psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

chore(e2e): capture access_token from /oauth2/token response, not just Bearer header #123

Merged
YousifShkara merged 1 commit from chore/e2e-capture-spa-build-hash into main 2026-06-06 05:06:32 +02:00
Conversation 0 Commits 1 Files changed 1 +73 -17
YousifShkara commented 2026-06-06 05:06:29 +02:00
Owner
Copy link

mokosh-apps PR #84 (fix/auth-callback-persists-tokens-before-nav) fixes an SPA bug where AuthCallback's post-login navigation kicked off an infinite OIDC loop. Without it the SPA exchanges tokens at /oauth2/token but never fires a Bearer-carrying API call, so this setup times out. The CI gate on E2E passing then blocks the very staging redeploy that would land the fix - circular.

Reading the access_token straight out of the first successful /oauth2/token response breaks the cycle. The token endpoint POST fires as part of OIDC itself, regardless of whether the SPA's downstream data fetches ever run, so token capture survives a fully-broken SPA. The bearer-header sniff stays as a backstop; whichever signal arrives first wins.

Once PR #84 deploys, the bearer-header path is the source of truth again - any healthy SPA fires authed API calls within milliseconds of mounting the dashboard, and the response-body path becomes a no-op fallback for whatever the NEXT regression in this area looks like.

Diagnostic: the timeout error block now also lists every observed /oauth2/token response with its HTTP status, so the next failure tells us whether OIDC even completed (zero entries = bunyip login never returned to mokosh) vs. completed but returned a bad token (entries with non-2xx status) vs. completed cleanly but the SPA never used the result.

Updated the leading comment to match (the /v1/auth/memberships reasoning was load-bearing for the original implementation but mokosh-apps PR #79 removed that call, so the explanation rotted; replaced it with the two-path justification).

Typecheck: npx tsc --noEmit clean.

mokosh-apps PR #84 (`fix/auth-callback-persists-tokens-before-nav`) fixes an SPA bug where AuthCallback's post-login navigation kicked off an infinite OIDC loop. Without it the SPA exchanges tokens at `/oauth2/token` but never fires a Bearer-carrying API call, so this setup times out. The CI gate on E2E passing then blocks the very staging redeploy that would land the fix - circular. Reading the access_token straight out of the first successful `/oauth2/token` response breaks the cycle. The token endpoint POST fires as part of OIDC itself, regardless of whether the SPA's downstream data fetches ever run, so token capture survives a fully-broken SPA. The bearer-header sniff stays as a backstop; whichever signal arrives first wins. Once PR #84 deploys, the bearer-header path is the source of truth again - any healthy SPA fires authed API calls within milliseconds of mounting the dashboard, and the response-body path becomes a no-op fallback for whatever the NEXT regression in this area looks like. Diagnostic: the timeout error block now also lists every observed `/oauth2/token` response with its HTTP status, so the next failure tells us whether OIDC even completed (zero entries = bunyip login never returned to mokosh) vs. completed but returned a bad token (entries with non-2xx status) vs. completed cleanly but the SPA never used the result. Updated the leading comment to match (the `/v1/auth/memberships` reasoning was load-bearing for the original implementation but mokosh-apps PR #79 removed that call, so the explanation rotted; replaced it with the two-path justification). Typecheck: `npx tsc --noEmit` clean.
chore(e2e): capture access_token from /oauth2/token response, not just Bearer header
All checks were successful
Create release / Create release from merged PR (pull_request) Has been skipped
Details
E2E (staging) / Playwright against staging (pull_request) Successful in 35s
Details
Check / fmt + clippy + compile + tests (pull_request) Successful in 1m39s
Details
160688de51 
mokosh-apps PR #84 (`fix/auth-callback-persists-tokens-before-nav`) fixes an SPA bug where AuthCallback's post-login navigation kicked off an infinite OIDC loop. Without it the SPA exchanges tokens at `/oauth2/token` but never fires a Bearer-carrying API call, so this setup times out. The CI gate on E2E passing then blocks the very staging redeploy that would land the fix - circular.

Reading the access_token straight out of the first successful `/oauth2/token` response breaks the cycle. The token endpoint POST fires as part of OIDC itself, regardless of whether the SPA's downstream data fetches ever run, so token capture survives a fully-broken SPA. The bearer-header sniff stays as a backstop; whichever signal arrives first wins.

Once PR #84 deploys, the bearer-header path is the source of truth again - any healthy SPA fires authed API calls within milliseconds of mounting the dashboard, and the response-body path becomes a no-op fallback for whatever the NEXT regression in this area looks like.

Diagnostic: the timeout error block now also lists every observed `/oauth2/token` response with its HTTP status, so the next failure tells us whether OIDC even completed (zero entries = bunyip login never returned to mokosh) vs. completed but returned a bad token (entries with non-2xx status) vs. completed cleanly but the SPA never used the result.

Updated the leading comment to match (the `/v1/auth/memberships` reasoning was load-bearing for the original implementation but mokosh-apps PR #79 removed that call, so the explanation rotted; replaced it with the two-path justification).

Typecheck: `npx tsc --noEmit` clean.
YousifShkara deleted branch chore/e2e-capture-spa-build-hash 2026-06-06 05:06:33 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!123
No description provided.