Add Integration Tests #816

Sneagan · 2025-08-07T20:58:48Z

Kafka token issuance
Kafka token redemption
V1 HTTP Issuer GET endpoint
V1 HTTP Token Redemption POST endpoint
V3 HTTP Token Redemption POST endpoint

This checks the entire token redemption flow for all known production
use cases as well as checks that duplicate redemtion fails. There are
some cases with time limited issuers where a token is issued for a
future issuer whose redemption fails. These tokens are tested and
verified to fail as expected.

.github/workflows/integration-tests.yml

docker-compose.integration.yml

socket-security · 2025-08-08T01:27:33Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

- Kafka token issuance - Kafka token redemption - V1 HTTP Issuer GET endpoint - V1 HTTP Token Redemption POST endpoint - V3 HTTP Token Redemption POST endpoint This checks the entire token redemption flow for all known production use cases as well as checks that duplicate redemtion fails. There are some cases with time limited issuers where a token is issued for a future issuer whose redemption fails. These tokens are tested and verified to fail as expected.

Copilot

Pull Request Overview

This PR adds comprehensive integration tests for the challenge-bypass system, including complete end-to-end flows for token issuance and redemption via Kafka and HTTP endpoints. The tests verify the entire system working together with all dependencies (PostgreSQL, Kafka, DynamoDB).

Added full integration test suite covering Kafka token flows and HTTP endpoints
Enhanced logging and debugging capabilities for development and testing
Updated build configuration and CI pipeline to support integration testing

Reviewed Changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
integration-tests/intergration_test.go	New comprehensive integration test file with end-to-end token flows
docker-compose.integration.yml	Test environment configuration with all required services
Dockerfile.test	Test-specific container configuration for running integration tests
Makefile	Added integration test commands and cleanup utilities
.github/workflows/integration-tests.yml	CI workflow for automated integration testing
README.md	Updated documentation with integration test instructions
utils/test/dynamodb.go	Adjusted timeout for table activation in test environment
server/.go, kafka/.go	Enhanced logging and debugging output for integration tests
go.mod	Updated testify dependency to latest version

Copilot · 2025-08-12T07:13:56Z

integration-tests/intergration_test.go

@@ -0,0 +1,1021 @@
+//go:build integration


The filename contains a typo: 'intergration_test.go' should be 'integration_test.go' (missing 'a' in 'integration').

Copilot · 2025-08-12T07:13:56Z

kafka/signed_token_redeem_handler.go

@@ -418,7 +431,7 @@ func avroRedeemErrorResultFromError(
 		Associated_data: []byte(message),
 	}
 	resultSet := avroSchema.RedeemResultSet{
-		Request_id: "",
+		Request_id: requestID,


The original code had Request_id: "" but now uses requestID. However, looking at the function signature and context, the requestID parameter may not always be available or valid when this function is called in error scenarios. This change might introduce bugs where an empty or invalid requestID is used.

clD11 · 2025-08-12T18:40:48Z

utils/test/dynamodb.go

@@ -64,7 +64,7 @@ func SetupDynamodbTables(db *dynamodb.DynamoDB) error {
 		return fmt.Errorf("error creating dynamodb table")
 	}

-	err = tableIsActive(db, *input.TableName, time.Second, 10*time.Millisecond)
+	err = tableIsActive(db, *input.TableName, time.Second, 100*time.Millisecond)


suggestion: scope the error in the if

if err := tableIsActive(db, *input.TableName, time.Second, 100*time.Millisecond); err != nil { return fmt.Errorf("error table is not active %w", err) }

clD11 · 2025-08-12T18:44:32Z

server/issuers.go

@@ -62,7 +62,11 @@ func (c *Server) GetLatestIssuer(issuerType string, issuerCohort int16) (*model.
 	)
 	if err != nil {
 		if errors.Is(err, errIssuerCohortNotFound) {
-			c.Logger.Error("Issuer with given type and cohort not found")
+			c.Logger.Error(


question: why are we logging here opposed to just returning errors and logging in the handlers/edges?

