Skip to content

Parallel tests 02 #24075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kalverra merged 1 commit into from
Nov 12, 2026
+796 −59
Merged

Parallel tests 02 #24075

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions core/capabilities/vault/allow_list_based_auth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import (
var allowlistTestOwner = common.Address{1, 2, 3}

func TestAllowListBasedAuth_CreateSecrets(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.CreateSecretsRequest{
EncryptedSecrets: []*vaultcommon.EncryptedSecret{
{
Expand Down Expand Up @@ -67,6 +68,7 @@ func TestAllowListBasedAuth_CreateSecrets(t *testing.T) {
}

func TestAllowListBasedAuth_UpdateSecrets(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.UpdateSecretsRequest{
EncryptedSecrets: []*vaultcommon.EncryptedSecret{
{
Expand Down Expand Up @@ -108,6 +110,7 @@ func TestAllowListBasedAuth_UpdateSecrets(t *testing.T) {
}

func TestAllowListBasedAuth_DeleteSecrets(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.DeleteSecretsRequest{
Ids: []*vaultcommon.SecretIdentifier{
{
Expand Down Expand Up @@ -143,6 +146,7 @@ func TestAllowListBasedAuth_DeleteSecrets(t *testing.T) {
}

func TestAllowListBasedAuth_ListSecrets(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.ListSecretIdentifiersRequest{
Namespace: "b",
Owner: allowlistTestOwner.Hex(),
Expand Down Expand Up @@ -221,6 +225,7 @@ func testAuthForRequests(t *testing.T, allowlistedRequest, notAllowlistedRequest
}

func TestAllowListBasedAuth_RetriesUntilRequestIsAllowlisted(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
owner := allowlistTestOwner
req := makeListSecretsRequest(t, "123", "b", owner.Hex())
Expand Down Expand Up @@ -254,6 +259,7 @@ func TestAllowListBasedAuth_RetriesUntilRequestIsAllowlisted(t *testing.T) {
}

func TestAllowListBasedAuth_FailsAfterAllowlistReadRetries(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
req := makeListSecretsRequest(t, "123", "b", allowlistTestOwner.Hex())

Expand All @@ -270,6 +276,7 @@ func TestAllowListBasedAuth_FailsAfterAllowlistReadRetries(t *testing.T) {
}

func TestAllowListBasedAuth_StopsRetriesWhenContextCanceled(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
req := makeListSecretsRequest(t, "123", "b", allowlistTestOwner.Hex())

Expand Down
10 changes: 10 additions & 0 deletions core/capabilities/vault/authorizer_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ import (
)

func TestAuthorizer_RejectsJWTBasedAuthWhenUnavailable(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.CreateSecretsRequest{})
require.NoError(t, err)

Expand All @@ -38,6 +39,7 @@ func TestAuthorizer_RejectsJWTBasedAuthWhenUnavailable(t *testing.T) {
}

func TestAuthorizer_UsesJWTWhenGateEnabled(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.CreateSecretsRequest{
EncryptedSecrets: []*vaultcommon.EncryptedSecret{
{Id: &vaultcommon.SecretIdentifier{Owner: "0xworkflow", Namespace: "ns", Key: "k"}, EncryptedValue: "cipher"},
Expand Down Expand Up @@ -67,6 +69,7 @@ func TestAuthorizer_UsesJWTWhenGateEnabled(t *testing.T) {
}

func TestAuthorizer_DelegatesDigestVerificationToJWTAuth(t *testing.T) {
t.Parallel()
req := jsonrpc.Request[json.RawMessage]{
ID: "1",
Method: vaulttypes.MethodPublicKeyGet,
Expand All @@ -86,6 +89,7 @@ func TestAuthorizer_DelegatesDigestVerificationToJWTAuth(t *testing.T) {
}

