Remove unintentionally committed backend files and fix signer Playwright tests

Author: archbilesherman

web/package.json

@@ -17,7 +17,7 @@
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest",
     "test:e2e": "playwright test",
-    "test:e2e:signer": "playwright test tests/signer-certificates.e2e.ts --project=chromium --workers=1",
+    "test:e2e:signer": "playwright test --config=playwright.signer.config.ts --project=chromium --workers=1",
     "clean": "rm -rf .next dist coverage",
     "gen:api": "tsx scripts/gen-api.mts",
     "gen:api:check": "pnpm gen:api && git diff --quiet src/generated || (echo 'OpenAPI codegen drift — re-run pnpm gen:api' && exit 1)",

web/playwright.signer.config.ts

@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import { defineConfig, devices } from "@playwright/test";
+
+const port = Number(process.env.PORT ?? 3217);
+const baseURL = `http://localhost:${port}`;
+const sharedSecret = "test-secret-for-playwright-cookie-fixture-only-32chars";
+
+export default defineConfig({
+  testDir: "./tests",
+  testMatch: "signer-certificates.e2e.ts",
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: 1,
+  reporter: "line",
+  use: {
+    baseURL,
+    trace: "retain-on-failure",
+    // The signer suite installs deterministic Playwright routes. Blocking
+    // service workers ensures browser MSW cannot consume or bypass a request.
+    serviceWorkers: "block",
+  },
+  projects: [
+    {
+      name: "chromium",
+      use: { ...devices["Desktop Chrome"] },
+    },
+  ],
+  webServer: {
+    command: `corepack pnpm dev --port ${port}`,
+    url: baseURL,
+    reuseExistingServer: !process.env.CI,
+    timeout: 120_000,
+    env: {
+      PORT: String(port),
+      NEXT_PUBLIC_PORTAL_USE_MSW: "false",
+      CUSTOS_E2E_FAIL_ON_SIGNER_PROXY_REQUEST: "true",
+      NEXTAUTH_SECRET: sharedSecret,
+      NEXTAUTH_URL: baseURL,
+      OIDC_ISSUER_URL: "http://localhost:8081/realms/custos",
+      OIDC_CLIENT_ID: "playwright-cookie-fixture",
+      OIDC_CLIENT_SECRET: "playwright-cookie-fixture",
+    },
+  },
+});
+
+process.env.NEXTAUTH_SECRET = sharedSecret;

web/src/app/api/v1/[...path]/__tests__/route.test.ts

@@ -19,6 +19,7 @@ import { NextRequest } from "next/server";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { responseBodyForStatus } from "../proxy-response";
+import { pickBackendBearer } from "@/shared/auth/session";
 
 vi.mock("@/lib/env", () => ({
   serverEnv: {
@@ -41,6 +42,9 @@ const ctx = { params: Promise.resolve({ path: ["roles", "role-1", "privileges"]
 
 afterEach(() => {
   fetchMock.mockReset();
+  vi.mocked(pickBackendBearer).mockReturnValue("access-token-abc");
+  vi.unstubAllEnvs();
+  vi.restoreAllMocks();
 });
 
