Skip to content

ES-2673 Conformance test fixes #2786

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Md-Humair-KK wants to merge 4 commits into
base: develop-go
Choose a base branch
from
Open

ES-2673 Conformance test fixes #2786

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
72ce5d3
conformance test fixes
Md-Humair-KK Nov 3, 2026
68bde63
code rabbit fixes
Md-Humair-KK Nov 4, 2026
00fc35e
fix: align map literal spacing to satisfy gofmt
Md-Humair-KK Nov 4, 2026
a48624f
fix: apply CodeRabbit review comments (round 2)
Md-Humair-KK Nov 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
192 changes: 101 additions & 91 deletions api-test/data/config/config.mock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,92 +1,102 @@
{
"_comment": [
"mock plugin — the reference run. Its identity and login are synthetic seed",
"data, so they are committed here rather than kept in config.local.json.",
"Run: ./run-all.sh -c data/config/config.mock.json",
"",
"Two conformance plans run back to back here, each with its own client/jwks",
"file (both gitignored — see conformance-suite-private/). The fapi2 entry pins",
"profile=full, which is also the default, so narrowing run.profile to smoke",
"cannot send it looking for a curated list that does not ship. api and",
"e2e still run once, and everything lands in one report. To run only one of",
"them: ./run-all.sh -c data/config/config.mock.json --check to see the order, then drop the",
"entry you do not want (or point both at the same config_file if the same",
"clients are registered for both profiles).",
"",
"api.flow_client_id is a client id registered on YOUR deployment, so it is left",
"empty here — the authorize-negative scenarios report ENV_NOT_READY until you",
"set it in config.local.json or via FLOW_CLIENT_ID.",
"",
"Also required from config.local.json or the environment, because this file",
"selects all three surfaces: esignet.base_url (api + e2e) and",
"keycloak.token_url + keycloak.client_secret (e2e registers a throwaway",
"client before it runs). Without them the run stops at config validation."
],
"conformance": {
"base_url": "https://localhost.emobix.co.uk:8443",
"tls_verify": false
},
"plans": [
{
"name": "oidcc-test-plan",
"variant": {
"client_auth_type": "private_key_jwt",
"response_type": "code",
"response_mode": "default",
"client_registration": "static_client"
},
"config_file": "conformance-suite-private/esignet-config.json"
},
{
"name": "fapi2-security-profile-final-test-plan",
"variant": {
"client_auth_type": "private_key_jwt",
"sender_constrain": "dpop",
"authorization_request_type": "simple",
"openid": "openid_connect",
"fapi_profile": "plain_fapi"
},
"config_file": "conformance-suite-private/esignet-fapi2-config.json",
"profile": "full"
}
],
"keycloak": {
"client_id": "mosip-pms-client"
},
"esignet": {
"provider": "mock",
"auth_factor": "otp",
"identity": {
"individual_id": "8267411574",
"id_type": "uin"
},
"credentials": {
"username": "decl-user-1",
"password": "Mosip@123",
"biometric": "mock-biometric-capture-e2e"
},
"otp": {
"source": "static",
"value": "111111"
}
},
"api": {
"tags": "",
"flow_client_id": ""
},
"e2e": {
"spec": "data/scenarios/e2e-scenarios.json",
"auth_factors": [],
"include": [],
"exclude": []
},
"run": {
"surfaces": [
"conformance",
"api",
"e2e"
],
"profile": "full",
"debug_show_secrets": false
}
{
"_comment": [
"mock plugin — the reference run. Its identity and login are synthetic seed",
"data, so they are committed here rather than kept in config.local.json.",
"Run: ./run-all.sh -c data/config/config.mock.json",
"",
"Two conformance plans run back to back here, each with its own client/jwks",
"file (both gitignored — see conformance-suite-private/). The fapi2 entry pins",
