make e2e auth extensible for multiple IdPs and auth modes - #190
Merged
Conversation
Extract the provider-specific login UI interaction from Session.getSession into pluggable IdP adapters (specs.wdio/helpers/idp/, selected via TEST_IDP, default auth0) and the app-side login flow into auth mode strategies (specs.wdio/helpers/auth_mode/, selected via TEST_AUTH_MODE, default confidential). This prepares adding Authentik to the test matrix and a future public-client/bearer mode leg without touching session.ts again. Also replace the hardcoded test user email pattern with a TEST_USERS env variable (comma-separated list), wired into the wdio CI workflows.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughWDIO authentication now supports configurable auth modes and identity providers, derives test emails from ChangesWDIO authentication flow
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Session
participant TestApp
participant AuthMode
participant IdP
participant LinkedRecords
Session->>TestApp: initialize configured client
Session->>AuthMode: initiateLogin
AuthMode->>IdP: start OIDC login
Session->>IdP: submit test user credentials
IdP-->>TestApp: redirect to callback
TestApp->>LinkedRecords: establish authenticated session
Session->>AuthMode: completeLogin
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@specs.wdio/helpers/auth_mode/confidential.ts`:
- Line 9: Replace the broad selector in the login flow with a resilient selector
that uniquely targets the Login link, using its stable id, test attribute, or
exact link text instead of the first anchor returned by browser.$.
In `@specs.wdio/helpers/idp/auth0.ts`:
- Around line 8-20: Update the consent handling after the initial login-button
click in the auth flow to wait for navigation or a consent-screen-specific
condition before querying the shared submit-button selector. Ensure the login
button cannot be clicked twice, then click the consent button only after the
consent screen is ready while preserving the existing optional-consent behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0250f04d-03fb-43c5-baf8-de7d2c390e51
📒 Files selected for processing (10)
.github/workflows/wdio-load-tests.yml.github/workflows/wdio-tests.ymlCONTRIBUTING.mdspecs.wdio/helpers/auth_mode/confidential.tsspecs.wdio/helpers/auth_mode/index.tsspecs.wdio/helpers/auth_mode/types.tsspecs.wdio/helpers/idp/auth0.tsspecs.wdio/helpers/idp/index.tsspecs.wdio/helpers/idp/types.tsspecs.wdio/helpers/session.ts
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@specs.wdio/helpers/auth_mode/public.ts`:
- Around line 34-38: Update the authentication polling callback in
browser.waitUntil to use browser.execute with an async function instead of
deprecated executeAsync. Return the result of lr.isAuthenticated() directly, or
false when lr is unavailable, and remove the done callback usage.
In `@specs.wdio/testapp/client.ts`:
- Around line 14-25: Update the LinkedRecords constructor call in client
initialization to pass a fourth argument with deferUserInfoFetching enabled,
preventing user-info retrieval until the redirect callback establishes the token
while preserving the existing configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2cb8e07f-3dfd-433f-bb83-5b32cae60710
📒 Files selected for processing (12)
bin/test.wdio.shspecs.wdio/helpers/auth_mode/index.tsspecs.wdio/helpers/auth_mode/public.tsspecs.wdio/helpers/idp/auth0.tsspecs.wdio/helpers/idp/dev_oidc.tsspecs.wdio/helpers/idp/index.tsspecs.wdio/helpers/lr_expects.tsspecs.wdio/testapp/client.tsspecs.wdio/testapp/webpack.config.jssrc/browser_sdk/oidc.tssrc/browser_sdk/records_repository.tswdio.conf.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- specs.wdio/helpers/idp/index.ts
- specs.wdio/helpers/auth_mode/index.ts
- specs.wdio/helpers/idp/auth0.ts
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/wdio-tests.yml:
- Line 17: Update the TEST_USERS configuration in the wdio workflow to read the
comma-separated test-user list from secrets.TEST_USERS or an equivalent
environment-scoped secret, removing all email addresses from the workflow
source.
- Around line 79-80: Disable checkout credential persistence in both checkout
steps in .github/workflows/wdio-tests.yml at lines 79-80 and 93-94 by setting
persist-credentials to false, before the local setup-node-deps action runs.
- Line 59: Use the string key ['5432'] when reading service ports in both
PostgreSQL service-port references: .github/workflows/wdio-tests.yml lines 59-59
and 85-85. Update both occurrences without changing the surrounding WDIO job
configuration.