There are many cases in the server code where we're logging in places where we should rely on the response logger. In this case, I added details for my own debugging. I'll remove this case because it shouldn't be here, but we should make a point to come back around to a lot of these logs later.

clD11 · 2025-08-12T19:08:29Z

integration-tests/intergration_test.go

+	PublicKey *crypto.PublicKey `json:"public_key"`
+	ExpiresAt string            `json:"expires_at,omitempty"`
+	Cohort    int16             `json:"cohort"`
+}


suggestion: add line break between types

clD11 · 2025-08-12T19:08:36Z

integration-tests/intergration_test.go

+	Duration  string     `json:"duration"`
+	Overlap   int        `json:"overlap"`
+	Buffer    int        `json:"buffer"`
+}


suggestion: add line break between types

clD11 · 2025-08-12T19:10:50Z

integration-tests/intergration_test.go

+//go:build integration
+// +build integration
+
+package integration


suggestion: add new line between functions and types declarations

Not sure whats going on with the formatting but there is a mixture of new lines and no line break between functions and types.

What's going on is my formatting plugin was failing and I didn't notice. Thanks. XD

clD11 · 2025-08-14T16:33:37Z

integration-tests/integration_test.go

+		expiresAt, err := time.Parse(time.RFC3339, issuerResp.ExpiresAt)
+		require.NoError(t, err, "failed to parse expires_at timestamp")
+
+		if expiresAt.After(time.Now()) {


suggestion: remove the extra logging and branching and just fail if there is no expires at

Gotta disagree on this one. We have expiration, buffers, overlaps, and more involved in these tokens and debugging issues related to those values is a challenge. I'd rather be verbose in the logs and eat the millisecond cost of branching in the test to have clarity.

clD11 · 2025-08-14T16:54:05Z

integration-tests/integration_test.go

+
+	t.Log("Generating random tokens...")
+	// Number of tokens must be divisible by the sum of Buffer and Overlap of the Issuer
+	for i := range 2 {


suggestion: pass the issuer into the function or surface the buffer and overlap

It is not clear how or where this value comes from or why it is set to two without having to really dig into the test setup. Also, if we want to change the number of token it will interfere with the other tests.

Totally right on this one. Thanks for calling this out.

clD11 · 2025-08-14T17:19:25Z

README.md

+- Verify the application correctly processes messages between Kafka topics
+- Ensure proper communication between all services
+
+#### Running Integration Tests


question: is there a way to run a single integration test?

I'll add documentation about the go test -run argument to help make this clear.

To run that we need to bring up the containers and test environment so we would need to run make dev then from the shell run the go test -run [args] but the make dev doesn't not include the new docker integration file so I am wondering if that would work.

It would be good to have something where we can run a single test and pick up and code changes we are making locally, similar to bat-go.

I see your meaning. Good point will add.

clD11 · 2025-08-14T20:43:17Z

integration-tests/integration_test.go

+
+	t.Log("HTTP ISSUER GET ENDPOINT TEST PASSED")
+}
+func TestTokenIssuanceViaKafkaAndRedeemViaHTTPFlow(t *testing.T) {


suggestion: break test into sub tests and make calls and assertions in the individual test

Its hard follow whats happening in these tests and there is a lot of coupling between issuing tokens and redeeming withing the test suite. For long term maintainability it might be easier to break the code up. For example,

// create issuer t.Run("sign_tokens", func(t *testing.T) { // ... }) t.Run("map_tokens", func(t *testing.T) { // ... }) t.Run("redeem_v3_success", func(t *testing.T) { // make http redeem calls // assert }) t.Run("redeem_v3_duplicate", func(t *testing.T) { // make http redeem calls // assert })

clD11 · 2025-08-14T20:45:47Z

integration-tests/integration_test.go

+			require.Equal(t, http.StatusConflict, resp2.StatusCode,
+				"Duplicate redemption should be blocked with 409 Conflict")
+		} else {
+			// Some failures are expected, especially for tokens with future keys


question: if the tests are not deterministic how do we know things are working?

