Validation: #255 dual-auth dependency for jersey/checkout
Validation: #255 dual-auth dependency for jersey/checkout routes
PR #258 merged to main. Woodpecker pipeline #260 succeeded. Deployed image tag
83188444d80c30a71ed8855601c785c232ae4572 matches merge commit 8318844.| Check | Result | Evidence |
|---|---|---|
| Pod running | PASS | <code>basketball-api-6947c75588-9flzv 1/1 Running</code> in namespace <code>basketball-api</code> |
| Image matches PR #258 merge commit | PASS | Deployed image tag <code>83188444...</code> = commit <code>8318844 feat: add dual-auth dependency for jersey and checkout routes (#255) (#258)</code> |
| CI pipeline succeeded | PASS | Woodpecker pipeline #260 (push to main after merge) status: <code>success</code> |
| Health endpoint responding | PASS | <code>GET /healthz</code> returns <code>{"status":"ok"}</code> HTTP 200. Liveness/readiness probes healthy in logs. |
| <code>get_parent_dual_auth</code> exists in deployed code | PASS | <code>hasattr(basketball_api.auth, 'get_parent_dual_auth')</code> returns <code>True</code> |
| Function signature correct | PASS | Signature: <code>(token: str | None = Query(None), user: User | None = Depends(_get_optional_user), db: Session = Depends(get_db))</code>. Accepts both query param token and Bearer JWT. |
| Jersey routes wired to dual-auth | PASS | <code>/player-info</code> deps: <code>[get_parent_dual_auth]</code>. <code>/checkout</code> deps: <code>[get_parent_dual_auth, get_db]</code>. |
| Checkout routes wired to dual-auth | PASS | <code>/create-session</code> deps: <code>[get_parent_dual_auth, get_db]</code>. |
| Public routes unaffected | PASS | <code>/jersey/options</code> (no auth) returns 200 with jersey options. <code>/checkout/products</code> returns 200 with products. |
| No-auth returns dual-auth error message | PASS | <code>GET /jersey/player-info</code> with no auth returns 401: <code>"Not authenticated: provide a token query param or Bearer token"</code> |
| Registration token path (backwards compat) | PASS | <code>GET /jersey/player-info?token=fake-token</code> returns 404 <code>"Invalid registration token"</code> (graceful lookup failure, no crash) |
| Bearer JWT path | PASS | <code>GET /jersey/player-info</code> with <code>Authorization: Bearer fake-jwt</code> returns 401 <code>"Invalid token header"</code> (graceful validation failure) |
| No errors in logs | PASS | Zero error/exception/traceback/warning lines in pod logs after deployment. |
Verdict: PASS
All 13 checks pass. Dual-auth dependency is correctly deployed and wired to jersey (
/player-info, /checkout) and checkout (/create-session) routes. Both registration_token and Keycloak JWT auth paths work. Public endpoints remain unprotected. No errors in production logs.Note
PR #259 (add jersey fields to PlayerProfileResponse) merged after #258 but its Woodpecker pipeline (#259) failed. The currently deployed image is from PR #258's merge commit. PR #259 deployment status is outside the scope of this validation.