test: add isolated e2e auth endpoint checks

Author: sidey79

.github/workflows/lint.yml

@@ -56,3 +56,13 @@ jobs:
       - name: Verify auth-protected endpoint policy
         run: |
           bash scripts/test-auth-protected-endpoints.sh caddy/Caddyfile
+
+  endpoint-authz-e2e:
+    name: runner / endpoint-authz-e2e
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+      - name: Run E2E auth endpoint checks
+        run: |
+          bash scripts/test-auth-endpoints-e2e.sh

scripts/test-auth-endpoints-e2e.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+COMPOSE_FILE="$ROOT_DIR/tests/e2e/docker-compose.e2e.yml"
+BASE_URL="http://127.0.0.1:18080"
+
+cleanup() {
+  docker compose -f "$COMPOSE_FILE" down -v --remove-orphans >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+req_code() {
+  local method="$1" host="$2" path="$3" auth="$4" extra_header="${5:-}"
+  local -a args=( -sS -o /dev/null -w "%{http_code}" -X "$method" -H "Host: $host" )
+  if [[ "$auth" == "auth" ]]; then
+    args+=( -H "X-Test-Auth: allow" )
+  fi
+  if [[ -n "$extra_header" ]]; then
+    args+=( -H "$extra_header" )
+  fi
+  curl "${args[@]}" "$BASE_URL$path"
+}
+
+req_header() {
+  local method="$1" host="$2" path="$3" auth="$4" header_name="$5" extra_header="${6:-}"
+  local -a args=( -sS -D - -o /dev/null -X "$method" -H "Host: $host" )
+  if [[ "$auth" == "auth" ]]; then
+    args+=( -H "X-Test-Auth: allow" )
+  fi
+  if [[ -n "$extra_header" ]]; then
+    args+=( -H "$extra_header" )
+  fi
+  curl "${args[@]}" "$BASE_URL$path" | awk -v h="$header_name" 'BEGIN{IGNORECASE=1} $0 ~ "^"h":" {print; found=1} END{if(!found) exit 1}'
+}
+
+assert_eq() {
+  local got="$1" want="$2" msg="$3"
+  if [[ "$got" != "$want" ]]; then
+    echo "FAIL: $msg (got=$got want=$want)" >&2
+    exit 1
+  fi
+  echo "OK: $msg -> $got"
+}
+
+assert_no_upstream_header() {
+  local method="$1" host="$2" path="$3" auth="$4"
+  if req_header "$method" "$host" "$path" "$auth" "X-Upstream" >/dev/null 2>&1; then
+    echo "FAIL: unexpected upstream proxy for $host$path" >&2
+    exit 1
+  fi
+  echo "OK: no upstream proxy header for $host$path"
+}
+
+echo "Starting isolated E2E stack..."
+docker compose -f "$COMPOSE_FILE" up -d --wait
+
+# landing.* protected endpoints
+assert_eq "$(req_code GET landing.test /backup/status none)" "401" "landing /backup/status requires auth"
+assert_eq "$(req_code GET landing.test /backup/status auth)" "200" "landing /backup/status works with auth"
+assert_eq "$(req_code GET landing.test /backup/names none)" "401" "landing /backup/names requires auth"
+assert_eq "$(req_code GET landing.test /backup/names auth)" "200" "landing /backup/names works with auth"
+assert_eq "$(req_code GET landing.test /api/me none)" "401" "landing /api/me requires auth"
+assert_eq "$(req_code GET landing.test /api/me auth)" "200" "landing /api/me works with auth"
+
+# Ensure no broad /backup/* passthrough remains
+assert_eq "$(req_code GET landing.test /backup/rest/workflows auth)" "404" "landing /backup/rest/workflows is not proxied"
+assert_no_upstream_header GET landing.test /backup/rest/workflows auth
+
+# workflow.* protected webhook path
+assert_eq "$(req_code POST workflow.test /webhook/protected none)" "401" "workflow protected webhook requires auth without mTLS/exception"
+assert_eq "$(req_code POST workflow.test /webhook/protected auth)" "200" "workflow protected webhook works with auth"
+
+# Explicit Telegram exception (no auth but header secret)
+assert_eq "$(req_code POST workflow.test /webhook/scanservjs/telegram/reissue none "X-Telegram-Bot-Api-Secret-Token: test-telegram-secret")" "200" "telegram exception works without auth when secret header matches"
+assert_eq "$(req_code POST workflow.test /webhook/scanservjs/telegram/reissue none)" "401" "telegram path without secret remains protected"
+
+echo "All E2E auth endpoint checks passed."

