pomerium / pomerium / 29331034788
53%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 706
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 52.235% (-0.01%) from 52.246%
29331034788

push

github

web-flow 
test: container-based MCP e2e suite with real IdP browser sign-in (#6484)

## Summary

Adds a container-based end-to-end test suite for Pomerium's **MCP (Model
Context Protocol)** support at `internal/acceptance/mcp/`, then expands
it into a **downstream authorization-server conformance suite for the
MCP 2025-11-25 spec**. A real MCP client (the official TypeScript SDK)
calls tools on an upstream MCP server **fronted by the official
`pomerium/pomerium` container**, authenticating through a **real
Keycloak browser sign-in**. The whole stack is launched with
**testcontainers**; TLS is issued with **mkcert**.

This is **additive** — it complements (does not replace) the in-process
Go suite at `internal/mcp/e2e/`, adding coverage that suite can't: a
real OAuth 2.1 client, a real browser login, a real IdP, and the
official published image.

### Architecture

- **Orchestration** — `testcontainers` boots one Docker network with
Keycloak (IdP), an upstream MCP server, and Pomerium (all-in-one). No
docker-compose, no build-from-source.
- **Client** — `@modelcontextprotocol/sdk` drives the full OAuth 2.1
flow (discovery → **Dynamic Client Registration** → PKCE → token);
**Playwright** performs the Keycloak sign-in when the SDK needs user
authorization; a loopback HTTP server captures the authorization code. A
second **raw-OAuth client** (`mcp-client/oauth-raw.ts`, over
Playwright's request context) drives the same flow for conformance and
negative cases that inject malformed inputs the SDK would never send.
- **Reuse** — the Keycloak realm and user fixtures come from the sibling
`internal/acceptance/` suite (users `alice`/`charlie`, password
`password123`).
- **Networking** — every service uses a `*.localhost.pomerium.io` host
that resolves to `127.0.0.1` on the host *and* is a Docker network
alias, on fixed/identical ports — so the OIDC issuer URL is
byte-identical from the browser (front-channel) and from inside Pomerium
(back-channel). Only Pomerium serves T... (continued)

36992 of 70819 relevant lines covered (52.23%)

460.83 hits per line

Coverage Regressions

Lines Coverage ∆ File
10
80.13
 -0.21% pkg/ssh/manager.go
5
77.31
 -1.32% pkg/storage/postgres/backend.go
4
90.91
 -3.64% pkg/fanout/receive.go
2
89.19
 -5.41% pkg/fanout/fanout.go
1
81.95
 -0.21% pkg/envoy/resource_monitor_linux.go
Jobs
ID Job ID Ran Files Coverage
1 29331034788.1 706
52.23
 GitHub Action Run
Source Files on build 29331034788