From 7311dae72d9d29083e0b88b83bd539dbf5e8ab61 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 31 Aug 2026 06:45:36 +0300 Subject: [PATCH] Test matrix-livekit-jwt-service with Molecule --- .github/renovate.json | 2 + .../molecule/default/converge.yml | 38 ++ .../molecule/default/files/openid-fixture.py | 53 ++ .../molecule/default/molecule.yml | 95 ++++ .../molecule/default/prepare.yml | 121 +++++ .../molecule/default/requirements.yml | 1 + .../molecule/default/verify.yml | 509 ++++++++++++++++++ 7 files changed, 819 insertions(+) create mode 100644 roles/custom/matrix-livekit-jwt-service/molecule/default/converge.yml create mode 100644 roles/custom/matrix-livekit-jwt-service/molecule/default/files/openid-fixture.py create mode 100644 roles/custom/matrix-livekit-jwt-service/molecule/default/molecule.yml create mode 100644 roles/custom/matrix-livekit-jwt-service/molecule/default/prepare.yml create mode 120000 roles/custom/matrix-livekit-jwt-service/molecule/default/requirements.yml create mode 100644 roles/custom/matrix-livekit-jwt-service/molecule/default/verify.yml diff --git a/.github/renovate.json b/.github/renovate.json index 7b59ff875..5afb732d5 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -144,6 +144,7 @@ "roles/custom/matrix-client-fluffychat/defaults/main.yml", "roles/custom/matrix-element-admin/defaults/main.yml", "roles/custom/matrix-ketesa/defaults/main.yml", + "roles/custom/matrix-livekit-jwt-service/defaults/main.yml", "roles/custom/matrix-static-files/defaults/main.yml", "roles/custom/matrix-synapse/defaults/main.yml", "roles/custom/matrix-synapse-auto-compressor/defaults/main.yml" @@ -164,6 +165,7 @@ "roles/custom/matrix-bridge-mautrix-slack/defaults/main.yml", "roles/custom/matrix-client-fluffychat/defaults/main.yml", "roles/custom/matrix-element-admin/defaults/main.yml", + "roles/custom/matrix-livekit-jwt-service/defaults/main.yml", "roles/custom/matrix-static-files/defaults/main.yml", "roles/custom/matrix-synapse-auto-compressor/defaults/main.yml" ], diff --git a/roles/custom/matrix-livekit-jwt-service/molecule/default/converge.yml b/roles/custom/matrix-livekit-jwt-service/molecule/default/converge.yml new file mode 100644 index 000000000..24e5c4e68 --- /dev/null +++ b/roles/custom/matrix-livekit-jwt-service/molecule/default/converge.yml @@ -0,0 +1,38 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +- name: Include roles for matrix-livekit-jwt-service Molecule tests + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + gather_facts: true + tasks: + - name: Include roles for matrix-livekit-jwt-service Molecule tests + ansible.builtin.include_role: + name: "{{ role_name }}" + public: true + loop: + - com.devture.ansible.role.playbook_help + - com.devture.ansible.role.systemd_docker_base + - "custom/{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}" + loop_control: + loop_var: role_name + +# The component role installs the unit; systemd_service_manager starts it in a +# full deployment. Start it directly at that same role-scoped boundary. +- name: Ensure matrix-livekit-jwt-service is started + hosts: all + become: true + gather_facts: false + tasks: + - name: Ensure systemd daemon is reloaded + ansible.builtin.systemd_service: + daemon_reload: true + + - name: Ensure matrix-livekit-jwt-service is started + ansible.builtin.systemd_service: + name: matrix-livekit-jwt-service.service + state: started diff --git a/roles/custom/matrix-livekit-jwt-service/molecule/default/files/openid-fixture.py b/roles/custom/matrix-livekit-jwt-service/molecule/default/files/openid-fixture.py new file mode 100644 index 000000000..cb59f64d6 --- /dev/null +++ b/roles/custom/matrix-livekit-jwt-service/molecule/default/files/openid-fixture.py @@ -0,0 +1,53 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +"""Small HTTPS Matrix federation OpenID userinfo fixture for Molecule.""" + +import json +import ssl +from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer +from urllib.parse import parse_qs, urlparse + + +KNOWN_TOKEN = "known-openid-token" +KNOWN_SUBJECT = "@alice:matrix-openid-fixture:8443" +REQUESTS = [] + + +class OpenIDHandler(BaseHTTPRequestHandler): + def send_json(self, status, document): + body = json.dumps(document, separators=(",", ":")).encode() + self.send_response(status) + self.send_header("Content-Type", "application/json") + self.send_header("Content-Length", str(len(body))) + self.end_headers() + self.wfile.write(body) + + def do_GET(self): # noqa: N802 - BaseHTTPRequestHandler API + parsed = urlparse(self.path) + if parsed.path == "/_molecule/requests": + self.send_json(200, {"requests": REQUESTS}) + return + + if parsed.path != "/_matrix/federation/v1/openid/userinfo": + self.send_json(404, {"errcode": "M_NOT_FOUND"}) + return + + token = parse_qs(parsed.query).get("access_token", [""])[0] + REQUESTS.append({"path": parsed.path, "access_token": token}) + if token == KNOWN_TOKEN: + self.send_json(200, {"sub": KNOWN_SUBJECT}) + return + + self.send_json(401, {"errcode": "M_UNAUTHORIZED", "error": "unknown token"}) + + def log_message(self, message, *args): + print("openid-fixture:", message % args, flush=True) + + +server = ThreadingHTTPServer(("0.0.0.0", 8443), OpenIDHandler) +tls_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) +tls_context.load_cert_chain("/fixture/cert.pem", "/fixture/key.pem") +server.socket = tls_context.wrap_socket(server.socket, server_side=True) +server.serve_forever() diff --git a/roles/custom/matrix-livekit-jwt-service/molecule/default/molecule.yml b/roles/custom/matrix-livekit-jwt-service/molecule/default/molecule.yml new file mode 100644 index 000000000..968e05a6b --- /dev/null +++ b/roles/custom/matrix-livekit-jwt-service/molecule/default/molecule.yml @@ -0,0 +1,95 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +dependency: + name: galaxy + options: + requirements-file: requirements.yml + force: true +driver: + name: docker +platforms: + - name: matrix-livekit-jwt-service-${MOLECULE_DISTRO:-ubuntu2604}-default + image: "geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2604}-ansible:latest" + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + pre_build_image: true +provisioner: + name: ansible + config_options: + defaults: + callback_result_format: yaml + inventory: + group_vars: + all: + matrix_livekit_jwt_service_enabled: true + + # Exercise role-controlled paths and networking with values which differ + # from both the role and image defaults. + matrix_livekit_jwt_service_base_path: /matrix/molecule-livekit-jwt-service + matrix_livekit_jwt_service_container_network: matrix-livekit-jwt-service-molecule + matrix_livekit_jwt_service_container_port: 8097 + matrix_livekit_jwt_service_environment_variable_livekit_jwt_bind: ":8097" + + matrix_livekit_jwt_service_environment_variable_livekit_key: molecule-livekit-api-key + matrix_livekit_jwt_service_environment_variable_livekit_secret: molecule-livekit-signing-secret-32-bytes-long + matrix_livekit_jwt_service_environment_variable_livekit_url: wss://sfu.livekit.molecule.invalid:7881/rtc + + # The OpenID fixture's origin is deliberately absent. This makes the + # successful request a restricted-user flow, so no SFU is contacted. + matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_default: + - full-access.molecule.local + matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom: + - second-full-access.molecule.local + + matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom: + "matrix-openid-fixture:8443": https://client-api.override.molecule.invalid + + # The scenario-local OpenID endpoint uses a self-signed certificate. + matrix_livekit_jwt_service_environment_variables_extension: | + LIVEKIT_INSECURE_SKIP_VERIFY_TLS=YES_I_KNOW_WHAT_I_AM_DOING + LIVEKIT_LOG_LEVEL=debug + MOLECULE_LIVEKIT_MARKER=environment-reached + + # v0.6.0 ships a malformed image healthcheck. The role intentionally + # disables it until upstream fixes its LIVEKIT_JWT_BIND interpolation. + matrix_livekit_jwt_service_container_healthcheck_enabled: false + + matrix_livekit_jwt_service_hostname: jwt.livekit.molecule.local + matrix_livekit_jwt_service_path_prefix: /matrix-rtc/jwt + matrix_livekit_jwt_service_container_labels_traefik_enabled: true + matrix_livekit_jwt_service_container_labels_traefik_priority: 847 + matrix_livekit_jwt_service_container_labels_traefik_entrypoints: web + matrix_livekit_jwt_service_container_labels_traefik_tls: false + matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_custom: + X-Molecule-LiveKit: jwt-service + matrix_livekit_jwt_service_container_labels_additional_labels: | + molecule.livekit-jwt.coverage=enabled + + # Prove the approved generic Docker-argument escape hatch reaches runtime. + matrix_livekit_jwt_service_container_extra_arguments: + - --hostname=livekit-jwt-molecule-runtime + - --label=molecule.livekit-jwt.extra-argument=reached + env: + # Workaround for https://github.com/ansible/molecule/issues/4391 + ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/../..:/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:${ANSIBLE_HOME:-~/.ansible}/roles +scenario: + test_sequence: + - dependency + - cleanup + - destroy + - syntax + - create + - prepare + - converge + - idempotence + - verify + - cleanup + - destroy +verifier: + name: ansible diff --git a/roles/custom/matrix-livekit-jwt-service/molecule/default/prepare.yml b/roles/custom/matrix-livekit-jwt-service/molecule/default/prepare.yml new file mode 100644 index 000000000..a3b3ba6af --- /dev/null +++ b/roles/custom/matrix-livekit-jwt-service/molecule/default/prepare.yml @@ -0,0 +1,121 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +- name: Prepare matrix-livekit-jwt-service Molecule tests + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml" + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + gather_facts: true + tasks: + - name: Ensure apt cache is updated + ansible.builtin.apt: + update_cache: true + cache_valid_time: 600 + when: ansible_facts['os_family'] == 'Debian' + + - name: Ensure required packages are installed + ansible.builtin.package: + name: + - python3-requests + - fuse-overlayfs + - openssl + state: present + + - name: Ensure Docker is installed + ansible.builtin.include_role: + name: ansible-role-docker + vars: + docker_daemon_options: + storage-driver: fuse-overlayfs + + - name: Ensure the matrix group exists + ansible.builtin.group: + name: "{{ matrix_group_name }}" + gid: "{{ matrix_user_gid }}" + state: present + + - name: Ensure the matrix user exists + ansible.builtin.user: + name: "{{ matrix_user_name }}" + uid: "{{ matrix_user_uid }}" + group: "{{ matrix_group_name }}" + create_home: false + system: true + state: present + + - name: Ensure the base data path exists + ansible.builtin.file: + path: "{{ matrix_base_data_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + mode: "0750" + + - name: Ensure the OpenID fixture directory exists + ansible.builtin.file: + path: /matrix/molecule-livekit-openid-fixture + state: directory + mode: "0755" + + - name: Install the OpenID fixture server + ansible.builtin.copy: + src: openid-fixture.py + dest: /matrix/molecule-livekit-openid-fixture/openid-fixture.py + mode: "0644" + + - name: Generate a self-signed certificate for the OpenID fixture + ansible.builtin.command: + argv: + - openssl + - req + - -x509 + - -newkey + - rsa:2048 + - -nodes + - -keyout + - /matrix/molecule-livekit-openid-fixture/key.pem + - -out + - /matrix/molecule-livekit-openid-fixture/cert.pem + - -days + - "2" + - -subj + - /CN=matrix-openid-fixture + creates: /matrix/molecule-livekit-openid-fixture/key.pem + + - name: Ensure the scenario container network exists + ansible.builtin.command: + argv: + - docker + - network + - create + - "{{ matrix_livekit_jwt_service_container_network }}" + register: matrix_livekit_jwt_service_molecule_network + changed_when: matrix_livekit_jwt_service_molecule_network.rc == 0 + failed_when: + - matrix_livekit_jwt_service_molecule_network.rc != 0 + - "'already exists' not in matrix_livekit_jwt_service_molecule_network.stderr" + + - name: Ensure the HTTPS OpenID fixture is running + community.docker.docker_container: + name: matrix-livekit-jwt-openid-fixture + image: "{{ molecule_shared_image_python }}" + pull: always + command: + - python3 + - /fixture/openid-fixture.py + mounts: + - source: /matrix/molecule-livekit-openid-fixture + target: /fixture + type: bind + read_only: true + networks: + - name: "{{ matrix_livekit_jwt_service_container_network }}" + aliases: + - matrix-openid-fixture + comparisons: + networks: strict + state: started diff --git a/roles/custom/matrix-livekit-jwt-service/molecule/default/requirements.yml b/roles/custom/matrix-livekit-jwt-service/molecule/default/requirements.yml new file mode 120000 index 000000000..1567a5392 --- /dev/null +++ b/roles/custom/matrix-livekit-jwt-service/molecule/default/requirements.yml @@ -0,0 +1 @@ +../../../../../molecule-shared/requirements.yml \ No newline at end of file diff --git a/roles/custom/matrix-livekit-jwt-service/molecule/default/verify.yml b/roles/custom/matrix-livekit-jwt-service/molecule/default/verify.yml new file mode 100644 index 000000000..2905b329f --- /dev/null +++ b/roles/custom/matrix-livekit-jwt-service/molecule/default/verify.yml @@ -0,0 +1,509 @@ +# SPDX-FileCopyrightText: 2026 Slavi Pantaleev +# +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- +- name: Verify matrix-livekit-jwt-service + hosts: all + become: true + vars_files: + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml" + - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml" + vars: + matrix_livekit_jwt_service_runtime: "{{ (matrix_livekit_jwt_service_container_inspect.stdout | from_json) | first }}" + matrix_livekit_jwt_service_valid_request: + room_id: "!call-room:molecule.local" + slot_id: molecule-slot + openid_token: + access_token: known-openid-token + token_type: Bearer + matrix_server_name: "matrix-openid-fixture:8443" + expires_in: 3600 + member: + id: member-molecule-01 + claimed_user_id: "@alice:matrix-openid-fixture:8443" + claimed_device_id: DEVICE_MOLECULE + gather_facts: false + + tasks: + - name: Load the role's defaults under a separate name + ansible.builtin.include_vars: + file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml" + name: matrix_livekit_jwt_service_role_defaults + + - name: Wait for the LiveKit JWT service to become active + ansible.builtin.systemd_service: + name: matrix-livekit-jwt-service.service + register: matrix_livekit_jwt_service_service + until: matrix_livekit_jwt_service_service.status.ActiveState == 'active' + retries: 30 + delay: 5 + failed_when: false + + # Restart=always keeps a crash-looping service nominally active. + - name: Assert the service is active and has not restarted + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_service.status.ActiveState == 'active' + - matrix_livekit_jwt_service_service.status.NRestarts is defined + - matrix_livekit_jwt_service_service.status.NRestarts | int == 0 + fail_msg: >- + matrix-livekit-jwt-service.service is + {{ matrix_livekit_jwt_service_service.status.ActiveState | default('unknown') }} after + {{ matrix_livekit_jwt_service_service.status.NRestarts | default('?') }} restart(s) + success_msg: "matrix-livekit-jwt-service.service is active and has not restarted" + + - name: Wait for the live health endpoint on the configured non-default port + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_livekit_jwt_service_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --output + - /dev/null + - --write-out + - "HTTP_STATUS=%{http_code}" + - http://matrix-livekit-jwt-service:8097/healthz + register: matrix_livekit_jwt_service_health + changed_when: false + until: matrix_livekit_jwt_service_health.stdout == 'HTTP_STATUS=200' + retries: 24 + delay: 5 + failed_when: false + + - name: Assert the live service is healthy on the configured port + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_health.rc == 0 + - matrix_livekit_jwt_service_health.stdout == 'HTTP_STATUS=200' + fail_msg: "The LiveKit JWT service did not answer /healthz on port 8097" + success_msg: "The LiveKit JWT service is healthy on its non-default port" + + - name: Exercise the get_token CORS preflight + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_livekit_jwt_service_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --include + - --request + - OPTIONS + - --write-out + - "\nHTTP_STATUS=%{http_code}" + - http://matrix-livekit-jwt-service:8097/get_token + register: matrix_livekit_jwt_service_cors + changed_when: false + failed_when: false + + - name: Assert get_token exposes its CORS contract + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_cors.rc == 0 + - "'HTTP_STATUS=200' in matrix_livekit_jwt_service_cors.stdout_lines" + - "'access-control-allow-origin: *' in matrix_livekit_jwt_service_cors.stdout | lower" + - "'access-control-allow-methods: post' in matrix_livekit_jwt_service_cors.stdout | lower" + - "'access-control-allow-headers: accept, content-type, content-length, accept-encoding, x-csrf-token' in matrix_livekit_jwt_service_cors.stdout | lower" + fail_msg: "OPTIONS /get_token did not return the service's expected CORS headers" + success_msg: "OPTIONS /get_token exposes the expected CORS contract" + + - name: Submit malformed JSON to get_token + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_livekit_jwt_service_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --header + - "Content-Type: application/json" + - --data-binary + - "{not-json" + - --write-out + - "\nHTTP_STATUS=%{http_code}" + - http://matrix-livekit-jwt-service:8097/get_token + register: matrix_livekit_jwt_service_malformed + changed_when: false + failed_when: false + + - name: Assert malformed JSON is rejected structurally + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_malformed.rc == 0 + - matrix_livekit_jwt_service_malformed.stdout_lines[-1] == 'HTTP_STATUS=400' + - matrix_livekit_jwt_service_malformed_document.errcode == 'M_NOT_JSON' + - matrix_livekit_jwt_service_malformed_document.error == 'Error reading request' + fail_msg: "Malformed JSON did not produce the expected Matrix error response" + success_msg: "Malformed JSON is rejected with M_NOT_JSON" + vars: + matrix_livekit_jwt_service_malformed_document: >- + {{ matrix_livekit_jwt_service_malformed.