fix(e2e): capture bearer from ANY host, not just /api/v1 #108

Merged

nrupard merged 1 commit from fix/e2e-capture-bearer-any-host into main

2026-06-05 18:43:45 +02:00

nrupard commented

2026-06-05 18:42:34 +02:00

Owner

Summary

CI diagnostic dump confirmed setup runs cleanly through SPA login (TOTP entered, OIDC callback succeeded, SPA landed on /dashboard) but the bearer-capture filter on url.includes('/api/v1/') rejected every observed request.

The SPA fires https://api.a8n.systems/v1/auth/memberships against the bunyip hub BEFORE any mokosh-server /api/v1 call. That membership request carries the bunyip-issued at+jwt as Authorization: Bearer, so the token IS available - the filter just skipped it.

Mokosh-server runs the bunyip-RS verifier (src/modules/auth/middleware.rs:69) and JIT-mirrors (sub, email) into local users on first use, so the SAME bearer authenticates both bunyip and mokosh PSA endpoints. Capture the first bearer seen on any URL; it works against both backends.

Also: log the URL the token was captured from on success so the next failure tells us at a glance whether the token came from bunyip, mokosh, or somewhere unexpected.

Test plan

Post-merge run: setup logs [setup] captured bearer from https://api.a8n.systems/... and proceeds; api project tests run against mokosh /api/v1/* with the same bearer.

## Summary CI diagnostic dump confirmed setup runs cleanly through SPA login (TOTP entered, OIDC callback succeeded, SPA landed on `/dashboard`) but the bearer-capture filter on `url.includes('/api/v1/')` rejected every observed request. The SPA fires `https://api.a8n.systems/v1/auth/memberships` against the bunyip hub BEFORE any mokosh-server `/api/v1` call. That membership request carries the bunyip-issued at+jwt as `Authorization: Bearer`, so the token IS available - the filter just skipped it. Mokosh-server runs the bunyip-RS verifier (`src/modules/auth/middleware.rs:69`) and JIT-mirrors `(sub, email)` into local `users` on first use, so the SAME bearer authenticates both bunyip and mokosh PSA endpoints. Capture the first bearer seen on any URL; it works against both backends. Also: log the URL the token was captured from on success so the next failure tells us at a glance whether the token came from bunyip, mokosh, or somewhere unexpected. ## Test plan - [ ] Post-merge run: setup logs `[setup] captured bearer from https://api.a8n.systems/...` and proceeds; api project tests run against mokosh `/api/v1/*` with the same bearer.

nrupard added 1 commit

2026-06-05 18:42:34 +02:00

fix(e2e): capture bearer from ANY host, not just /api/v1

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / fmt + clippy + compile + tests (pull_request) Successful in 1m26s

Details

8a69f3fb34

CI dump showed setup running cleanly through login (TOTP entered, OIDC callback succeeded, SPA landed on /dashboard) but the bearer-capture filter rejected every observed request. The SPA fired `/v1/auth/memberships` against the bunyip hub (api.a8n.systems) BEFORE any mokosh-server /api/v1 call. The membership request DID carry the bunyip-issued at+jwt as `Authorization: Bearer`, but the old filter on `url.includes('/api/v1/')` skipped it.

Mokosh-server runs the bunyip-RS verifier (src/modules/auth/middleware.rs:69) and JIT-mirrors (sub, email) into local `users` on first sight, so the same bearer authenticates both the bunyip hub AND the mokosh PSA API. Capture the FIRST bearer seen on any URL; it works against both.

While here, log the URL the token was captured from on success - on the next failure we can confirm at a glance whether it came from bunyip, mokosh, or somewhere else.

#PMS-140