bcgov / digital-trust-common-service / 32156312903

87%

push

github

[AU-01] followup (#168)

* feat(oidc): operator-driven key rotation, explicit DB pool, multi-replica exercise (#156)

- add --append multi-kid mode to generate-oidc-keys.mjs (prepend newest-first,
  keep old keys for verification, dedupe kid) plus an oidc:rotate-keys script
- add docs/OIDC-KEY-ROTATION.md: two-pass rolling-restart runbook; retirement is
  gated by the JWT access-token TTL (5m), not the refresh TTL (refresh tokens are
  opaque adapter records, unaffected by signing-key rotation)
- fix stale "auto-rotated keys" claims in ARCHITECTURE.md
- bound the node-postgres pool explicitly (DB_POOL_MAX/MIN/IDLE_TIMEOUT_MS) instead
  of the driver default; document the vars in .env.example
- run PR envs at replicaCount 2 to exercise the stateless cross-pod JWKS path;
  interactive cross-pod verification deferred to AU-02 (#35)
- document the cookie-key render-determinism constraint (in-cluster helm upgrade
  only) in the signing-secret template, values.yaml and README

* test(oidc): cover key rotation, multi-key JWKS load, and pool config (#156)

- e2e (oidc-key-rotation.e2e-spec.ts): boot against a real rotated 2-key JWKS and
  assert both keys publish at /oidc/jwks and new tokens are signed by the newest
  key, verified via kid selection
- unit: multi-key JWKS load order, generate-oidc-keys --append path, explicit
  DB pool defaults and overrides

* test(chart): add helm unit tests for OIDC signing secret and replicas

- cover the oidc-signing-secret guard rails: skips when create is false
  or an existingSecret is set, fails closed when create is on but no keys
- lock in cookie-key determinism: explicit cookieKeys used verbatim, and
  the 48-char random fallback when none supplied and no live secret exists
- assert replicaCount defaults to 1 and the PR overlay runs 2 replicas
- install and run the helm-unittest plugin in the helm CI job

* fix(ci): pin helm-unittest to v1.0.1 for helm 3.16 compatibility

v1.1.2's plugin.yaml uses platformHooks, w... (continued)

1444 of 1799 branches covered (80.27%)

Branch coverage included in aggregate %.

12 of 14 new or added lines in 2 files covered. (85.71%)

2697 of 2889 relevant lines covered (93.35%)

9.37 hits per line