceedOAuthStep throw via ensureOAuthManager when oauthManager is unset", async () => {
|
||||
it("authenticate throws via ensureOAuthManager when oauthManager is unset", async () => {
|
||||
const c = new InspectorClient(
|
||||
{
|
||||
type: "stdio",
|
||||
|
|
@ -4949,10 +4949,6 @@ describe("InspectorClient", () => {
|
|||
{ environment: { transport: createTransportNode } },
|
||||
);
|
||||
await expect(c.authenticate()).rejects.toThrow(/OAuth not configured/);
|
||||
await expect(c.runGuidedAuth()).rejects.toThrow(/OAuth not configured/);
|
||||
await expect(c.proceedOAuthStep()).rejects.toThrow(
|
||||
/OAuth not configured/,
|
||||
);
|
||||
});
|
||||
|
||||
it("simple session/roots/subscription accessors return empty defaults before connect", () => {
|
||||
|
|
|
|||
|
|
@ -99,6 +99,34 @@ describe("/api/storage/client keychain", () => {
|
|||
await teardown(h);
|
||||
});
|
||||
|
||||
it("POST persists EMA and CIMD together in client.json", async () => {
|
||||
const body = {
|
||||
enterpriseManagedAuth: {
|
||||
enabled: true,
|
||||
idp: {
|
||||
issuer: "https://idp.example.com",
|
||||
clientId: "inspector-app",
|
||||
},
|
||||
},
|
||||
cimd: {
|
||||
enabled: true,
|
||||
clientMetadataUrl: "https://example.com/cimd.json",
|
||||
},
|
||||
};
|
||||
const res = await fetch(`${h.baseUrl}/api/storage/client`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify(body),
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
const onDisk = JSON.parse(
|
||||
readFileSync(h.clientPath, "utf-8"),
|
||||
) as typeof body;
|
||||
expect(onDisk.enterpriseManagedAuth).toEqual(body.enterpriseManagedAuth);
|
||||
expect(onDisk.cimd).toEqual(body.cimd);
|
||||
});
|
||||
|
||||
it("POST writes IdP clientSecret to keychain, not client.json", async () => {
|
||||
const res = await fetch(`${h.baseUrl}/api/storage/client`, {
|
||||
method: "POST",
|
||||
|
|
|
|||
Loading…
Reference in a new issue