It might be beneficial to move these calls into the specific tests and try and alleviate these issues.

clD11 · 2025-08-14T21:06:40Z

integration-tests/integration_test.go

+	TokenPreimage *crypto.TokenPreimage         `json:"t"`
+	Signature     *crypto.VerificationSignature `json:"signature"`
+}
+type blindedTokenRedeemResponse struct {


suggestion: can we remove this, looks like its unused

clD11 · 2025-08-14T21:06:45Z

integration-tests/integration_test.go

+type blindedTokenRedeemResponse struct {
+	Cohort int16 `json:"cohort"`
+}
+type BlindedTokenIssueRequestV2 struct {


suggestion: can we remove this, looks like its unused

clD11 · 2025-08-14T21:06:53Z

integration-tests/integration_test.go

+	BlindedTokens []*crypto.BlindedToken `json:"blinded_tokens"`
+	IssuerCohort  int16                  `json:"cohort"`
+}
+type blindedTokenIssueResponse struct {


suggestion: can we remove this, looks like its unused

kdenhartog

I can't see any issues with the postgres warnings and I see v3 was pinned

This LGTM from security perspective

Address PR comments regarding testing structure.

github-actions · 2025-08-23T03:37:10Z

[puLL-Merge] - brave-intl/challenge-bypass-server@816

Description

This PR adds comprehensive integration testing capabilities to the challenge-bypass-server project. It introduces a Docker-based integration test environment that spins up all required dependencies (PostgreSQL, Kafka, Zookeeper, LocalStack for DynamoDB emulation) and tests end-to-end flows including token issuance via Kafka, token redemption via both Kafka and HTTP endpoints, and proper handling of duplicate requests.

Security Hotspots

Hardcoded Test Credentials (Medium Risk - Test Environment Only)
- docker-compose.integration.yml contains hardcoded credentials (testuser:testpassword, AWS keys test:test)
- While this is acceptable for test environments, ensure these credentials never leak to production configurations
Network Exposure (Low Risk - Test Environment Only)
- Multiple services expose ports (2416, 5432, 9092, etc.) in the test environment
- This is expected for testing but should be isolated to test networks

Privacy Hotspots

Test Data Logging (Low Risk)
- Integration tests log various identifiers and request data
- Test metadata includes user IDs which could be considered PII in some contexts
- Logging is appropriately scoped to test environment only

Changes

Changes

`.github/workflows/integration-tests.yml`

New GitHub Actions workflow that runs integration tests on PR events
Uses pinned action version for security
Includes cleanup step that always runs

`Dockerfile.test`

New multi-stage Docker image for running integration tests
Builds Rust FFI library from specific git tag (1.0.1)
Installs PostgreSQL client and Go testing dependencies

`Makefile`

Adds comprehensive integration test targets (integration-test, integration-test-clean, integration-test-logs)
Updates docker-test target to exclude integration tests and set AWS pager
Provides detailed logging and error handling for test orchestration

`README.md`

Extensive documentation of integration testing capabilities
Clear instructions for running, debugging, and understanding the test suite
Explains test architecture and what flows are validated

`docker-compose.integration.yml`

Complete test environment configuration with health checks
Isolated test topics and databases
LocalStack configuration for DynamoDB emulation
Proper service dependencies and startup ordering

`go.mod` / `go.sum`

Updates testify dependency from v1.9.0 to v1.10.0

`integration-tests/integration_test.go`

Comprehensive integration test suite (986 lines)
Tests token issuance and redemption flows via both Kafka and HTTP
Validates duplicate detection, error handling, and end-to-end cryptographic operations
Includes proper setup/teardown and service readiness checks

`kafka/main.go`

Modifies Prometheus registry handling for test environments
Updates TLS dialer logic to handle test environment

`kafka/signed_blinded_token_issuer_handler.go`

Enhanced error logging with additional context for debugging

`kafka/signed_token_redeem_handler.go`

Improved error handling and logging
Fixed error result request ID assignment
Added debug logging for issuer matching

`server/issuers.go`

Removes redundant error logging for issuer not found cases

`server/tokens.go`

Adds debug logging for issuer information and token verification failures

`utils/test/dynamodb.go`

Increases retry interval for table activation checks (10ms → 100ms)

sequenceDiagram
    participant GHA as GitHub Actions
    participant Docker as Docker Compose
    participant Kafka as Kafka
    participant DB as PostgreSQL
    participant LS as LocalStack
    participant CBP as Challenge Bypass Server
    participant Tests as Integration Tests

