Run the dockerised e2e suite with write auth enabled #181

Merged

benvin merged 2 commits from benvin/e2e-oidc-auth into master 2026-11-08 11:08:00 +11:00

Conversation 2 Commits 2 Files Changed 17

+239 -28

unkin-agent commented 2026-11-02 22:02:02 +11:00

Member

Copy Link

Copy Source

Write auth broke buildkit pushes in production because the dockerised e2e suite runs artifactapi with auth disabled, so no real client ever authenticated a publish.

• serve a static mock OIDC issuer; TestMain generates the key, writes the JWKS and mints tokens
• run the stack with ARTIFACTAPI_AUTH_UPLOADS=true
• authenticate each local publish the way its client does (curl Bearer/Basic, docker login, npm, gem, ansible-galaxy)
• assert publishes without a token or with a foreign-key token get 401 and anonymous reads still work
• add docker CLI, buildx and helm OCI push cases; skip the last two until unkin/artifactapi#180 lands

Write auth broke buildkit pushes in production because the dockerised e2e suite runs artifactapi with auth disabled, so no real client ever authenticated a publish. - serve a static mock OIDC issuer; TestMain generates the key, writes the JWKS and mints tokens - run the stack with ARTIFACTAPI_AUTH_UPLOADS=true - authenticate each local publish the way its client does (curl Bearer/Basic, docker login, npm, gem, ansible-galaxy) - assert publishes without a token or with a foreign-key token get 401 and anonymous reads still work - add docker CLI, buildx and helm OCI push cases; skip the last two until unkin/artifactapi#180 lands

unkin-agent added 1 commit 2026-11-02 22:02:02 +11:00

Run the dockerised e2e suite with write auth enabled ... a161c44575

Real clients now authenticate every local publish against a static mock
OIDC issuer, and each type checks unauthenticated publishes are refused
while anonymous reads keep working.

unkin-agent commented 2026-11-02 22:04:33 +11:00

Author

Member

Copy Link

Copy Source

• e2e-docker/local_test.go:126 — deb Packages poll rewrite is a test-race fix unrelated to write auth → split into its own PR (or drop; the old getEventually would still fail only on the empty-index race, so it is independent of this change).
• nit: e2e-docker/docker_local_test.go:~219, e2e-docker/helm_local_test.go:~76 — t.Skip cites a branch name (benvin/registry-token-oauth-post) that disappears on merge → cite an issue/PR number so the skips are traceable and removable.

- e2e-docker/local_test.go:126 — deb Packages poll rewrite is a test-race fix unrelated to write auth → split into its own PR (or drop; the old getEventually would still fail only on the empty-index race, so it is independent of this change). - nit: e2e-docker/docker_local_test.go:~219, e2e-docker/helm_local_test.go:~76 — t.Skip cites a branch name (benvin/registry-token-oauth-post) that disappears on merge → cite an issue/PR number so the skips are traceable and removable.

unkin-agent added 1 commit 2026-11-02 22:19:27 +11:00

Drop the deb index poll change and cite #180 in registry-token skips c1571f1960

unkin-agent commented 2026-11-02 22:24:10 +11:00

Author

Member

Copy Link

Copy Source

No findings.

No findings.

benvin merged commit 6429e62f17 into master 2026-11-08 11:08:00 +11:00

benvin deleted branch benvin/e2e-oidc-auth 2026-11-08 11:08:00 +11:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/artifactapi#181