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }} + + - name: Ask get_token to validate an unknown OpenID token + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_livekit_jwt_service_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --header + - "Content-Type: application/json" + - --data-binary + - "{{ matrix_livekit_jwt_service_unknown_token_request | to_json }}" + - --write-out + - "\nHTTP_STATUS=%{http_code}" + - http://matrix-livekit-jwt-service:8097/get_token + register: matrix_livekit_jwt_service_unknown_token + changed_when: false + failed_when: false + vars: + matrix_livekit_jwt_service_unknown_token_request: >- + {{ matrix_livekit_jwt_service_valid_request | combine({'openid_token': matrix_livekit_jwt_service_valid_request.openid_token | combine({'access_token': 'unknown-openid-token'})}, recursive=True) }} + + - name: Assert an unknown OpenID token is unauthorized + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_unknown_token.rc == 0 + - matrix_livekit_jwt_service_unknown_token.stdout_lines[-1] == 'HTTP_STATUS=401' + - matrix_livekit_jwt_service_unknown_token_document.errcode == 'M_UNAUTHORIZED' + - matrix_livekit_jwt_service_unknown_token_document.error == 'The request could not be authorised.' + fail_msg: "An unknown OpenID token was not rejected as unauthorized" + success_msg: "The live service rejects an unknown OpenID token" + vars: + matrix_livekit_jwt_service_unknown_token_document: >- + {{ matrix_livekit_jwt_service_unknown_token.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }} + + - name: Ask get_token to validate a mismatched claimed user + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_livekit_jwt_service_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --header + - "Content-Type: application/json" + - --data-binary + - "{{ matrix_livekit_jwt_service_mismatched_user_request | to_json }}" + - --write-out + - "\nHTTP_STATUS=%{http_code}" + - http://matrix-livekit-jwt-service:8097/get_token + register: matrix_livekit_jwt_service_mismatched_user + changed_when: false + failed_when: false + vars: + matrix_livekit_jwt_service_mismatched_user_request: >- + {{ matrix_livekit_jwt_service_valid_request | combine({'member': matrix_livekit_jwt_service_valid_request.member | combine({'claimed_user_id': '@mallory:matrix-openid-fixture:8443'})}, recursive=True) }} + + - name: Assert a valid token cannot impersonate another Matrix user + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_mismatched_user.rc == 0 + - matrix_livekit_jwt_service_mismatched_user.stdout_lines[-1] == 'HTTP_STATUS=401' + - matrix_livekit_jwt_service_mismatched_user_document.errcode == 'M_UNAUTHORIZED' + fail_msg: "The OpenID subject and claimed Matrix user mismatch was not rejected" + success_msg: "The live service rejects a claimed-user mismatch" + vars: + matrix_livekit_jwt_service_mismatched_user_document: >- + {{ matrix_livekit_jwt_service_mismatched_user.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }} + + # The request's server is not in FULL_ACCESS, so this validates OpenID and + # signs a join token without trying to create a room on the absent SFU. + - name: Request a real restricted-user LiveKit JWT + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_livekit_jwt_service_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --header + - "Content-Type: application/json" + - --data-binary + - "{{ matrix_livekit_jwt_service_valid_request | to_json }}" + - --write-out + - "\nHTTP_STATUS=%{http_code}" + - http://matrix-livekit-jwt-service:8097/get_token + register: matrix_livekit_jwt_service_token_response + changed_when: false + failed_when: false + + - name: Parse the successful token response + ansible.builtin.set_fact: + matrix_livekit_jwt_service_token_document: >- + {{ matrix_livekit_jwt_service_token_response.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }} + + - name: Assert the live service returns a JWT for the configured SFU URL + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_token_response.rc == 0 + - matrix_livekit_jwt_service_token_response.stdout_lines[-1] == 'HTTP_STATUS=200' + - matrix_livekit_jwt_service_token_document.keys() | sort == ['jwt', 'url'] + - matrix_livekit_jwt_service_token_document.url == matrix_livekit_jwt_service_environment_variable_livekit_url + - matrix_livekit_jwt_service_token_document.jwt.split('.') | length == 3 + fail_msg: "The restricted-user exchange did not return a JWT and configured SFU URL" + success_msg: "The restricted-user exchange returns a real