mosaicstack/stack
1
0
Fork 0
Code Issues 36 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

test(#462): add federation M3 integration coverage #685

Merged
jason.woltje merged 1 commits from feat/federation-m3-integration into next 2026-06-25 04:14:57 +00:00
Conversation 1 Commits 1 Files Changed 2 +579
jason.woltje commented 2026-06-25 04:06:11 +00:00
Owner
Copy Link

Summary

  • Implements FED-M3-10 single-gateway federation integration coverage.
  • Adds gated real-PostgreSQL Vitest suite for M3 acceptance #6 and #7.
  • Uses mocked TLS/Fastify request shim against FederationAuthGuard and direct ListController calls for the real POST /api/federation/v1/list/:resource contract.
  • Seeds fixtures directly in PostgreSQL with project/mission chain, second-user rows, and unauthorized-team rows aligned with the shared B2 fixture vocabulary.

Depends on M3-05 and merged M3-06 (#683) in next.

Refs #462

Coverage

  • #6 malformed/missing Mosaic cert OIDs -> 401 federation unauthorized envelope.
  • #6 valid cert + revoked grant -> 403 federation forbidden envelope.
  • #7 max_rows_per_query cap on list tasks, including _truncated, nextCursor, _source, and exclusion assertions.
  • Cross-user mission_tasks.notes exclusion on the same authorized mission.
  • Unsupported resource fails closed with scope_violation.

Verification

  • pnpm --filter @mosaicstack/gateway typecheck — PASS
  • pnpm --filter @mosaicstack/gateway lint — PASS
  • pnpm format:check — PASS
  • pnpm --filter @mosaicstack/gateway test -- src/__tests__/integration/federation-m3-list.integration.test.ts — PASS (5 skipped; gated when FEDERATED_INTEGRATION unset)
  • FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test -- src/__tests__/integration/federation-m3-list.integration.test.ts — PASS (5 tests, local Postgres + db:push)
  • Codex code review — PASS, no findings
  • Codex security review — PASS, risk none
## Summary - Implements FED-M3-10 single-gateway federation integration coverage. - Adds gated real-PostgreSQL Vitest suite for M3 acceptance #6 and #7. - Uses mocked TLS/Fastify request shim against `FederationAuthGuard` and direct `ListController` calls for the real `POST /api/federation/v1/list/:resource` contract. - Seeds fixtures directly in PostgreSQL with project/mission chain, second-user rows, and unauthorized-team rows aligned with the shared B2 fixture vocabulary. Depends on M3-05 and merged M3-06 (#683) in `next`. Refs #462 ## Coverage - #6 malformed/missing Mosaic cert OIDs -> 401 federation `unauthorized` envelope. - #6 valid cert + revoked grant -> 403 federation `forbidden` envelope. - #7 `max_rows_per_query` cap on `list tasks`, including `_truncated`, `nextCursor`, `_source`, and exclusion assertions. - Cross-user `mission_tasks.notes` exclusion on the same authorized mission. - Unsupported resource fails closed with `scope_violation`. ## Verification - `pnpm --filter @mosaicstack/gateway typecheck` — PASS - `pnpm --filter @mosaicstack/gateway lint` — PASS - `pnpm format:check` — PASS - `pnpm --filter @mosaicstack/gateway test -- src/__tests__/integration/federation-m3-list.integration.test.ts` — PASS (5 skipped; gated when `FEDERATED_INTEGRATION` unset) - `FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test -- src/__tests__/integration/federation-m3-list.integration.test.ts` — PASS (5 tests, local Postgres + db:push) - Codex code review — PASS, no findings - Codex security review — PASS, risk none
jason.woltje added 1 commit 2026-06-25 04:06:12 +00:00
test(#462): add federation M3 integration coverage
Some checks failed
ci/woodpecker/push/ci Pipeline was canceled
Details
ci/woodpecker/pr/ci Pipeline was successful
Details
c371e73692
jason.woltje merged commit a3c1ab923c into next 2026-06-25 04:14:57 +00:00
jason.woltje deleted branch feat/federation-m3-integration 2026-06-25 04:14:57 +00:00
jason.woltje commented 2026-06-25 04:25:53 +00:00
Author
Owner
Copy Link

RETROACTIVE REVIEW-OF-RECORD — APPROVE (#685, merged into next at a3c1ab923c6e4a6190b49e544d175195654d5bd9; PR head c371e73692). I reviewed the merged FED-M3-10 integration test code and found no concerns requiring a follow-up fix card.

Scope/trust-boundary coverage is appropriate for a test-only PR: the gated single-gateway suite exercises malformed/missing Mosaic cert OIDs -> 401 unauthorized envelope, valid cert with revoked grant -> 403 forbidden envelope, max_rows_per_query cap with _truncated/nextCursor/_source, exclusion of other-user and unauthorized-team task rows, cross-user mission_tasks.notes exclusion on the same authorized mission, and unsupported list resources failing closed with a scope_violation envelope. The fixtures deliberately place excluded rows at newer timestamps, so the cap/exclusion test would catch leakage ahead of valid rows.

Implementation review: the suite is correctly gated behind FEDERATED_INTEGRATION=1, uses real PostgreSQL and the real FederationAuthGuard/FederationScopeService/FederationListQueryService/ListController path, avoids request/response persistence, and cleans up seeded rows by generated IDs. No product/runtime source changes beyond the integration test and scratchpad.

Reviewer verification on merge commit a3c1ab92: ungated scoped integration test run passes as 5 skipped; FEDERATED_INTEGRATION=1 scoped integration test run passes 5/5 against local PostgreSQL; gateway typecheck pass; gateway lint pass; prettier check pass for the integration test and scratchpad. APPROVE.

RETROACTIVE REVIEW-OF-RECORD — APPROVE (#685, merged into next at a3c1ab923c6e4a6190b49e544d175195654d5bd9; PR head c371e73692eaf60504791abb06ab9e97caeb7fdb). I reviewed the merged FED-M3-10 integration test code and found no concerns requiring a follow-up fix card. Scope/trust-boundary coverage is appropriate for a test-only PR: the gated single-gateway suite exercises malformed/missing Mosaic cert OIDs -> 401 unauthorized envelope, valid cert with revoked grant -> 403 forbidden envelope, max_rows_per_query cap with `_truncated`/`nextCursor`/`_source`, exclusion of other-user and unauthorized-team task rows, cross-user `mission_tasks.notes` exclusion on the same authorized mission, and unsupported list resources failing closed with a scope_violation envelope. The fixtures deliberately place excluded rows at newer timestamps, so the cap/exclusion test would catch leakage ahead of valid rows. Implementation review: the suite is correctly gated behind `FEDERATED_INTEGRATION=1`, uses real PostgreSQL and the real FederationAuthGuard/FederationScopeService/FederationListQueryService/ListController path, avoids request/response persistence, and cleans up seeded rows by generated IDs. No product/runtime source changes beyond the integration test and scratchpad. Reviewer verification on merge commit a3c1ab92: ungated scoped integration test run passes as 5 skipped; FEDERATED_INTEGRATION=1 scoped integration test run passes 5/5 against local PostgreSQL; gateway typecheck pass; gateway lint pass; prettier check pass for the integration test and scratchpad. APPROVE.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#685
Delete Branch "feat/federation-m3-integration"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?