chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 11:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
57886f9268
prole/pg-knoe-auth/test/integration
History
chrisfu 57886f9268 feat(pg-knoe-auth): import upstream PostgreSQL JWT auth extension; compile in knoe-db image 
- Copy pg-knoe-auth/ wholesale from upstream/knoe-db/20260523 (Task 1 of
  docs/plans/junie/upstream-knoe-db-20260523-integration.md).
- Extension: PG18 OAUTHBEARER JWT validator using libcurl + OpenSSL RS256.
- knoe-db/Dockerfile: add libcurl4-openssl-dev to dev deps; COPY src/ and
  build with make USE_PGXS=1 install after tds_fdw.
- NOT enabled in the default database build (absent from 20_create_extensions.sh).
  To enable: CREATE EXTENSION pg_knoe_auth; (requires pg_hba.conf oauth_issuer).

Closes Task 1 of upstream-knoe-db-20260523-integration.md.
2026-05-23 21:52:06 -07:00
..
expected feat(pg-knoe-auth): import upstream PostgreSQL JWT auth extension; compile in knoe-db image 2026-05-23 21:52:06 -07:00
sql feat(pg-knoe-auth): import upstream PostgreSQL JWT auth extension; compile in knoe-db image 2026-05-23 21:52:06 -07:00
Makefile feat(pg-knoe-auth): import upstream PostgreSQL JWT auth extension; compile in knoe-db image 2026-05-23 21:52:06 -07:00
mock_jwks.py feat(pg-knoe-auth): import upstream PostgreSQL JWT auth extension; compile in knoe-db image 2026-05-23 21:52:06 -07:00
README.md feat(pg-knoe-auth): import upstream PostgreSQL JWT auth extension; compile in knoe-db image 2026-05-23 21:52:06 -07:00

README.md

pg-knoe-auth integration tests

These are pg_regress-style SQL tests that run against a real PG18 instance with pg_knoe_auth.so loaded and a mock JWKS server.

Prerequisites

  • PG18 with pg_knoe_auth installed (make USE_PGXS=1 install)
  • postgresql.conf includes: 
    shared_preload_libraries = 'pg_knoe_auth'
pg_knoe_auth.audience    = 'pg.0.knoe.dev'
pg_knoe_auth.role_claim  = 'preferred_username'
  • pg_hba.conf includes an oauth line for the test role
  • Mock JWKS server running on http://localhost:9999 (see mock_jwks.py)
  • pg_knoe_auth.issuer set to http://localhost:9999 in postgresql.conf

Running

cd pg-knoe-auth/test/integration
# Start mock JWKS server (generates RSA key, serves /jwks.json)
python3 mock_jwks.py &
MOCK_PID=$!

make installcheck

kill $MOCK_PID

Test cases

Test file What it verifies
valid_token.sql Properly signed JWT authenticates to correct role
expired_token.sql Expired JWT is rejected
wrong_iss.sql Wrong issuer is rejected
wrong_aud_string.sql Wrong string aud is rejected
wrong_aud_array.sql Wrong array aud is rejected
tampered_sig.sql Tampered signature is rejected
kid_unknown.sql Unknown kid is rejected
jwks_unreachable_first_call.sql JWKS 5xx with no cache → reject
jwks_unreachable_after_cache.sql JWKS 5xx with cached key → accept (stale fallback)