homelab-frontend/INTEGRATION_TESTS.md

Real Integration Tests

These tests call actual services through the gateway and validate real operations.

Current State

⚠️ Most services NOT YET wired for JWT validation (per homelab/project-usage/jwt-auth-rollout.md):

Service	Status	Notes
SQS (kmsvc)	❌ Code unverified	Placeholders exist, JWT validation not tested
MinIO/S3	⚠️ Partial	Has OIDC config, JWT forwarding works, actual validation not load-tested
Memory (Poimen)	❌ Not implemented	Uses static API key internally, no JWT support
Authentik (IAM)	✅ Works	Is the auth server, validates JWTs it issued
Temporal	❌ Not configured	Has native JWT support but not wired yet, gRPC only

Running Tests

Get a Real JWT First

# Get client_credentials from Authentik admin
# Set these:
export AUTHENTIK_URL=https://authentik.riotpiao.com
export AUTHENTIK_CLIENT_ID=<from Authentik OAuth2 Provider>
export AUTHENTIK_CLIENT_SECRET=<from Authentik OAuth2 Provider>
export GATEWAY_URL=https://api.riotpiao.com

# Run tests with real JWT
go test -tags integration -v ./internal/serviceadapter -run TestRealIntegration

Without JWT (services in local testing)

GATEWAY_URL=http://localhost:8080 \
go test -tags integration -v ./internal/serviceadapter -run TestRealIntegration

What Gets Tested

✅ Working (Gateway Routing)

• Request routing via X-Service header
• Path rewriting via X-Resource
• Authorization header pass-through
• Proper error responses (404, 400)

⚠️ Partially Working (Service Integration)

• MinIO/S3: Receives JWT via Authorization header (may not validate it yet)
• Authentik: Receives requests properly
• SQS: Receives requests but JWT validation unverified
• Memory: Receives requests (no JWT expected)

❌ Not Yet Implemented

• SQS JWT validation (code in kmsvc not tested)
• MinIO JWT validation (not load-tested per rollout doc)
• Memory JWT validation (would need code change in poimen)
• Temporal gRPC forwarding (requires grpcproxy, Phase 9)
• Temporal JWT validation (not configured yet)

Test Output Example

=== RUN   TestRealIntegration
=== RUN   TestRealIntegration/get_JWT_from_Authentik
    real_integration_test.go:XX: ✅ Got JWT token (first 50 chars): eyJ0eXAiOiJKV1QiLCJhbGc...
--- PASS: TestRealIntegration/get_JWT_from_Authentik (0.54s)

=== RUN   TestRealIntegration/SQS:_list-queues
    real_integration_test.go:XX: ⚠️  SQS backend unreachable (502/504)
--- SKIP: TestRealIntegration/SQS:_list-queues (not reachable from test env)

=== RUN   TestRealIntegration/S3:_list-objects_with_JWT
    real_integration_test.go:XX: Using JWT token with MinIO
    real_integration_test.go:XX: Response: <?xml version="1.0" encoding="UTF-8"?>...
    real_integration_test.go:XX: ✅ MinIO list-objects returned 200
--- PASS: TestRealIntegration/S3:_list-objects_with_JWT (0.23s)

=== RUN   TestRealIntegration/IAM:_get_user_info_with_JWT
    real_integration_test.go:XX: ✅ Authentik returned 200
--- PASS: TestRealIntegration/IAM:_get_user_info_with_JWT (0.19s)

What Needs to be Done Next

Phase 3 (Auth Integration)

• Test SQS JWT validation actually works
• Load-test MinIO JWT validation
• Add JWT validation to poimen-memory
• Configure Temporal JWT validation

Phase 9 (gRPC)

• Add grpcproxy for Temporal forwarding
• Test Temporal workflow operations end-to-end

Debugging Failed Tests

If a test fails:

1. Check if service is reachable:

   # SQS
   kubectl -n sqs port-forward svc/management-service 9090:9090
   curl http://localhost:9090/sqs/queues
   
   # MinIO
   kubectl -n storage port-forward svc/minio 9000:80
   curl http://localhost:9000
   
   # Authentik
   curl https://authentik.riotpiao.com/api/v3/roles/ \
     -H "Authorization: Bearer $JWT_TOKEN"
   

2. Check if JWT is valid:

   # Decode JWT (copy to jwt.io or use jq)
   echo "$JWT_TOKEN" | cut -d. -f2 | base64 -d | jq .
   

3. Check gateway routing:

   kubectl -n api logs -l app=api-gateway --tail=50
   

4. Test gateway directly:

   curl -v https://api.riotpiao.com/ \
     -H "X-Service: s3" \
     -H "X-Resource: list-objects" \
     -H "Authorization: Bearer $JWT_TOKEN"
   

Notes

• Tests gracefully skip if services are unreachable (502/504)
• Tests report ⚠️ warnings for operations that may not be fully integrated
• Full JWT validation is Phase 3 work, not Phase 8
• gRPC support is Phase 9 work