sefrone-api-e2e 1.2.7__tar.gz → 1.2.9__tar.gz

{sefrone_api_e2e-1.2.7 → sefrone_api_e2e-1.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sefrone_api_e2e
-Version: 1.2.7
+Version: 1.2.9
 Summary: A Python package to provide e2e testing helpers for sefrone API projects
 Home-page: https://bitbucket.org/sefrone/sefrone_pypi
 Author: Sefrone

{sefrone_api_e2e-1.2.7 → sefrone_api_e2e-1.2.9}/sefrone_api_e2e/e2e/Scenarios/Auth/7_email_2fa_flow.yaml

@@ -77,3 +77,61 @@ steps:
       - "{{body.errorCode}} == 0"
       - "{{body.response.accountType}} == '2fa'"
       - "{{body.response.isActive}} == True"
+
+  - name: "Login admin for invite"
+    skip_if:
+      - "InviteEmail2FA not in {$stored.0_check_features.enabled_features}"
+    retry:
+      attempts: 10
+      delay_seconds: 5
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/login"
+    send_as: "json"
+    body:
+      device: "e2e_test_device"
+      pseudo: "$var(DEFAULT_USERNAME)"
+      password: "$var(DEFAULT_PASSWORD)"
+    expect:
+      status: 200
+      body:
+        response:
+          token: string
+    save:
+      admin_token: "{{body.response.token}}"
+
+  - name: "Generate unique invite email"
+    skip_if:
+      - "InviteEmail2FA not in {$stored.0_check_features.enabled_features}"
+    randomize:
+      invite_email_suffix: 12
+
+  - name: "Invite new user by email"
+    skip_if:
+      - "InviteEmail2FA not in {$stored.0_check_features.enabled_features}"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/2fa/invite"
+    request_headers:
+      - x-api-token: "{$stored.7_email_2fa_flow.admin_token}"
+    send_as: "json"
+    body:
+      email: "e2e_invite_{$stored.7_email_2fa_flow.invite_email_suffix}@mock.local"
+      accountType: "2fa"
+    expect:
+      status: 200
+      body:
+        errorCode: number
+        errorCodeStr: string
+        message: string
+    assertions:
+      - "{{body.errorCode}} == 0"
+
+  - name: "Verify invite email was sent"
+    skip_if:
+      - "InviteEmail2FA not in {$stored.0_check_features.enabled_features}"
+    check_email:
+      to: "e2e_invite_{$stored.7_email_2fa_flow.invite_email_suffix}@mock.local"
+    retry:
+      attempts: 15
+      delay_seconds: 2
+    assertions:
+      - "{{email.to}} include e2e_invite_{$stored.7_email_2fa_flow.invite_email_suffix}@mock.local"

sefrone_api_e2e-1.2.9/sefrone_api_e2e/e2e/Scenarios/Oidc/1_relying_party_admin.yaml

@@ -0,0 +1,84 @@
+name: "Oidc - Relying Party Admin CRUD"
+base_url: "http://localhost:$var(API_PUBLIC_PORT)"
+skip_if:
+  - "OidcIdentityProvider not in {$stored.0_check_features.enabled_features}"
+
+steps:
+  - name: "Login admin"
+    retry:
+      attempts: 10
+      delay_seconds: 5
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/login"
+    send_as: "json"
+    body:
+      device: "e2e_oidc_admin_device"
+      pseudo: "$var(DEFAULT_USERNAME)"
+      password: "$var(DEFAULT_PASSWORD)"
+    expect:
+      status: 200
+      body:
+        response:
+          token: string
+    save:
+      admin_token: "{{body.response.token}}"
+
+  - name: "Generate unique client id"
+    randomize:
+      client_suffix: 8
+
+  - name: "Register a relying party"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    send_as: "json"
+    body:
+      clientId: "e2e-rp-{$stored.client_suffix}"
+      clientSecret: "e2e-secret-{$stored.client_suffix}"
+      displayName: "E2E Relying Party {$stored.client_suffix}"
+      redirectUris:
+        - "http://localhost:9999/callback"
+      postLogoutRedirectUris: []
+      requiresConsent: false
+    expect:
+      status: 200
+      body:
+        response:
+          id: string
+          clientId: string
+    save:
+      relying_party_db_id: "{{body.response.id}}"
+    assertions:
+      - "{{body.response.clientId}} == 'e2e-rp-{$stored.client_suffix}'"
+      - "{{body.response.requiresConsent}} == False"
+
+  - name: "List relying parties — the new one is present"
+    method: "GET"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+      body:
+        response: []
+    assertions:
+      - "{{body.response.count()}} >= 1"
+
+  - name: "Delete the relying party (cleanup)"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties/e2e-rp-{$stored.client_suffix}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+      body:
+        errorCode: number
+
+  - name: "Deleting again returns not found"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties/e2e-rp-{$stored.client_suffix}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 404

