fix(ci): treat LXD auth challenge as safe

Author: terion-labs

tests/integration-lxd-api-response.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, test } from "bun:test";
+import { assertSafeLxdApiRootResponse } from "./integration/scenarios/common";
+import type { HttpsResponse } from "./integration/assertions/http";
+
+function response(status: number, body = "", headers = ""): HttpsResponse {
+  return { status, body, headers };
+}
+
+const lxdRootBody = JSON.stringify({
+  metadata: {
+    api_extensions: ["oidc"],
+    auth: "untrusted"
+  }
+});
+
+describe("LXD API public probe", () => {
+  test("accepts unauthenticated LXD JSON when it is not trusted", () => {
+    expect(() => assertSafeLxdApiRootResponse(response(200, lxdRootBody), "lxd.example.test", "auth.example.test")).not.toThrow();
+  });
+
+  test("rejects trusted anonymous LXD JSON", () => {
+    const body = JSON.stringify({ metadata: { api_extensions: [], auth: "trusted" } });
+
+    expect(() => assertSafeLxdApiRootResponse(response(200, body), "lxd.example.test", "auth.example.test")).toThrow("trusted anonymous");
+  });
+
+  test("accepts expected OIDC challenges without following interactive redirects", () => {
+    expect(() =>
+      assertSafeLxdApiRootResponse(response(302, "", "HTTP/2 302\r\nlocation: /oidc/login\r\n"), "lxd.example.test", "auth.example.test")
+    ).not.toThrow();
+    expect(() =>
+      assertSafeLxdApiRootResponse(
+        response(303, "", "HTTP/2 303\r\nlocation: https://auth.example.test/oauth/v2/authorize\r\n"),
+        "lxd.example.test",
+        "auth.example.test"
+      )
+    ).not.toThrow();
+    expect(() => assertSafeLxdApiRootResponse(response(403), "lxd.example.test", "auth.example.test")).not.toThrow();
+  });
+
+  test("rejects redirects away from the managed LXD and auth hosts", () => {
+    expect(() =>
+      assertSafeLxdApiRootResponse(response(302, "", "location: https://evil.example.test/login\r\n"), "lxd.example.test", "auth.example.test")
+    ).toThrow("unexpected location");
+  });
+});

tests/integration-scenario-timeouts.test.ts

@@ -8,7 +8,7 @@ describe("integration scenario timeout guardrails", () => {
     expect(commonSource).toContain("verify ${host.label} LXD API");
     expect(commonSource).toContain("verified ${host.label} LXD API");
     expect(commonSource).toContain("LXD API verification for ${host.label}");
-    expect(commonSource).toContain("timeoutMs: LXD_API_POLL_TIMEOUT_MS");
+    expect(commonSource).toContain("Date.now() + LXD_API_POLL_TIMEOUT_MS");
     expect(commonSource).toContain("external OIDC LXD API for ${host.label}");
     expect(commonSource).toContain("local ZITADEL LXD API for ${host.label}");
     expect(commonSource.match(/verifyLxdApi\(host, context\)/g)?.length).toBe(2);

tests/integration/assertions/http.test.ts

@@ -32,5 +32,6 @@ describe("HTTP assertion helpers", () => {
     expect(source.match(/timeoutMs: CURL_PROCESS_TIMEOUT_MS/g)?.length).toBe(2);
     expect(source.match(/await fetchWithTimeout\(url/g)?.length).toBe(1);
     expect(source.match(/await fetchTextWithTimeout\(url/g)?.length).toBe(1);
+    expect(source).toContain("...(options.followRedirects ? [\"-L\"] : [])");
   });
 });

tests/integration/assertions/http.ts

@@ -9,6 +9,17 @@ type HttpAssertionOptions = {
   insecure?: boolean;
 };
 
