docker-compose.test.yml

# Docker Compose for E2E Tests
#
# Core test environment: frontend, backend (with built-in VCTM registry), trust PDP, and verifier.
# For credential issuance/verification tests, layer the VC services overlay:
#   docker compose -f docker-compose.test.yml -f docker-compose.vc-services.yml up -d
#
# Usage:
#   make up              # Build and start core services
#   make up-vc           # Build and start with VC issuer/verifier
#   make run             # Run all E2E tests
#   make down            # Stop all services
#   make ci-docker       # Full cycle: up, run, down
#
# Or directly:
#   docker-compose -f docker-compose.test.yml up -d --build
#   npx playwright test
#   docker-compose -f docker-compose.test.yml down
#
# Configuration (via environment variables):
#   BACKEND_PATH  - Path to go-wallet-backend source
#                   Local: ../go-wallet-backend (default)
#                   CI:    ./go-wallet-backend
#   FRONTEND_PATH - Path to wallet-frontend source
#                   Local: ../wallet-frontend (default)
#                   CI:    ./wallet-frontend

services:
  # Wallet Frontend - React app served via nginx
  # Uses the production-like Dockerfile.e2e with runtime config injection.
  # Environment variables are read by the nginx entrypoint script (wallet-config.sh)
  # which injects them into index.html as a <meta> tag at container startup.
  wallet-frontend:
    build:
      context: ${FRONTEND_PATH:-../wallet-frontend}
      dockerfile: Dockerfile.e2e
    image: wallet-frontend-e2e-test:local
    container_name: wallet-frontend-e2e-test
    ports:
      - "3000:80"
    environment:
      - WALLET_BACKEND_URL=http://localhost:8080
      - WALLET_ENGINE_URL=http://localhost:8082
      - WEBAUTHN_RPID=localhost
      # Must be the SPA's actual "cb/*" callback route under BASE_PATH below
      # (App.tsx registers it relative to the router's basename), not the
      # bare origin - a bare "/" redirect lands on the dashboard instead of
      # OpenIDFlowCallback, and doesn't match what register-vc-services
      # registers as e2e-test-client's redirect_uri - confirmed live as the
      # cause of every web-initiated authorization_code credential issuance
      # (any auth_provider: oidc scope, e.g. pid/pid_1_5/pid_1_8/ehic/diploma)
      # failing with vc-apigw's "invalid_client" (same root cause found and
      # fixed for Fly environments, see render-helm-config.py/fly-up.py).
      - OPENID4VCI_REDIRECT_URI=http://localhost:3000/id/default/cb
      - STATIC_PUBLIC_URL=http://localhost:3000
      - STATIC_NAME=${WALLET_NAME:-SIROS ID (dev)}
      - VCT_REGISTRY_URL=http://localhost:8080/registry/type-metadata
      # Transport: websocket by default; use docker-compose.wmp-transport.yml overlay for WMP
      - TRANSPORT_PREFERENCE=websocket
      - ALLOWED_TRANSPORTS=http,websocket,wmp
      # Logging and debugging
      - LOG_LEVEL=debug
      - DISPLAY_CONSOLE=true
      # Credentials
      - LOGIN_WITH_PASSWORD=false
      - DID_KEY_VERSION=jwk_jcs-pub
      - OPENID4VCI_PROOF_TYPE_PRECEDENCE=attestation,jwt
      - OPENID4VP_SAN_DNS_CHECK=false
      - OPENID4VP_SAN_DNS_CHECK_SSL_CERTS=false
      - DELEGATE_TRUST_TO_BACKEND=true
      - MULTI_LANGUAGE_DISPLAY=true
      - DISPLAY_ISSUANCE_WARNINGS=false
      # Multi-tenant mode: enables /id/:tenantId/* routing
      - BASE_PATH=/id/default/
    volumes:
      - ./nginx-e2e.conf:/etc/nginx/conf.d/default.conf:ro
      - ./startup.html:/usr/share/nginx/startup.html:ro
      - ./dashboard/storage-card.js:/usr/share/nginx/storage-card.js:ro
      - ./build-info.json:/usr/share/nginx/build-info.json:ro
      # Android Digital Asset Links (generated by: scripts/setup-android.sh)
      - ./.well-known/assetlinks.json:/usr/share/nginx/assetlinks.json:ro
    depends_on:
      - wallet-backend
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:80/"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - e2e-test-network

