test: add e2e auth flow test script
Validates JWT auth, identity claims, X-Service dispatch, and auth endpoints against live cluster. 16 tests across 5 scenarios. 15/16 pass (1 skipped: poimen-memory pods down). Closes #14 Co-authored-by: poimen <[email protected]>
This commit is contained in:
Executable
+178
@@ -0,0 +1,178 @@
|
||||
#!/usr/bin/env bash
|
||||
# End-to-end auth flow tests for api-gateway.
|
||||
# Validates: JWT auth, identity headers, token exchange, error handling.
|
||||
#
|
||||
# Usage:
|
||||
# ./scripts/test-auth-e2e.sh
|
||||
#
|
||||
# Requires: kubectl access to cluster, curl, jq
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
API="https://api.riotpiao.com"
|
||||
TOKEN_URL="https://authentik.riotpiao.com/application/o/token/"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
SKIP=0
|
||||
|
||||
# Colors
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[0;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
check() {
|
||||
local name="$1" expected="$2" actual="$3"
|
||||
if [ "$expected" = "$actual" ]; then
|
||||
echo -e " ${GREEN}✓${NC} $name"
|
||||
PASS=$((PASS + 1))
|
||||
else
|
||||
echo -e " ${RED}✗${NC} $name (expected $expected, got $actual)"
|
||||
FAIL=$((FAIL + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
skip() {
|
||||
echo -e " ${YELLOW}○${NC} $1 (skipped: $2)"
|
||||
SKIP=$((SKIP + 1))
|
||||
}
|
||||
|
||||
# --- Load credentials ---
|
||||
echo "Loading credentials from cluster..."
|
||||
P_SECRET=$(kubectl get secret -n portfolio portfolio-agent-oidc -o jsonpath='{.data.CLIENT_SECRET}' | base64 -d 2>/dev/null) || true
|
||||
M_SECRET=$(kubectl get secret -n poimen memory-agent-oidc -o jsonpath='{.data.CLIENT_SECRET}' | base64 -d 2>/dev/null) || true
|
||||
|
||||
if [ -z "$P_SECRET" ] || [ -z "$M_SECRET" ]; then
|
||||
echo "ERROR: Cannot read service account secrets. Check kubectl context."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# --- Get tokens ---
|
||||
echo ""
|
||||
echo "=== Acquiring tokens ==="
|
||||
|
||||
P_TOKEN=$(curl -s -X POST "$TOKEN_URL" \
|
||||
-d "grant_type=client_credentials&client_id=portfolio-agent&client_secret=$P_SECRET&scope=openid roles" \
|
||||
| jq -r '.access_token')
|
||||
|
||||
M_TOKEN=$(curl -s -X POST "$TOKEN_URL" \
|
||||
-d "grant_type=client_credentials&client_id=memory-agent&client_secret=$M_SECRET&scope=openid roles" \
|
||||
| jq -r '.access_token')
|
||||
|
||||
if [ "$P_TOKEN" = "null" ] || [ -z "$P_TOKEN" ]; then
|
||||
echo "ERROR: Failed to get portfolio-agent token"
|
||||
exit 1
|
||||
fi
|
||||
echo " portfolio-agent: token acquired"
|
||||
echo " memory-agent: token acquired"
|
||||
|
||||
# --- Scenario 1: LLM inference ---
|
||||
echo ""
|
||||
echo "=== Scenario 1: LLM inference (llm:inference) ==="
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/chat/completions" \
|
||||
-H "Authorization: Bearer $P_TOKEN" -H "Content-Type: application/json" \
|
||||
-d '{"model":"qwen2.5:3b-instruct","messages":[{"role":"user","content":"ok"}],"max_tokens":2}')
|
||||
check "portfolio-agent -> qwen chat" "200" "$CODE"
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/chat/completions" \
|
||||
-H "Authorization: Bearer $M_TOKEN" -H "Content-Type: application/json" \
|
||||
-d '{"model":"reasoning","messages":[{"role":"user","content":"ok"}],"max_tokens":2}')
|
||||
check "memory-agent -> reasoning chat" "200" "$CODE"
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/embeddings" \
|
||||
-H "Authorization: Bearer $P_TOKEN" -H "Content-Type: application/json" \
|
||||
-d '{"model":"nomic-ai/nomic-embed-text-v2-moe","input":"test"}')
|
||||
check "portfolio-agent -> embeddings" "200" "$CODE"
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" "$API/v1/models")
|
||||
check "GET /v1/models (no auth)" "200" "$CODE"
|
||||
|
||||
# --- Scenario 2: Auth enforcement ---
|
||||
echo ""
|
||||
echo "=== Scenario 2: Auth enforcement ==="
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/chat/completions" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"model":"qwen2.5:3b-instruct","messages":[{"role":"user","content":"ok"}]}')
|
||||
check "no token -> 401" "401" "$CODE"
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/chat/completions" \
|
||||
-H "Authorization: Bearer garbage-token" -H "Content-Type: application/json" \
|
||||
-d '{"model":"qwen2.5:3b-instruct","messages":[{"role":"user","content":"ok"}]}')
|
||||
check "bad token -> 403" "403" "$CODE"
|
||||
|
||||
# --- Scenario 3: Token claims ---
|
||||
echo ""
|
||||
echo "=== Scenario 3: Token claims ==="
|
||||
|
||||
decode_jwt() { python3 -c "import base64,json,sys; p=sys.argv[1].split('.')[1]; p+='='*(4-len(p)%4); print(json.dumps(json.loads(base64.urlsafe_b64decode(p))))" "$1"; }
|
||||
|
||||
P_CLAIMS=$(decode_jwt "$P_TOKEN")
|
||||
P_ROLES=$(echo "$P_CLAIMS" | jq -r '.roles | join(",")')
|
||||
check "portfolio-agent has llm:inference" "true" "$(echo "$P_ROLES" | grep -q 'llm:inference' && echo true || echo false)"
|
||||
check "portfolio-agent has s3:read" "true" "$(echo "$P_ROLES" | grep -q 's3:read' && echo true || echo false)"
|
||||
check "portfolio-agent has sqs:read" "true" "$(echo "$P_ROLES" | grep -q 'sqs:read' && echo true || echo false)"
|
||||
|
||||
M_CLAIMS=$(decode_jwt "$M_TOKEN")
|
||||
M_ROLES=$(echo "$M_CLAIMS" | jq -r '.roles | join(",")')
|
||||
check "memory-agent has memory:write" "true" "$(echo "$M_ROLES" | grep -q 'memory:write' && echo true || echo false)"
|
||||
check "memory-agent has s3:write" "true" "$(echo "$M_ROLES" | grep -q 's3:write' && echo true || echo false)"
|
||||
|
||||
# --- Scenario 4: X-Service dispatch ---
|
||||
echo ""
|
||||
echo "=== Scenario 4: X-Service dispatch ==="
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" "$API/" \
|
||||
-H "X-Service: s3" -H "X-Resource: list-objects" \
|
||||
-H "Authorization: Bearer $P_TOKEN")
|
||||
check "portfolio-agent -> S3 list (reaches MinIO)" "403" "$CODE"
|
||||
# 403 = MinIO reached but rejects JWT (needs SigV4). Not a gateway auth issue.
|
||||
|
||||
# Memory service might be down
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$API/" \
|
||||
-H "X-Service: memory" -H "X-Resource: skills" \
|
||||
-H "Authorization: Bearer $P_TOKEN" 2>/dev/null)
|
||||
if [ "$CODE" = "200" ]; then
|
||||
check "portfolio-agent -> memory skills" "200" "$CODE"
|
||||
elif [ "$CODE" = "502" ]; then
|
||||
skip "portfolio-agent -> memory skills" "poimen-memory pods down"
|
||||
else
|
||||
check "portfolio-agent -> memory skills" "200" "$CODE"
|
||||
fi
|
||||
|
||||
# --- Scenario 5: Auth endpoints ---
|
||||
echo ""
|
||||
echo "=== Scenario 5: Auth endpoints ==="
|
||||
|
||||
# /auth/token — may return 400 if password grant not working, but endpoint should respond
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/auth/token" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"username":"rock","password":"wrong"}')
|
||||
# Should get 400 (bad creds forwarded from Authentik) or 502 (upstream issue), not 404
|
||||
if [ "$CODE" != "404" ] && [ "$CODE" != "405" ]; then
|
||||
check "/auth/token endpoint exists" "true" "true"
|
||||
else
|
||||
check "/auth/token endpoint exists" "not-404" "$CODE"
|
||||
fi
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X GET "$API/auth/token")
|
||||
check "GET /auth/token -> 405" "405" "$CODE"
|
||||
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/auth/refresh" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"refresh_token":"invalid"}')
|
||||
if [ "$CODE" != "404" ] && [ "$CODE" != "405" ]; then
|
||||
check "/auth/refresh endpoint exists" "true" "true"
|
||||
else
|
||||
check "/auth/refresh endpoint exists" "not-404" "$CODE"
|
||||
fi
|
||||
|
||||
# --- Summary ---
|
||||
echo ""
|
||||
echo "========================================="
|
||||
TOTAL=$((PASS + FAIL + SKIP))
|
||||
echo -e "Results: ${GREEN}$PASS passed${NC}, ${RED}$FAIL failed${NC}, ${YELLOW}$SKIP skipped${NC} / $TOTAL total"
|
||||
echo "========================================="
|
||||
|
||||
[ "$FAIL" -eq 0 ] && exit 0 || exit 1
|
||||
Reference in New Issue
Block a user