+type HttpsReadOptions = HttpAssertionOptions & {
+  followRedirects?: boolean;
+  headers?: string[];
+};
+
+export type HttpsResponse = {
+  status: number;
+  body: string;
+  headers: string;
+};
+
 type JsonValidator = (value: unknown) => void;
 
 export const HTTP_FETCH_TIMEOUT_MS = 20000;
@@ -74,17 +85,21 @@ export async function waitForHttpStatus(url: string, expectedStatuses: number[],
   throw new Error(`timed out waiting for ${url} to return one of [${expectedStatuses.join(", ")}], last status: ${lastResponse?.status ?? "none"}`);
 }
 
-async function readHttpsBody(url: string, options: HttpAssertionOptions = {}): Promise<{ status: number; body: string }> {
+export async function readHttpsResponse(url: string, options: HttpsReadOptions = {}): Promise<HttpsResponse> {
   const tempDir = await mkdtemp(join(tmpdir(), "terrarium-http-"));
   const bodyPath = join(tempDir, "body");
+  const headersPath = join(tempDir, "headers");
   try {
     const result = await runAllowFailure([
       "curl",
       "-4",
       "-sS",
-      "-L",
       "--noproxy",
       "*",
+      ...(options.followRedirects ? ["-L"] : []),
+      ...((options.headers ?? []).flatMap((header) => ["-H", header])),
+      "-D",
+      headersPath,
       "-o",
       bodyPath,
       "-w",
@@ -102,12 +117,18 @@ async function readHttpsBody(url: string, options: HttpAssertionOptions = {}): P
     }
 
     const body = await readFile(bodyPath, "utf8");
-    return parseCurlHttpBodyResult(result.stdout, body);
+    const headers = await readFile(headersPath, "utf8").catch(() => "");
+    return { ...parseCurlHttpBodyResult(result.stdout, body), headers };
   } finally {
     await rm(tempDir, { recursive: true, force: true });
   }
 }
 
+async function readHttpsBody(url: string, options: HttpsReadOptions = {}): Promise<{ status: number; body: string }> {
+  const { status, body } = await readHttpsResponse(url, options);
+  return { status, body };
+}
+
 /** Polls an HTTPS endpoint with certificate verification disabled until it returns an expected status. */
 export async function waitForHttpStatusInsecure(
   url: string,
@@ -187,7 +208,7 @@ export async function expectHttpBodyContains(
   while (Date.now() < deadline) {
     try {
       if (url.startsWith("https://")) {
-        const { status, body } = await readHttpsBody(url, { resolveIp, insecure });
+        const { status, body } = await readHttpsBody(url, { resolveIp, insecure, followRedirects: true });
         lastStatus = String(status || 0);
         lastBody = body;
         if (body.includes(needle)) {

tests/integration/scenarios/common.ts

@@ -5,7 +5,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { IntegrationContext } from "../context";
 import type { ExternalOidcFixture, ManagedHost, VolumeRecord } from "../types";
 import { SshHost } from "../remote/ssh";
-import { expectHttpBodyContains, expectHttpsJson, waitForHttpStatusResolved } from "../assertions/http";
+import { expectHttpBodyContains, readHttpsResponse, waitForHttpStatusResolved, type HttpsResponse } from "../assertions/http";
 import { expectLxdUi, expectManagementSurfaces, expectManagementUi, expectProtectedRoute } from "../assertions/browser";
 import { expectRemoteContains, expectSystemdActive } from "../assertions/host";
 import { collectHostArtifacts } from "../cleanup";
@@ -330,36 +330,95 @@ export async function verifyManagementSurfaces(
 export async function verifyLxdApi(host: ManagedHost, context?: IntegrationContext): Promise<void> {
   await withStepTimeout(`LXD API verification for ${host.label}`, LXD_API_VERIFY_TIMEOUT_MS, async () => {
     context?.logger.info(`verify ${host.label} LXD API`);
-    await expectHttpsJson(
-      `https://${host.domains.lxd}/1.0`,
-      (body) => {
-        if (!isObject(body)) {
-          throw new Error("LXD API root did not return an object");
-        }
-
-        const metadata = body.metadata;
-        if (!isObject(metadata)) {
-          throw new Error("LXD API root did not include metadata");
-        }
-
-        if (!Array.isArray(metadata.api_extensions)) {
-          throw new Error("LXD API root did not include api_extensions");
-        }
-
-        const auth = typeof metadata.auth === "string" ? metadata.auth.toLowerCase() : "";
-        if (!auth) {
-          throw new Error("LXD API root did not include auth state");
-        }
-        if (auth === "trusted") {
-          throw new Error("LXD API root allowed trusted anonymous access");
-        }
-      },
-      { timeoutMs: LXD_API_POLL_TIMEOUT_MS, resolveIp: host.server.ipv4 }
-    );
+    const response = await waitForLxdApiRootResponse(host);
+    assertSafeLxdApiRootResponse(response, host.domains.lxd, host.domains.auth);
     context?.logger.info(`verified ${host.label} LXD API`);
   });
 }
 
