Run the dockerised e2e suite with write auth enabled

Real clients now authenticate every local publish against a static mock OIDC issuer, and each type checks unauthenticated publishes are refused while anonymous reads keep working.
2026-11-02 22:01:44 +11:00
parent f8d6db3bd2
commit a161c44575
17 changed files with 249 additions and 34 deletions
@@ -68,6 +68,7 @@ func TestLocalPuppetRealClient(t *testing.T) {
 	if resp, body := getEventually(t, api("/api/v1/local/local-puppet/v3/releases/unkin-hello-0.1.0"), 15*time.Second); resp.StatusCode != http.StatusOK || !strings.Contains(string(body), `"file_md5"`) {
 		t.Fatalf("release never indexed: %d %s", resp.StatusCode, body)
 	}
+	assertWriteGated(t, http.MethodPut, api("/api/v2/remotes/local-puppet/files/unkin-hello-0.2.0.tar.gz"), tarball, "application/gzip", api("/api/v1/local/local-puppet/v3/releases/unkin-hello-0.1.0"))

 	forge := internal + "/api/v1/local/local-puppet"
 	run := func(image, script string) string {