Merge pull request #729 from authorizerdev/worktree-playground-e2e

test(e2e-playground): live-playground e2e suite for OIDC/SAML/SCIM/SSO/OAuth/MFA

Author: lakhansamani

.gitignore

@@ -16,6 +16,9 @@ test.db
 .yalc
 yalc.lock
 certs/
+# Test-only e2e-playground fixtures are intentionally checked in (docs/superpowers/plans/2026-07-20-playground-e2e.md Global Constraints).
+!e2e-playground/fixtures/certs/
+!e2e-playground/mocks/mock-saml-idp/certs/
 *-shm
 *-wal
 .idea

Makefile

@@ -298,3 +298,27 @@ perf-k6-validate:
 .PHONY: perf-k6-check
 perf-k6-check:
 	k6 run perf/k6/fga_check.js
+
+.PHONY: e2e-playground
+e2e-playground: ## Run the live-playground e2e suite (OIDC/SAML/SCIM/SSO/OAuth/MFA) against an ephemeral docker-compose stack
+	export DOCKER_DEFAULT_PLATFORM=linux/$$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/'); \
+	docker compose -f e2e-playground/docker-compose.yml up -d --wait authorizer authorizer-sso mock-oauth mock-saml-idp mailpit sms-sink; \
+	status=$$?; \
+	if [ $$status -eq 0 ]; then \
+		docker compose -f e2e-playground/docker-compose.yml run --rm playwright npx playwright test; \
+		status=$$?; \
+	fi; \
+	docker compose -f e2e-playground/docker-compose.yml down -v; \
+	exit $$status
+
+.PHONY: e2e-playground-sdk
+e2e-playground-sdk: ## Run the SDK-driven Go suite (drives authorizer-go over the enterprise/MFA surface) against an ephemeral docker-compose stack
+	export DOCKER_DEFAULT_PLATFORM=linux/$$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/'); \
+	docker compose -f e2e-playground/docker-compose.yml up -d --wait --build authorizer authorizer-webauthn authorizer-mfa-enforced authorizer-mfa-magic-link mock-oauth mock-saml-idp mailpit sms-sink webhook-sink; \
+	status=$$?; \
+	if [ $$status -eq 0 ]; then \
+		docker compose -f e2e-playground/docker-compose.yml run --rm --build go-sdk-tests; \
+		status=$$?; \
+	fi; \
+	docker compose -f e2e-playground/docker-compose.yml down -v; \
+	exit $$status

cmd/root.go

@@ -421,6 +421,16 @@ func runRoot(c *cobra.Command, args []string) {
 		}
 	}
 
+	// Warn if --env=e2e is set — this relaxes SSRF protection (private/loopback-IP
+	// rejection) for the per-org SSO broker and webhook registration/delivery, and
+	// routes social-login OAuth and SMS sending to fixed e2e-playground mock
+	// addresses. It exists solely for e2e-playground/docker-compose.yml and must
+	// never be set on a real deployment; unlike production/staging, there is no
+	// other visible symptom if it is (see internal/constants/env.go's E2EEnv doc).
+	if rootArgs.config.Env == constants.E2EEnv {
+		log.Warn().Msg("running with --env=e2e: SSRF protection is relaxed for the SSO broker and webhooks, and OAuth/SMS are routed to e2e-playground mock addresses. This must never be set in a real deployment.")
+	}
+
 	// Initialize prometheus metrics
 	metrics.Init()
 

e2e-playground/.dockerignore

@@ -0,0 +1,3 @@
+node_modules
+playwright-report
+test-results

e2e-playground/.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+playwright-report/
+test-results/

e2e-playground/Dockerfile

@@ -0,0 +1,7 @@
+# e2e-playground/Dockerfile
+FROM mcr.microsoft.com/playwright:v1.61.1-jammy
+WORKDIR /e2e
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+CMD ["npx", "playwright", "test"]

