feat/pms-271-e2e-staging-prod-secrets #205

Merged

nrupard merged 4 commits from feat/pms-271-e2e-staging-prod-secrets into main

2026-06-13 17:32:07 +02:00

nrupard commented

2026-06-13 17:32:00 +02:00

Owner

No description provided.

nrupard added 4 commits

2026-06-13 17:32:00 +02:00

fix(e2e): keep bare E2E_* as staging, add only E2E_PRODUCTION_* d8e8eb04aa

Revise the PMS-271 secret split so the existing bare `E2E_*` Forgejo Actions secrets remain the staging set unchanged, instead of renaming every var to `E2E_STAGING_*`. A production target is added as a parallel `E2E_PRODUCTION_*` set only.

The job env: selection becomes `inputs.environment == 'production' && secrets.E2E_PRODUCTION_<NAME> || secrets.E2E_<NAME>`, so push / pull_request still resolve to the bare staging secrets and a production dispatch picks the override. No mass rename and no deletion of the bare secrets is required; provisioning is additive (only the production set is new).

Docs updated to match (README required-config note, provisioning step 5, CI section; .env.example header).

#PMS-271

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Revert "fix(e2e): keep bare E2E_* as staging, add only E2E_PRODUCTION_*" 222c6496ee

This reverts commit d8e8eb04aa.

refactor(e2e): name CI secrets after deployment variables fb735aac9e

Rename the workflow's secret references for the three E2E vars that have a real deployment equivalent, verified against the mokosh infra repo (server/{c-01 staging, nc-01 production}), so the secret names match what the values are actually called in the environment:

- E2E_OIDC_CLIENT_ID -> a single shared `MOKOSH_OIDC_CLIENT_ID`. The mokosh-apps public PKCE client is seeded by bunyip-api with the same id (b0000000-0000-4000-8000-000000000002) in both environments and read by the SPA as MOKOSH_OIDC_CLIENT_ID, so it needs no staging/production split.
- E2E_OIDC_REDIRECT_URI -> `MOKOSH_APPS_REDIRECT_URIS_STAGING` / `_PRODUCTION` (bunyip-api MOKOSH_APPS_REDIRECT_URIS; msp.a8n.systems vs msp.psa.systems).
- E2E_OP_BASE_URL -> `OIDC_ISSUER_STAGING` / `OIDC_ISSUER_PRODUCTION` (mokosh-server OIDC_ISSUER; the bunyip OP apex api.a8n.systems vs api.psa.systems).

The remaining vars are test-only with no deployment variable to match (the SPA host is a Traefik Host() rule, and the E2E account / tenant / TOTP / foreign-company values exist only for the suite), so they keep the E2E_STAGING_* / E2E_PRODUCTION_* names. Forgejo must hold both environments at once, so per-env secrets keep a _STAGING/_PRODUCTION suffix on the deployment base name; the shared client id has no suffix.

The left side of each env: line stays E2E_*, so env.ts and the gate scripts are unchanged. Docs (README required-config table, provisioning step 5, CI section; .env.example header) updated to spell out the mapping.

#PMS-271

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix(e2e): correct OIDC redirect_uri default to /auth/callback

Create release / Create release from merged PR (pull_request) Has been skipped

Details

E2E / Playwright against staging (pull_request) Failing after 23s

Details

Check / fmt + clippy + compile + tests (pull_request) Successful in 2m44s

Details

5807db81d3

The .env.example default was `https://msp.a8n.systems/oauth2/callback`, but the mokosh-apps public PKCE client registers `/auth/callback` (the value bunyip-api seeds as MOKOSH_APPS_REDIRECT_URIS). A mismatched redirect_uri makes the OP return invalid_redirect_uri at /oauth2/authorize. Point the example at the registered path and note where the authoritative value comes from.

#PMS-271

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>