Repository navigation
test(#129): run the full openespi-authserver test suite in CI - #227
Merged
Merged
Conversation
dfcoffin
force-pushed
the
feature/196-dcr-opaque-tokens
branch
from
November 13, 2026 07:53
8937bd3 to
763ee55
Compare
dfcoffin
force-pushed
the
fix/129-authserver-unit-tests
branch
from
November 13, 2026 08:02
4817529 to
b0bf4ed
Compare
…llerTest The standalone MockMvc setup installs no security filter chain and no method-security proxy, so the 401/403 (and "allowed") tests could never exercise access control. Admin API authorization is covered against the real configuration by AdminEndpointAuthorizationIntegrationTest and AdminBearerTokenIntegrationTest. The request-handling tests stay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the strict-stubbed JwtEncodingContext mocks (UnnecessaryStubbing, NPE on null claims) with a real context and assertions on the resulting claims. Role-to-resource-URI and customer-grant cases become parameterized; duplicate "ESPI compliance" cases and null-context/null-claims/null-endpoint cases (outside the framework contract) are removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… test AuthorizationServerConfigTest called the @bean filter-chain methods against a mocked HttpSecurity and stubbed JdbcTemplate (ClassCast, UnfinishedStubbing, null @value settings, removed /connect/register and JWK expectations) - it tested the framework, not our configuration. AuthorizationServerApplicationTests booted on the H2 'local' profile, which no longer starts. AuthorizationServerApplicationTests now extends AbstractAuthserverIntegrationTest (real config, MySQL Testcontainer) and asserts what the started context holds: the four security filter chains, no JwtDecoder/JwtEncoder (opaque only, #134), issuer and protocol endpoints, the JDBC client repository, grant-context authorization service and ESPI customizer beans, and the seeded default clients' grants, scopes, token format, TTLs, consent and PKCE settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move SecurityIntegrationTest off the H2 'test' profile (no schema: the H2
profile had no Flyway location) onto AbstractAuthserverIntegrationTest, and
correct its stale expectations:
- use the seeded clients' real secrets (the "{bcrypt}secret" literal never matched)
- malformed Basic header -> 400 invalid_request; client_secret_post on a
client_secret_basic client -> 401 invalid_client
- protocol endpoints are CSRF-exempt by design; CSRF is asserted on the
session-chain admin DELETE with an MFA-complete admin instead
- discovery document instead of the removed /oauth2/jwks endpoint
- authorize requests use queryParam (Spring AS reads the query string) and a
per-test client, and assert delegation/redirect-URI/scope outcomes exactly
- introspection by the DataCustodian client of another client's token
Removed: the six admin access-control cases (covered by
AdminEndpointAuthorizationIntegrationTest / AdminBearerTokenIntegrationTest),
the duplicate opaque-token case, the no-op CORS case, and the unused
application-test.yml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The authserver unit tests are repaired, so drop the -Dgroups=testcontainers-it restriction from the CI test matrix and from release-meta.sh, and update CLAUDE.md, README.md, RELEASING.md, CI_CD_SETUP.md and the testcontainers-it tag comments to say that `mvn verify -pl openespi-authserver` runs everything. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dfcoffin
force-pushed
the
fix/129-authserver-unit-tests
branch
from
November 14, 2026 19:05
b0bf4ed to
8c69ee7
Compare
AuthorizationServerApplicationTests pins the exact set of SecurityFilterChain beans. It was written before #240 added actuatorSecurityFilterChain, so the first CI run of the rebased suite failed on that one assertion (1 of 274). Keep the pin (a new chain changes which requests the others see) and list the fifth chain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Authorization Server's untagged tests were broken (306 run, 29 failures, 23 errors), and CI ran only the
testcontainers-itgroup. This PR fixes or deletes every failing test and makes CI and releases run the whole suite.Stacked on #207 (base
feature/196-dcr-opaque-tokens), because #207 deletesClientRegistrationControllerTest. Merge #207 first; this PR then retargets tomain.AuthorizationServerApplicationTestscontextLoadson H2local(which can't start: #226) replaced by 7 tests against the real context on MySQL: filter chains, settings, beans, seeded clientsAuthorizationServerConfigTestHttpSecurityand checked framework behavior; their concerns are covered by the context tests aboveEspiTokenCustomizerTestJwtEncodingContextinstead of mocks; duplicate cases merged into parameterized testsOAuthAdminControllerTestAdminEndpointAuthorizationIntegrationTest(GHSA-mh65) covers itSecurityIntegrationTestqueryParamfor authorize, CSRF on the session chain, real response headers)Also removes the unused H2
testprofile, and drops-Dgroups=testcontainers-itfrom the CI matrix andrelease-meta.sh. Docs are updated. No production code changed.Found along the way (separate issues)
POST /oauth2/token/introspect/revokewithAccept: */*or noAcceptgets a 302 to/authorize/delegateinstead of RFC 6749's 401. The test sendsAccept: application/jsonuntil that's fixed.localprofile fails to start.Notes
authserver0.33,controller0.27,dto0.22,service0.25. It's advisory (haltOnFailure=false), so the build doesn't fail.Test plan
mvn clean verify -pl openespi-authserverwith no group filter: 268 run, 0 failures, 0 errors, 1 skipped. The skip is the existing@DisabledPostgreSQL test (AS PostgreSQL migration V2 attaches chk_risk_score_range to wrong table #152).test (openespi-authserver)matrix entry runs the full suite.Closes #129
🤖 Generated with Claude Code