feat(federation): two-gateway test harness scaffold (FED-M3-02) #505

2026-04-24T01:23:37Z

jason.woltje commented

2026-04-24 01:23:37 +00:00

Summary

Adds tools/federation-harness/ — permanent M3+ federation E2E test bed.

docker-compose.two-gateways.yml: gateway-a/b each with Postgres+pgvector+Valkey, shared Step-CA; image digest-pinned (sha256:1069117740e00ccfeba357cae38c43f3729fe5ae702740ce474f6512414d7c02, sha-9f1a081 post-#491)
seed.ts: provisions scope variants A/B/C via real admin REST API; full enrollment flow (peer keypair to grant to token to redeem to cert store)
harness.ts: bootHarness/tearDownHarness/serverA/serverB/seed helpers for vitest; idempotent boot
README.md: prereqs, topology, troubleshooting, vitest integration

Scope variants

Variant	Resources	Filters	Excluded
A	tasks, notes	include_personal: true	(none)
B	tasks	include_teams: T1, no personal	(none)
C	tasks, credentials	include_personal: true	credentials

Bugs found in production code (NOT fixed - tooling-only PR)

FederationController.generateToken derives enrollment URL from BETTER_AUTH_URL env - defaults to http://localhost:14242 when unset, wrong inside Docker network.
Admin guard header name (x-admin-key) not documented in controller; seed assumes this header.

Test plan

docker compose up -d: 7 services come healthy
pnpm tsx tools/federation-harness/seed.ts: 3 grants enrolled
docker compose down -v: clean teardown
bootHarness() twice: second call returns ownedStack: false
pnpm typecheck / pnpm lint / pnpm format:check: all green

Followups

Image digest staleness: update if new build promoted before M3-11
Port collision: env var overrides documented in README
Subject user UUIDs are placeholders; M3-11 replaces with real auth API user creation

Closes #462

## Summary Adds tools/federation-harness/ — permanent M3+ federation E2E test bed. - docker-compose.two-gateways.yml: gateway-a/b each with Postgres+pgvector+Valkey, shared Step-CA; image digest-pinned (sha256:1069117740e00ccfeba357cae38c43f3729fe5ae702740ce474f6512414d7c02, sha-9f1a081 post-#491) - seed.ts: provisions scope variants A/B/C via real admin REST API; full enrollment flow (peer keypair to grant to token to redeem to cert store) - harness.ts: bootHarness/tearDownHarness/serverA/serverB/seed helpers for vitest; idempotent boot - README.md: prereqs, topology, troubleshooting, vitest integration ## Scope variants | Variant | Resources | Filters | Excluded | |---------|-----------|---------|----------| | A | tasks, notes | include_personal: true | (none) | | B | tasks | include_teams: T1, no personal | (none) | | C | tasks, credentials | include_personal: true | credentials | ## Bugs found in production code (NOT fixed - tooling-only PR) 1. FederationController.generateToken derives enrollment URL from BETTER_AUTH_URL env - defaults to http://localhost:14242 when unset, wrong inside Docker network. 2. Admin guard header name (x-admin-key) not documented in controller; seed assumes this header. ## Test plan - docker compose up -d: 7 services come healthy - pnpm tsx tools/federation-harness/seed.ts: 3 grants enrolled - docker compose down -v: clean teardown - bootHarness() twice: second call returns ownedStack: false - pnpm typecheck / pnpm lint / pnpm format:check: all green ## Followups - Image digest staleness: update if new build promoted before M3-11 - Port collision: env var overrides documented in README - Subject user UUIDs are placeholders; M3-11 replaces with real auth API user creation Closes #462

jason.woltje force-pushed feat/federation-m3-harness from dc122e138b to 4cf9362e75

2026-04-24 02:55:11 +00:00

Compare

jason.woltje merged commit 89c733e0b9 into main

2026-04-24 03:01:26 +00:00

jason.woltje referenced this issue from a commit

2026-04-24 03:01:27 +00:00

feat(federation): two-gateway test harness scaffold (FED-M3-02) (#505)

jason.woltje referenced this issue from a commit

2026-06-24 20:51:49 +00:00

docs(federation): sync M3 backlog to origin/main reality

jason.woltje referenced this pull request