E2E: public-client OIDC fixtures + portable-cluster run checklist #43

Merged

ginjiruu merged 1 commit from t37-e2e into t36-pkce-nonce

2026-09-16 00:51:31 +00:00

ginjiruu commented

2026-09-16 00:38:53 +00:00

Owner

Closes #37

E2E fixtures for the public-client OIDC App: an OauthClient with no clientSecretRef (a Public client) plus its OidcPolicy, and the samples kustomization.

The live portable-cluster rip-and-replace run is a post-merge step that needs the merged code (#32-#36) and cluster access. Run checklist (on the portable cluster, after #32-#36 are merged):

Delete the old CRs, the old authzapps CRD, and the authz-bridge-system namespace.
Build + push the new image; update kustomize; deploy the bridge.
Apply the public-client fixtures; verify the OIDC Flow end-to-end (302 → IdP → callback → Session cookie → authorized Check, and a lazy refresh re-issue).
Verify the Exchange Flow end-to-end (RFC 8693, no secret, token injected as Authorization, subject token consumed).
Verify the gateway honours denied_response (302 + Set-Cookie) and response_headers_to_add (Set-Cookie) — the #30 gateway gate.
Recreate the authzapps CRD (deleted for now; recreated only after E2E passes).

Stacked on #36.

Closes #37 E2E fixtures for the public-client OIDC App: an `OauthClient` with **no `clientSecretRef`** (a Public client) plus its `OidcPolicy`, and the samples kustomization. The live **portable-cluster rip-and-replace run** is a post-merge step that needs the merged code (#32-#36) and cluster access. Run checklist (on the `portable` cluster, after #32-#36 are merged): 1. Delete the old CRs, the old `authzapps` CRD, and the `authz-bridge-system` namespace. 2. Build + push the new image; update kustomize; deploy the bridge. 3. Apply the public-client fixtures; verify the OIDC Flow end-to-end (302 → IdP → callback → Session cookie → authorized Check, and a lazy refresh re-issue). 4. Verify the Exchange Flow end-to-end (RFC 8693, no secret, token injected as `Authorization`, subject token consumed). 5. Verify the gateway honours `denied_response` (302 + `Set-Cookie`) and `response_headers_to_add` (`Set-Cookie`) — the #30 gateway gate. 6. Recreate the `authzapps` CRD (deleted for now; recreated only after E2E passes). Stacked on #36.

ginjiruu added 1 commit

2026-09-16 00:38:53 +00:00

test: public-client OIDC E2E fixtures (#37 )

Lint / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

Tests / Run on Ubuntu (pull_request) Has been cancelled