fix e2e test issues

Author: scottgerring

docker-compose.yml

@@ -463,6 +463,13 @@ services:
 
       # External service configuration
       CATALOGUE_BASE_URL: http://sticker-catalogue:8080
+
+      # OAuth/JWT configuration
+      # OAUTH_ISSUER: The issuer claim expected in JWT tokens (matches what user-management sets)
+      # Note: OpenIddict adds trailing slash to issuer, so we must include it here
+      # OAUTH_JWKS_URL: Internal Docker network URL to fetch JWKS for token validation
+      OAUTH_ISSUER: ${DEPLOYMENT_HOST_URL}/
+      OAUTH_JWKS_URL: http://user-management:8080/.well-known/jwks
     healthcheck:
       test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
       interval: 1s

sticker-award/infra/aws/lib/api.ts

@@ -86,6 +86,7 @@ export class Api extends Construct {
         MESSAGING_PROVIDER: "aws",
         CATALOGUE_BASE_URL: `https://${props.serviceProps.cloudfrontDistribution.distributionDomainName}`,
         USER_REGISTERED_QUEUE_URL: userRegisteredQueue.queueUrl,
+        OAUTH_ISSUER: `https://${props.serviceProps.cloudfrontDistribution.distributionDomainName}`,
         ...props.serviceProps.messagingConfiguration.asEnvironmentVariables(),
       },
       secrets: secrets,

sticker-award/internal/api/middleware/jwt.go

@@ -40,7 +40,7 @@ func NewJWTValidator(cfg *config.AuthConfig) (*JWTValidator, error) {
 	ctx, cancel := context.WithCancel(context.Background())
 
 	// Create JWKS keyfunc with background refresh
-	jwks, err := keyfunc.NewDefaultCtx(ctx, []string{cfg.JWKSUrl})
+	jwks, err := keyfunc.NewDefaultCtx(ctx, []string{cfg.JWKSUrl()})
 	if err != nil {
 		cancel()
 		return nil, err

sticker-award/internal/config/config.go

@@ -37,11 +37,19 @@ type Config struct {
 
 // AuthConfig holds JWT authentication configuration
 type AuthConfig struct {
-	JWKSUrl   string `mapstructure:"jwks_url"`
 	Issuer    string `mapstructure:"issuer"`
+	JwksUrl   string `mapstructure:"jwks_url"`
 	ClockSkew int    `mapstructure:"clock_skew"`
 }
 
+// JWKSUrl returns the JWKS URL - uses explicit jwks_url if set, otherwise derives from issuer
+func (a *AuthConfig) JWKSUrl() string {
+	if a.JwksUrl != "" {
+		return a.JwksUrl
+	}
+	return a.Issuer + "/.well-known/jwks"
+}
+
 // ServerConfig holds HTTP server configuration
 type ServerConfig struct {
 	Port string `mapstructure:"port"`
@@ -229,14 +237,14 @@ func setDefaults() {
 	viper.SetDefault("logging.level", "info")
 	viper.SetDefault("logging.format", "json")
 
-	// Auth defaults
-	viper.SetDefault("auth.jwks_url", "http://user-management:8080/.well-known/jwks")
+	// Auth defaults - JWKS URL can be set separately from issuer for Docker networking
 	viper.SetDefault("auth.issuer", "http://user-management:8080")
+	viper.SetDefault("auth.jwks_url", "") // Empty means derive from issuer
 	viper.SetDefault("auth.clock_skew", 30)
 
 	// Explicit env var bindings for auth config
-	_ = viper.BindEnv("auth.jwks_url", "JWKS_URI")
 	_ = viper.BindEnv("auth.issuer", "OAUTH_ISSUER")
+	_ = viper.BindEnv("auth.jwks_url", "OAUTH_JWKS_URL")
 }
 
 // ConnectionString returns the database connection string

sticker-catalogue/infra/aws/lib/api.ts

@@ -77,6 +77,7 @@ export class Api extends Construct {
         QUARKUS_DATASOURCE_JDBC_ACQUISITION_TIMEOUT: "30S",
         QUARKUS_S3_PATH_STYLE_ACCESS: "true",
         STICKER_IMAGES_BUCKET: props.stickerImagesBucket.bucketName,
+        OAUTH_ISSUER: `https://${props.serviceProps.cloudfrontDistribution.distributionDomainName}`,
         ...props.serviceProps.messagingProps.asEnvironmentVariables(),
       },
       secrets: secrets,

sticker-catalogue/src/main/resources/application.properties

@@ -32,9 +32,9 @@ MESSAGING_PROVIDER=kafka
 quarkus.eventbridge.aws.region=${AWS_REGION:us-east-1}
 quarkus.eventbridge.aws.credentials.type=default
 
-# JWT Configuration
+# JWT Configuration - JWKS URL derived from issuer
 mp.jwt.verify.issuer=${OAUTH_ISSUER:http://user-management:8080}
-mp.jwt.verify.publickey.location=${JWKS_URI:http://user-management:8080/.well-known/jwks}
+mp.jwt.verify.publickey.location=${OAUTH_ISSUER:http://user-management:8080}/.well-known/jwks
 smallrye.jwt.clock.skew=30
 
 # Dev profile JWT overrides

user-management/src/Stickerlandia.UserManagement.Auth/AuthServiceExtensions.cs

@@ -51,6 +51,12 @@ public static IServiceCollection AddCoreAuthentication(this IServiceCollection s
                 options.AddDevelopmentEncryptionCertificate()
                     .AddDevelopmentSigningCertificate();
 
+                // Disable access token encryption to allow external services to validate tokens.
+                // This makes tokens transparent (signed JWTs) instead of encrypted JWEs.
+                // Required for services like sticker-award and sticker-catalogue that validate
+                // tokens using the JWKS endpoint.
+                options.DisableAccessTokenEncryption();
+
                 // Register the ASP.NET Core host and configure the ASP.NET Core options.
                 if (disableSsl)
                     options.UseAspNetCore()