sefrone_api_e2e-1.2.9/sefrone_api_e2e/e2e/Scenarios/Oidc/2_authorization_code_flow.yaml

@@ -0,0 +1,257 @@
+name: "Oidc - Discovery, JWKS and Full Authorization Code Flow"
+base_url: "http://localhost:$var(API_PUBLIC_PORT)"
+skip_if:
+  - "OidcIdentityProvider not in {$stored.0_check_features.enabled_features}"
+
+steps:
+  - name: "Login admin"
+    retry:
+      attempts: 10
+      delay_seconds: 5
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/login"
+    send_as: "json"
+    body:
+      device: "e2e_oidc_authorize_device"
+      pseudo: "$var(DEFAULT_USERNAME)"
+      password: "$var(DEFAULT_PASSWORD)"
+    expect:
+      status: 200
+      body:
+        response:
+          token: string
+    save:
+      admin_token: "{{body.response.token}}"
+
+  - name: "Generate unique ids and PKCE verifier"
+    randomize:
+      client_suffix: 8
+      account_suffix: 8
+      pkce_verifier:
+        type: string
+        length: 64
+
+  - name: "Register a relying party for this flow (pre-trusted, no consent)"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    send_as: "json"
+    body:
+      clientId: "e2e-authz-{$stored.client_suffix}"
+      clientSecret: "e2e-secret-{$stored.client_suffix}"
+      displayName: "E2E Authorize Flow Client"
+      redirectUris:
+        - "http://localhost:9999/callback"
+      postLogoutRedirectUris: []
+      requiresConsent: false
+    expect:
+      status: 200
+      body:
+        response:
+          clientId: string
+
+  - name: "Create a standard test account for this flow"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/create?accountType=standard"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    send_as: "json"
+    body:
+      username: "e2e_oidc_user_{$stored.account_suffix}"
+      password: "E2eTestPass{$stored.account_suffix}"
+    expect:
+      status: 200
+      body:
+        response:
+          accountId: string
+          isActive: boolean
+    save:
+      test_account_id: "{{body.response.accountId}}"
+    assertions:
+      - "{{body.response.isActive}} == True"
+
+  - name: "Discovery document exposes the expected endpoints"
+    method: "GET"
+    endpoint: "/.well-known/openid-configuration"
+    expect:
+      status: 200
+      body:
+        issuer: string
+        authorization_endpoint: string
+        token_endpoint: string
+        userinfo_endpoint: string
+        jwks_uri: string
+        grant_types_supported: []
+        scopes_supported: []
+    assertions:
+      - "{{body.authorization_endpoint}} include /account/oidc/authorize"
+      - "{{body.token_endpoint}} include /account/oidc/token"
+      - "{{body.userinfo_endpoint}} include /account/oidc/userinfo"
+      - "{{body.grant_types_supported}} include authorization_code"
+      - "{{body.grant_types_supported}} include refresh_token"
+      - "{{body.scopes_supported}} include openid"
+
+  - name: "JWKS exposes at least one RSA signing key"
+    method: "GET"
+    endpoint: "/.well-known/jwks"
+    expect:
+      status: 200
+      body:
+        keys: []
+    assertions:
+      - "{{body.keys.count()}} >= 1"
+      - "{{body.keys[0].kty}} == 'RSA'"
+
+  - name: "GET authorize without credentials renders the login page"
+    method: "GET"
+    endpoint: "/account/oidc/authorize"
+    request_query_params:
+      client_id: "e2e-authz-{$stored.client_suffix}"
+      redirect_uri: "http://localhost:9999/callback"
+      response_type: "code"
+      scope: "openid profile email"
+      state: "e2e-state-{$stored.client_suffix}"
+      code_challenge: "{$stored.pkce_verifier}"
+      code_challenge_method: "plain"
+    expect:
+      status: 200
+      content_type: "text/html"
+
+  - name: "POST authorize with wrong password re-renders the login page (not a crash)"
+    method: "POST"
+    endpoint: "/account/oidc/authorize"
+    send_as: "form"
+    body:
+      client_id: "e2e-authz-{$stored.client_suffix}"
+      redirect_uri: "http://localhost:9999/callback"
+      response_type: "code"
+      scope: "openid profile email"
