tests.yml

name: Tests

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: tests-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  unit-tests:
    name: Unit & Integration Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4

      - name: Run tests
        run: ./gradlew test

      - name: Upload test report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: gradle-test-report
          path: build/reports/tests/test/

  playwright-tests:
    name: Playwright E2E Tests
    runs-on: ubuntu-latest
    services:
      mariadb:
        image: mariadb:12.2
        env:
          MARIADB_DATABASE: springuser
          MARIADB_USER: springuser
          MARIADB_PASSWORD: springuser
          MARIADB_ROOT_PASSWORD: rootpassword
        ports:
          - 3306:3306
        options: >-
          --health-cmd="healthcheck.sh --connect --innodb_initialized"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
      mailpit:
        # Mail catcher for the step-up run's passkey-registration notification assertion. Compose is
        # disabled in CI (SPRING_DOCKER_COMPOSE_ENABLED=false), so the compose.dev.yaml Mailpit is
        # replaced by this service container; the step-up-e2e profile points spring.mail at localhost:1025.
        image: axllent/mailpit:v1.30.7
        env:
          MP_SMTP_AUTH_ACCEPT_ANY: "1"
          MP_SMTP_AUTH_ALLOW_INSECURE: "1"
        ports:
          - 1025:1025
          - 8025:8025
        options: >-
          --health-cmd="/mailpit readyz"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    env:
      # The MariaDB service container replaces Spring Boot's Docker Compose integration
      SPRING_DOCKER_COMPOSE_ENABLED: "false"
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4

      - name: Build application
        run: ./gradlew assemble

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: playwright/package-lock.json

      - name: Install Playwright dependencies
        working-directory: playwright
        run: |
          npm ci
          npx playwright install --with-deps chromium

      - name: Run E2E tests (MFA disabled)
        working-directory: playwright
        env:
          APP_PROFILES: playwright-test
        run: npx playwright test --project=chromium

      - name: Run E2E tests (MFA enabled)
        working-directory: playwright
        env:
          APP_PROFILES: playwright-test,mfa
        run: npx playwright test --project=chromium-mfa

      - name: Run E2E tests (step-up enabled)
        working-directory: playwright
        # `local` activates the dev-login controller (@Profile("local")) the factorless-session case needs;
        # application-local.yml is absent in CI so it adds no overrides, and playwright-test pins rpId=localhost.
        env:
          APP_PROFILES: local,playwright-test,step-up,step-up-e2e
        run: npx playwright test --project=chromium-step-up

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report
          path: playwright/reports/

  playwright-tests-oidc:
    name: Playwright OIDC Step-Up Tests
    # Heavier than the other jobs (two app boots plus a Keycloak container), so it runs only on pushes
    # to main, not on every pull request. The `push` trigger is already scoped to main; the ref check
    # keeps it correct if more push branches are added later.
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    services:
      mariadb:
        image: mariadb:12.2
        env:
          MARIADB_DATABASE: springuser
          MARIADB_USER: springuser
          MARIADB_PASSWORD: springuser
          MARIADB_ROOT_PASSWORD: rootpassword
        ports:
          - 3306:3306
        options: >-
          --health-cmd="healthcheck.sh --connect --innodb_initialized"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
      mailpit:
        # The first-passkey-enrollment test registers a passkey, and user.webauthn.notifyOnRegistration
        # is on by default, so the app sends a notification email. Without a relay it would attempt a real
        # outbound SMTP connection to the base config's SES host on every run; catch it in Mailpit instead
        # (the mail env below points spring.mail here). The test does not assert the mail; this just keeps
        # the send local.
        image: axllent/mailpit:v1.30.7
        env:
          MP_SMTP_AUTH_ACCEPT_ANY: "1"
          MP_SMTP_AUTH_ALLOW_INSECURE: "1"
        ports:
          - 1025:1025
          - 8025:8025
        options: >-
          --health-cmd="/mailpit readyz"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    env:
      # The MariaDB service container replaces Spring Boot's Docker Compose integration.
      SPRING_DOCKER_COMPOSE_ENABLED: "false"
      # Point mail at the Mailpit service container so passkey-registration notifications stay local
      # (mirrors docker-compose-keycloak.yml's SPRING_MAIL_* for the same plain-SMTP, no-auth setup).
      SPRING_MAIL_HOST: localhost
      SPRING_MAIL_PORT: "1025"
      SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH: "false"
      SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE: "false"
      SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_REQUIRED: "false"
      # Tell Playwright's globalSetup to start a Keycloak provider (via docker) for this run.
      KEYCLOAK_E2E: "1"
      # OIDC client + provider config for the app under test. The app runs on the runner host (started by
      # Playwright's webServer), not inside a compose network, so every provider URI points at the host's
      # published Keycloak port 8180 rather than the compose-network keycloak:8080. Client id/secret match
      # keycloak/realm/realm-export.json (dev-only credentials committed to the repo).
      DS_SPRING_USER_KEYCLOAK_CLIENT_ID: ds-spring-user-framework-demo
      DS_SPRING_USER_KEYCLOAK_CLIENT_SECRET: FTp1j7sGvc4g3MFdghEX4n7RPhbu86PQ
      DS_SPRING_USER_KEYCLOAK_PROVIDER_AUTHORIZATION_URI: http://localhost:8180/realms/demo/protocol/openid-connect/auth
      DS_SPRING_USER_KEYCLOAK_PROVIDER_TOKEN_URI: http://localhost:8180/realms/demo/protocol/openid-connect/token
      DS_SPRING_USER_KEYCLOAK_PROVIDER_USER_INFO_URI: http://localhost:8180/realms/demo/protocol/openid-connect/userinfo
      DS_SPRING_USER_KEYCLOAK_PROVIDER_JWK_SET_URI: http://localhost:8180/realms/demo/protocol/openid-connect/certs
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4

      - name: Build application
        run: ./gradlew assemble

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: playwright/package-lock.json

      - name: Install Playwright dependencies
        working-directory: playwright
        run: |
          npm ci
          npx playwright install --with-deps chromium

      # Two boots: the allowInitialPasswordSetWithoutStepUp flag is boot-time config, so each branch of
      # the OIDC fallback needs its own app start. globalSetup brings Keycloak up for each run.
      - name: Run E2E (OIDC step-up, initial password allowed)
        working-directory: playwright
        env:
          APP_PROFILES: docker-keycloak,playwright-test,step-up
          STEP_UP_OIDC_ALLOW_INITIAL: "true"
        run: npx playwright test --project=chromium-step-up-oidc

      - name: Run E2E (OIDC step-up, initial password denied)
        working-directory: playwright
        env:
          APP_PROFILES: docker-keycloak,playwright-test,step-up
          STEP_UP_OIDC_ALLOW_INITIAL: "false"
          # Override playwright-test's flag (true) so the denial branch is exercised.
          SPRING_APPLICATION_JSON: '{"user":{"security":{"allowInitialPasswordSetWithoutStepUp":false}}}'
        run: npx playwright test --project=chromium-step-up-oidc

      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: playwright-report-oidc
          path: playwright/reports/