JWT for the configured SFU" + + - name: Decode and authenticate the returned LiveKit JWT + ansible.builtin.command: + argv: + - python3 + - -c + - >- + import base64, hashlib, hmac, json, sys; + parts = sys.argv[1].split('.'); + decode = lambda value: json.loads(base64.urlsafe_b64decode(value + '=' * (-len(value) % 4))); + signature = base64.urlsafe_b64decode(parts[2] + '=' * (-len(parts[2]) % 4)); + expected = hmac.new(sys.argv[2].encode(), (parts[0] + '.' + parts[1]).encode(), hashlib.sha256).digest(); + print(json.dumps({'header': decode(parts[0]), 'claims': decode(parts[1]), 'signature_valid': hmac.compare_digest(signature, expected)})) + - "{{ matrix_livekit_jwt_service_token_document.jwt }}" + - "{{ matrix_livekit_jwt_service_environment_variable_livekit_secret }}" + register: matrix_livekit_jwt_service_jwt_decode + changed_when: false + no_log: true + + - name: Assert the JWT signature, identity, room and restricted grant + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_jwt.signature_valid is sameas true + - matrix_livekit_jwt_service_jwt.header.alg == 'HS256' + - matrix_livekit_jwt_service_jwt.claims.iss == matrix_livekit_jwt_service_environment_variable_livekit_key + - matrix_livekit_jwt_service_jwt.claims.sub == 'BE7ZK/J/c3LsogjI1JLni7qtWV/DP6c+ev68BvHem0Y' + - matrix_livekit_jwt_service_jwt.claims.video.room == 'diNaPECp1jHt2l0dLdiDxi+dgNzgucxPYMD0lCs1tEQ' + - matrix_livekit_jwt_service_jwt.claims.video.roomJoin is sameas true + - "'roomCreate' not in matrix_livekit_jwt_service_jwt.claims.video" + - matrix_livekit_jwt_service_jwt.claims.video.canPublish is sameas true + - matrix_livekit_jwt_service_jwt.claims.video.canSubscribe is sameas true + - matrix_livekit_jwt_service_jwt.claims.video.canUpdateOwnMetadata is sameas true + - matrix_livekit_jwt_service_jwt.claims.exp | int - matrix_livekit_jwt_service_jwt.claims.nbf | int == 3600 + fail_msg: "The returned JWT lost its authenticated MSC4195 identity, room or restricted join grant" + success_msg: "The returned JWT has a valid signature and restricted MSC4195 grant" + vars: + matrix_livekit_jwt_service_jwt: "{{ matrix_livekit_jwt_service_jwt_decode.stdout | from_json }}" + + - name: Read the OpenID fixture's observed requests + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_livekit_jwt_service_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --insecure + - https://matrix-livekit-jwt-openid-fixture:8443/_molecule/requests + register: matrix_livekit_jwt_service_openid_requests_command + changed_when: false + + - name: Assert the live service exercised both OpenID fixture outcomes + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_openid_requests.requests | length >= 3 + - matrix_livekit_jwt_service_openid_requests.requests | map(attribute='path') | unique | list == ['/_matrix/federation/v1/openid/userinfo'] + - matrix_livekit_jwt_service_openid_requests.requests[-3:] | map(attribute='access_token') | list == ['unknown-openid-token', 'known-openid-token', 'known-openid-token'] + fail_msg: "The OpenID fixture did not observe the expected unknown and known token exchanges" + success_msg: "The service exercised both HTTPS OpenID fixture outcomes" + vars: + matrix_livekit_jwt_service_openid_requests: "{{ matrix_livekit_jwt_service_openid_requests_command.stdout | from_json }}" + + - name: Read the environment file the role rendered + ansible.builtin.slurp: + src: "{{ matrix_livekit_jwt_service_base_path }}/env" + register: matrix_livekit_jwt_service_env_file + + - name: Initialize the parsed environment + ansible.builtin.set_fact: + matrix_livekit_jwt_service_env_parsed: {} + + - name: Parse the rendered environment + ansible.builtin.set_fact: + matrix_livekit_jwt_service_env_parsed: >- + {{ matrix_livekit_jwt_service_env_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }} + loop: "{{ (matrix_livekit_jwt_service_env_file.content | b64decode).splitlines() | reject('equalto', '') }}" + when: "'=' in item" + no_log: true + + - name: Assert the rendered environment carries every scenario setting + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_env_parsed.LIVEKIT_JWT_BIND == ':8097' + - matrix_livekit_jwt_service_env_parsed.LIVEKIT_KEY == 'molecule-livekit-api-key' + - matrix_livekit_jwt_service_env_parsed.LIVEKIT_SECRET == 'molecule-livekit-signing-secret-32-bytes-long' + - matrix_livekit_jwt_service_env_parsed.LIVEKIT_URL == 'wss://sfu.livekit.molecule.invalid:7881/rtc' + - matrix_livekit_jwt_service_env_parsed.LIVEKIT_FULL_ACCESS_HOMESERVERS == 