+      state: "e2e-state-{$stored.client_suffix}"
+      code_challenge: "{$stored.pkce_verifier}"
+      code_challenge_method: "plain"
+      sefrone_username: "e2e_oidc_user_{$stored.account_suffix}"
+      sefrone_password: "definitely-the-wrong-password"
+    expect:
+      status: 200
+      content_type: "text/html"
+
+  - name: "POST authorize with valid credentials redirects with an authorization code"
+    method: "POST"
+    endpoint: "/account/oidc/authorize"
+    send_as: "form"
+    allow_redirects: false
+    body:
+      client_id: "e2e-authz-{$stored.client_suffix}"
+      redirect_uri: "http://localhost:9999/callback"
+      response_type: "code"
+      scope: "openid profile email"
+      state: "e2e-state-{$stored.client_suffix}"
+      code_challenge: "{$stored.pkce_verifier}"
+      code_challenge_method: "plain"
+      sefrone_username: "e2e_oidc_user_{$stored.account_suffix}"
+      sefrone_password: "E2eTestPass{$stored.account_suffix}"
+    expect:
+      status: 302
+      headers:
+        Location: "include:http://localhost:9999/callback?code="
+    save:
+      auth_code:
+        from: "{{headers.Location}}"
+        regex: "code=([^&]+)"
+
+  - name: "Exchange the authorization code for tokens"
+    method: "POST"
+    endpoint: "/account/oidc/token"
+    send_as: "form"
+    body:
+      grant_type: "authorization_code"
+      code: "{$stored.auth_code}"
+      redirect_uri: "http://localhost:9999/callback"
+      client_id: "e2e-authz-{$stored.client_suffix}"
+      client_secret: "e2e-secret-{$stored.client_suffix}"
+      code_verifier: "{$stored.pkce_verifier}"
+    expect:
+      status: 200
+      body:
+        access_token: string
+        token_type: string
+        id_token: string
+    save:
+      access_token: "{{body.access_token}}"
+    assertions:
+      - "{{body.token_type}} == 'Bearer'"
+
+  - name: "Userinfo returns the authenticated account's claims"
+    method: "GET"
+    endpoint: "/account/oidc/userinfo"
+    request_headers:
+      - Authorization: "Bearer {$stored.access_token}"
+    expect:
+      status: 200
+      body:
+        sub: string
+        preferred_username: string
+    assertions:
+      - "{{body.sub}} == '{$stored.test_account_id}'"
+      - "{{body.preferred_username}} == 'e2e_oidc_user_{$stored.account_suffix}'"
+
+  - name: "Replaying the same authorization code is rejected"
+    method: "POST"
+    endpoint: "/account/oidc/token"
+    send_as: "form"
+    body:
+      grant_type: "authorization_code"
+      code: "{$stored.auth_code}"
+      redirect_uri: "http://localhost:9999/callback"
+      client_id: "e2e-authz-{$stored.client_suffix}"
+      client_secret: "e2e-secret-{$stored.client_suffix}"
+      code_verifier: "{$stored.pkce_verifier}"
+    expect:
+      status: 400
+      body:
+        error: string
+    assertions:
+      - "{{body.error}} == 'invalid_grant'"
+
+  - name: "Token endpoint rejects a bogus authorization code"
+    method: "POST"
+    endpoint: "/account/oidc/token"
+    send_as: "form"
+    body:
+      grant_type: "authorization_code"
+      code: "this-code-does-not-exist"
+      redirect_uri: "http://localhost:9999/callback"
+      client_id: "e2e-authz-{$stored.client_suffix}"
+      client_secret: "e2e-secret-{$stored.client_suffix}"
+      code_verifier: "{$stored.pkce_verifier}"
+    expect:
+      status: 400
+      body:
+        error: string
+    assertions:
+      - "{{body.error}} == 'invalid_grant'"
+
+  - name: "Userinfo rejects a garbage bearer token"
+    method: "GET"
+    endpoint: "/account/oidc/userinfo"
+    request_headers:
+      - Authorization: "Bearer this-is-not-a-real-token"
+    expect:
+      status: 401
+
+  - name: "Cleanup: delete relying party"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties/e2e-authz-{$stored.client_suffix}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+
+  - name: "Cleanup: delete test account"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/delete/{$stored.test_account_id}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200