+async function waitForLxdApiRootResponse(host: ManagedHost): Promise<HttpsResponse> {
+  const deadline = Date.now() + LXD_API_POLL_TIMEOUT_MS;
+  let lastError = "";
+  while (Date.now() < deadline) {
+    try {
+      return await readHttpsResponse(`https://${host.domains.lxd}/1.0`, {
+        resolveIp: host.server.ipv4,
+        headers: ["Accept: application/json"]
+      });
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+      await Bun.sleep(5000);
+    }
+  }
+
+  throw new Error(`timed out waiting for LXD API root; last error=${lastError || "none"}`);
+}
+
+export function assertSafeLxdApiRootResponse(response: HttpsResponse, lxdHost: string, authHost?: string): void {
+  if ([301, 302, 303, 307, 308].includes(response.status)) {
+    const location = response.headers.match(/^location:\s*(.+)$/im)?.[1]?.trim() ?? "";
+    if (isExpectedLxdAuthRedirect(location, lxdHost, authHost)) {
+      return;
+    }
+    throw new Error(`LXD API root redirected to unexpected location: ${location || "<missing>"}`);
+  }
+
+  if ([401, 403].includes(response.status)) {
+    return;
+  }
+
+  if (response.status < 200 || response.status >= 300) {
+    throw new Error(`LXD API root returned unexpected HTTP status ${response.status}`);
+  }
+
+  let body: unknown;
+  try {
+    body = JSON.parse(response.body) as unknown;
+  } catch {
+    throw new Error(`LXD API root did not return JSON; body=${response.body.replace(/\s+/g, " ").trim().slice(0, 400) || "<empty>"}`);
+  }
+
+  if (!isObject(body)) {
+    throw new Error("LXD API root did not return an object");
+  }
+
+  const metadata = body.metadata;
+  if (!isObject(metadata)) {
+    throw new Error("LXD API root did not include metadata");
+  }
+
+  if (!Array.isArray(metadata.api_extensions)) {
+    throw new Error("LXD API root did not include api_extensions");
+  }
+
+  const auth = typeof metadata.auth === "string" ? metadata.auth.toLowerCase() : "";
+  if (!auth) {
+    throw new Error("LXD API root did not include auth state");
+  }
+  if (auth === "trusted") {
+    throw new Error("LXD API root allowed trusted anonymous access");
+  }
+}
+
+function isExpectedLxdAuthRedirect(location: string, lxdHost: string, authHost?: string): boolean {
+  if (!location) {
+    return false;
+  }
+
+  let target: URL;
+  try {
+    target = new URL(location, `https://${lxdHost}`);
+  } catch {
+    return false;
+  }
+
+  if (target.host === lxdHost) {
+    return target.pathname.startsWith("/oidc/") || target.pathname.startsWith("/ui/");
+  }
+
+  return Boolean(authHost && target.host === authHost);
+}
+
 /** Verifies a real browser login through LXD's public OIDC flow. */
 export async function verifyLxdUi(
   context: IntegrationContext,