func TestAuthorizer_RejectsJWTReplay(t *testing.T) {
t.Parallel()
req := jsonrpc.Request[json.RawMessage]{
ID: "1",
Method: vaulttypes.MethodPublicKeyGet,
Expand All @@ -109,6 +113,7 @@ func TestAuthorizer_RejectsJWTReplay(t *testing.T) {
}

func TestAuthorizer_RejectsAllowListBasedAuthReplay(t *testing.T) {
t.Parallel()
allowListBasedAuth := vaultmocks.NewAuthorizer(t)
// Use a method without secret identifiers so the owner-binding check is a no-op.
req := jsonrpc.Request[json.RawMessage]{ID: "1", Method: vaulttypes.MethodPublicKeyGet}
Expand All @@ -128,6 +133,7 @@ func TestAuthorizer_RejectsAllowListBasedAuthReplay(t *testing.T) {
}

func TestAuthorizer_PropagatesJWTValidationErrors(t *testing.T) {
t.Parallel()
// JWT mock fails before owner binding; params are irrelevant here.
req := jsonrpc.Request[json.RawMessage]{
ID: "1",
Expand All @@ -146,6 +152,7 @@ func TestAuthorizer_PropagatesJWTValidationErrors(t *testing.T) {
}

func TestAuthorizer_AllowListPath_RejectsCreateOwnerMismatch(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.CreateSecretsRequest{
EncryptedSecrets: []*vaultcommon.EncryptedSecret{
{Id: &vaultcommon.SecretIdentifier{Owner: "0xother", Namespace: "ns", Key: "k"}, EncryptedValue: "cipher"},
Expand All @@ -170,6 +177,7 @@ func TestAuthorizer_AllowListPath_RejectsCreateOwnerMismatch(t *testing.T) {
}

func TestAuthorizer_AllowListPath_RejectsUpdateOwnerMismatch(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.UpdateSecretsRequest{
EncryptedSecrets: []*vaultcommon.EncryptedSecret{
{Id: &vaultcommon.SecretIdentifier{Owner: "0xother", Namespace: "ns", Key: "k"}, EncryptedValue: "cipher"},
Expand All @@ -194,6 +202,7 @@ func TestAuthorizer_AllowListPath_RejectsUpdateOwnerMismatch(t *testing.T) {
}

func TestAuthorizer_AllowListPath_RejectsDeleteOwnerMismatch(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.DeleteSecretsRequest{
Ids: []*vaultcommon.SecretIdentifier{
{Owner: "0xother", Namespace: "ns", Key: "k"},
Expand All @@ -218,6 +227,7 @@ func TestAuthorizer_AllowListPath_RejectsDeleteOwnerMismatch(t *testing.T) {
}

func TestAuthorizer_AllowListPath_RejectsListOwnerMismatch(t *testing.T) {
t.Parallel()
params, err := json.Marshal(vaultcommon.ListSecretIdentifiersRequest{
Owner: "0xother",
Namespace: "ns",
Expand Down
15 changes: 15 additions & 0 deletions core/capabilities/vault/capability_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ func newTestRequestLifecycleTracker(t *testing.T) *RequestLifecycleTracker {
}

func TestCapability_CapabilityCall(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -137,6 +138,7 @@ func TestCapability_CapabilityCall(t *testing.T) {
}

func TestCapability_CapabilityCall_DuringSubscriptionPhase(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -354,6 +356,7 @@ func TestCapability_Execute_GetSecretsRequestValidationFailed(t *testing.T) {
})

t.Run("rejects key with invalid characters on a later batched item", func(t *testing.T) {
t.Parallel()
capability, _ := newCapability(t)
gsr := &vault.GetSecretsRequest{
Requests: []*vault.SecretRequest{
Expand Down Expand Up @@ -402,6 +405,7 @@ func TestCapability_Execute_GetSecretsRequestValidationFailed(t *testing.T) {
})

