mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 16:51:31 +00:00
shankar0123
7c04f0a0b8
CI break diagnosed from go-build-and-test on f1fa311+36840dd:
TestTestDiscovery_HappyPath_AgainstMockIdP + TestTestDiscovery_JWKSFetchFails
fail with "refusing to dial reserved address 127.0.0.1" because my
Bundle 5 R6 closure wrapped jwksReachable in
validation.SafeHTTPDialContext — which is exactly what the production
guard is supposed to refuse for httptest.NewServer's 127.0.0.1 bind.
Same shape as the Slack/Teams test-seam fix in 36840dd: factor the
http.Client construction into a package-level var (`jwksProbeClient`),
default to the SSRF-safe transport in production, override to
http.DefaultTransport in test-only `setup_test.go::init()`. Production
code never reassigns the var. The audit R6 closure stands — the
production jwksReachable still uses validation.SafeHTTPDialContext.
Verification (sandbox, Go 1.25.10):
go test -short -count=1
-run 'TestTestDiscovery_HappyPath|TestTestDiscovery_JWKSFetchFails'
./internal/auth/oidc # PASS (1.1s)
go test -short -count=1 ./internal/auth/oidc # PASS (21.8s)
gofmt -l # clean
go vet ./internal/auth/oidc # clean