test: dial the configured grpc endpoint and seed FGA before public checks - #26
Merged
Conversation
…ecks Two defects that let integration tests pass without testing anything. The grpc subtests never read AUTHORIZER_TEST_GRPC -- neither protocolClient nor adminClient passed a grpc endpoint, so the SDK derived it from AUTHORIZER_TEST_URL's host plus the DEFAULT grpc port. A suite pointed at a container on a non-default port still sent every grpc call to whatever was listening on 9091, silently testing a different server. Locally that meant an unrelated dev server, which surfaced as "invalid credentials" on grpc login while graphql and rest passed. TestCheckPermissions and TestListPermissions depended on test ordering: TestAdminFgaResetLast wipes the FGA store, and Go runs tests in declaration order, so by the time the public FGA tests ran there was no authorization model. They took the "authorization check failed" branch of skipIfFgaUnavailable and skipped -- so in a full-suite run those two never executed at all, and only passed when run in isolation. They now seed the model they check against. A server with no FGA engine still skips, which is the case that guard is actually for.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two defects that let integration tests pass without testing anything.
grpc subtests dialed the wrong server
Neither
protocolClientnoradminClientpassed a grpc endpoint, and the suite never readAUTHORIZER_TEST_GRPC. The SDK therefore derived the endpoint fromAUTHORIZER_TEST_URL's host plus the default grpc port — so a suite pointed at a container on a non-default port still sent every grpc call to whatever happened to be listening on 9091.Locally that was an unrelated dev server, which showed up as:
The signup had gone to one server and the login to another. Worse than the failure is the inverse: when the two servers happen to be compatible, the grpc assertions pass while testing the wrong process entirely.
Public FGA tests never ran
TestCheckPermissionsandTestListPermissionsdepended on declaration order.TestAdminFgaResetLastwipes the FGA store, and it is declared earlier, so the public tests found no authorization model, hit theauthorization check failedbranch ofskipIfFgaUnavailable, and skipped. They only ever passed when run in isolation.They now seed the model they check against. A server with no FGA engine at all still skips — that is the case the guard is genuinely for.
Verification
Full suite against
quay.io/authorizer/authorizer:2.4.0-rc.13: all tests pass, andTestCheckPermissions/TestListPermissionsnow report PASS rather than SKIP in a full run.