Testing

This page describes how the tests of this repository run.

Layout

deployment

QuarkusUnitTest classes against the Dev Service. They cover the beans, the global interceptors and the health check when up, down and disabled. They also cover a TLS misconfiguration and the API key check. They also test the seeding of the Dev Service, its failure modes and the Dev UI JSON-RPC service.

runtime

Plain unit tests of the client against in-process gRPC servers.

security/deployment

QuarkusUnitTest classes for quarkus-topaz-security against the Dev Service. They cover the route policy in both modes, @TopazAuthorize, @TopazCheck and the @PermissionsAllowed bridge. They also cover the startup validation and the denials when Topaz is down.

security/no-rest-tests

An application without quarkus-rest. It builds, and the topaz route policy enforces on a reactive route.

zanzibar/deployment

QuarkusUnitTest classes for quarkus-topaz-zanzibar against the Dev Service. They cover the relationship manager, the quarkus-zanzibar filter and its behaviour when Topaz is down.

integration-tests

The todo application. Its endpoints include some that the route policy and the interceptors secure, and the /fga/todos endpoints with quarkus-zanzibar annotations. The @QuarkusTest classes TodoResourceTest, SecuredTodoResourceTest and FgaTodoResourceTest run with Surefire. Their *IT subclasses TodoResourceIT, SecuredTodoResourceIT and FgaTodoResourceIT run the same tests with Failsafe against the native executable. Maven skips them unless you pass -Dnative.

Running locally

Tests that start Topaz need a container runtime. With rootless Podman:

DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock TESTCONTAINERS_RYUK_DISABLED=true \
JAVA_HOME=/path/to/jdk-21 mvn verify

  • The build needs Java 21 or later. It also builds this documentation.

  • Add -ntp when the local repository is cold. The Quarkus bootstrap may download an artifact inside a @QuarkusTest fork. It then prints the download line through the captured output of Surefire, and the fork can deadlock. See quarkus#57751. -ntp turns that output off, and the Quarkus bootstrap honours it inside the fork.

A native run builds the todo application with a container build:

DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock TESTCONTAINERS_RYUK_DISABLED=true \
JAVA_HOME=/path/to/jdk-21 mvn -pl integration-tests -am verify -Dnative \
    -Dquarkus.native.container-build=true

To check against an older Topaz, override the Dev Service image:

mvn -pl deployment -am test -Dquarkus.topaz.devservices.image-name=ghcr.io/aserto-dev/topaz:0.33.21

CI

GitHub Actions runs mvn -B -ntp clean install -Dno-format, the native integration tests, and the deployment tests against the previous Topaz release. GitHub runners have Docker, so the CI jobs do not set the Podman variables.

Every command passes -ntp because the runners start with an empty local repository. That is the condition for the deadlock above. Without -ntp, the @QuarkusTest modules hung on the ubuntu-26.04 runner image. They stayed stuck until the six-hour limit of the job.