sefrone_api_e2e-1.2.9/sefrone_api_e2e/e2e/Scenarios/Oidc/3_disable_propagation_flow.yaml

@@ -0,0 +1,208 @@
+name: "Oidc - Account Disable Propagation"
+base_url: "http://localhost:$var(API_PUBLIC_PORT)"
+skip_if:
+  - "OidcIdentityProvider not in {$stored.0_check_features.enabled_features}"
+
+# This is the core safety requirement of the OIDC identity provider: deactivating an
+# account here must cut off that user's access to every downstream relying party.
+#   - userinfo re-checks IsActive on every call -> cut off immediately.
+#   - a refresh grant is NOT automatically rejected just because IsActive flipped
+#     (best-effort v1 design) -- it keeps working until the admin explicitly calls
+#     the revoke-access endpoint, after which OpenIddict's own token-status check
+#     rejects it natively.
+
+steps:
+  - name: "Login admin"
+    retry:
+      attempts: 10
+      delay_seconds: 5
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/login"
+    send_as: "json"
+    body:
+      device: "e2e_oidc_disable_device"
+      pseudo: "$var(DEFAULT_USERNAME)"
+      password: "$var(DEFAULT_PASSWORD)"
+    expect:
+      status: 200
+      body:
+        response:
+          token: string
+    save:
+      admin_token: "{{body.response.token}}"
+
+  - name: "Generate unique ids and PKCE verifier"
+    randomize:
+      client_suffix: 8
+      account_suffix: 8
+      pkce_verifier:
+        type: string
+        length: 64
+
+  - name: "Register a relying party for this flow"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    send_as: "json"
+    body:
+      clientId: "e2e-disable-{$stored.client_suffix}"
+      clientSecret: "e2e-secret-{$stored.client_suffix}"
+      displayName: "E2E Disable Propagation Client"
+      redirectUris:
+        - "http://localhost:9999/callback"
+      postLogoutRedirectUris: []
+      requiresConsent: false
+    expect:
+      status: 200
+
+  - name: "Create a standard test account"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/create?accountType=standard"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    send_as: "json"
+    body:
+      username: "e2e_oidc_disable_{$stored.account_suffix}"
+      password: "E2eTestPass{$stored.account_suffix}"
+    expect:
+      status: 200
+      body:
+        response:
+          accountId: string
+    save:
+      test_account_id: "{{body.response.accountId}}"
+
+  - name: "Sign in, requesting offline_access for a refresh token"
+    method: "POST"
+    endpoint: "/account/oidc/authorize"
+    send_as: "form"
+    allow_redirects: false
+    body:
+      client_id: "e2e-disable-{$stored.client_suffix}"
+      redirect_uri: "http://localhost:9999/callback"
+      response_type: "code"
+      scope: "openid profile email offline_access"
+      state: "e2e-state-{$stored.client_suffix}"
+      code_challenge: "{$stored.pkce_verifier}"
+      code_challenge_method: "plain"
+      sefrone_username: "e2e_oidc_disable_{$stored.account_suffix}"
+      sefrone_password: "E2eTestPass{$stored.account_suffix}"
+    expect:
+      status: 302
+      headers:
+        Location: "include:http://localhost:9999/callback?code="
+    save:
+      auth_code:
+        from: "{{headers.Location}}"
+        regex: "code=([^&]+)"
+
