diff --git a/tests/integration/aggregator_e2e_test.go b/tests/integration/aggregator_e2e_test.go index f9228bf..7598385 100644 --- a/tests/integration/aggregator_e2e_test.go +++ b/tests/integration/aggregator_e2e_test.go @@ -3,7 +3,6 @@ package integration import ( "Coves/internal/api/handlers/aggregator" "Coves/internal/api/handlers/post" - "Coves/internal/api/middleware" "Coves/internal/atproto/identity" "Coves/internal/atproto/jetstream" "Coves/internal/core/aggregators" @@ -82,8 +81,7 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { getAuthorizationsHandler := aggregator.NewGetAuthorizationsHandler(aggregatorService) listForCommunityHandler := aggregator.NewListForCommunityHandler(aggregatorService) createPostHandler := post.NewCreateHandler(postService) - authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true) // Skip JWT verification for testing - defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine + e2eAuth := NewE2EOAuthMiddleware() ctx := context.Background() @@ -99,7 +97,7 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { // Part 1: Service Declaration via Real PDS // ==================================================================================== // Store DIDs, tokens, and URIs for use across all test parts - var aggregatorDID, aggregatorToken, aggregatorHandle, communityDID, communityToken, authorizationRkey string + var aggregatorDID, aggregatorToken, aggregatorAPIToken, aggregatorHandle, communityDID, communityToken, authorizationRkey string t.Run("1. Service Declaration - PDS Account ā†’ Write Record ā†’ Jetstream ā†’ AppView DB", func(t *testing.T) { t.Log("\nšŸ“ Part 1: Create aggregator account and publish service declaration to PDS...") @@ -119,6 +117,9 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { t.Logf("āœ“ Created aggregator account: %s (%s)", aggregatorHandle, aggregatorDID) + // Register aggregator user with OAuth middleware for API requests + aggregatorAPIToken = e2eAuth.AddUser(aggregatorDID) + // STEP 2: Write service declaration to aggregator's repository on PDS configSchema := map[string]interface{}{ "type": "object", @@ -335,14 +336,11 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { req := httptest.NewRequest("POST", "/xrpc/social.coves.community.post.create", bytes.NewReader(reqJSON)) req.Header.Set("Content-Type", "application/json") - - // Create JWT for aggregator (not a user) - aggregatorJWT := createSimpleTestJWT(aggregatorDID) - req.Header.Set("Authorization", "DPoP "+aggregatorJWT) + req.Header.Set("Authorization", "Bearer "+aggregatorAPIToken) // Execute request through auth middleware + handler rr := httptest.NewRecorder() - handler := authMiddleware.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) + handler := e2eAuth.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) handler.ServeHTTP(rr, req) // STEP 2: Verify post creation succeeded @@ -425,10 +423,10 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { req := httptest.NewRequest("POST", "/xrpc/social.coves.community.post.create", bytes.NewReader(reqJSON)) req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+createSimpleTestJWT(aggregatorDID)) + req.Header.Set("Authorization", "Bearer "+aggregatorAPIToken) rr := httptest.NewRecorder() - handler := authMiddleware.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) + handler := e2eAuth.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) handler.ServeHTTP(rr, req) require.Equal(t, http.StatusOK, rr.Code, "Post %d should succeed", i) @@ -447,10 +445,10 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { req := httptest.NewRequest("POST", "/xrpc/social.coves.community.post.create", bytes.NewReader(reqJSON)) req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+createSimpleTestJWT(aggregatorDID)) + req.Header.Set("Authorization", "Bearer "+aggregatorAPIToken) rr := httptest.NewRecorder() - handler := authMiddleware.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) + handler := e2eAuth.