E2E: portable-cluster rip-and-replace re-run (OIDC + Exchange; #30 gateway gate) #37

New issue

Closed

opened 2026-09-15 23:27:28 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-15 23:27:28 +00:00

Owner

Parent

#31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio

What to build

On the portable cluster, rip and replace the old bridge: delete the old CRs, the old authzapps CRD, and the authz-bridge-system namespace; build/push the image and deploy the new bridge; then verify the OIDC Flow (public client, PKCE, session, lazy refresh) and the Exchange Flow (RFC 8693, no secret) end-to-end through the httpbin-auth fixture. This run also closes the #30 gateway verification gate (the gateway must honor denied_response 302 + Set-Cookie and response_headers_to_add Set-Cookie).

Acceptance criteria

The old CRs, the old authzapps CRD, and the authz-bridge-system namespace are removed.
The new bridge image is built/pushed and the bridge is deployed (kustomize updated).
A public-client OIDC App signs in end-to-end: 302 → IdP → callback → Session cookie → authorized Check (and a lazy refresh re-issues the cookie).
The Exchange Flow exchanges a service-account token end-to-end (no secret; exchanged token injected as Authorization, subject token consumed).
The gateway honors denied_response (302 + Set-Cookie) and response_headers_to_add (Set-Cookie) — the #30 gateway gate.
The authzapps CRD is recreated (deleted for now, recreated only after E2E passes).

Blocked by

#32 — Public-client config: optional clientSecretRef (CRD + registry)
#33 — Securecookie cookies + Cookie key (BYO + leader-generated)
#34 — OIDC Flow to the trio: x/oauth2 + go-oidc (mechanical swap)
#35 — Exchange Flow to hstern/go-token-exchange (mechanical swap)
#36 — PKCE (always) + id_token nonce + public-client no-secret

## Parent #31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio ## What to build On the **`portable`** cluster, rip and replace the old bridge: delete the old CRs, the old `authzapps` CRD, and the `authz-bridge-system` namespace; build/push the image and deploy the new bridge; then verify the **OIDC Flow** (public client, PKCE, session, lazy refresh) and the **Exchange Flow** (RFC 8693, no secret) end-to-end through the `httpbin-auth` fixture. This run also closes the **#30 gateway verification gate** (the gateway must honor `denied_response` 302 + `Set-Cookie` and `response_headers_to_add` `Set-Cookie`). ## Acceptance criteria - [ ] The old CRs, the old `authzapps` CRD, and the `authz-bridge-system` namespace are removed. - [ ] The new bridge image is built/pushed and the bridge is deployed (kustomize updated). - [ ] A public-client OIDC App signs in end-to-end: 302 → IdP → callback → Session cookie → authorized Check (and a lazy refresh re-issues the cookie). - [ ] The Exchange Flow exchanges a service-account token end-to-end (no secret; exchanged token injected as `Authorization`, subject token consumed). - [ ] The gateway honors `denied_response` (302 + `Set-Cookie`) and `response_headers_to_add` (`Set-Cookie`) — the #30 gateway gate. - [ ] The `authzapps` CRD is recreated (deleted for now, recreated only after E2E passes). ## Blocked by - #32 — Public-client config: optional clientSecretRef (CRD + registry) - #33 — Securecookie cookies + Cookie key (BYO + leader-generated) - #34 — OIDC Flow to the trio: x/oauth2 + go-oidc (mechanical swap) - #35 — Exchange Flow to hstern/go-token-exchange (mechanical swap) - #36 — PKCE (always) + id_token nonce + public-client no-secret

ginjiruu added the

ready-for-agent

label

2026-09-15 23:27:37 +00:00

ginjiruu referenced this issue from a commit

2026-09-16 00:37:36 +00:00

test: public-client OIDC E2E fixtures (#37)

ginjiruu referenced this issue from a pull request that will close it,

2026-09-16 00:38:53 +00:00

E2E: public-client OIDC fixtures + portable-cluster run checklist #43

ginjiruu closed this issue

2026-09-16 00:51:32 +00:00