test: authorization-outcome matrix across auth mechanisms and impersonation e2e#24498
Merged
Conversation
…nation e2e Adds e2e coverage (default profile, every PR) asserting that authorization outcomes are identical regardless of authentication mechanism, and full impersonation flow tests over a real session: - AuthMechanism: turns (username, password) into authenticated request headers for SESSION_COOKIE (form login), BASIC, and PAT. - AuthorizationMatrixTest, parameterized over the mechanisms: exact @RequiresAuthority 403 message contract, authority-granted, implicit ALL bypass, sharing ACL (private metadata invisible to others, 404 pin); plus org-unit capture scope on data value writes (E8011 pin) and basic-auth rejection for TOTP-2FA-enabled users. - ImpersonationTest: impersonate -> act as target (target's authorities apply) -> /me shows impersonator USERNAME -> exit restores original; negatives incl. the exact 403/400 message contracts, self- and superuser-impersonation refusals, and a pin that re-login in the same session invalidates impersonation state (exit denied). - Impersonation enabled in the e2e dhis.conf; fixed compose subnet and a static IP for the test container because switch_user_allow_listed_ips is an exact string match. Verified locally against the compose stack: 20/20 green, ~6s added to the default profile. AI Assisted
netroms
marked this pull request as draft
July 19, 2026 08:44
netroms
marked this pull request as ready for review
July 20, 2026 11:24
jbee
approved these changes
Jul 20, 2026
|
david-mackessy
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
E2e tests (default profile, every PR) asserting authorization outcomes are IDENTICAL regardless of authentication mechanism, plus full impersonation flow coverage. Part of the auth coverage initiative preceding the UserDetails/interceptor refactoring; companion to #24497.
AuthMechanism: turns credentials into authenticated request headers for SESSION_COOKIE, BASIC, PAT.AuthorizationMatrixTest(parameterized over mechanisms): exact@RequiresAuthority403 message contract, authority-granted, implicit ALL bypass, sharing ACL (private metadata 404 to others); plus org-unit capture scope on data value writes (E8011 pin) and basic-auth rejection for TOTP-2FA users.ImpersonationTest(cookie jar): impersonate -> act as target ->/meshows impersonator USERNAME -> exit; negative cases with exact message contracts; pin that re-login in the same session invalidates impersonation state.Testing
Verified against the local compose stack: 20/20 green, ~6s added to the default profile.
AI Assisted