mirror of
https://github.com/SigNoz/signoz.git
synced 2026-08-10 23:10:47 +01:00
#### Description - Adds end-to-end coverage for the google authn flow (`callbackauthn/04_google.py`): happy-path login, hd-claim mismatch rejection, unverified-email rejection + `insecureSkipEmailVerified` opt-in, and roleMapping defaultRole. - The google callback authn hardcodes `https://accounts.google.com` as its issuer and fully verifies the RS256 id_token, so a wiremock container impersonates Google: it joins the test network under the `accounts.google.com` alias and serves HTTPS with a certificate issued by a new integration CA (`tests/fixtures/tls.py`), which every signoz container now trusts via `SSL_CERT_FILE`. - Stubs (discovery, auto-approving authorize, token, JWKS) are installed per test via the existing `make_http_mocks` fixture with a pre-signed id_token for the identity under test; one session-scoped RSA key signs all tokens.