"profile=full, which is also the default, so narrowing run.profile to smoke",
"cannot send it looking for a curated list that does not ship. api and",
"e2e still run once, and everything lands in one report. To run only one of",
"them: ./run-all.sh -c data/config/config.mock.json --check to see the order, then drop the",
"entry you do not want (or point both at the same config_file if the same",
"clients are registered for both profiles).",
"",
"api.flow_client_id is a client id registered on YOUR deployment, so it is left",
"empty here — the authorize-negative scenarios report ENV_NOT_READY until you",
"set it in config.local.json or via FLOW_CLIENT_ID.",
"",
"Also required from config.local.json or the environment, because this file",
"selects all three surfaces: esignet.base_url (api + e2e) and",
"keycloak.token_url + keycloak.client_secret (e2e registers a throwaway",
"client before it runs). Without them the run stops at config validation."
],
"conformance": {
"base_url": "https://localhost.emobix.co.uk:8443",
"tls_verify": false
},
"plans": [
{
"name": "fapi2-security-profile-final-test-plan",
"variant": {
"client_auth_type": "private_key_jwt",
"sender_constrain": "dpop",
"authorization_request_type": "simple",
"openid": "openid_connect",
"fapi_profile": "plain_fapi"
},
"config_file": "conformance-suite-private/esignet-fapi2-config.json",
"profile": "full"
},
{
"name": "oidcc-test-plan",
"variant": {
"client_auth_type": "private_key_jwt",
"response_type": "code",
"response_mode": "default",
"client_registration": "static_client"
},
"config_file": "conformance-suite-private/esignet-config.json",
"skip": [
"oidcc-refresh-token",
"oidcc-ensure-request-object-with-redirect-uri"
],
"known_issues": [
{
"module": "oidcc-discovery-endpoint-verification",
"reason": "Only PS256 key registered on this deployment; OIDC Core §3.1.3.7 mandates RS256 in id_token_signing_alg_values_supported. Fix: register an RS256 key in the crypto store."
}
]
}
],
"keycloak": {
"client_id": "mosip-pms-client"
},
"esignet": {
"provider": "mock",
"auth_factor": "otp",
"identity": {
"individual_id": "1774231388",
"id_type": "uin"
},
"credentials": {
"username": "decl-user-1",
"password": "Mosip@123",
"biometric": "mock-biometric-capture-e2e"
},
"otp": {
"source": "static",
"value": "111111"
}
},
"api": {
"tags": "",
"flow_client_id": ""
},
"e2e": {
"spec": "data/scenarios/e2e-scenarios.json",
"auth_factors": [],
"include": [],
"exclude": []
},
"run": {
"surfaces": [
"conformance",
"api",
"e2e"
],
"profile": "full",
"debug_show_secrets": false
}
}
13 changes: 13 additions & 0 deletions api-test/internal/conformance/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,19 @@ type DeliverResult struct {
var implicitSubmitRe = regexp.MustCompile(`"implicitSubmitUrl"\s*:\s*"([^"]+)"`)
var implicitPathRe = regexp.MustCompile(`https?://[^"'\s]+/implicit/[^"'\s]+`)

// Continue sends the operator "Continue" signal to a test that is paused waiting for an operator action
// (e.g. oidcc-server-rotate-keys waits at CONFIGURED before the key rotation step).
func (c *Client) Continue(ctx context.Context, testID string) error {
body, status, err := c.do(ctx, "suite /api/runner (continue)", http.MethodPost, "/api/runner/"+testID, []byte(`{"action":"continue"}`), "application/json")
if err != nil {
return err
}
if status != http.StatusOK && status != http.StatusNoContent {
return fmt.Errorf("continue HTTP %d: %s", status, snippet(body))
}
return nil
}

// DeliverCallback performs the suite's two-request hand-off: GET the redirect_uri, then POST implicitSubmitUrl.
func (c *Client) DeliverCallback(ctx context.Context, redirectURI string) (DeliverResult, error) {
var res DeliverResult
Expand Down
Loading
Loading