nsaspy/quasar

Fork 0

Fix StarIntel v1 auth/path contract and add live server CI #67

Open

nsaspy wants to merge 15 commits from fix/starintel-auth-contract-ci into main

nsaspy commented

2026-09-04 20:56:29 +00:00

Owner

Slice

Fix Quasar's StarIntel HTTP client against the current starintel-server contract and gate it with a real disposable server in CI.

Root causes fixed

Current StarIntel v1 uses POST /auth/login to turn username/password into an opaque star_sk_v1_... API key; Quasar was incorrectly sending HTTP Basic auth to v1 routes.
/api/v1/capabilities is public and returns the contract under data; Quasar was attaching credentials to discovery and retaining the envelope.
The current target route advertised by capabilities is /new/target/:actor; Quasar was trying the nonexistent /api/v1/targets first.
Quasar sent Idempotency-Key, which is not in the current server CORS allow-header contract.
Any v1 error caused a legacy fallback, masking real auth/server failures.
Browser network/CORS failures only surfaced as Failed to fetch.

Client behavior

Public capability discovery is credential-free.
Explicit bearer API keys still work.
Username/password now log in through /auth/login, cache the minted session key in memory, validate it through /auth/context, and retry once after a stale login key gets a 401.
Basic auth is retained only for actual legacy fallback.
Target submission follows the target_create capability path.
Network/CORS errors now include the requested endpoint and a STAR_AUTH_ALLOWED_ORIGINS hint when running in a browser.

Tests / CI

Expanded unit coverage for discovery, login, bearer auth, missing credentials, strict legacy fallback, current target routing, legacy Basic auth, and session-key reuse.
Added a live integration test for the Quasar client.
Added StarIntel HTTP Contract CI that checks out pinned starintel-server commit 8fb297d146e7332fae7e38170b5b49d49530ac53, builds the real Nix server, starts CouchDB/RabbitMQ/Valkey, starts StarIntel with disposable known CI username/password, verifies capabilities + CORS, and runs Quasar against the authenticated server.

No production credentials are used or committed; all CI credentials are disposable literals inside the ephemeral job.

## Slice Fix Quasar's StarIntel HTTP client against the current `starintel-server` contract and gate it with a real disposable server in CI. ### Root causes fixed - Current StarIntel v1 uses `POST /auth/login` to turn username/password into an opaque `star_sk_v1_...` API key; Quasar was incorrectly sending HTTP Basic auth to v1 routes. - `/api/v1/capabilities` is public and returns the contract under `data`; Quasar was attaching credentials to discovery and retaining the envelope. - The current target route advertised by capabilities is `/new/target/:actor`; Quasar was trying the nonexistent `/api/v1/targets` first. - Quasar sent `Idempotency-Key`, which is not in the current server CORS allow-header contract. - Any v1 error caused a legacy fallback, masking real auth/server failures. - Browser network/CORS failures only surfaced as `Failed to fetch`. ### Client behavior - Public capability discovery is credential-free. - Explicit bearer API keys still work. - Username/password now log in through `/auth/login`, cache the minted session key in memory, validate it through `/auth/context`, and retry once after a stale login key gets a 401. - Basic auth is retained only for actual legacy fallback. - Target submission follows the `target_create` capability path. - Network/CORS errors now include the requested endpoint and a `STAR_AUTH_ALLOWED_ORIGINS` hint when running in a browser. ### Tests / CI - Expanded unit coverage for discovery, login, bearer auth, missing credentials, strict legacy fallback, current target routing, legacy Basic auth, and session-key reuse. - Added a live integration test for the Quasar client. - Added `StarIntel HTTP Contract` CI that checks out pinned `starintel-server` commit `8fb297d146e7332fae7e38170b5b49d49530ac53`, builds the real Nix server, starts CouchDB/RabbitMQ/Valkey, starts StarIntel with disposable known CI username/password, verifies capabilities + CORS, and runs Quasar against the authenticated server. No production credentials are used or committed; all CI credentials are disposable literals inside the ephemeral job.

nsaspy added 15 commits

2026-09-04 20:56:29 +00:00

fix: align Quasar with StarIntel v1 auth contract 2a35ab7cf8

test: cover StarIntel v1 login and target routing 4b0e15ca90

test: add live StarIntel auth contract coverage 75af0d3182

ci: exercise Quasar against real StarIntel auth 06b1215fb2

fix: keep capability discovery credential-free 2ef2fea06b

test: assert public discovery never sends credentials 7ecf04d7a6

ci: boot the canonical StarIntel stack with known credentials cabfb240fd

ci: preserve known StarIntel login credentials b3f009ec2a

Merge main into StarIntel auth contract slice c8cb0b26e1

ci: provision auth user through canonical bootstrap 6f3181eabc

ci: print StarIntel client formatting diff 9bbc462485

ci: run Prettier from repository root ba08e48f3c

test: format StarIntel client coverage 7e05902d49

ci: restore strict Quasar quality gate 37cc579ec4

ci: provision known user via server-local admin

StarIntel HTTP Contract / live-http-contract (pull_request) Failing after 42s

Details

18c19da303

StarIntel HTTP Contract / live-http-contract (pull_request) Failing after 42s

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/starintel-auth-contract-ci:fix/starintel-auth-contract-ci

git switch fix/starintel-auth-contract-ci

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff fix/starintel-auth-contract-ci

git switch fix/starintel-auth-contract-ci

git rebase main

git switch main

git merge --ff-only fix/starintel-auth-contract-ci

git switch fix/starintel-auth-contract-ci

git rebase main

git switch main

git merge --no-ff fix/starintel-auth-contract-ci

git switch main

git merge --squash fix/starintel-auth-contract-ci