tests/e2e/Caddyfile

@@ -0,0 +1,116 @@
+{
+  auto_https off
+  admin off
+}
+
+(authelia_forward_auth) {
+  forward_auth authelia:9091 {
+    uri /api/authz/forward-auth
+    copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+  }
+}
+
+(n8n_upstream) {
+  reverse_proxy http://n8n-mock:5678
+}
+
+http://landing.test {
+  encode gzip
+
+  @landingApiMe {
+    method GET HEAD
+    path /api/me
+  }
+
+  @landingBackupStatus {
+    method GET HEAD
+    path /backup/status
+  }
+
+  @landingBackupNames {
+    method GET HEAD
+    path /backup/names
+  }
+
+  route {
+    handle @landingApiMe {
+      import authelia_forward_auth
+      rewrite * /webhook/landing/api/me
+      import n8n_upstream
+    }
+
+    handle @landingBackupStatus {
+      import authelia_forward_auth
+      rewrite * /webhook/backup/status-public
+      import n8n_upstream
+    }
+
+    handle @landingBackupNames {
+      import authelia_forward_auth
+      rewrite * /webhook/backup/names
+      import n8n_upstream
+    }
+
+    handle {
+      import authelia_forward_auth
+      respond "landing static" 404
+    }
+  }
+}
+
+http://workflow.test {
+  @apiMe {
+    method GET HEAD
+    path /api/me
+  }
+
+  @oauth2Credential {
+    method GET HEAD OPTIONS
+    path /rest/oauth2-credential*
+  }
+
+  @telegramReissueWebhook {
+    method POST
+    header X-Telegram-Bot-Api-Secret-Token {$TELEGRAM_WEBHOOK_SECRET}
+    path /webhook/scanservjs/telegram/reissue /webhook-test/scanservjs/telegram/reissue
+  }
+
+  @alexaGeminiWebhook {
+    method POST
+    path /webhook/antannah/alexa-gemini /webhook-test/antannah/alexa-gemini /webhook/sven/alexa-gemini /webhook-test/sven/alexa-gemini
+  }
+
+  # In this HTTP-only e2e setup, mTLS vars are empty, so all webhooks go via Authelia unless explicit exceptions above.
+  @webhooksAuthelia {
+    path /webhook/* /webhook-test/*
+  }
+
+  route {
+    handle @apiMe {
+      import authelia_forward_auth
+      rewrite * /webhook/landing/api/me
+      import n8n_upstream
+    }
+
+    handle @oauth2Credential {
+      import n8n_upstream
+    }
+
+    handle @telegramReissueWebhook {
+      import n8n_upstream
+    }
+
+    handle @alexaGeminiWebhook {
+      import n8n_upstream
+    }
+
+    handle @webhooksAuthelia {
+      import authelia_forward_auth
+      import n8n_upstream
+    }
+
+    handle {
+      respond "workflow fallback" 404
+    }
+  }
+}