 describe("responseBodyForStatus", () => {
@@ -117,4 +121,65 @@ describe("api v1 proxy route", () => {
       "https://core.example.org/roles/role-1/privileges",
     );
   });
+
+  it("rejects unauthenticated requests before contacting an upstream", async () => {
+    vi.mocked(pickBackendBearer).mockReturnValueOnce(null);
+
+    const response = await GET(
+      new NextRequest("http://localhost:3000/api/v1/signer/admin/certificates"),
+      { params: Promise.resolve({ path: ["signer", "admin", "certificates"] }) },
+    );
+
+    expect(response.status).toBe(401);
+    expect(await response.json()).toEqual({
+      code: "missing_bearer",
+      message: "Not authenticated",
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("returns a sanitized 503 when the selected upstream is unavailable", async () => {
+    const consoleError = vi.spyOn(console, "error").mockImplementation(() => undefined);
+    fetchMock.mockRejectedValueOnce(new TypeError("fetch failed for secret upstream URL"));
+
+    const response = await GET(
+      new NextRequest("http://localhost:3000/api/v1/signer/admin/certificates?limit=20"),
+      { params: Promise.resolve({ path: ["signer", "admin", "certificates"] }) },
+    );
+
+    expect(response.status).toBe(503);
+    expect(await response.json()).toEqual({
+      code: "upstream_unavailable",
+      message: "Backend service is unavailable",
+    });
+    expect(consoleError).toHaveBeenCalledWith("API proxy upstream unavailable", {
+      service: "signer",
+      method: "GET",
+      path: "/api/v1/admin/certificates",
+    });
+    expect(JSON.stringify(consoleError.mock.calls)).not.toContain("access-token-abc");
+    expect(JSON.stringify(consoleError.mock.calls)).not.toContain("signer.example.org");
+    expect(JSON.stringify(consoleError.mock.calls)).not.toContain("secret upstream URL");
+  });
+
+  it("fails explicitly if a hermetic signer E2E request reaches the proxy", async () => {
+    vi.stubEnv("CUSTOS_E2E_FAIL_ON_SIGNER_PROXY_REQUEST", "true");
+    const consoleError = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    const response = await GET(
+      new NextRequest("http://localhost:3000/api/v1/signer/admin/certificates"),
+      { params: Promise.resolve({ path: ["signer", "admin", "certificates"] }) },
+    );
+
+    expect(response.status).toBe(500);
+    expect(await response.json()).toEqual({
+      code: "unexpected_signer_proxy_request",
+      message: "Signer E2E request escaped its Playwright route",
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(consoleError).toHaveBeenCalledWith(
+      "Unexpected signer proxy request during hermetic E2E",
+      { method: "GET", path: "/api/v1/signer/admin/certificates" },
+    );
+  });
 });

web/src/app/api/v1/[...path]/route.ts

@@ -27,6 +27,19 @@ type Context = { params: Promise<{ path: string[] }> };
 async function proxy(request: NextRequest, ctx: Context) {
   const { path } = await ctx.params;
   const isSigner = path[0] === "signer";
+  if (isSigner && process.env.CUSTOS_E2E_FAIL_ON_SIGNER_PROXY_REQUEST === "true") {
+    console.error("Unexpected signer proxy request during hermetic E2E", {
+      method: request.method,
+      path: request.nextUrl.pathname,
+    });
+    return NextResponse.json(
+      {
+        code: "unexpected_signer_proxy_request",
+        message: "Signer E2E request escaped its Playwright route",
+      },
+      { status: 500 },
+    );
+  }
   const upstreamBase = isSigner
     ? serverEnv.CUSTOS_SIGNER_API_BASE_URL
     : serverEnv.CUSTOS_CORE_API_BASE_URL;
@@ -53,12 +66,25 @@ async function proxy(request: NextRequest, ctx: Context) {
   const method = request.method;
   const body = method === "GET" || method === "HEAD" ? undefined : await request.text();
 
-  const upstream = await fetch(upstreamUrl, {
-    method,
-    headers,
-    body,
-    cache: "no-store",
-  });
+  let upstream: Response;
+  try {
+    upstream = await fetch(upstreamUrl, {
+      method,
+      headers,
+      body,
+      cache: "no-store",
+    });
+  } catch {
+    console.error("API proxy upstream unavailable", {
+      service: isSigner ? "signer" : "core",
+      method,
+      path: upstreamPath,
+    });
+    return NextResponse.json(
+      { code: "upstream_unavailable", message: "Backend service is unavailable" },
+      { status: 503 },
+    );
+  }
 
   const responseHeaders = new Headers();
   const upstreamType = upstream.headers.get("content-type");