Get the devnet e2e harness running again - #367
Draft
gyorgybalazsi wants to merge 3 commits into
Draft
Conversation
The EKS cluster ibtc-devnet no longer exists. The Canton participants
now run one per namespace, as canton-node-{1,2,3}/svc/participant. The
justfile port-forward recipe already used that layout, but
devnet.env.sh was missed, so every run died opening the tunnels.
Compose the Keycloak token URL the way the runtime auth path does,
{url}/realms/{realm}. The old form stripped a trailing /auth and then
re-added it unconditionally, so no configured value could reach a
KeycloakX server.
Report the smoke-check failure instead of hiding it. Piping curl into
jq under `set -o pipefail` killed the script before the diagnostic
printed, and `-f` turned a 401 into exit 56, which reads as a network
fault rather than a rejected login.
Add DECPM_KEYCLOAK_{URL,USERNAME,PASSWORD}_OVERRIDE so a credential can
come from a secret manager without editing the per-participant .env
files.
Refs #366
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The fixture stripped a trailing /auth and then re-added it, so both
`https://host` and `https://host/auth` produced /auth/realms/... The
migrated devnet Keycloak is KeycloakX, which serves no /auth prefix, so
the fixture could not authenticate and no configuration could fix it.
DecMan's runtime path already builds {url}/realms/{realm}, in
src/auth/validators/common.rs::oidc_issuer_of. Follow that, and let a
deployment which still serves the legacy prefix carry it in the
configured URL.
The stale comment claimed to mirror src/auth/mod.rs::token_url. No such
function exists.
crates/decman/tests/common/auth.rs:75 has the same bug. This commit
does not touch it.
Refs #366
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The comparison table pages its rows 25 at a time. Devnet vets 324 packages, so governance-core sorts onto a later page and is never mounted. The count saw 0 and polled for the full 60s against something that could not appear, while the table itself was healthy and showing matches on both peers. Search narrows comparison.local_packages ahead of pagination, in PackagesPanel.tsx:92, so filtering first puts the matches on page 1. The assertion then resolves in about 3 seconds. Refs #366 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
The devnet e2e and integration-test harness could not reach devnet at all. This
gets it running again. Issue #366 has the full findings; this PR carries the
five fixes I have working code for.
Why
Devnet moved. The old EKS cluster
ibtc-devnetno longer exists, and Keycloakmoved with it. The harness still pointed at both.
One bug hid the rest.
devnet.env.shpipedcurlintojq, and bothrun.shand
bring-up.shset-o pipefail. A failing curl therefore killed the scriptbefore its own diagnostic could print, so the caller saw
exit 6and nothingelse.
curl -fcompounded it by discarding the response body and, on HTTP/2,turning a plain 401 into exit 56 — which reads as a network fault rather than a
rejected login.
That is why this went undiagnosed, and why #348 and #214 both shipped saying
the suite had not been run live. Nobody could run it.
Changes
e2e/fixtures/auth.tsstops forcing/authThe participants now run one per namespace:
ieu-devnetdevnetcatalyst-cantoncanton-node-{1,2,3}participant-ibtc-devnet-$idxparticipantThe
justfileport-forwardrecipe already used this layout, down to the portpairs. The migration updated it and missed
devnet.env.sh.How tested
Brought the stack up against live devnet and ran the Playwright suite. 8 of
12 passed, up from not starting at all.
All three nodes serve the SPA and report the new Keycloak host. The login phase
mints a real ROPC token and DecMan accepts it, which is the direct check on the
token-URL change. Test 04 went from a 57.5s timeout to passing in 3.1s, which
is the check on the pagination change.
npm run typecheckis clean. Both shell scripts passbash -n.The run needed the current Keycloak password from 1Password, because the value
in
development/remote/participant-*/.envis stale. Those files are nottouched here — see #366.
What this does not fix
Phase 05 still fails, so phases 05-08 do not run. The Deploy Contracts dialog
renders the Governance Core card disabled even though phase 04 has just
confirmed both peers hold the DAR. That is defect 9 in #366, in the frontend
rather than the harness, and I have not pinned down the cause.
Also left alone:
crates/decman/tests/common/auth.rs:75has the same/authbug and will fail the same way,
build.rsnever refreshes a stalenode_modules, and the README documents the old cluster and a run command thatfails under zsh. All in #366.
Note for the reviewer
Commit 1 groups four changes to one file. They are facets of one fix rather
than separate concerns — none of them alone makes the harness work, so
splitting them would produce commits that cannot be tested independently.
Happy to split if you would rather.
🤖 Generated with Claude Code