+  - name: "Exchange the code for an access token and a refresh token"
+    method: "POST"
+    endpoint: "/account/oidc/token"
+    send_as: "form"
+    body:
+      grant_type: "authorization_code"
+      code: "{$stored.auth_code}"
+      redirect_uri: "http://localhost:9999/callback"
+      client_id: "e2e-disable-{$stored.client_suffix}"
+      client_secret: "e2e-secret-{$stored.client_suffix}"
+      code_verifier: "{$stored.pkce_verifier}"
+    expect:
+      status: 200
+      body:
+        access_token: string
+        refresh_token: string
+    save:
+      access_token: "{{body.access_token}}"
+      refresh_token: "{{body.refresh_token}}"
+
+  - name: "Sanity check: userinfo works before deactivation"
+    method: "GET"
+    endpoint: "/account/oidc/userinfo"
+    request_headers:
+      - Authorization: "Bearer {$stored.access_token}"
+    expect:
+      status: 200
+      body:
+        sub: string
+    assertions:
+      - "{{body.sub}} == '{$stored.test_account_id}'"
+
+  - name: "Deactivate the account"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/activationState/{$stored.test_account_id}?isActive=false"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+      body:
+        errorCode: number
+    assertions:
+      - "{{body.errorCode}} == 0"
+
+  - name: "Userinfo is cut off immediately after deactivation"
+    method: "GET"
+    endpoint: "/account/oidc/userinfo"
+    request_headers:
+      - Authorization: "Bearer {$stored.access_token}"
+    expect:
+      status: 401
+
+  - name: "Refresh grant still succeeds before the explicit revoke-access call (documented best-effort gap)"
+    method: "POST"
+    endpoint: "/account/oidc/token"
+    send_as: "form"
+    body:
+      grant_type: "refresh_token"
+      refresh_token: "{$stored.refresh_token}"
+      client_id: "e2e-disable-{$stored.client_suffix}"
+      client_secret: "e2e-secret-{$stored.client_suffix}"
+    expect:
+      status: 200
+      body:
+        access_token: string
+
+  - name: "Admin explicitly revokes all OIDC access for the account"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/accounts/{$stored.test_account_id}/revoke-access"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+      body:
+        errorCode: number
+    assertions:
+      - "{{body.errorCode}} == 0"
+
+  - name: "Refresh grant now fails after the explicit revoke"
+    method: "POST"
+    endpoint: "/account/oidc/token"
+    send_as: "form"
+    body:
+      grant_type: "refresh_token"
+      refresh_token: "{$stored.refresh_token}"
+      client_id: "e2e-disable-{$stored.client_suffix}"
+      client_secret: "e2e-secret-{$stored.client_suffix}"
+    expect:
+      status: 400
+      body:
+        error: string
+    assertions:
+      - "{{body.error}} == 'invalid_grant'"
+
+  - name: "Cleanup: delete relying party"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties/e2e-disable-{$stored.client_suffix}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+
+  - name: "Cleanup: delete test account"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/delete/{$stored.test_account_id}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200

sefrone_api_e2e-1.2.9/sefrone_api_e2e/e2e/Scenarios/Oidc/4_multi_project_isolation.yaml