tests/e2e/docker-compose.e2e.yml

@@ -0,0 +1,28 @@
+name: caddy-rproxy-e2e
+
+services:
+  caddy-e2e:
+    image: caddy:2.11.3@sha256:ec18ee54aab3315c22e25f3b2babda73ff8007d39b13b3bd1bfffa2f0444c7d9
+    environment:
+      TELEGRAM_WEBHOOK_SECRET: test-telegram-secret
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+    ports:
+      - "18080:80"
+    depends_on:
+      - authelia
+      - n8n-mock
+
+  authelia:
+    image: python:3.12-alpine
+    working_dir: /app
+    volumes:
+      - ./mock_auth.py:/app/mock_auth.py:ro
+    command: ["python3", "/app/mock_auth.py"]
+
+  n8n-mock:
+    image: python:3.12-alpine
+    working_dir: /app
+    volumes:
+      - ./mock_n8n.py:/app/mock_n8n.py:ro
+    command: ["python3", "/app/mock_n8n.py"]

tests/e2e/mock_auth.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+class Handler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        self._handle()
+
+    def do_POST(self):
+        self._handle()
+
+    def _handle(self):
+        if self.path != "/api/authz/forward-auth":
+            self.send_response(404)
+            self.end_headers()
+            self.wfile.write(b"not found")
+            return
+
+        allowed = self.headers.get("X-Test-Auth", "") == "allow"
+        if not allowed:
+            self.send_response(401)
+            self.send_header("Content-Type", "text/plain")
+            self.end_headers()
+            self.wfile.write(b"unauthorized")
+            return
+
+        self.send_response(200)
+        self.send_header("Content-Type", "text/plain")
+        self.send_header("Remote-User", "test-user")
+        self.send_header("Remote-Groups", "admins")
+        self.send_header("Remote-Email", "test@example.com")
+        self.send_header("Remote-Name", "Test User")
+        self.end_headers()
+        self.wfile.write(b"ok")
+
+    def log_message(self, fmt, *args):
+        return
+
+if __name__ == "__main__":
+    HTTPServer(("0.0.0.0", 9091), Handler).serve_forever()

tests/e2e/mock_n8n.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+import json
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+class Handler(BaseHTTPRequestHandler):
+    def _send_json(self, code, payload):
+        data = json.dumps(payload).encode("utf-8")
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("X-Upstream", "n8n-mock")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def do_GET(self):
+        self._handle()
+
+    def do_HEAD(self):
+        self._handle(head=True)
+
+    def do_POST(self):
+        self._handle()
+
+    def _handle(self, head=False):
+        path = self.path
+        if path == "/webhook/backup/status-public":
+            payload = {"status": "ok", "backupName": "paperless", "checkedAt": "2026-05-23T00:00:00Z"}
+            if head:
+                self.send_response(200)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("X-Upstream", "n8n-mock")
+                self.end_headers()
+            else:
+                self._send_json(200, payload)
+            return
+
+        if path == "/webhook/backup/names":
+            payload = {"count": 1, "backupNames": ["paperless"], "backups": [{"backupName": "paperless", "status": "ok"}]}
+            if head:
+                self.send_response(200)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("X-Upstream", "n8n-mock")
+                self.end_headers()
+            else:
+                self._send_json(200, payload)
+            return
+
+        if path == "/webhook/landing/api/me":
+            payload = {"user": "test-user", "groups": ["admins"], "role": "admin"}
+            if head:
+                self.send_response(200)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("X-Upstream", "n8n-mock")
+                self.end_headers()
+            else:
+                self._send_json(200, payload)
+            return
+
+        # Generic webhook sink for protected workflow endpoints.
+        if path.startswith("/webhook/") or path.startswith("/webhook-test/") or path.startswith("/rest/oauth2-credential"):
+            payload = {"ok": True, "path": path, "method": self.command}
+            if head:
+                self.send_response(200)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("X-Upstream", "n8n-mock")
+                self.end_headers()
+            else:
+                self._send_json(200, payload)
+            return
+
+        self._send_json(404, {"error": "not found", "path": path})
+
+    def log_message(self, fmt, *args):
+        return
+
+if __name__ == "__main__":
+    HTTPServer(("0.0.0.0", 5678), Handler).serve_forever()