t.Run("rejects key that exceeds configured max length on a later batched item", func(t *testing.T) {
t.Parallel()
getter, err := settings.NewJSONGetter([]byte(`{"global":{"VaultIdentifierKeySizeLimit":"3b"}}`))
require.NoError(t, err)
lf := limits.Factory{Settings: getter}
Expand Down Expand Up @@ -457,6 +461,7 @@ func TestCapability_Execute_GetSecretsRequestValidationFailed(t *testing.T) {
}

func TestCapability_CapabilityCall_SecretIdentifierOwnerMismatch(t *testing.T) {
t.Parallel()
testCases := []struct {
name string
workflowOwner string
Expand Down Expand Up @@ -531,6 +536,7 @@ func TestCapability_CapabilityCall_SecretIdentifierOwnerMismatch(t *testing.T) {

for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -610,6 +616,7 @@ func TestCapability_CapabilityCall_SecretIdentifierOwnerMismatch(t *testing.T) {
}

func TestCapability_CapabilityCall_UsesMetadataWorkflowOwner(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -683,6 +690,7 @@ func TestCapability_CapabilityCall_UsesMetadataWorkflowOwner(t *testing.T) {
}

func TestCapability_CapabilityCall_ForwardsRequestGetSecretsIdentity(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -775,6 +783,7 @@ func TestCapability_CapabilityCall_ForwardsRequestGetSecretsIdentity(t *testing.
}

func TestCapability_CapabilityCall_BackfillsGetSecretsWorkflowOwnerFromFirstSecretOwner(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -868,6 +877,7 @@ func TestCapability_CapabilityCall_BackfillsGetSecretsWorkflowOwnerFromFirstSecr
}

func TestCapability_CapabilityCall_ReturnsIncorrectType(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -944,6 +954,7 @@ func TestCapability_CapabilityCall_ReturnsIncorrectType(t *testing.T) {
}

func TestCapability_CapabilityCall_TimeOut(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
fakeClock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -1016,6 +1027,7 @@ func TestCapability_CapabilityCall_TimeOut(t *testing.T) {
}

func TestCapability_CRUD(t *testing.T) {
t.Parallel()
owner := "0x0001020304050607080900010203040506070809"
requestID := owner + "::" + "test-request-id"
sid := &vault.SecretIdentifier{
Expand Down Expand Up @@ -1658,6 +1670,7 @@ func TestCapability_CRUD(t *testing.T) {

for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -1704,6 +1717,7 @@ func TestCapability_CRUD(t *testing.T) {
}

func TestCapability_Lifecycle(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down Expand Up @@ -1734,6 +1748,7 @@ func TestCapability_Lifecycle(t *testing.T) {
}

func TestCapability_PublicKeyGet(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
clock := clockwork.NewFakeClock()
expiry := 10 * time.Second
Expand Down
5 changes: 5 additions & 0 deletions core/capabilities/vault/gw_handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@ func requiresMasterPublicKey(method string) bool {
}

func TestGatewayHandler_HandleGatewayMessage(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
ctx := t.Context()
authResult := func(orgID, workflowOwner string) *vaultcap.AuthResult {
Expand Down Expand Up @@ -649,6 +650,7 @@ func TestGatewayHandler_HandleGatewayMessage(t *testing.T) {

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
secretsService := vaulttypesmocks.NewSecretsService(t)
gwConnector := connector_mocks.NewGatewayConnector(t)
allowListBasedAuth := vaultcapmocks.NewAuthorizer(t)
Expand Down Expand Up @@ -837,7 +839,9 @@ func TestGatewayHandler_CreateUpdateReusesCachedPublicKey(t *testing.T) {
}
}

//nolint:paralleltest // subtests start and close the same handler in order
func TestGatewayHandler_Lifecycle(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
ctx := t.Context()

Expand Down Expand Up @@ -876,6 +880,7 @@ func TestGatewayHandler_Lifecycle(t *testing.T) {
}

func TestGatewayHandler_Lifecycle_DefaultAuthorizer_NoJWTConfig(t *testing.T) {
t.Parallel()
lggr := logger.TestLogger(t)
ctx := t.Context()

Expand Down
Loading
Loading