From acf2311ceaae51623d6d27d004918da7d5764a76 Mon Sep 17 00:00:00 2001
From: Edouard Vanbelle <opensource@edouard.vanbelle.fr>
Date: Mon, 29 Jun 2026 21:10:26 +0200
Subject: [PATCH] test(oidc): ensure that static-dist is built to validate
 tests

---
 tests/oidc/oidc.hurl | 23 ++++++++++++-----------
 tests/oidc/run.sh    | 15 +++++++++++++++
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/tests/oidc/oidc.hurl b/tests/oidc/oidc.hurl
index c8ee6ee2..47e7b428 100644
--- a/tests/oidc/oidc.hurl
+++ b/tests/oidc/oidc.hurl
@@ -109,24 +109,23 @@ header "Location" contains "redirect_uri="
 #          {frontend_url}/login?oidc_code=…
 #
 #          With `location: true` Hurl follows the whole chain and
-#          lands on the SPA login URL. The test server config
-#          (server-with-oidc.env) points `OXICLOUD_STATIC_PATH`
-#          at ./static — which is the legacy vanilla frontend, NOT
-#          static-dist/ — so /login returns 404. That 404 is the
-#          test signal: it proves we landed AT /login (i.e. the
-#          d1bbe8ba contract held). The URL we end at is the
-#          actual assertion.
+#          lands on the SPA login URL. The SvelteKit SPA serves
+#          `/login` from `static-dist/login.html` with 200 — this
+#          is the production contract. The runner (`tests/oidc/run.sh`)
+#          builds `static-dist/` before launching the server so
+#          local and CI both see the production behaviour. Without
+#          that build the route would 404 via the ServeDir fallback.
 #
 #          A pre-d1bbe8ba server would have redirected to
-#          `http://localhost:8087/?oidc_code=…` instead — same
-#          404, but the `landed_at` assertion would catch it.
+#          `http://localhost:8087/?oidc_code=…` instead — the
+#          `landed_at` regex below catches that regardless.
 # ─────────────────────────────────────────────────────────────
 GET {{idp_url}}
 [Options]
 location: true
 location-trusted: true
 
-HTTP 404
+HTTP 200
 [Captures]
 landed_at: url
 oidc_code: url regex "oidc_code=([a-f0-9]+)"
@@ -289,7 +288,9 @@ GET {{relogin_idp_url}}
 location: true
 location-trusted: true
 
-HTTP 404
+# Same contract as Step 4 — the SPA serves /login with 200 (the
+# runner ensures static-dist/ is built before the server starts).
+HTTP 200
 [Captures]
 relogin_oidc_code: url regex "oidc_code=([a-f0-9]+)"
 [Asserts]
diff --git a/tests/oidc/run.sh b/tests/oidc/run.sh
index 407e5228..0a72f972 100755
--- a/tests/oidc/run.sh
+++ b/tests/oidc/run.sh
@@ -143,6 +143,21 @@ set +a
 source "$COMMON/wipe-storage.sh"
 wipe_storage "$OXICLOUD_STORAGE_PATH"
 
+# ── 3.5. Ensure the SPA is built (static-dist/) ────────────────────────────
+# The OIDC suite's Step 4 + Step 9 walk the full redirect chain and assert
+# they land on `/login?oidc_code=…` with HTTP 200 — the production contract,
+# where the container ships `static-dist/login.html`. Without that bundle
+# `resolve_static_path` falls back to `OXICLOUD_STATIC_PATH=./static`, which
+# was removed in commit 54639d46 — so ServeDir 404s the route and Step 4
+# fails. Build here so local + CI both exercise the production layout.
+DIST_DIR="$REPO_ROOT/static-dist"
+if [[ ! -f "$DIST_DIR/login.html" ]]; then
+  log "Building SvelteKit SPA (static-dist/login.html missing)..."
+  (cd "$REPO_ROOT/frontend" \
+    && npm ci --silent --no-audit --no-fund \
+    && npm run build) || die "Frontend build failed; static-dist/ is required for the OIDC tests"
+fi
+
 # ── 4. Start OxiCloud server with OIDC enabled ─────────────────────────────
 BUILD_TARGET="${BUILD_TARGET:-debug}"
 OXICLOUD_BIN="$REPO_ROOT/target/$BUILD_TARGET/oxicloud"