fix(startup): fail loud when configured SSO bootstrap fails #223

Merged

nrupard merged 1 commit from fix/pms-289-sso-fail-loud-when-configured into main

2026-06-13 20:20:47 +02:00

nrupard commented

2026-06-13 20:18:35 +02:00

Owner

Summary

Makes a configured-but-broken SSO bootstrap fatal instead of a silent degrade to legacy auth. Closes PMS-289. Sibling to PMS-286 (fatal PSA migrations).

try_bootstrap_sso collapsed two outcomes into one Err, and main treated them identically (WARN + run legacy-only):

SSO env not set - a legitimate legacy-only deployment.
SSO configured but from_env (partial/invalid config) or bootstrap (auth migrations, key load) failed - a real error.

So a configured deployment whose SSO bootstrap broke silently lost its OIDC / at+jwt verification path with only a WARN.

Change

SsoSetup enum + sso_is_configured(): SSO is "configured" when any required MOKOSH_AUTH_* env var is set (MOKOSH_AUTH_ISSUER, _JWT_PRIVATE_KEY_PATH, _JWT_ACTIVE_KID, _JWT_PUBLIC_KEYS_DIR, _DATA_ENCRYPTION_KEY).
try_bootstrap_sso: returns Ok(NotConfigured) when none set; Ok(Mounted) on success; Err (fatal) when configured but bootstrap fails.
main: NotConfigured -> WARN + legacy-only (unchanged); Err -> ERROR + return from main -> exit non-zero.

No new env var. The legacy-only path (no MOKOSH_AUTH_*) is unchanged.

Tests

Unit test sso_is_configured_tracks_env_presence: none set => not configured; any set => configured.
Fatal-startup behaviour is a documented manual repro (main() isn't unit-testable), same approach as PMS-286: with MOKOSH_AUTH_* set but e.g. an unreadable key dir, the server logs ERROR ... SSO is configured but failed to bootstrap and exits non-zero instead of coming up legacy-only.

Verification

cargo test --bin mokosh-server sso_is_configured_tracks_env_presence: 1 passed.
cargo fmt --all --check clean; cargo clippy --bin mokosh-server clean.

## Summary Makes a configured-but-broken SSO bootstrap fatal instead of a silent degrade to legacy auth. Closes PMS-289. Sibling to PMS-286 (fatal PSA migrations). `try_bootstrap_sso` collapsed two outcomes into one `Err`, and `main` treated them identically (WARN + run legacy-only): - SSO env not set - a legitimate legacy-only deployment. - SSO configured but `from_env` (partial/invalid config) or `bootstrap` (auth migrations, key load) failed - a real error. So a configured deployment whose SSO bootstrap broke silently lost its OIDC / at+jwt verification path with only a WARN. ## Change - `SsoSetup` enum + `sso_is_configured()`: SSO is "configured" when any required `MOKOSH_AUTH_*` env var is set (`MOKOSH_AUTH_ISSUER`, `_JWT_PRIVATE_KEY_PATH`, `_JWT_ACTIVE_KID`, `_JWT_PUBLIC_KEYS_DIR`, `_DATA_ENCRYPTION_KEY`). - `try_bootstrap_sso`: returns `Ok(NotConfigured)` when none set; `Ok(Mounted)` on success; `Err` (fatal) when configured but bootstrap fails. - `main`: `NotConfigured` -> WARN + legacy-only (unchanged); `Err` -> ERROR + return from `main` -> exit non-zero. No new env var. The legacy-only path (no `MOKOSH_AUTH_*`) is unchanged. ## Tests - Unit test `sso_is_configured_tracks_env_presence`: none set => not configured; any set => configured. - Fatal-startup behaviour is a documented manual repro (`main()` isn't unit-testable), same approach as PMS-286: with `MOKOSH_AUTH_*` set but e.g. an unreadable key dir, the server logs `ERROR ... SSO is configured but failed to bootstrap` and exits non-zero instead of coming up legacy-only. ## Verification - `cargo test --bin mokosh-server sso_is_configured_tracks_env_presence`: 1 passed. - `cargo fmt --all --check` clean; `cargo clippy --bin mokosh-server` clean.

nrupard added 1 commit

2026-06-13 20:18:35 +02:00

fix(startup): fail loud when configured SSO bootstrap fails

E2E / Playwright against staging (pull_request) Failing after 44s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / fmt + clippy + compile + tests (pull_request) Failing after 3m47s

Details

d79ab987bc

try_bootstrap_sso collapsed two outcomes into one Err that main treated identically: SSO env not set (a legitimate legacy-only deployment) and SSO configured but failed to bootstrap (invalid config, or the auth migrations / key load failing). Both logged a single WARN and ran legacy-only, so a configured deployment whose SSO bootstrap broke silently lost its OIDC / at+jwt verification path with no loud signal - the same silent-degrade class PMS-286 fixed for the PSA migrations, one subsystem over.

Split the outcomes: SSO is "configured" when any of the required MOKOSH_AUTH_* env vars is set. If none are set, return SsoSetup::NotConfigured and run legacy-only (WARN, unchanged). If SSO is configured but from_env or bootstrap fails, return Err; main logs at ERROR and returns it so the process exits non-zero, mirroring PMS-286. No new env var; the legacy-only path (no MOKOSH_AUTH_*) is unchanged.

A unit test pins the intent detector (none set => not configured; any set => configured); the fatal-startup behaviour is documented as a manual repro (main() is not unit-testable, same as PMS-286).

#PMS-289