fix(tui): correctly handle plaintext and cloudflare_jwt gateway auth#1876
Draft
alexclewontin wants to merge 4 commits into
Draft
fix(tui): correctly handle plaintext and cloudflare_jwt gateway auth#1876alexclewontin wants to merge 4 commits into
alexclewontin wants to merge 4 commits into
Conversation
6 tasks
Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
alexclewontin
force-pushed
the
tui-plaintext-jwt
branch
from
a28fd20 to
c348ee2
Compare
alexclewontin
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
Add harness::mock_gateway with MockGateway — a minimal stub implementing the full OpenShell gRPC trait so tonic is satisfied. Only health and list_providers do real work: counting calls and validating auth headers (cf-access-jwt-assertion for edge tokens, Authorization: Bearer for OIDC). Plaintext and mTLS modes need no header checks; authentication is enforced at the TLS layer. Add harness::certs with generate_test_certs() to produce a CA, server cert (valid for localhost and 127.0.0.1), and client cert via rcgen. Used by TLS and mTLS mock gateway variants. Public API: start_gateway() plain HTTP start_gateway_with_edge_token(name, tok) validates JWT header start_gateway_with_tls_and_bearer(...) TLS + bearer token start_gateway_with_mtls(...) mutual TLS Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
alexclewontin
force-pushed
the
tui-plaintext-jwt
branch
from
c348ee2 to
dab4e24
Compare
Add e2e tests verifying the TUI can authenticate and connect to gateways using all four channel modes: - plaintext (explicit auth_mode=plaintext) - edge/Cloudflare JWT (auth_mode=cloudflare_jwt; mock validates the cf-access-jwt-assertion header) - http endpoint fallback (no auth_mode, http:// URL) - OIDC (auth_mode=oidc; TLS server, mock validates Authorization: Bearer) - mTLS (default for https:// with no auth_mode; full mutual TLS handshake) Each test starts the TUI pointed at the target gateway, waits 3 s for refresh_data to complete (health + list_providers + sandboxes on startup, before the event loop), then kills the process and asserts provider_calls > 0. Graceful exit via 'q' is avoided because crossterm's event::poll is a blocking call that starves other tasks on a single-thread tokio runtime, preventing the keystroke from being processed. TLS tests use rcgen-generated self-signed certs valid for localhost and 127.0.0.1. Signed-off-by: Alex Lewontin <alex.lewontin@canonical.com>
alexclewontin
force-pushed
the
tui-plaintext-jwt
branch
from
dab4e24 to
73a569d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix TUI gateway switching for non-mTLS gateways. This PR makes the TUI honor explicit plaintext
gateway metadata and adds a dedicated
cloudflare_jwtpath so edge-authenticated gateways nolonger fall through to the mTLS flow.
This was identified in the review process of #1625 but since it pre-dates that PR and is not really directly related to it, I wanted to split it out.
Related Issue
N/A — split from review feedback on
system-gateway-dir.Changes
auth_mode = "plaintext"when selecting the TUI transport instead of defaulting HTTPSendpoints to mTLS
GatewayChannelMode::Edgepath forauth_mode = "cloudflare_jwt"EdgeAuthInterceptorforedge-authenticated gateways
crates/openshell-tui/src/edge_tunnel.rsto bridge local gRPC traffic over the gateway/_ws_tunnelWebSocket endpoint for HTTPS edge gatewayscases
tokio-tungsteniteandfuturesto support the edge tunnel clientTesting
mise run pre-commitpassesAdditional testing:
cargo test -p openshell-tui --libcargo clippy -p openshell-tui --all-targets -- -D warningsChecklist