e2e-playground/README.md

@@ -0,0 +1,84 @@
+# Live-Playground E2E Suite
+
+A real, live-server end-to-end test suite for Authorizer. Every spec drives a real `authorizer` binary (built from this repo's source) plus a real browser (Playwright) — no unit-level mocking of Authorizer itself. Third-party services (Google/GitHub/Discord/etc. OAuth, SMS delivery, an external SAML IdP) are stood in for by small local mock servers under `mocks/`, wired in via `authorizer`'s own test-only mechanism (`--env=e2e`) — every behavior it enables is a documented no-op unless that exact env value is set, so none of this affects production behavior.
+
+## Coverage
+
+- OIDC provider (signup/login/PKCE/token issuance) and OIDC SSO relying-party (home-realm discovery)
+- SAML SP and SAML IdP
+- SCIM (CRUD, filter operators, webhooks — including real webhook delivery with HMAC verification)
+- 10 social OAuth providers (Google, GitHub, Facebook, LinkedIn, Apple, Discord, Twitter, Microsoft, Twitch, Roblox)
+- WebAuthn/passkeys (via Playwright's CDP-backed virtual authenticator)
+- TOTP, SMS-OTP, WebOTP auto-fill, magic-link
+- MFA enforcement routing matrix
+- OTP brute-force lockout
+- Dashboard verified-domains UI
+
+## Prerequisites
+
+- Docker + Docker Compose (everything else — Node, Playwright browsers, the `authorizer` binary — is built into containers; nothing needs to be installed on the host).
+
+## Run the full suite
+
+From the repository root:
+
+```bash
+make e2e-playground
+```
+
+This builds and starts the full docker-compose stack (six `authorizer` instances configured for different scenarios, the mock OAuth/SAML/SMS/webhook servers, Mailpit for email), runs the entire Playwright suite in a containerized runner, and **always** tears the stack down afterward (`docker compose down -v`) — including on failure or if the stack fails to start.
+
+Equivalent to, run manually:
+
+```bash
+docker compose -f e2e-playground/docker-compose.yml up -d --wait authorizer authorizer-sso mock-oauth mock-saml-idp mailpit sms-sink
+docker compose -f e2e-playground/docker-compose.yml run --rm playwright npx playwright test
+docker compose -f e2e-playground/docker-compose.yml down -v
+```
+
+(The `playwright` service's own `depends_on` brings up the remaining instances — `authorizer-webauthn`, `authorizer-magic-link`, `authorizer-mfa-enforced`, `authorizer-mfa-magic-link`, `webhook-sink` — automatically; they don't need to be named in the `up` step.)
+
+## Run a subset
+
+Any Playwright CLI filter works. From `e2e-playground/`, after starting the stack:
+
+```bash
+# One spec file
+docker compose run --rm --build playwright npx playwright test totp.spec.ts
+
+# By name pattern
+docker compose run --rm --build playwright npx playwright test -g "SCIM"
+
+# A whole directory
+docker compose run --rm --build playwright npx playwright test social/
+```
+
+**`--build` is required whenever a spec file (or anything else under `e2e-playground/`) has changed** — the `playwright` service's Dockerfile bakes test files into the image at build time rather than mounting them live; without `--build` you'll run stale tests, or Playwright will report "No tests found" if a new file was added since the image was last built.
+
+Don't forget to tear down afterward: `docker compose -f e2e-playground/docker-compose.yml down -v`.
+
+## Verify results after a run
+
+Playwright's HTML report is written to `e2e-playground/playwright-report/` on the host (mounted, survives container teardown). To view it:
+
+```bash
+npx playwright show-report e2e-playground/playwright-report
+```
+
+or open `e2e-playground/playwright-report/index.html` directly in a browser. It shows every test's pass/fail status, timing, and — for failures — a full trace (screenshots, network log, action-by-action replay).
+
+Raw output (traces, videos on retry, etc.) is under `e2e-playground/test-results/`, also host-mounted.
+
+A clean run's terminal output ends with a summary line, e.g.:
+
+```
+XX passed (NNs)
+```
+
+Any skip is intentional and self-documenting — read the `test.skip(...)` call's message in the relevant spec file for the reason. As of this writing there are no skips tied to real product gaps.
+
+## Notes
+
+- Every spec seeds its own state (org, users, connections) — specs are independently runnable and safe to run in parallel or in any order.
+- `authorizer-sso` runs a second, separately-configured instance (port 8081) specifically because `--enable-org-discovery=true` is a global login-UX toggle that would otherwise change behavior for every other spec sharing the default instance.
+- Test-only secrets (SAML certs, JWT signing keys) live under `fixtures/certs/`, are checked in, and sign nothing real — the same pattern `make dev`'s embedded dev RSA keys already use.