homelab-frontend/INTEGRATION_TESTS.md

# Real Integration Tests

These tests call actual services through the gateway and validate real operations.

## Current State

⚠️ **Most services NOT YET wired for JWT validation** (per homelab/project-usage/jwt-auth-rollout.md):

| Service | Status | Notes |
|---------|--------|-------|
| **SQS (kmsvc)** | ❌ Code unverified | Placeholders exist, JWT validation not tested |
| **MinIO/S3** | ⚠️ Partial | Has OIDC config, JWT forwarding works, actual validation not load-tested |
| **Memory (Poimen)** | ❌ Not implemented | Uses static API key internally, no JWT support |
| **Authentik (IAM)** | ✅ Works | Is the auth server, validates JWTs it issued |
| **Temporal** | ❌ Not configured | Has native JWT support but not wired yet, gRPC only |

## Running Tests

### Get a Real JWT First

```bash
# Get client_credentials from Authentik admin
# Set these:
export AUTHENTIK_URL=https://authentik.riotpiao.com
export AUTHENTIK_CLIENT_ID=<from Authentik OAuth2 Provider>
export AUTHENTIK_CLIENT_SECRET=<from Authentik OAuth2 Provider>
export GATEWAY_URL=https://api.riotpiao.com

# Run tests with real JWT
go test -tags integration -v ./internal/serviceadapter -run TestRealIntegration
```

### Without JWT (services in local testing)

```bash
GATEWAY_URL=http://localhost:8080 \
go test -tags integration -v ./internal/serviceadapter -run TestRealIntegration
```

## What Gets Tested

### ✅ Working (Gateway Routing)
- Request routing via X-Service header
- Path rewriting via X-Resource
- Authorization header pass-through
- Proper error responses (404, 400)

### ⚠️ Partially Working (Service Integration)
- **MinIO/S3**: Receives JWT via Authorization header (may not validate it yet)
- **Authentik**: Receives requests properly
- **SQS**: Receives requests but JWT validation unverified
- **Memory**: Receives requests (no JWT expected)

### ❌ Not Yet Implemented
- SQS JWT validation (code in kmsvc not tested)
- MinIO JWT validation (not load-tested per rollout doc)
- Memory JWT validation (would need code change in poimen)
- Temporal gRPC forwarding (requires grpcproxy, Phase 9)
- Temporal JWT validation (not configured yet)

## Test Output Example

```
=== RUN   TestRealIntegration
=== RUN   TestRealIntegration/get_JWT_from_Authentik
    real_integration_test.go:XX: ✅ Got JWT token (first 50 chars): eyJ0eXAiOiJKV1QiLCJhbGc...
--- PASS: TestRealIntegration/get_JWT_from_Authentik (0.54s)

=== RUN   TestRealIntegration/SQS:_list-queues
    real_integration_test.go:XX: ⚠️  SQS backend unreachable (502/504)
--- SKIP: TestRealIntegration/SQS:_list-queues (not reachable from test env)

=== RUN   TestRealIntegration/S3:_list-objects_with_JWT
    real_integration_test.go:XX: Using JWT token with MinIO
    real_integration_test.go:XX: Response: <?xml version="1.0" encoding="UTF-8"?>...
    real_integration_test.go:XX: ✅ MinIO list-objects returned 200
--- PASS: TestRealIntegration/S3:_list-objects_with_JWT (0.23s)

=== RUN   TestRealIntegration/IAM:_get_user_info_with_JWT
    real_integration_test.go:XX: ✅ Authentik returned 200
--- PASS: TestRealIntegration/IAM:_get_user_info_with_JWT (0.19s)
```

## What Needs to be Done Next

### Phase 3 (Auth Integration)
- [ ] Test SQS JWT validation actually works
- [ ] Load-test MinIO JWT validation
- [ ] Add JWT validation to poimen-memory
- [ ] Configure Temporal JWT validation

### Phase 9 (gRPC)
- [ ] Add grpcproxy for Temporal forwarding
- [ ] Test Temporal workflow operations end-to-end

## Debugging Failed Tests

If a test fails:

1. **Check if service is reachable:**
   ```bash
   # SQS
   kubectl -n sqs port-forward svc/management-service 9090:9090
   curl http://localhost:9090/sqs/queues
   
   # MinIO
   kubectl -n storage port-forward svc/minio 9000:80
   curl http://localhost:9000
   
   # Authentik
   curl https://authentik.riotpiao.com/api/v3/roles/ \
     -H "Authorization: Bearer $JWT_TOKEN"
   ```

2. **Check if JWT is valid:**
   ```bash
   # Decode JWT (copy to jwt.io or use jq)
   echo "$JWT_TOKEN" | cut -d. -f2 | base64 -d | jq .
   ```

3. **Check gateway routing:**
   ```bash
   kubectl -n api logs -l app=api-gateway --tail=50
   ```

4. **Test gateway directly:**
   ```bash
   curl -v https://api.riotpiao.com/ \
     -H "X-Service: s3" \
     -H "X-Resource: list-objects" \
     -H "Authorization: Bearer $JWT_TOKEN"
   ```

## Notes

- Tests gracefully skip if services are unreachable (502/504)
- Tests report ⚠️ warnings for operations that may not be fully integrated
- Full JWT validation is Phase 3 work, not Phase 8
- gRPC support is Phase 9 work