In `@specs.wdio/testapp/client.ts`:
- Around line 23-24: Await the redirect callback completion before invoking
ensureUserIdIsKnown in the LinkedRecords initialization flow. Reuse the
awaitable public callback-handling API exposed by the OIDC implementation,
ensuring token establishment finishes before user-info retrieval; keep the defer
flag and avoid starting a second concurrent callback.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 60b9bd6f-65f1-4357-8cef-6750f3c95515
📒 Files selected for processing (4)
.github/actions/setup-node-deps/action.yml.github/workflows/wdio-tests.ymllib/client-server-bus/drivers/ws/server/index.tsspecs.wdio/testapp/client.ts
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/setup-authentik/action.yml:
- Line 8: Update the Docker Compose startup step in the setup-authentik action
so it explicitly waits for or verifies Authentik blueprint provisioning before
the action returns. Do not rely solely on docker compose up --wait; add a
provisioning completion check using the existing worker or Authentik service
flow, and only proceed once OAuth applications and test users are created for
WDIO.
In @.github/actions/setup-authentik/docker-compose.yml:
- Line 43: Update both Authentik service image references in the Docker Compose
configuration from 2025.8 to the patched 2025.8.6 release, including the image
at the commented location and the second Authentik service image.
In @.github/workflows/wdio-tests.yml:
- Around line 103-104: Update both Authentik job checkout steps in
.github/workflows/wdio-tests.yml at lines 103-104 and 122-123 to set
persist-credentials to false, while leaving the subsequent setup-node-deps local
action steps unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 63b79a4f-7211-4adf-8f7c-f64d07bf456a
📒 Files selected for processing (9)
.env.authentik.example.github/actions/setup-authentik/action.yml.github/actions/setup-authentik/blueprints/e2e-test-setup.yaml.github/actions/setup-authentik/docker-compose.yml.github/workflows/wdio-tests.yml.vscode/settings.jsonspecs.wdio/helpers/auth_mode/public.tsspecs.wdio/helpers/idp/authentik.tsspecs.wdio/helpers/idp/index.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- specs.wdio/helpers/idp/index.ts
- specs.wdio/helpers/auth_mode/public.ts
…mode The LinkedRecords constructor fires handleRedirectCallback() in the background (it can't be async) when landing back from the IdP with ?code&state. The test app called ensureUserIdIsKnown() right after construction without waiting for that exchange to finish, so the first request could go out before an access token was available. Memoize handleRedirectCallback() so it's safe to await from the test app without triggering a second concurrent callback.
docker compose --wait only waits for containers to report healthy, not for authentik's own background blueprint discovery to finish provisioning the flows/cert/scope-mappings the e2e blueprint's !Find lookups depend on, causing an intermittent race on a freshly started worker.
With REUSE_TEST_BROWSERS=true (npm run wdio:fast), the first test in a run logs all 4 browsers into the hermetic Authentik container concurrently, which means 4 concurrent password-stage hashes competing for the runner's CPU - slower than the near-instant dev-oidc/auth0 flows these 10s waits were originally tuned for. Bump both window.lr checks to 30s, matching the other Authentik-aware waits already in auth_mode/public.ts.
Both auth paths in authentication.ts constructed a fresh express-openid-connect or express-oauth2-jwt-bearer middleware inside the per-request handler, so every single request re-ran OIDC issuer discovery (and JWKS setup for the bearer path) from scratch. Fast against dev-oidc/Auth0, but against the CPU-constrained hermetic Authentik container used in CI this added multi-second latency to every request, making auth-mode test runs crawl or appear to hang. Build both middlewares once (the OIDC one cached per distinct ?prompt= value, since that's the only thing that varies) and reuse them. Also fixes a latent bug this exposed: afterCallback ignored its own req/res arguments in favor of the outer handler's, which only worked by accident because a fresh instance used to be built per request.
This reverts commit 084d2c5.
wolfoo2931
changed the title
wdio-tests-pg.yml covers the postgres 15/17/18 + PGlite backend matrix using dev-oidc as a cheap stand-in IdP. wdio-tests-auth0.yml covers Auth0 confidential/public client mode against PGlite. The disabled Authentik jobs move into their own wdio-tests-authentik.yml, now enabled but manual-only (workflow_dispatch), since they're too heavy to run on every push/PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extract the provider-specific login UI interaction from Session.getSession into pluggable IdP adapters (specs.wdio/helpers/idp/, selected via TEST_IDP, default auth0) and the app-side login flow into auth mode strategies (specs.wdio/helpers/auth_mode/, selected via TEST_AUTH_MODE, default confidential). This prepares adding Authentik to the test matrix and a future public-client/bearer mode leg without touching session.ts again.
Also replace the hardcoded test user email pattern with a TEST_USERS env variable (comma-separated list), wired into the wdio CI workflows.
Summary by CodeRabbit
TEST_USERS.