mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 13:34:31 +00:00
57886f9268
- Copy pg-knoe-auth/ wholesale from upstream/knoe-db/20260523 (Task 1 of docs/plans/junie/upstream-knoe-db-20260523-integration.md). - Extension: PG18 OAUTHBEARER JWT validator using libcurl + OpenSSL RS256. - knoe-db/Dockerfile: add libcurl4-openssl-dev to dev deps; COPY src/ and build with make USE_PGXS=1 install after tds_fdw. - NOT enabled in the default database build (absent from 20_create_extensions.sh). To enable: CREATE EXTENSION pg_knoe_auth; (requires pg_hba.conf oauth_issuer). Closes Task 1 of upstream-knoe-db-20260523-integration.md.
45 lines
1.4 KiB
Markdown
45 lines
1.4 KiB
Markdown
# pg-knoe-auth integration tests
|
|
|
|
These are `pg_regress`-style SQL tests that run against a real PG18 instance
|
|
with `pg_knoe_auth.so` loaded and a mock JWKS server.
|
|
|
|
## Prerequisites
|
|
|
|
- PG18 with `pg_knoe_auth` installed (`make USE_PGXS=1 install`)
|
|
- `postgresql.conf` includes:
|
|
```
|
|
shared_preload_libraries = 'pg_knoe_auth'
|
|
pg_knoe_auth.audience = 'pg.0.knoe.dev'
|
|
pg_knoe_auth.role_claim = 'preferred_username'
|
|
```
|
|
- `pg_hba.conf` includes an `oauth` line for the test role
|
|
- Mock JWKS server running on `http://localhost:9999` (see `mock_jwks.py`)
|
|
- `pg_knoe_auth.issuer` set to `http://localhost:9999` in `postgresql.conf`
|
|
|
|
## Running
|
|
|
|
```bash
|
|
cd pg-knoe-auth/test/integration
|
|
# Start mock JWKS server (generates RSA key, serves /jwks.json)
|
|
python3 mock_jwks.py &
|
|
MOCK_PID=$!
|
|
|
|
make installcheck
|
|
|
|
kill $MOCK_PID
|
|
```
|
|
|
|
## Test cases
|
|
|
|
| Test file | What it verifies |
|
|
|---|---|
|
|
| `valid_token.sql` | Properly signed JWT authenticates to correct role |
|
|
| `expired_token.sql` | Expired JWT is rejected |
|
|
| `wrong_iss.sql` | Wrong issuer is rejected |
|
|
| `wrong_aud_string.sql` | Wrong string aud is rejected |
|
|
| `wrong_aud_array.sql` | Wrong array aud is rejected |
|
|
| `tampered_sig.sql` | Tampered signature is rejected |
|
|
| `kid_unknown.sql` | Unknown kid is rejected |
|
|
| `jwks_unreachable_first_call.sql` | JWKS 5xx with no cache → reject |
|
|
| `jwks_unreachable_after_cache.sql` | JWKS 5xx with cached key → accept (stale fallback) |
|