KofTwentyTwo/carl
Archived
2
0 Fork 0
Code Issues 34 Actions Packages Projects Releases Wiki Activity

No test covers an OIDC authorization-code sign-in; fixtures mint JWTs directly #20

New Issue
Open
opened 2026-10-01 22:50:51 +00:00 by KofTwentyTwo · 0 comments
KofTwentyTwo commented 2026-10-01 22:50:51 +00:00 (Migrated from github.com)
Copy link
Copy source

Summary

Browser fixtures sign in through a loopback HTML page that picks alice and mints an RS256 JWT (scripts/e2e/NativeVisualIdentity.java:197-201); tests validate the bearer and JWKS path only (CarlDashboardScopeEpochNativeTest.java:114, CarlTaxPlanningNativeTest.java:78). Alice and Bob are inserted by scripts/e2e/CarlPackagedVisualFixture.java:80-81. No test or script performs an authorization-code flow against an OIDC provider, and config/agent.properties:16 runs qqq.auth-mode=local. Authentik appears only in design documents.

This is a prerequisite for #4. The foundation's own browser gate already runs a local HTTPS OIDC issuer; reuse it so the full redirect, callback and session bootstrap are exercised in Carl's suite.

Priority rationale

P2: the production sign-in path is untested in this repository.

Filed from the 2026-10-01 real-versus-fake audit of Carl (branch feature/cicd-liquibase-gitops, HEAD 5414d7a, main 1b334d1). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.

## Summary Browser fixtures sign in through a loopback HTML page that picks `alice` and mints an RS256 JWT (`scripts/e2e/NativeVisualIdentity.java:197-201`); tests validate the bearer and JWKS path only (`CarlDashboardScopeEpochNativeTest.java:114`, `CarlTaxPlanningNativeTest.java:78`). Alice and Bob are inserted by `scripts/e2e/CarlPackagedVisualFixture.java:80-81`. No test or script performs an authorization-code flow against an OIDC provider, and `config/agent.properties:16` runs `qqq.auth-mode=local`. Authentik appears only in design documents. This is a prerequisite for #4. The foundation's own browser gate already runs a local HTTPS OIDC issuer; reuse it so the full redirect, callback and session bootstrap are exercised in Carl's suite. ## Priority rationale P2: the production sign-in path is untested in this repository. --- Filed from the 2026-10-01 real-versus-fake audit of Carl (branch `feature/cicd-liquibase-gitops`, HEAD `5414d7a`, main `1b334d1`). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.
This repo is archived. You cannot comment on issues.
No Branch/Tag Specified
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 audit-2026-10-01
Found by the October 1 2026 full codebase audit
 bug
Something isn't working
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 priority: P0
Critical: blocks release or is a correctness/security defect
 priority: P1
High: must fix before next release
 priority: P2
Medium: should fix soon
 priority: P3
Low: cleanup or nice to have
 question
Further information is requested
 tech-debt
Bloat, dead code, or housekeeping
 wontfix
This will not be worked on
No labels audit-2026-10-01 enhancement priority: P2
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/carl#20