'full-access.molecule.local,second-full-access.molecule.local' + - matrix_livekit_jwt_service_env_parsed.LIVEKIT_CS_API_URL_OVERRIDES == 'matrix-openid-fixture:8443=https://client-api.override.molecule.invalid' + - matrix_livekit_jwt_service_env_parsed.LIVEKIT_INSECURE_SKIP_VERIFY_TLS == 'YES_I_KNOW_WHAT_I_AM_DOING' + - matrix_livekit_jwt_service_env_parsed.LIVEKIT_LOG_LEVEL == 'debug' + - matrix_livekit_jwt_service_env_parsed.MOLECULE_LIVEKIT_MARKER == 'environment-reached' + fail_msg: "The parsed environment file does not carry the scenario's complete contract" + success_msg: "The parsed environment file carries every scenario setting" + no_log: true + + - name: Read the labels file the role rendered + ansible.builtin.slurp: + src: "{{ matrix_livekit_jwt_service_base_path }}/labels" + register: matrix_livekit_jwt_service_labels_file + + - name: Initialize the parsed labels + ansible.builtin.set_fact: + matrix_livekit_jwt_service_labels_parsed: {} + + - name: Parse the rendered labels + ansible.builtin.set_fact: + matrix_livekit_jwt_service_labels_parsed: >- + {{ matrix_livekit_jwt_service_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }} + loop: "{{ (matrix_livekit_jwt_service_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}" + when: "'=' in item" + no_log: true + + - name: Assert the rendered labels carry the public routing contract + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_labels_parsed['traefik.enable'] == 'true' + - matrix_livekit_jwt_service_labels_parsed['traefik.docker.network'] == matrix_livekit_jwt_service_container_network + - matrix_livekit_jwt_service_labels_parsed['traefik.http.services.matrix-livekit-jwt-service.loadbalancer.server.port'] == '8097' + - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.rule'] == 'Host(`jwt.livekit.molecule.local`) && PathPrefix(`/matrix-rtc/jwt`)' + - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.priority'] == '847' + - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.entrypoints'] == 'web' + - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.tls'] == 'false' + - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.middlewares'] == 'matrix-livekit-jwt-service-slashless-redirect,matrix-livekit-jwt-service-strip-prefix,matrix-livekit-jwt-service-add-headers' + - matrix_livekit_jwt_service_labels_parsed['traefik.http.middlewares.matrix-livekit-jwt-service-add-headers.headers.customresponseheaders.X-Molecule-LiveKit'] == 'jwt-service' + - matrix_livekit_jwt_service_labels_parsed['molecule.livekit-jwt.coverage'] == 'enabled' + fail_msg: "The parsed labels do not carry the scenario's routing contract" + success_msg: "The parsed labels carry the scenario's complete routing contract" + + - name: Inspect the running LiveKit JWT service container + ansible.builtin.command: + argv: + - docker + - container + - inspect + - matrix-livekit-jwt-service + register: matrix_livekit_jwt_service_container_inspect + changed_when: false + + - name: Assert the configured environment reached the running container + ansible.builtin.assert: + that: + - "'LIVEKIT_JWT_BIND=:8097' in matrix_livekit_jwt_service_runtime.Config.Env" + - "'LIVEKIT_FULL_ACCESS_HOMESERVERS=full-access.molecule.local,second-full-access.molecule.local' in matrix_livekit_jwt_service_runtime.Config.Env" + - "'LIVEKIT_CS_API_URL_OVERRIDES=matrix-openid-fixture:8443=https://client-api.override.molecule.invalid' in matrix_livekit_jwt_service_runtime.Config.Env" + - "'LIVEKIT_INSECURE_SKIP_VERIFY_TLS=YES_I_KNOW_WHAT_I_AM_DOING' in matrix_livekit_jwt_service_runtime.Config.Env" + - "'MOLECULE_LIVEKIT_MARKER=environment-reached' in matrix_livekit_jwt_service_runtime.Config.Env" + fail_msg: "The running container environment lost role-rendered settings" + success_msg: "The role-rendered environment reached the running container" + + - name: Assert the configured labels reached the running container + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.enable'] == 'true' + - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.docker.network'] == matrix_livekit_jwt_service_container_network + - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.http.routers.matrix-livekit-jwt-service.priority'] == '847' + - matrix_livekit_jwt_service_runtime.Config.Labels['molecule.livekit-jwt.coverage'] == 'enabled' + - matrix_livekit_jwt_service_runtime.Config.Labels['molecule.livekit-jwt.extra-argument'] == 'reached' + fail_msg: "The running container lost role-rendered or extra-argument labels" + success_msg: "The configured labels reached the running container" + + - name: Assert the running container uses the exact image and