[Kzoeps]

Refs TECH-683.

Problem

TECH-683 requires OTP, session and consent to work when successive requests reach different PostgreSQL-backed Entryway nodes. The two-node profile already crossed nodes for OTP and sessions, but the account chooser, consent and full OAuth sign-in only ran on one node.

Fix

• New cross-node-signin stage in the two-node PostgreSQL profile. Email entry, code verify, account choice and consent alternate nodes, and each step must be served by the expected node's boot ID (x-entryway-instance).
• A tampered account choice is refused on both nodes; the finished session must hold the chosen DID, its PDS as token audience, and an account-scoped write.
• The profile receipt check fails if the stage is missing or ran on one node.
• The shared-email fixture accepts a PostgreSQL database config; assertOAuthSubjectAndWrite moves to oauth-client.mjs so both specs share it.

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Adds a shared-email OAuth sign-in that alternates between two PostgreSQL-backed nodes.

• A shared-email OAuth sign-in now moves between the two profile nodes.

No actionable issues found. Live profile tests were not run.

Diagram

sequenceDiagram
  participant Browser
  participant A as Node A
  participant DB as PostgreSQL
  participant B as Node B
  Browser->>A: Begin authorization and request code
  A->>DB: Save pending sign-in
  Browser->>B: Verify code
  B->>DB: Read sign-in and save verified identity
  Browser->>A: Choose account
  A->>DB: Save chosen DID
  Browser->>B: Approve consent and finish OAuth
  B->>DB: Save client session
  Browser->>A: Read session and write as chosen DID

Loading

_{Reviews (1) · Last reviewed commit: "tests/profiles: cross TECH-683 OAuth sig..." · Reviewed by Greptile}

Summary by CodeRabbit

• Tests
  • Added browser coverage for OAuth sign-in across two nodes, including account selection, consent, session validation, and account-scoped writes.
  • Expanded resilience checks to verify requests reach the expected nodes during the cross-node flow.
• Documentation
  • Clarified the shared-email OAuth flow across nodes, including account mismatch handling and per-step verification.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The resilience profile adds a two-node OAuth sign-in phase. Browser tests check node-specific responses, account selection, the client session, and an account-scoped write. Profile scripts and deployment documentation include the new phase.

Changes: Cross-node OAuth sign-in

Layer / File(s)	Summary
Shared OAuth and account fixtures tests/browser/support/oauth-client.mjs, tests/browser/support/email-chooser-fixture.mjs, tests/browser/account-chooser.spec.mjs	A reusable helper checks the OAuth session subject, token audience, and account-scoped write. The shared-email fixture accepts a database option and defaults to SQLite. The account chooser test uses the shared helper.
Cross-node browser sign-in tests/browser/resilience-profile.spec.mjs	The test requests a code on node A, verifies it on node B, checks account choices and mismatched-DID refusals, then selects an account on A and approves consent on B. It checks node IDs for responses, the resulting session, and the write.
Profile phase wiring and validation tests/profiles.playwright.config.mjs, tests/support/run-resilience-profile.sh, tests/support/assert-resilience-profile.mjs, docs/deployment-profiles.md	The two-node profile runs and requires the new phase. The assertion script checks its four steps against the observed node IDs. The deployment profile documentation describes the cross-node flow.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Possibly related PRs

• hypercerts-org/hypercerts-entryway#9: Adds the account chooser and consent continuation that the cross-node test exercises.
• hypercerts-org/hypercerts-entryway#10: Changes shared-email lookup and selected-DID validation exercised by the test.
• hypercerts-org/hypercerts-entryway#4: Adds storage support for multiple DIDs sharing an email, used by the test fixture.

Suggested reviewers: ashex

Merge Risk: Minimal · up to 878f2

This change adds cross-node OAuth sign-in coverage to the two-node profile. It touches only tests, profile scripts and documentation, so it does not affect production behavior. No concrete merge-blocking risk was identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the cross-node OAuth sign-in test for the two-node PostgreSQL profile.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 3 functions across 7 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 69ed4716-7e0f-4a95-b97c-4cb33fc534f5

Commits

Reviewing files that changed from the base of the PR and between 385ac78 and 878f267.

Files selected for processing: 8

• docs/deployment-profiles.md
• tests/browser/account-chooser.spec.mjs
• tests/browser/resilience-profile.spec.mjs
• tests/browser/support/email-chooser-fixture.mjs
• tests/browser/support/oauth-client.mjs
• tests/profiles.playwright.config.mjs
• tests/support/assert-resilience-profile.mjs
• tests/support/run-resilience-profile.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud