P3.9: End-to-end integration test — full auth flow #14

New Issue

2026-09-08T04:43:06Z

rock commented

2026-09-08 04:43:06 +00:00

Summary

Document and script complete auth flow. Partially validated 2026-09-08.

Test results (2026-09-08)

Scenario 1: Service-to-service (client_credentials)

Service	Client	Result	Notes
LLM chat (qwen)	portfolio-agent	✅ 200	`llm:inference` role checked
LLM chat (reasoning)	portfolio-agent	✅ 200	vLLM backend
LLM chat	memory-agent	✅ 200
Embeddings	portfolio-agent	✅ 200	TEI backend
Models list	portfolio-agent	✅ 200
No auth	—	✅ 401	Auth enforced

Scenario 2: X-Service adapter dispatch

Service	Client	Result	Notes
S3 list	portfolio-agent	❌ 403	MinIO OIDC locked to `minio` provider, rejects other JWTs
SQS list	portfolio-agent	❌ 403	Gateway hardcodes non-existent `sqs` JWKS. See P3.6
Memory skills	portfolio-agent	❌ 502	`poimen-memory` pods CrashLoopBackOff (unrelated)
Memory query	memory-agent	❌ 502	Same pod crash

Scenario 3: Direct service access (bypass gateway)

Service	Method	Result	Notes
S3 (MinIO)	SigV4 root creds	✅ 200	4 buckets listed
Temporal HTTP	no auth	✅ 200	3 namespaces, 7 workflows. No auth on Temporal UI
Temporal gRPC	—	N/A	Requires in-cluster access

Scenario 4: Password grant (user login)

api-gw provider: password grant configured but returns invalid_grant for user rock
Needs investigation: headless flow stages work for service accounts but fail for internal users

Remaining work

Fix password grant for human users (P3.1 blocked on this)
Script scripts/test-auth-e2e.sh
Document in docs/auth-flows.md
Re-test memory service when pods recover
Re-test SQS after P3.6 fix

## Summary Document and script complete auth flow. Partially validated 2026-09-08. ## Test results (2026-09-08) ### Scenario 1: Service-to-service (client_credentials) | Service | Client | Result | Notes | |---------|--------|--------|-------| | LLM chat (qwen) | portfolio-agent | ✅ 200 | `llm:inference` role checked | | LLM chat (reasoning) | portfolio-agent | ✅ 200 | vLLM backend | | LLM chat | memory-agent | ✅ 200 | | | Embeddings | portfolio-agent | ✅ 200 | TEI backend | | Models list | portfolio-agent | ✅ 200 | | | No auth | — | ✅ 401 | Auth enforced | ### Scenario 2: X-Service adapter dispatch | Service | Client | Result | Notes | |---------|--------|--------|-------| | S3 list | portfolio-agent | ❌ 403 | MinIO OIDC locked to `minio` provider, rejects other JWTs | | SQS list | portfolio-agent | ❌ 403 | Gateway hardcodes non-existent `sqs` JWKS. See P3.6 | | Memory skills | portfolio-agent | ❌ 502 | `poimen-memory` pods CrashLoopBackOff (unrelated) | | Memory query | memory-agent | ❌ 502 | Same pod crash | ### Scenario 3: Direct service access (bypass gateway) | Service | Method | Result | Notes | |---------|--------|--------|-------| | S3 (MinIO) | SigV4 root creds | ✅ 200 | 4 buckets listed | | Temporal HTTP | no auth | ✅ 200 | 3 namespaces, 7 workflows. **No auth on Temporal UI** | | Temporal gRPC | — | N/A | Requires in-cluster access | ### Scenario 4: Password grant (user login) - `api-gw` provider: password grant configured but returns `invalid_grant` for user `rock` - Needs investigation: headless flow stages work for service accounts but fail for internal users ## Remaining work - [ ] Fix password grant for human users (P3.1 blocked on this) - [ ] Script `scripts/test-auth-e2e.sh` - [ ] Document in `docs/auth-flows.md` - [ ] Re-test memory service when pods recover - [ ] Re-test SQS after P3.6 fix

rock added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:43:07 +00:00