version the role pins + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_runtime.Config.Image == matrix_livekit_jwt_service_expected_image + fail_msg: >- + The running container uses {{ matrix_livekit_jwt_service_runtime.Config.Image }}, + expected {{ matrix_livekit_jwt_service_expected_image }} + success_msg: "The running container uses the exact image and version defaults/main.yml pins" + vars: + matrix_livekit_jwt_service_expected_image: >- + {{ matrix_livekit_jwt_service_role_defaults.matrix_livekit_jwt_service_container_image_registry_prefix_upstream_default }}element-hq/lk-jwt-service:{{ matrix_livekit_jwt_service_role_defaults.matrix_livekit_jwt_service_version }} + + - name: Assert the running container identity and image command + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_runtime.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string) + - matrix_livekit_jwt_service_runtime.Config.Entrypoint | default([], true) | length == 0 + - matrix_livekit_jwt_service_runtime.Config.Cmd == ['/lk-jwt-service'] + - matrix_livekit_jwt_service_runtime.HostConfig.RestartPolicy.Name == 'no' + - matrix_livekit_jwt_service_runtime.HostConfig.AutoRemove is sameas true + - matrix_livekit_jwt_service_runtime.HostConfig.LogConfig.Type == 'none' + fail_msg: "The running container has an unexpected identity, command or Docker lifecycle" + success_msg: "The running container uses the configured identity, command and Docker lifecycle" + + - name: Assert the running container security and filesystem contract + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_runtime.HostConfig.Privileged is sameas false + - matrix_livekit_jwt_service_runtime.HostConfig.CapAdd | default([], true) | length == 0 + - matrix_livekit_jwt_service_runtime.HostConfig.CapDrop == ['ALL'] + - matrix_livekit_jwt_service_runtime.HostConfig.ReadonlyRootfs is sameas false + - matrix_livekit_jwt_service_runtime.Mounts | length == 0 + - matrix_livekit_jwt_service_runtime.HostConfig.Binds | default([], true) | length == 0 + fail_msg: "The running container differs from the role's capability and mount contract" + success_msg: "The running container has all capabilities dropped and no mounts" + + - name: Assert the broken upstream healthcheck is disabled + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_runtime.Config.Healthcheck is mapping + - matrix_livekit_jwt_service_runtime.Config.Healthcheck.Test == ['NONE'] + - matrix_livekit_jwt_service_runtime.State.Health.Status is not defined + fail_msg: "The v0.6.0 image healthcheck was not disabled by the role" + success_msg: "The broken v0.6.0 image healthcheck is disabled" + + - name: Assert the running container is attached only to its dedicated network + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_runtime.HostConfig.NetworkMode == matrix_livekit_jwt_service_container_network + - matrix_livekit_jwt_service_runtime.NetworkSettings.Networks is mapping + - matrix_livekit_jwt_service_runtime.NetworkSettings.Networks | length == 1 + - matrix_livekit_jwt_service_container_network in matrix_livekit_jwt_service_runtime.NetworkSettings.Networks + fail_msg: >- + LiveKit JWT service has unexpected network attachments: + {{ matrix_livekit_jwt_service_runtime.NetworkSettings.Networks.keys() | list }} + success_msg: "The running container is attached only to its dedicated network" + + - name: Assert the observable extra runtime argument reached Docker + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_runtime.Config.Hostname == 'livekit-jwt-molecule-runtime' + fail_msg: "The configured hostname extra argument did not reach Docker" + success_msg: "The approved container extra-argument setting reached Docker" + + - name: Ask Docker for the service's published ports + ansible.builtin.command: + argv: + - docker + - container + - port + - matrix-livekit-jwt-service + register: matrix_livekit_jwt_service_published_ports + changed_when: false + failed_when: false + + - name: Assert the role publishes no host ports + ansible.builtin.assert: + that: + - matrix_livekit_jwt_service_runtime.Config.ExposedPorts.keys() | list == ['8080/tcp'] + - matrix_livekit_jwt_service_runtime.HostConfig.PortBindings | default({}, true) | length == 0 + - matrix_livekit_jwt_service_published_ports.rc == 0 + - matrix_livekit_jwt_service_published_ports.stdout | trim | length == 0 + fail_msg: >- + LiveKit JWT service unexpectedly publishes a host port: + {{ matrix_livekit_jwt_service_published_ports.stdout | default('unknown') }} + success_msg: "The role leaves the image's declared port unpublished"