@@ -0,0 +1,156 @@
+name: "Oidc - Relying Parties Are Isolated Per Project"
+base_url: "http://localhost:$var(API_PUBLIC_PORT)"
+skip_if:
+  - "OidcIdentityProvider not in {$stored.0_check_features.enabled_features}"
+  - "Projects not in {$stored.0_check_features.enabled_features}"
+
+# Relying parties are scoped per-project (stored on the OpenIddict application's own
+# Properties dictionary, not a global registry) so that an admin in one project never
+# sees or can delete another project's relying parties.
+
+steps:
+  - name: "Login admin"
+    retry:
+      attempts: 10
+      delay_seconds: 5
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/login"
+    send_as: "json"
+    body:
+      device: "e2e_oidc_multiproject_device"
+      pseudo: "$var(DEFAULT_USERNAME)"
+      password: "$var(DEFAULT_PASSWORD)"
+    expect:
+      status: 200
+      body:
+        response:
+          token: string
+    save:
+      admin_token: "{{body.response.token}}"
+
+  - name: "Generate unique ids"
+    randomize:
+      project_suffix: 8
+      client_a_suffix: 8
+      client_b_suffix: 8
+
+  - name: "Create a second project"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/project"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    send_as: "json"
+    body:
+      name: "e2e_oidc_proj_{$stored.project_suffix}"
+      description: "E2E OIDC multi-project isolation test"
+    expect:
+      status: 200
+      body:
+        response:
+          id: string
+          name: string
+    save:
+      second_project_id: "{{body.response.id}}"
+      second_project_name: "{{body.response.name}}"
+
+  - name: "Register a relying party under the default project"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    send_as: "json"
+    body:
+      clientId: "e2e-isoA-{$stored.client_a_suffix}"
+      clientSecret: "e2e-secret-{$stored.client_a_suffix}"
+      displayName: "E2E Isolation Client A"
+      redirectUris:
+        - "http://localhost:9999/callback"
+      postLogoutRedirectUris: []
+      requiresConsent: false
+    expect:
+      status: 200
+      body:
+        response:
+          project: string
+    assertions:
+      - "{{body.response.project}} == '$var(AUTH_PROJECT_NAME)'"
+
+  - name: "Register a relying party under the second project"
+    method: "POST"
+    endpoint: "/api/v1/apiAuth/account/{$stored.second_project_name}/oidc/admin/relying-parties"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    send_as: "json"
+    body:
+      clientId: "e2e-isoB-{$stored.client_b_suffix}"
+      clientSecret: "e2e-secret-{$stored.client_b_suffix}"
+      displayName: "E2E Isolation Client B"
+      redirectUris:
+        - "http://localhost:9999/callback"
+      postLogoutRedirectUris: []
+      requiresConsent: false
+    expect:
+      status: 200
+      body:
+        response:
+          project: string
+    assertions:
+      - "{{body.response.project}} == '{$stored.second_project_name}'"
+
+  - name: "Listing under the default project only shows client A"
+    method: "GET"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+      body:
+        response: []
+    assertions:
+      - "{{body.response.count()}} == 1"
+      - "{{body.response[0].clientId}} == 'e2e-isoA-{$stored.client_a_suffix}'"
+
+  - name: "Listing under the second project only shows client B"
+    method: "GET"
+    endpoint: "/api/v1/apiAuth/account/{$stored.second_project_name}/oidc/admin/relying-parties"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+      body:
+        response: []
+    assertions:
+      - "{{body.response.count()}} == 1"
+      - "{{body.response[0].clientId}} == 'e2e-isoB-{$stored.client_b_suffix}'"
+
+  - name: "Cannot delete client B through the default project's route"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties/e2e-isoB-{$stored.client_b_suffix}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 404
+
+  - name: "Cleanup: delete client A"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/$var(AUTH_PROJECT_NAME)/oidc/admin/relying-parties/e2e-isoA-{$stored.client_a_suffix}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+
+  - name: "Cleanup: delete client B through its own project's route"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/account/{$stored.second_project_name}/oidc/admin/relying-parties/e2e-isoB-{$stored.client_b_suffix}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200
+
+  - name: "Cleanup: delete second project"
+    method: "DELETE"
+    endpoint: "/api/v1/apiAuth/project/{$stored.second_project_id}"
+    request_headers:
+      - x-api-token: "{$stored.admin_token}"
+    expect:
+      status: 200