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) handler.ServeHTTP(rr, req) require.Equal(t, http.StatusOK, rr.Code, "10th post should succeed (at limit)") @@ -468,10 +466,10 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { req = httptest.NewRequest("POST", "/xrpc/social.coves.community.post.create", bytes.NewReader(reqJSON)) req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+createSimpleTestJWT(aggregatorDID)) + req.Header.Set("Authorization", "Bearer "+aggregatorAPIToken) rr = httptest.NewRecorder() - handler = authMiddleware.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) + handler = e2eAuth.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) handler.ServeHTTP(rr, req) // Should be rate limited @@ -649,6 +647,9 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { err := aggregatorConsumer.HandleEvent(ctx, &unAuthAggEvent) require.NoError(t, err) + // Register unauthorized aggregator with OAuth middleware + unauthorizedAPIToken := e2eAuth.AddUser(unauthorizedAggDID) + // Try to create post without authorization reqBody := map[string]interface{}{ "community": communityDID, @@ -660,10 +661,10 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { req := httptest.NewRequest("POST", "/xrpc/social.coves.community.post.create", bytes.NewReader(reqJSON)) req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+createSimpleTestJWT(unauthorizedAggDID)) + req.Header.Set("Authorization", "Bearer "+unauthorizedAPIToken) rr := httptest.NewRecorder() - handler := authMiddleware.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) + handler := e2eAuth.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) handler.ServeHTTP(rr, req) // Should be forbidden @@ -784,10 +785,10 @@ func TestAggregator_E2E_WithJetstream(t *testing.T) { req := httptest.NewRequest("POST", "/xrpc/social.coves.community.post.create", bytes.NewReader(reqJSON)) req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+createSimpleTestJWT(aggregatorDID)) + req.Header.Set("Authorization", "Bearer "+aggregatorAPIToken) rr := httptest.NewRecorder() - handler := authMiddleware.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) + handler := e2eAuth.RequireAuth(http.HandlerFunc(createPostHandler.HandleCreate)) handler.ServeHTTP(rr, req) assert.Equal(t, http.StatusForbidden, rr.Code, "Should reject post from disabled aggregator") diff --git a/tests/integration/community_e2e_test.go b/tests/integration/community_e2e_test.go index 4c6f232..78ee03b 100644 --- a/tests/integration/community_e2e_test.go +++ b/tests/integration/community_e2e_test.go @@ -1,7 +1,6 @@ package integration import ( - "Coves/internal/api/middleware" "Coves/internal/api/routes" "Coves/internal/atproto/identity" "Coves/internal/atproto/jetstream" @@ -108,13 +107,10 @@ func TestCommunity_E2E(t *testing.T) { t.Logf("āœ… Authenticated - Instance DID: %s", instanceDID) - // Initialize auth middleware with skipVerify=true - // IMPORTANT: PDS password authentication returns Bearer tokens (not DPoP-bound tokens). - // E2E tests use these Bearer tokens with the DPoP scheme header, which only works - // because skipVerify=true bypasses signature and DPoP binding verification. - // In production, skipVerify=false requires proper DPoP-bound tokens from OAuth flow. - authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true) - defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine + // Initialize OAuth auth middleware for E2E testing + e2eAuth := NewE2EOAuthMiddleware() + // Register the instance user for OAuth authentication + token := e2eAuth.AddUser(instanceDID) // V2.0: Extract instance domain for community provisioning var instanceDomain string @@ -152,7 +148,7 @@ func TestCommunity_E2E(t *testing.T) { // Setup HTTP server with XRPC routes r := chi.NewRouter() - routes.RegisterCommunityRoutes(r, communityService, authMiddleware, nil) // nil = allow all community creators + routes.RegisterCommunityRoutes(r, communityService, e2eAuth.OAuthAuthMiddleware, nil) // nil = allow all community creators httpServer := httptest.NewServer(r) defer httpServer.Close() @@ -387,8 +383,8 @@ func TestCommunity_E2E(t *testing.T) { t.Fatalf("Failed to create request: %v", err) } req.Header.Set("Content-Type", "application/json") - // Use real PDS access token for E2E authentication - req.Header.Set("Authorization", "DPoP "+accessToken) + // Use OAuth token for Coves API authentication + req.Header.Set("Authorization", "Bearer "+token) resp, err := http.DefaultClient.Do(req) if err != nil { @@ -773,8 +769,8 @@ func TestCommunity_E2E(t *testing.T) { t.Fatalf("Failed to create request: %v", err) } req.Header.Set("Content-Type", "application/json") - // Use real PDS access token for E2E authentication - req.Header.Set("Authorization", "DPoP "+accessToken) + // Use OAuth token for Coves API authentication + req.Header.Set("Authorization", "Bearer "+token) resp, err := http.DefaultClient.Do(req) if err != nil { @@ -1008,8 +1004,8 @@ func TestCommunity_E2E(t *testing.T) { t.Fatalf("Failed to create request: %v", err) } req.Header.Set("Content-Type", "application/json") - // Use real PDS access token for E2E authentication - req.Header.Set("Authorization", "DPoP "+accessToken) + // Use OAuth token for Coves API authentication + req.Header.Set("Authorization", "Bearer "+token) resp, err := http.DefaultClient.Do(req) if err != nil { @@ -1141,7 +1137,7 @@ func TestCommunity_E2E(t *testing.T) { t.Fatalf("Failed to create block request: %v", err) } req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+accessToken) + req.Header.Set("Authorization", "Bearer "+token) resp, err := http.DefaultClient.Do(req) if err != nil { @@ -1261,7 +1257,7 @@ func TestCommunity_E2E(t *testing.T) { t.Fatalf("Failed to create block request: %v", err) } blockHttpReq.Header.Set("Content-Type", "application/json") - blockHttpReq.Header.Set("Authorization", "DPoP "+accessToken) + blockHttpReq.Header.Set("Authorization", "Bearer "+token) blockResp, err := http.DefaultClient.Do(blockHttpReq) if err != nil { @@ -1321,7 +1317,7 @@ func TestCommunity_E2E(t *testing.T) { t.Fatalf("Failed to create unblock request: %v", err) } req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+accessToken) + req.Header.Set("Authorization", "Bearer "+token) resp, err := http.DefaultClient.Do(req) if err != nil { @@ -1477,8 +1473,8 @@ func TestCommunity_E2E(t *testing.T) { t.Fatalf("Failed to create request: %v", err) } req.Header.Set("Content-Type", "application/json") - // Use real PDS access token for E2E authentication - req.Header.Set("Authorization", "DPoP "+accessToken) + // Use OAuth token for Coves API authentication + req.Header.Set("Authorization", "Bearer "+token) resp, err := http.DefaultClient.Do(req) if err != nil { diff --git a/tests/integration/helpers.go b/tests/integration/helpers.go index 7ac12ff..54fbfb0 100644 --- a/tests/integration/helpers.go +++ b/tests/integration/helpers.go @@ -1,12 +1,12 @@ package integration import ( - "Coves/internal/atproto/auth" + "Coves/internal/api/middleware" + "Coves/internal/atproto/oauth" "Coves/internal/core/users" "bytes" "context" "database/sql" - "encoding/base64" "encoding/json" "fmt" "io" @@ -16,7 +16,8 @@ import ( "testing" "time" - "github.com/golang-jwt/jwt/v5" + oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth" + "github.com/bluesky-social/indigo/atproto/syntax" ) // getTestPDSURL returns the PDS URL for testing from env var or default @@ -115,40 +116,6 @@ func authenticateWithPDS(pdsURL, handle, password string) (string, string, error return sessionResp.AccessJwt, sessionResp.DID, nil } -// createSimpleTestJWT creates a minimal JWT for testing (Phase 1 - no signature) -// In production, this would be a real OAuth token from PDS with proper signatures -func createSimpleTestJWT(userDID string) string { - // Create minimal JWT claims using RegisteredClaims - // Use userDID as issuer since we don't have a proper PDS DID for testing - claims := auth.Claims{ - RegisteredClaims: jwt.RegisteredClaims{ - Subject: userDID, - Issuer: userDID, // Use DID as issuer for testing (valid per atProto) - Audience: jwt.ClaimStrings{getTestInstanceDID()}, - IssuedAt: jwt.NewNumericDate(time.Now()), - ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)), - }, - Scope: "com.atproto.access", - } - - // For Phase 1 testing, we create an unsigned JWT - // The middleware is configured with skipVerify=true for testing - header := map[string]interface{}{ - "alg": "none", - "typ": "JWT", - } - - headerJSON, _ := json.Marshal(header) - claimsJSON, _ := json.Marshal(claims) - - // Base64url encode (without padding) - headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON) - claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON) - - // For "alg: none", signature is empty - return headerB64 + "." + claimsB64 + "." -} - // generateTID generates a simple timestamp-based identifier for testing // In production, PDS generates proper TIDs func generateTID() string { @@ -310,3 +277,135 @@ func createTestPost(t *testing.T, db *sql.DB, communityDID, authorDID, title str return uri } + +// MockSessionUnsealer is a mock implementation of SessionUnsealer for testing +// It returns predefined sessions based on token value +type MockSessionUnsealer struct { + sessions map[string]*oauth.SealedSession +} + +// NewMockSessionUnsealer creates a new mock unsealer +func NewMockSessionUnsealer() *MockSessionUnsealer { + return &MockSessionUnsealer{ + sessions: make(map[string]*oauth.SealedSession), + } +} + +// AddSession adds a token -> session mapping +func (m *MockSessionUnsealer) AddSession(token, did, sessionID string) { + m.sessions[token] = &oauth.SealedSession{ + DID: did, + SessionID: sessionID, + ExpiresAt: time.Now().Add(1 * time.Hour).Unix(), + } +} + +// UnsealSession returns the predefined session for a token +func (m *MockSessionUnsealer) UnsealSession(token string) (*oauth.SealedSession, error) { + if sess, ok := m.sessions[token]; ok { + return sess, nil + } + return nil, fmt.Errorf("unknown token") +} + +// MockOAuthStore is a mock implementation of ClientAuthStore for testing +type MockOAuthStore struct { + sessions map[string]*oauthlib.ClientSessionData +} + +// NewMockOAuthStore creates a new mock OAuth store +func NewMockOAuthStore() *MockOAuthStore { + return &MockOAuthStore{ + sessions: make(map[string]*oauthlib.ClientSessionData), + } +} + +// AddSession adds a session to the store +func (m *MockOAuthStore) AddSession(did, sessionID, accessToken string) { + key := did + ":" + sessionID + parsedDID, _ := syntax.ParseDID(did) + m.sessions[key] = &oauthlib.ClientSessionData{ + AccountDID: parsedDID, + SessionID: sessionID, + AccessToken: accessToken, + } +} + +// GetSession implements ClientAuthStore +func (m *MockOAuthStore) GetSession(ctx context.Context, did syntax.DID, sessionID string) (*oauthlib.ClientSessionData, error) { + key := did.String() + ":" + sessionID + if sess, ok := m.sessions[key]; ok { + return sess, nil + } + return nil, fmt.Errorf("session not found") +} + +// SaveSession implements ClientAuthStore +func (m *MockOAuthStore) SaveSession(ctx context.Context, sess oauthlib.ClientSessionData) error { + key := sess.AccountDID.String() + ":" + sess.SessionID + m.sessions[key] = &sess + return nil +} + +// DeleteSession implements ClientAuthStore +func (m *MockOAuthStore) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error { + key := did.String() + ":" + sessionID + delete(m.sessions, key) + return nil +} + +// GetAuthRequestInfo implements ClientAuthStore +func (m *MockOAuthStore) GetAuthRequestInfo(ctx context.Context, state string) (*oauthlib.AuthRequestData, error) { + return nil, fmt.Errorf("not implemented in mock") +} + +// SaveAuthRequestInfo implements ClientAuthStore +func (m *MockOAuthStore) SaveAuthRequestInfo(ctx context.Context, info oauthlib.AuthRequestData) error { + return nil +} + +// DeleteAuthRequestInfo implements ClientAuthStore +func (m *MockOAuthStore) DeleteAuthRequestInfo(ctx context.Context, state string) error { + return nil +} + +// CreateTestOAuthMiddleware creates an OAuth middleware with mock implementations for testing +// The returned middleware accepts a test token that maps to the specified userDID +func CreateTestOAuthMiddleware(userDID string) (*middleware.OAuthAuthMiddleware, string) { + unsealer := NewMockSessionUnsealer() + store := NewMockOAuthStore() + + testToken := "test-token-" + userDID + sessionID := "test-session-123" + + // Add the test session + unsealer.AddSession(testToken, userDID, sessionID) + store.AddSession(userDID, sessionID, "test-access-token") + + authMiddleware := middleware.NewOAuthAuthMiddleware(unsealer, store) + return authMiddleware, testToken +} + +// E2EOAuthMiddleware wraps OAuth middleware for E2E testing with multiple users +type E2EOAuthMiddleware struct { + *middleware.OAuthAuthMiddleware + unsealer *MockSessionUnsealer + store *MockOAuthStore +} + +// NewE2EOAuthMiddleware creates an OAuth middleware for E2E testing +func NewE2EOAuthMiddleware() *E2EOAuthMiddleware { + unsealer := NewMockSessionUnsealer() + store := NewMockOAuthStore() + m := middleware.NewOAuthAuthMiddleware(unsealer, store) + return &E2EOAuthMiddleware{m, unsealer, store} +} + +// AddUser registers a user DID and returns the token to use in Authorization header +func (e *E2EOAuthMiddleware) AddUser(did string) string { + token := "test-token-" + did + sessionID := "session-" + did + e.unsealer.AddSession(token, did, sessionID) + e.store.AddSession(did, sessionID, "access-token-"+did) + return token +} diff --git a/tests/integration/post_e2e_test.go b/tests/integration/post_e2e_test.go index 44ea3a3..1bf40e0 100644 --- a/tests/integration/post_e2e_test.go +++ b/tests/integration/post_e2e_test.go @@ -2,7 +2,6 @@ package integration import ( "Coves/internal/api/handlers/post" - "Coves/internal/api/middleware" "Coves/internal/atproto/identity" "Coves/internal/atproto/jetstream" "Coves/internal/core/communities" @@ -405,9 +404,8 @@ func TestPostCreation_E2E_LivePDS(t *testing.T) { postService := posts.NewPostService(postRepo, communityService, nil, nil, nil, pdsURL) // nil aggregatorService, blobService, unfurlService for user-only tests - // Setup auth middleware (skip JWT verification for testing) - authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true) - defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine + // Setup OAuth auth middleware for E2E testing + e2eAuth := NewE2EOAuthMiddleware() // Setup HTTP handler createHandler := post.NewCreateHandler(postService) @@ -476,14 +474,14 @@ func TestPostCreation_E2E_LivePDS(t *testing.T) { req := httptest.NewRequest("POST", "/xrpc/social.coves.community.post.create", bytes.NewReader(reqJSON)) req.Header.Set("Content-Type", "application/json") - // Create a simple JWT for testing (Phase 1: no signature verification) - // In production, this would be a real OAuth token from PDS - testJWT := createSimpleTestJWT(author.DID) - req.Header.Set("Authorization", "DPoP "+testJWT) + // Register the author user with OAuth middleware and get test token + // For Coves API handlers, use Bearer scheme with OAuth middleware + token := e2eAuth.AddUser(author.DID) + req.Header.Set("Authorization", "Bearer "+token) // Execute request through auth middleware + handler rr := httptest.NewRecorder() - handler := authMiddleware.RequireAuth(http.HandlerFunc(createHandler.HandleCreate)) + handler := e2eAuth.RequireAuth(http.HandlerFunc(createHandler.HandleCreate)) handler.ServeHTTP(rr, req) // Check response diff --git a/tests/integration/user_journey_e2e_test.go b/tests/integration/user_journey_e2e_test.go index f08f0e6..cfd94db 100644 --- a/tests/integration/user_journey_e2e_test.go +++ b/tests/integration/user_journey_e2e_test.go @@ -1,7 +1,6 @@ package integration import ( - "Coves/internal/api/middleware" "Coves/internal/api/routes" "Coves/internal/atproto/identity" "Coves/internal/atproto/jetstream" @@ -22,14 +21,14 @@ import ( "testing" "time" - timelineCore "Coves/internal/core/timeline" - "github.com/go-chi/chi/v5" "github.com/gorilla/websocket" _ "github.com/lib/pq" "github.com/pressly/goose/v3" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + + timelineCore "Coves/internal/core/timeline" ) // TestFullUserJourney_E2E tests the complete user experience from signup to interaction: @@ -139,16 +138,12 @@ func TestFullUserJourney_E2E(t *testing.T) { commentConsumer := jetstream.NewCommentEventConsumer(commentRepo, db) voteConsumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db) - // Setup HTTP server with all routes - // IMPORTANT: skipVerify=true because PDS password auth returns Bearer tokens (not DPoP-bound). - // E2E tests use Bearer tokens with DPoP scheme header, which only works with skipVerify=true. - // In production, skipVerify=false requires proper DPoP-bound tokens from OAuth flow. - authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true) - defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine + // Setup HTTP server with all routes using OAuth middleware + e2eAuth := NewE2EOAuthMiddleware() r := chi.NewRouter() - routes.RegisterCommunityRoutes(r, communityService, authMiddleware, nil) // nil = allow all community creators - routes.RegisterPostRoutes(r, postService, authMiddleware) - routes.RegisterTimelineRoutes(r, timelineService, authMiddleware) + routes.RegisterCommunityRoutes(r, communityService, e2eAuth.OAuthAuthMiddleware, nil) // nil = allow all community creators + routes.RegisterPostRoutes(r, postService, e2eAuth.OAuthAuthMiddleware) + routes.RegisterTimelineRoutes(r, timelineService, e2eAuth.OAuthAuthMiddleware) httpServer := httptest.NewServer(r) defer httpServer.Close() @@ -181,10 +176,12 @@ func TestFullUserJourney_E2E(t *testing.T) { var ( userAHandle string userADID string - userAToken string + userAToken string // PDS access token for direct PDS requests + userAAPIToken string // Coves API token for Coves API requests userBHandle string userBDID string - userBToken string + userBToken string // PDS access token for direct PDS requests + userBAPIToken string // Coves API token for Coves API requests communityDID string communityHandle string postURI string @@ -217,6 +214,9 @@ func TestFullUserJourney_E2E(t *testing.T) { userA := createTestUser(t, db, userAHandle, userADID) require.NotNil(t, userA) + // Register user with OAuth middleware for Coves API requests + userAAPIToken = e2eAuth.AddUser(userADID) + t.Logf("āœ… User A indexed in AppView") }) @@ -244,7 +244,7 @@ func TestFullUserJourney_E2E(t *testing.T) { httpServer.URL+"/xrpc/social.coves.community.create", bytes.NewBuffer(reqBody)) req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+userAToken) + req.Header.Set("Authorization", "Bearer "+userAAPIToken) resp, err := http.DefaultClient.Do(req) require.NoError(t, err) @@ -328,7 +328,7 @@ func TestFullUserJourney_E2E(t *testing.T) { httpServer.URL+"/xrpc/social.coves.community.post.create", bytes.NewBuffer(reqBody)) req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+userAToken) + req.Header.Set("Authorization", "Bearer "+userAAPIToken) resp, err := http.DefaultClient.Do(req) require.NoError(t, err) @@ -413,6 +413,9 @@ func TestFullUserJourney_E2E(t *testing.T) { userB := createTestUser(t, db, userBHandle, userBDID) require.NotNil(t, userB) + // Register user with OAuth middleware for Coves API requests + userBAPIToken = e2eAuth.AddUser(userBDID) + t.Logf("āœ… User B indexed in AppView") }) @@ -437,7 +440,7 @@ func TestFullUserJourney_E2E(t *testing.T) { httpServer.URL+"/xrpc/social.coves.community.subscribe", bytes.NewBuffer(reqBody)) req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "DPoP "+userBToken) + req.Header.Set("Authorization", "Bearer "+userBAPIToken) resp, err := http.DefaultClient.Do(req) require.NoError(t, err) @@ -669,10 +672,10 @@ func TestFullUserJourney_E2E(t *testing.T) { t.Run("9. User B - Verify Timeline Feed Shows Subscribed Community Posts", func(t *testing.T) { t.Log("\nšŸ“° Part 9: User B checks timeline feed...") - // Use HTTP client to properly go through auth middleware with DPoP token + // Use HTTP client to properly go through auth middleware with Bearer token req, _ := http.NewRequest(http.MethodGet, httpServer.URL+"/xrpc/social.coves.feed.getTimeline?sort=new&limit=10", nil) - req.Header.Set("Authorization", "DPoP "+userBToken) + req.Header.Set("Authorization", "Bearer "+userBAPIToken) resp, err := http.DefaultClient.Do(req) require.NoError(t, err)