sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

M7.1 smoke harness: lift auth to compliance-core + compliance-smoke service #83

Merged
sharang merged 2 commits from feat/m7.1-smoke-harness into main 2026-06-04 14:38:36 +00:00
Conversation 0 Commits 2 Files Changed 11
+950
sharang commented 2026-06-04 09:11:49 +00:00
Owner
Copy Link
Copy Source

Summary

  • Lifts the M7.1 tenant infrastructure (TenantStatus/OrgRole/TenantContext, db::tenant_filter, JWT middleware, TenantCtx extractor) from compliance-agent into compliance-core under a new axum cargo feature, so every future product can consume one source of truth.
  • Adds compliance-smoke: a tiny Axum binary with three endpoints (public health, protected GET echo, protected POST echo) that mounts compliance-core's middleware end-to-end against a live Keycloak.
  • Adds scripts/smoke.sh: bash runner that hits the smoke service with tokens for the five certifai-realm test users (admin/user → active, trial, frozen, archived) and asserts the exact status code per (user × method × endpoint).

Why independent of #82

PR #82 wired the original M7.1 middleware into compliance-agent inline. We parked it so this PR can land first as the canonical home — when #82 is rebased on top, it shrinks to "delete compliance-agent's local copy + import from compliance-core".

Smoke verdict (run against local certifai KC, 15/15 PASS)

  • Public /api/v1/health → 200 (no auth)
  • Anon / bogus token on protected → 401
  • admin/user (active) → 200 read + 200 write
  • trial → 200 read + 200 write
  • frozen → 200 read + 402 write (read-after-cancel gate)
  • archived → 410 read + 410 write (retention window closed)

How to run locally

docker compose up -d keycloak                # in certifai repo
cargo run -p compliance-smoke &              # exports KEYCLOAK_URL/REALM
KEYCLOAK_URL=http://localhost:8080 \
  KEYCLOAK_REALM=certifai \
  cargo run -p compliance-smoke
./scripts/smoke.sh                           # asserts all 15

Test plan

  • cargo fmt --all
  • cargo clippy --workspace --exclude compliance-dashboard -- -D warnings
  • cargo test -p compliance-core --features axum (43 passing)
  • cargo build --workspace --exclude compliance-dashboard
  • scripts/smoke.sh against live KC — 15/15 assertions PASS

Follow-ups (not in scope here)

  • Rebase PR #82 on top of this — drop the inline middleware and import from compliance-core.
  • JWKS refresh-on-failure (today the agent caches forever; KC key rotation = silent 401 storm).
  • Switch certifai compose KC from dev-mem → dev-file so the realm survives idle periods.
## Summary - Lifts the M7.1 tenant infrastructure (TenantStatus/OrgRole/TenantContext, db::tenant_filter, JWT middleware, TenantCtx extractor) from compliance-agent into compliance-core under a new `axum` cargo feature, so every future product can consume one source of truth. - Adds `compliance-smoke`: a tiny Axum binary with three endpoints (public health, protected GET echo, protected POST echo) that mounts compliance-core's middleware end-to-end against a live Keycloak. - Adds `scripts/smoke.sh`: bash runner that hits the smoke service with tokens for the five certifai-realm test users (admin/user → active, trial, frozen, archived) and asserts the exact status code per (user × method × endpoint). ## Why independent of #82 PR #82 wired the original M7.1 middleware into compliance-agent inline. We parked it so this PR can land first as the canonical home — when #82 is rebased on top, it shrinks to "delete compliance-agent's local copy + import from compliance-core". ## Smoke verdict (run against local certifai KC, 15/15 PASS) - Public `/api/v1/health` → 200 (no auth) - Anon / bogus token on protected → 401 - admin/user (active) → 200 read + 200 write - trial → 200 read + 200 write - frozen → 200 read + **402** write (read-after-cancel gate) - archived → **410** read + **410** write (retention window closed) ## How to run locally ``` docker compose up -d keycloak # in certifai repo cargo run -p compliance-smoke & # exports KEYCLOAK_URL/REALM KEYCLOAK_URL=http://localhost:8080 \ KEYCLOAK_REALM=certifai \ cargo run -p compliance-smoke ./scripts/smoke.sh # asserts all 15 ``` ## Test plan - [x] cargo fmt --all - [x] cargo clippy --workspace --exclude compliance-dashboard -- -D warnings - [x] cargo test -p compliance-core --features axum (43 passing) - [x] cargo build --workspace --exclude compliance-dashboard - [x] scripts/smoke.sh against live KC — 15/15 assertions PASS ## Follow-ups (not in scope here) - Rebase PR #82 on top of this — drop the inline middleware and import from compliance-core. - JWKS refresh-on-failure (today the agent caches forever; KC key rotation = silent 401 storm). - Switch certifai compose KC from `dev-mem` → `dev-file` so the realm survives idle periods.
sharang added 2 commits 2026-06-04 09:11:50 +00:00
feat(core): lift M7.1 tenant types, db helper, and auth middleware into compliance-core f583d0788c 
Moves the tenant-aware HTTP infrastructure into compliance-core so every
future product (compliance-agent, compliance-dast, compliance-mcp, the
upcoming smoke harness) shares one source of truth instead of each crate
re-implementing claims extraction and the status gate.

* tenant.rs — TenantStatus / OrgRole / TenantContext (unconditional)
* db.rs — tenant_filter + tenant_filter_merge for query scoping
* auth.rs — require_jwt_auth + require_tenant_status + JwksState
* tenant_ctx.rs — Axum TenantCtx extractor
* `axum` cargo feature gates the HTTP-dependent modules so wasm
  consumers (the dashboard frontend) don't pull axum/jsonwebtoken/reqwest

40 unit tests across the moved modules — all green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
feat(smoke): add compliance-smoke crate + scripts/smoke.sh tenant-gating harness
CI / Check (pull_request) Successful in 8m18s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details
079f913024 
A minimal Axum binary that mounts compliance-core's M7.1 middleware on
three endpoints (public health, protected GET echo, protected POST echo)
so we can prove the tenant-gating contract end-to-end against a live KC
before any auth-path PR merges.

scripts/smoke.sh drives the binary against the five test users defined
in the certifai realm (admin/user → active, trial/frozen/archived) and
asserts the exact response code per (user × method × endpoint). Run it
once before touching auth, tenant_status, or org_roles code.

Validated locally — 15/15 assertions pass:
* anon/bogus → 401 on protected, 200 on /health
* active/trial → 200 on read + write
* frozen → 200 read, 402 write (read-after-cancel gate)
* archived → 410 read + 410 write (retention window closed)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
sharang merged commit 116293519d into main 2026-06-04 14:38:36 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#83