52 lines
2.0 KiB
JavaScript
52 lines
2.0 KiB
JavaScript
|
// Journey: ZITADEL id_token → CloudEP JWT exchange.
|
||
|
|
//
|
||
|
|
// Endpoint exercised:
|
||
|
|
// POST /api/v1/auth/token/exchange (TokenExchangeReq)
|
||
|
|
//
|
||
|
|
// Happy path requires a valid ZITADEL id_token issued for the gateway's
|
||
|
|
// configured OIDC client. The default `make k6-up` ZITADEL bootstrap only
|
||
|
|
// creates a service-account PAT (no human-user OIDC client + password grant),
|
||
|
|
// so we cover negative cases only and mark the happy path as TODO.
|
||
|
|
//
|
||
|
|
// To enable happy-path: configure a ZITADEL OIDC application with password
|
||
|
|
// grant in deploy/zitadel/steps.yaml, export OAUTH_CLIENT_ID + secret + user
|
||
|
|
// credentials, then call ZITADEL's /oauth/v2/token to obtain an id_token.
|
||
|
|
import { post, checkErrorOneOf } from '../lib/http.js';
|
||
|
|
import { cfg } from '../lib/config.js';
|
||
|
|
|
||
|
|
export const options = {
|
||
|
|
vus: 1,
|
||
|
|
iterations: 1,
|
||
|
|
thresholds: { checks: ['rate==1.0'] },
|
||
|
|
};
|
||
|
|
|
||
|
|
export default function () {
|
||
|
|
// Negative 1: empty id_token → 400 missing/invalid input
|
||
|
|
const r1 = post('/api/v1/auth/token/exchange', {
|
||
|
|
tenant_slug: cfg.tenantSlug,
|
||
|
|
id_token: '',
|
||
|
|
});
|
||
|
|
// either 400 (validation) or 401 (id_token invalid)
|
||
|
|
if (r1.status !== 400 && r1.status !== 401) {
|
||
|
|
throw new Error(`empty id_token: unexpected status ${r1.status}: ${r1.body}`);
|
||
|
|
}
|
||
|
|
|
||
|
|
// Negative 2: bogus id_token. Two acceptable outcomes depending on whether
|
||
|
|
// a JWKS URL is wired:
|
||
|
|
// 401+28501000 → invalid id_token (JWKS wired; gateway verified locally)
|
||
|
|
// 502+28802000 → zitadel request failed (default k6 env: no JWKS configured,
|
||
|
|
// gateway falls through to a remote introspection call).
|
||
|
|
// Either outcome proves the endpoint exists and refuses bad tokens.
|
||
|
|
const r2 = post('/api/v1/auth/token/exchange', {
|
||
|
|
tenant_slug: cfg.tenantSlug,
|
||
|
|
id_token: 'not.a.real.jwt',
|
||
|
|
});
|
||
|
|
checkErrorOneOf(r2, 'POST /auth/token/exchange (bogus id_token)', [
|
||
|
|
[401, 28501000],
|
||
|
|
[502, 28802000],
|
||
|
|
]);
|
||
|
|
|
||
|
|
// TODO: happy path — needs ZITADEL OAuth client + password grant configured.
|
||
|
|
console.log('[token_exchange] happy path skipped (needs ZITADEL OIDC client; see file header)');
|
||
|
|
}
|