test(auth): add Dex-backed OIDC authorizer integration test#388
Merged
Conversation
Exercises the OIDC authorizer end-to-end against a real Dex container: Dex issues a real signed, groups-bearing token (via the mockCallback connector and the auth-code flow, since static passwords carry no groups), and the test asserts the tier policy holds — read open to any valid token, write gated on an admin group (403 otherwise), and missing/garbage tokens rejected (401). Pins Dex to a reserved host port so the issuer URL is known before startup (it must match what clients discover). Complements the unit tests by proving real OIDC discovery, JWKS, and claim-shape compatibility. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds an integration-level, real-OIDC-provider test to validate SchemaBot’s OIDC authorizer interoperability (discovery + JWKS + signed token + groups claim) using a Dex container, ensuring the read/write tier policy holds end-to-end under make test-integration.
Changes:
- Added
//go:build integrationDex-backed end-to-end authorizer test covering valid admin token, valid non-admin token, missing token, and garbage token cases. - Updated
go.modto make the Docker client dependency direct (needed by the new integration test’s container HostConfig modifier).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| pkg/auth/dex_integration_test.go | New integration test that spins up Dex via testcontainers, mints a token via auth-code flow, and asserts OIDC tier enforcement through the middleware. |
| go.mod | Promotes github.com/docker/docker to a direct dependency for the new test’s Docker HostConfig types. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- bound every HTTP call with an explicit client timeout so a hung Dex or network fails fast instead of blocking until the test timeout - reuse the configured client for the token exchange instead of the default - retry Dex startup with a freshly reserved port to absorb the inherent reserve-then-bind TOCTOU race - terminate the container with a fresh context in cleanup (t.Context() is already cancelled by then) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
aparajon
force-pushed
the
aparajon/auth-dex-e2e
branch
from
1caa1b9 to
d164cf9
Compare
morgo
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this matters — Auth is a tier-0 safety gate. The unit tests verify the tier policy against an in-process JWKS stub, but nothing yet proves SchemaBot interoperates with a real OIDC provider's discovery, key set, and token shape.
What it does — Adds an integration test that stands up a real Dex container, mints a genuine signed, groups-bearing token via the auth-code flow, and asserts the read/write tier policy end-to-end:
GET /api/status)POST /api/apply)How it moves toward the northstar — Locks in OIDC provider compatibility before the CLI Bearer/login work builds on it, so a provider-shape regression fails CI instead of surfacing in production.
Mechanics worth noting for review:
groupsclaim, so the test uses themockCallbackconnector (a fixed identity in groupauthors) driven through the auth-code flow to get a token that actually carries groups.//go:build integration; runs undermake test-integration.🤖 Generated with Claude Code