🛠️ Testing | Test-auth foundation — generic test user + non-interactive login (API + AdminUI)

[jernejk]

Why — this blocks all test-automation PBIs

Every testing initiative is stuck on the same first step: tests can't log in without a human, a browser, or real staging credentials.

This PBI delivers the shared auth foundation — a generic test user that works non-interactively across the API and AdminUI — so e2e suites and AI agents (CI, Claude, Codex, Copilot) can authenticate with one command and zero secrets.

⛔ Blocks:

• 🛠️ Testing | Smoke and Integration Tests #670 Testing | Smoke and Integration Tests
• 🛠️ API/Mobile | Testing #869 API/Mobile | Testing
• 🧪 Load Testing | Initial loading testing for most important endpoints #1124 Load Testing | Initial load testing for most important endpoints
• ✨ Multi-Tenant Integration Tests #1514 Multi-Tenant Integration Tests

The design (validated)

Internal research (incl. an independently reviewed .NET 10 spike — 8/8 auth assertions passing) landed on:

A test access-token the API trusts is the universal login. Add a dev/test-only signing key that the API trusts only under a Testing profile, and a helper that mints a rewards-audience JWT offline with arbitrary claims (sub, email, role=Admin). Every test surface then authenticates with no IdP, no browser, no network, no secrets.

• API e2e → send the minted token as Authorization: Bearer — exercises the real controller pipeline incl. [Authorize(Roles = "Admin")] (today's integration tests bypass this by mocking ICurrentUserService).
• AdminUI e2e → Blazor WASM does a real auth-code+PKCE redirect, so Playwright drives login against a pinned local SSW.IdentityServer with a seeded admin user (reuses the existing tools/ui-tests harness — just an authority swap; no staging, no real creds).

Scope

• Test signing key + Testing profile in WebAPI: trusted only when ASPNETCORE_ENVIRONMENT=Testing; if the flag is set under any other environment (incl. Staging) the API fails fast at startup. Issuer validation stays ON (append a fixed test issuer — never ValidateIssuer=false). No live OIDC metadata fetch on this path (static configuration so validation is fully offline). Asymmetric keypair: API trusts only the public key.
• Token mint helper (TestTokenFactory / small CLI): aud=rewards, header typ=at+jwt, claims sub/email/role. Generic test user identity is deterministic + documented.
• API e2e proof: WebApplicationFactory-based tests hitting real controllers with the minted token — positive (user + admin) and negative (no token, unknown key, wrong audience, flag off ⇒ all 401).
• AdminUI e2e login: tools/ui-tests Playwright auth.setup.ts authenticates against local IdentityServer (pinned port) with the seeded admin — full suite green locally with no staging dependency.
• Docs: one page — how CI/agents mint a token and run each layer.

Out of scope

• Mobile e2e — the sswrewards://autologin?token=… deep link makes the same token work on iOS/Android, but the mobile team is busy; follow-up under 🛠️ API/Mobile | Testing #869.
• Demo/user data seeding — handled in parallel under API - Add seed profile command line args #540; this PBI only consumes a seeded/auto-provisioned user.

Security guardrail (non-negotiable)

The test key must be worthless against Production: trust is gated to the Testing environment with a fail-fast startup check, Production/Staging keep real OIDC validation only, and the design is documented in the API so a future change can't silently widen trust.

[jernejk]

✅ Done — automated tests and AI agents can now log into SSW.Rewards without a person, a browser, or real passwords

• Until now, every e2e/integration test that needed a logged-in user was stuck: sign-in required a real person's staging credentials and a browser. That blocker sat in front of all of our test-automation backlog (🛠️ Testing | Smoke and Integration Tests #670, 🛠️ API/Mobile | Testing #869, 🧪 Load Testing | Initial loading testing for most important endpoints #1124, ✨ Multi-Tenant Integration Tests #1514).
• Now any test or agent can create a "generic test user" on the fly — including an Admin — and the API treats it exactly like a real signed-in user. This only works on a developer/test machine; production and staging refuse these test logins by design and shut down with an error if anyone even tries to enable it there (independently security-reviewed).
• The Admin-portal browser tests also no longer need staging or anyone's real password — they log in against a local sign-in server with built-in demo users.
• Verified end to end: 12/12 new API auth tests, the real login flow in a live browser, and the existing test suites all green.

PR to follow.

Technical details

Mechanism: committed non-secret RSA test keypair; the WebAPI trusts the public key only when ASPNETCORE_ENVIRONMENT=Testing + Testing:AcceptTestSigningKey=true (src/Infrastructure/ConfigureServices.cs — any other environment with the flag throws at startup, covered by a test). tools/TestToken mints rewards-audience JWTs (typ=at+jwt) offline; the API auto-provisions users from the token's email claim and enforces roles from the role claim, so --role Admin exercises the real [Authorize(Roles="Admin")] pipeline.

New: tests/ApiE2E (WebApplicationFactory, 12 specs: 401/200/403 matrix, auto-provisioning, forged-key/wrong-audience/flag-off rejections, Production-guardrail startup throw) · tools/TestToken CLI/library · local-IdP mode for tools/ui-tests (Playwright; USE_STAGING=1 escape hatch, verified live 1/1) + idempotent seed-admin.sh · _docs/Testing-Auth.md.

Also fixed: rewards-dev identity local pointed at a dead port (:14330 → :5003); found an SSW.IdentityServer login-page nit (username input type="email" blocks non-email dev usernames — harness works around it, upstream fix suggested).

Reviews: independent Codex code review — no blockers/majors, guardrail cleared; 3 minors fixed. Scope: ~44 LOC in src/, everything else isolated tooling/tests/docs.

🤖