Test sign-in against a real proxy: oauth2-proxy and Dex in CI #717

Part of #701.

Scope

A CI lane runs Simlock behind a real sign-in proxy (oauth2-proxy) and a real identity provider (Dex), both in Docker, and signs a person in through them in a real browser. It proves the claims, header and key format of a real proxy match what Simlock checks, which the other lanes only imitate. It runs on pull requests that change source code, and once a week. It runs on Linux only.

In short

Nothing changes for a user. CI gains a "Real proxy" workflow. A person logs in on Dex's page, oauth2-proxy passes their ID token to a Simlock gateway, and the console opens with their name.

flowchart LR
  B[Playwright browser] --> O["oauth2-proxy :4180"]
  O -->|login| D["Dex :5556"]
  O -->|X-Id-Token: ID token| G["Simlock gateway :4700"]
  W[Simlock worker] -->|/v1/uplink, skip-auth route| O
  G -->|keys| D

All on 127.0.0.1 of the runner: the two containers use host networking, so the browser, oauth2-proxy and Simlock reach Dex at the same issuer URL, http://127.0.0.1:5556/dex, and Simlock's jwksUrl (http://127.0.0.1:5556/dex/keys) is a loopback address.

Word: Dex, an open-source identity provider that can run with a fixed user list, used here as the team's identity provider.

If this goes wrong, a user would notice nothing directly; a broken lane would hide a real-proxy regression, or a flaky one would waste CI time.

Technical spec

Facts

Commit ccb50353. oauth2-proxy v7.15.5 and Dex v2.46.0, read in their sources at those tags.

Modules touched

Search: rg 'playwright' package.json playwright.config.ts .github.

• New .github/workflows/real-proxy.yml: triggers pull_request, schedule weekly, workflow_dispatch. A changes job like the console lane's (F3) runs the lane job when a non-test file under src/ or ui/, e2e/real-proxy/**, .github/workflows/real-proxy.yml, package.json or pnpm-lock.yaml changed; otherwise the lane job is skipped by its if. Not part of the Quality check.
• New e2e/real-proxy/:
  • compose.yaml: Dex v2.46.0 and oauth2-proxy v7.15.5, each pinned by digest, both network_mode: host.
  • dex.yaml: issuer http://127.0.0.1:5556/dex; enablePasswordDB: true; oauth2.skipApprovalScreen: true; one static password (email alice@example.test, username Alice, a bcrypt hash of a fixed test password); one static client simlock-real-proxy with a fixed secret and redirectURIs: [http://127.0.0.1:4180/oauth2/callback].
  • oauth2-proxy.yaml (alpha config): providers (one oidc provider, the client id and secret, issuer http://127.0.0.1:5556/dex, scope openid email profile), upstreamConfig (http://127.0.0.1:4700/, WebSockets on), server.bindAddress 127.0.0.1:4180, injectRequestHeaders X-Id-Token from id_token with preserveRequestValue: false.
  • The lane's own starter for the gateway (fixed port 4700) and a worker, not the console fixtures (F21).
  • real-proxy.spec.ts; playwright.real-proxy.config.ts (60 s test timeout, 15 s action timeout).
  • Global setup: check ports 4180, 5556 and 4700 are free; docker compose up -d dex; wait for http://127.0.0.1:5556/dex/.well-known/openid-configuration; docker compose up -d oauth2-proxy; wait for http://127.0.0.1:4180/ping; each wait at most 60 s. Teardown: docker compose down -v.
• oauth2-proxy flags, core flag set only (F17): --alpha-config=/etc/oauth2-proxy.yaml, --email-domain=* (F18), --cookie-secret=<fixed 32-byte test value>, --cookie-secure=false (plain HTTP on loopback), --skip-provider-button, --skip-auth-route=^/v1/uplink$, --skip-auth-route=^/v1/healthz$.
• The gateway's http.proxyAuth: header: x-id-token, jwksUrl: http://127.0.0.1:5556/dex/keys, issuer: http://127.0.0.1:5556/dex, audience: the client id.
• package.json: script test:real-proxy.
• docs/internal/agent-rules/toolchain.md: the lane, its command, Linux with Docker only, one run per machine (fixed ports).

Contract and event changes

none.

Other code on the same state

The lane's daemons have their own SIMLOCK_HOMEs under a temp directory. Its ports (4180, 5556, the gateway's) are fixed: two runs on one machine collide, so the global setup checks the ports are free and fails naming the busy one.

Failure modes

State: none kept between runs.

Rules in play

• Testing rule 10, prove each claim once at the cheapest level: this lane proves only what needs a real proxy (real claims, header, keys, login); every refusal case stays in Sign in through a sign-in proxy's signed JWT #714's tests.
• vendor-and-third-party-code.md, nothing fetched at runtime: the images are CI test fixtures, not part of Simlock, pinned by digest.

Tests

Seam: a Playwright browser through oauth2-proxy at http://127.0.0.1:4180, against a fake-driver gateway with the http.proxyAuth above. Model on e2e/console/sign-in.spec.ts.

• e2e/real-proxy/real-proxy.spec.ts: opening the console through oauth2-proxy lands on Dex's login page; after logging in as Alice the console opens reading "Signed in as Alice".
• e2e/real-proxy/real-proxy.spec.ts: after that login, GET /v1/identity from the page answers a principal starting proxy:http://127.0.0.1:5556/dex# with a non-empty rest, name Alice, via proxy, role admin.
• e2e/real-proxy/real-proxy.spec.ts: a worker with gateway.url ws://127.0.0.1:4180 joins through /v1/uplink (its join token passes the proxy) and appears on the console's Workers page.
• e2e/real-proxy/real-proxy.spec.ts: GET /v1/identity through oauth2-proxy with no session and Accept: text/html gets oauth2-proxy's redirect to Dex, never Simlock's answer.
• e2e/real-proxy/real-proxy.spec.ts: signed in as Alice, a request through oauth2-proxy carrying a minted agent token answers GET /v1/identity as that token (the token wins; Authorization passes untouched).
• e2e/real-proxy/ports.test.ts: the setup's port check, with port 4180 held by the test, fails naming 4180; with all free, it passes.
• The scheduled-failure step has no test: it is a gh call in the workflow, run only by the schedule.

Done when

• pnpm test:real-proxy passes on Linux with Docker.
• The "Real proxy" workflow runs on a PR that changes a file under src/, is skipped on one that changes only docs, and has a weekly schedule.
• docs/internal/agent-rules/toolchain.md lists the lane.

Out of scope

• Cloudflare Access, Google IAP or Pomerium in CI.
• Making the lane a required check.
• Running the lane on macOS.

Depends on

• The console signs in through the sign-in proxy and shows who is signed in #716

Written by an agent.