    GHA->>Docker: make integration-test
    Docker->>DB: Start PostgreSQL
    Docker->>Kafka: Start Kafka + Zookeeper
    Docker->>LS: Start LocalStack (DynamoDB)
    Docker->>CBP: Start main application
    
    Note over Docker: Wait for all services healthy
    
    Docker->>Tests: Build and start test runner
    Tests->>CBP: Create test issuer (HTTP)
    Tests->>Kafka: Send token signing request
    CBP->>Kafka: Process signing request
    Kafka->>Tests: Return signed tokens
    Tests->>Kafka: Send redemption request
    CBP->>Kafka: Process redemption
    Kafka->>Tests: Return redemption result
    Tests->>CBP: Test HTTP redemption endpoints
    CBP->>Tests: Return redemption response
    Tests->>Tests: Validate duplicate detection
    
    Tests->>Docker: Tests complete
    Docker->>Docker: Cleanup all containers/volumes
    Docker->>GHA: Report results

Sneagan changed the title ~~Feature/integration testing~~ Add Integration Tests Aug 7, 2025

github-actions bot reviewed Aug 7, 2025

View reviewed changes

.github/workflows/integration-tests.yml Show resolved Hide resolved

docker-compose.integration.yml Show resolved Hide resolved

docker-compose.integration.yml Show resolved Hide resolved

github-actions bot added the needs-security-review label Aug 7, 2025

github-actions bot assigned kdenhartog and thypon Aug 7, 2025

Sneagan force-pushed the feature/integration-testing branch from abe7f82 to 12b7ac1 Compare August 12, 2025 02:05

Tidy

d041c99

Sneagan requested review from tackley, clD11 and mihaiplesa August 12, 2025 02:17

Sneagan marked this pull request as ready for review August 12, 2025 02:18

Correct test name

5faf2d9

github-actions bot added the puLL-Merge label Aug 12, 2025

Correct README

181e487

mihaiplesa previously approved these changes Aug 12, 2025

View reviewed changes

mihaiplesa requested a review from Copilot August 12, 2025 07:12

Copilot AI reviewed Aug 12, 2025

View reviewed changes

Rename integration test file

7c7d9f5

Sneagan dismissed mihaiplesa’s stale review via 7c7d9f5 August 13, 2025 19:19

clD11 reviewed Aug 14, 2025

View reviewed changes

Sneagan added 3 commits August 19, 2025 16:12

Address simple PR feedback

88f35b4

Resolve conflicts

e5bf5ed

Remove unneeded type

b9c03f6

kdenhartog removed the needs-security-review label Aug 20, 2025

kdenhartog unassigned thypon and kdenhartog Aug 20, 2025

kdenhartog approved these changes Aug 20, 2025

View reviewed changes

Integration testing pr feedback (#827)

710af15

Address PR comments regarding testing structure.

Enable specifying an integration test

15ec90f

Add Integration Tests #816

Are you sure you want to change the base?

Add Integration Tests #816

Uh oh!

Conversation

Sneagan commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 12, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

clD11 Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kdenhartog left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Aug 23, 2025

Description

Security Hotspots

Privacy Hotspots

Changes

.github/workflows/integration-tests.yml

Dockerfile.test

Makefile

README.md

docker-compose.integration.yml

Sneagan commented Aug 7, 2025 •

edited

Loading

socket-security bot commented Aug 8, 2025 •

edited

Loading

clD11 Aug 14, 2025 •

edited

Loading

`.github/workflows/integration-tests.yml`

`Dockerfile.test`

`Makefile`

`README.md`

`docker-compose.integration.yml`

`go.mod` / `go.sum`

`integration-tests/integration_test.go`

`kafka/main.go`

`kafka/signed_blinded_token_issuer_handler.go`

`kafka/signed_token_redeem_handler.go`

`server/issuers.go`

`server/tokens.go`

`utils/test/dynamodb.go`