{sefrone_api_e2e-1.2.7 → sefrone_api_e2e-1.2.9}/sefrone_api_e2e/e2e_scenarios_manager.py

@@ -8,6 +8,7 @@ class E2EScenariosManager:
 
     # Path to bundled e2e resources relative to this file
     _BUNDLED_AUTH_SCENARIOS_DIR = Path(__file__).parent / "e2e" / "Scenarios" / "Auth"
+    _BUNDLED_OIDC_SCENARIOS_DIR = Path(__file__).parent / "e2e" / "Scenarios" / "Oidc"
 
     @staticmethod
     def __export_scenarios(src, destination_dir, overwrite=False):
@@ -45,6 +46,15 @@ class E2EScenariosManager:
             destination_dir,
             overwrite
         )
+        
+    @staticmethod
+    def export_oidc_scenarios(destination_dir, overwrite=False):
+        """Export bundled OIDC scenario YAML files to *destination_dir*."""
+        return E2EScenariosManager.__export_scenarios(
+            E2EScenariosManager._BUNDLED_OIDC_SCENARIOS_DIR,
+            destination_dir,
+            overwrite
+        )
 
     @staticmethod
     def list_bundled_scenarios():

{sefrone_api_e2e-1.2.7 → sefrone_api_e2e-1.2.9}/sefrone_api_e2e.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sefrone_api_e2e
-Version: 1.2.7
+Version: 1.2.9
 Summary: A Python package to provide e2e testing helpers for sefrone API projects
 Home-page: https://bitbucket.org/sefrone/sefrone_pypi
 Author: Sefrone

{sefrone_api_e2e-1.2.7 → sefrone_api_e2e-1.2.9}/sefrone_api_e2e.egg-info/SOURCES.txt

@@ -24,4 +24,8 @@ sefrone_api_e2e/e2e/Scenarios/Auth/4_workspace_endpoints.yaml
 sefrone_api_e2e/e2e/Scenarios/Auth/5_apikey_endpoints.yaml
 sefrone_api_e2e/e2e/Scenarios/Auth/6_project_endpoints.yaml
 sefrone_api_e2e/e2e/Scenarios/Auth/7_email_2fa_flow.yaml
-sefrone_api_e2e/e2e/Scenarios/Auth/8_temporary_passwords_flow.yaml
+sefrone_api_e2e/e2e/Scenarios/Auth/8_temporary_passwords_flow.yaml
+sefrone_api_e2e/e2e/Scenarios/Oidc/1_relying_party_admin.yaml
+sefrone_api_e2e/e2e/Scenarios/Oidc/2_authorization_code_flow.yaml
+sefrone_api_e2e/e2e/Scenarios/Oidc/3_disable_propagation_flow.yaml
+sefrone_api_e2e/e2e/Scenarios/Oidc/4_multi_project_isolation.yaml

{sefrone_api_e2e-1.2.7 → sefrone_api_e2e-1.2.9}/setup.py

@@ -5,7 +5,7 @@ with open("README.md", "r", encoding="utf-8") as fh:
 
 setup(
     name="sefrone_api_e2e",
-    version="1.2.7",
+    version="1.2.9",
     author="Sefrone",
     author_email="contact@sefrone.com",
     description="A Python package to provide e2e testing helpers for sefrone API projects",
@@ -24,7 +24,7 @@ setup(
         "requests"
     ],
     package_data={
-        "sefrone_api_e2e": ["e2e/Scenarios/Auth/*.yaml"]
+        "sefrone_api_e2e": ["e2e/Scenarios/Auth/*.yaml", "e2e/Scenarios/Oidc/*.yaml"]
     },
     include_package_data=True,
 )