# pg-knoe-auth integration tests

These are `pg_regress`-style SQL tests that run against a real PG18 instance
with `pg_knoe_auth.so` loaded and a mock JWKS server.

## Prerequisites

- PG18 with `pg_knoe_auth` installed (`make USE_PGXS=1 install`)
- `postgresql.conf` includes:
  ```
  shared_preload_libraries = 'pg_knoe_auth'
  pg_knoe_auth.audience    = 'pg.0.knoe.dev'
  pg_knoe_auth.role_claim  = 'preferred_username'
  ```
- `pg_hba.conf` includes an `oauth` line for the test role
- Mock JWKS server running on `http://localhost:9999` (see `mock_jwks.py`)
- `pg_knoe_auth.issuer` set to `http://localhost:9999` in `postgresql.conf`

## Running

```bash
cd pg-knoe-auth/test/integration
# Start mock JWKS server (generates RSA key, serves /jwks.json)
python3 mock_jwks.py &
MOCK_PID=$!

make installcheck

kill $MOCK_PID
```

## Test cases

| Test file | What it verifies |
|---|---|
| `valid_token.sql` | Properly signed JWT authenticates to correct role |
| `expired_token.sql` | Expired JWT is rejected |
| `wrong_iss.sql` | Wrong issuer is rejected |
| `wrong_aud_string.sql` | Wrong string aud is rejected |
| `wrong_aud_array.sql` | Wrong array aud is rejected |
| `tampered_sig.sql` | Tampered signature is rejected |
| `kid_unknown.sql` | Unknown kid is rejected |
| `jwks_unreachable_first_call.sql` | JWKS 5xx with no cache → reject |
| `jwks_unreachable_after_cache.sql` | JWKS 5xx with cached key → accept (stale fallback) |