Add Integration Tests for New jwt-auth, mcp-auth and mcp-authz Improvements

[O-sura]

Purpose

This PR adds some additional integration test scenarios to test and ensure the functionality of the jwt-auth, mcp-auth and mcp-authz policies after the improvements made for addressing the following set of issues

• [Task]: Make claims optional in MCP AuthZ policy #2841
• Expose jwt-auth token forwarding params in mcp-auth for consistency #2867
• mcp-auth strips Authorization header injected by set-headers policy #2866
• [Bug]: MCP auth policy breaks authorization not applied MCP tools, resources, prompt invocations #2842
• [Improvement]: JWT Auth Policy - Claim & Scope Matching Refactor #2746

[coderabbitai]

📝 Walkthrough

Walkthrough

JWT and MCP integration tests now cover custom JWT claims, scope and claim authorization formats, deprecated-parameter precedence, token forwarding, header interactions, multi-rule authorization, governance, and exclusions.

Changes

Authentication and authorization coverage

Layer / File(s)	Summary
Custom JWT claim generation gateway/it/steps_jwt.go, tests/mock-servers/mock-jwks/main.go	JWT test steps accept custom claims, and the mock JWKS server includes them in signed tokens.
JWT scope and claim authorization gateway/it/features/jwt-auth.feature	Scenarios validate allOf/anyOf scope and claim matching, combined requirements, and precedence of new parameters over deprecated ones.
MCP authentication and token forwarding gateway/it/features/mcp_policies.feature	Scenarios validate forwarding options, Authorization header overwrites, and forwarding-header collisions.
MCP authorization policy enforcement gateway/it/features/mcp_policies.feature	Scenarios validate scope and claim rules, precedence, multi-rule matching, mixed formats, governance, and exclusions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: chamilaadhi, tharsanan1, renuka-fernando

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description only includes Purpose and omits most required template sections like Goals, Approach, tests, security, and environment.	Fill in the missing template sections with goals, approach, user stories, documentation, automation/security test details, samples, related PRs, and test environment.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately reflects the main change: added integration tests for jwt-auth, mcp-auth, and mcp-authz.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain modules listed in go.work or their selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[O-sura]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

🧹 Nitpick comments (1)

gateway/it/features/jwt-auth.feature (1)

550-555: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Precedence scenarios assert only the rejection path. Both new-vs-deprecated precedence scenarios would still pass if the policy rejected every request, so they do not actually prove the new param is evaluated. Add a matching positive case to each.

• gateway/it/features/jwt-auth.feature#L550-L555: add a token with scope api:deploy expecting 200.
• gateway/it/features/jwt-auth.feature#L652-L657: add a token with claim role=superadmin expecting 200.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@gateway/it/features/jwt-auth.feature` around lines 550 - 555, The precedence
scenarios only test rejection, so they do not verify that the new policy
parameters are accepted. In gateway/it/features/jwt-auth.feature lines 550-555,
add a positive request using scope api:deploy and assert status 200; in lines
652-657, add a positive request using claim role=superadmin and assert status
200. Keep the existing rejection cases unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@gateway/it/features/jwt-auth.feature`:
- Around line 550-555: The precedence scenarios only test rejection, so they do
not verify that the new policy parameters are accepted. In
gateway/it/features/jwt-auth.feature lines 550-555, add a positive request using
scope api:deploy and assert status 200; in lines 652-657, add a positive request
using claim role=superadmin and assert status 200. Keep the existing rejection
cases unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b5c4dcca-d4b4-4764-b383-fb547bd367f8

📥 Commits

Reviewing files that changed from the base of the PR and between 0637a89 and 5974bd1.

📒 Files selected for processing (4)

• gateway/it/features/jwt-auth.feature
• gateway/it/features/mcp_policies.feature
• gateway/it/steps_jwt.go
• tests/mock-servers/mock-jwks/main.go

[coderabbitai]

🧹 Nitpick comments (1)

gateway/it/steps_jwt.go (1)

185-208: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Collapse the duplicated token fetch in iGetJWTTokenWithIssuerAndScope.

fetchTokenFrom is a verbatim copy of lines 119-137, and the existing method still hand-rolls ?/& concatenation. Delegating it to the new helpers removes the duplication and the fragile query building.

♻️ Proposed refactor for lines 103-138

 func (j *JWTSteps) iGetJWTTokenWithIssuerAndScope(issuer, scope string) error {
-	tokenURL := j.mockJWKSURL + "/token"
-	if issuer != "" {
-		tokenURL = tokenURL + "?issuer=" + url.QueryEscape(issuer)
-	}
-	if scope != "" {
-		if issuer != "" {
-			tokenURL = tokenURL + "&"
-		} else {
-			tokenURL = tokenURL + "?"
-		}
-		tokenURL = tokenURL + "scope=" + url.QueryEscape(scope)
-	}
-
-	log.Printf("DEBUG: Fetching JWT token from %s", tokenURL)
-
-	resp, err := j.state.HTTPClient.Get(tokenURL)
-	if err != nil {
-		return fmt.Errorf("failed to get JWT token from mock JWKS server: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("mock JWKS server returned status %d", resp.StatusCode)
-	}
-
-	tokenBytes, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Errorf("failed to read token response: %w", err)
-	}
-
-	j.currentToken = string(tokenBytes)
-	log.Printf("DEBUG: Obtained JWT token (length: %d)", len(j.currentToken))
-
-	return nil
+	return j.iGetJWTTokenWithIssuerScopeAndClaims(issuer, scope, "")
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@gateway/it/steps_jwt.go` around lines 185 - 208, Update
iGetJWTTokenWithIssuerAndScope to build issuer and scope parameters with the
existing query helpers and delegate token retrieval to fetchTokenFrom. Remove
its duplicated HTTP GET, status validation, response reading, and currentToken
assignment logic; retain fetchTokenFrom as the single implementation for
fetching and storing the token.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@gateway/it/steps_jwt.go`:
- Around line 185-208: Update iGetJWTTokenWithIssuerAndScope to build issuer and
scope parameters with the existing query helpers and delegate token retrieval to
fetchTokenFrom. Remove its duplicated HTTP GET, status validation, response
reading, and currentToken assignment logic; retain fetchTokenFrom as the single
implementation for fetching and storing the token.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 064a4c94-9181-4f08-a3a8-72e73e951281

📥 Commits

Reviewing files that changed from the base of the PR and between 5974bd1 and 54d5dea.

📒 Files selected for processing (3)

• gateway/it/features/jwt-auth.feature
• gateway/it/features/mcp_policies.feature
• gateway/it/steps_jwt.go