fix(ci): Fix intermittent failures from auth tests

[elizabethhealy]

Proposed Changes

• the auth tests have been failing intermittently since the addition of connect rpc due to what appears to be a race condition on the server close, separate the connect rpc and grpc tests for the auth interceptors

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[gemini-code-assist]

Hello @elizabethhealy, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Summary of Changes

Hello! Gemini here, providing a summary of this pull request to help everyone get up to speed.

This PR aims to address intermittent CI failures specifically within the authentication tests. According to the description, these failures seem to stem from a race condition that arose after the introduction of Connect RPC, potentially related to server teardown in the tests. To mitigate this, the changes involve separating the existing combined tests for the token adding interceptor into distinct tests for gRPC and Connect protocols. This refactoring should help isolate the test environments and prevent the race condition.

Highlights

• CI Stability: Fixes intermittent failures observed in CI runs, specifically within the authentication test suite.
• Race Condition Mitigation: Addresses a suspected race condition during test server shutdown by separating test execution paths.
• Test Refactoring: Splits existing tests that covered both gRPC and Connect into dedicated tests for each protocol to improve reliability and clarity.
• Test Helpers: Introduces helper functions to streamline test setup and assertion logic, making the tests more maintainable.

Changelog

• sdk/auth/token_adding_interceptor_test.go
  • Renamed TestAddingTokensToOutgoingRequest to setupTokenAddingInterceptor and refactored it into a test setup helper function (lines 34-52).
  • Extracted the token and DPoP assertion logic into a new helper function checkAccessAndDpopTokens (lines 55-95).
  • Modified the original TestAddingTokensToOutgoingRequest to specifically test the gRPC path using the new helpers (lines 97-109).
  • Added a new test TestAddingTokensToOutgoingRequest_Connect to specifically test the Connect path using the new helpers (lines 111-122).
  • Modified Test_InvalidCredentials_DoesNotSendMessage to specifically test the gRPC path (lines 124-136).
  • Added a new test Test_InvalidCredentials_DoesNotSendMessage_Connect to specifically test the Connect path (lines 138-150).

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

Tests fail now and then,
A race condition, oh when?
Split the protocols,
Fix the test goals,
CI green once again.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request effectively addresses the intermittent test failures by separating the gRPC and Connect RPC tests for the auth interceptors. The refactoring into helper functions setupTokenAddingInterceptor and checkAccessAndDpopTokens significantly improves the readability and maintainability of the test suite by reducing code duplication. Overall, the changes are well-implemented and directly target the described issue.

Summary of Findings

• Minor inconsistencies in test helper function arguments and usage: The checkAccessAndDpopTokens function expects slice arguments (accessToken []string, dpopToken []string) but the fake Connect server implementation wraps a single string header value in a slice before passing it, while the fake gRPC server naturally returns a slice. While this works for the current test structure, it's a minor inconsistency. Additionally, the function immediately asserts the length of the dpopToken slice is 1, implying it always expects a single token. (Note: These points were identified but not included as review comments due to the configured severity filter.)
• Ignored parsing errors in test helper: The jws.Parse and jwt.Parse calls within checkAccessAndDpopTokens ignore potential parsing errors using the blank identifier _. While acceptable in a test where inputs are controlled, it's generally good practice to handle or assert errors even in tests. (Note: This point was identified but not included as a review comment due to the configured severity filter.)

Merge Readiness

The code changes appear correct and effectively resolve the intermittent test failures by improving test isolation and structure. The refactoring enhances test maintainability. Based on my review, the pull request looks ready to be merged. Please ensure other required reviewers have approved before merging, as I am unable to approve the pull request directly.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	482.938311ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	311.967962ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	348.827495ms
Throughput	286.67 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	53.160060435s
Average Latency	528.197113ms
Throughput	94.06 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4972
Failed Requests	28
Concurrent Requests	50
Total Time	44.176043524s
Average Latency	438.991847ms
Throughput	112.55 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	28 occurrences

Standard Benchmark Metrics Skipped or Failed

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	465.743006ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	278.238754ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	352.252941ms
Throughput	283.89 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	52.04538888s
Average Latency	517.702253ms
Throughput	96.07 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4975
Failed Requests	25
Concurrent Requests	50
Total Time	44.074569124s
Average Latency	437.657006ms
Throughput	112.88 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	25 occurrences

Standard Benchmark Metrics Skipped or Failed