  # Go Wallet Backend - built from local source
  wallet-backend:
    build:
      context: ${BACKEND_PATH:-../go-wallet-backend}
      dockerfile: Dockerfile
    image: wallet-backend-e2e-test:local
    container_name: wallet-backend-e2e-test
    ports:
      - "8080:8080"
      - "8081:8081"
      - "8082:8082"
    # Run with all roles (backend + engine for WebSocket support)
    command: ["--mode=all"]
    environment:
      - WALLET_JWT_SECRET=test-secret-for-e2e-testing-minimum-32-chars
      - WALLET_SERVER_WEBAUTHN_DISPLAY_NAME=${WALLET_NAME:-SIROS ID (dev)}
      - WALLET_SERVER_RP_ID=${WALLET_RP_ID:-localhost}
      - WALLET_SERVER_RP_ORIGIN=${WALLET_RP_ORIGIN:-http://localhost:3000}
      - WALLET_SERVER_RP_ORIGINS=${WALLET_RP_ORIGINS:-http://localhost:3000,android:apk-key-hash:${APK_KEY_HASH:-xAfybcO0yPlUA_Gko2tH6oIRb9Y-qa3uVtm0m_qW07Q}}
      - WALLET_SERVER_PORT=8080
      - WALLET_SERVER_ADMIN_HOST=0.0.0.0
      - WALLET_SERVER_ADMIN_PORT=8081
      - WALLET_SERVER_ENGINE_PORT=8082
      - WALLET_SERVER_ADMIN_TOKEN=e2e-test-admin-token-for-testing-purposes-only
      - WALLET_LOG_LEVEL=debug
      # Use Docker DNS for inter-container communication
      - WALLET_TRUST_PDP_URL=http://go-trust-allow:6001
      - WALLET_TRUST_ENABLED=true
      # Allow HTTP and private IPs for local E2E testing with VC services
      - WALLET_HTTP_CLIENT_ALLOW_PRIVATE_IPS=true
      - WALLET_HTTP_CLIENT_ALLOW_HTTP=true
      - WALLET_HTTP_CLIENT_INSECURE_SKIP_VERIFY=true
      # Built-in Authorization Server (AS) — passkey login/register + token endpoint
      - WALLET_AS_ENABLED=true
      - WALLET_AS_INSECURE_COOKIES=true
      - WALLET_AS_DEFAULT_MAX_TAC=rwlidk
      - WALLET_AS_SIGNING_KEY_PATH=/app/fixtures/signing_ec_private.pem
      - WALLET_AS_EXTERNAL_URL=http://localhost:8080
      - WALLET_AS_ISSUER=http://localhost:8080
      - WALLET_AS_RULES_DIR=/app/fixtures/as-rules
      # CORS for the AS: its client sends credentials (cookies), so the origin
      # must be explicit — browsers reject wildcard '*' on credentialed
      # requests. X-Token-Mode is required too: the AS itself defines the
      # header (internal/as/compat.go) and wallet-frontend sends it on every
      # AuthServerClient call, but configs/config.yaml sets allowed_headers
      # explicitly and omits it, so config.SetDefaults() (which does list it)
      # never fires. Without this, every /auth/token call fails CORS preflight.
      - WALLET_SERVER_CORS_ALLOWED_ORIGINS=${WALLET_CORS_ORIGIN:-http://localhost:3000}
      - WALLET_SERVER_CORS_ALLOW_CREDENTIALS=true
      - WALLET_SERVER_CORS_ALLOWED_HEADERS=Authorization,Content-Type,X-Tenant-ID,X-Token-Mode,If-None-Match,X-Private-Data-If-Match,X-Private-Data-If-None-Match,Upgrade,Connection,Sec-WebSocket-Key,Sec-WebSocket-Version,Sec-WebSocket-Protocol
      # Wallet Provider Key Attestation (OID4VCI "attestation" proof type) -
      # real x5c-chained signing key, so the SDK gets a genuine trust anchor
      # instead of the self-signed bare-jwk fallback. WIA is disabled since
      # Key Attestation doesn't require it (wallet_instance_id is optional).
      - WALLET_WALLET_PROVIDER_PRIVATE_KEY_PATH=/app/fixtures/wallet_provider_ec_private.pem
      - WALLET_WALLET_PROVIDER_CERTIFICATE_PATH=/app/fixtures/wallet_provider_ec.crt
      - WALLET_WALLET_PROVIDER_CA_CERT_PATH=/app/fixtures/rootCA.crt
      - WALLET_WALLET_PROVIDER_WIA_ENABLED=false
      # Registry configuration (served via --mode=all on the same port)
      - REGISTRY_SOURCE_URL=https://registry.siros.org/.well-known/vctm-registry.json
      - REGISTRY_SOURCE_POLL_INTERVAL=5m
      - REGISTRY_CACHE_PATH=/tmp/vctm-cache.json
      - REGISTRY_DYNAMIC_CACHE_ENABLED=true
      - REGISTRY_DYNAMIC_CACHE_DEFAULT_TTL=1h
      - REGISTRY_DYNAMIC_CACHE_MAX_TTL=24h
      - REGISTRY_DYNAMIC_CACHE_MIN_TTL=1m
      - REGISTRY_JWT_REQUIRE_AUTH=false
      - REGISTRY_RATE_LIMIT_UNAUTHENTICATED_RPM=1000
      - REGISTRY_RATE_LIMIT_BURST_MULTIPLIER=10
    depends_on:
      mock-trust-pdp:
        condition: service_healthy
      mock-verifier:
        condition: service_healthy
    networks:
      - e2e-test-network
    volumes:
      - ./fixtures/vc-pki/signing_ec_private.pem:/app/fixtures/signing_ec_private.pem:ro
      - ./fixtures/as-rules:/app/fixtures/as-rules:ro
      - ./fixtures/vc-pki/wallet_provider_ec_private.pem:/app/fixtures/wallet_provider_ec_private.pem:ro
      - ./fixtures/vc-pki/wallet_provider_ec.crt:/app/fixtures/wallet_provider_ec.crt:ro
      - ./fixtures/vc-pki/rootCA.crt:/app/fixtures/rootCA.crt:ro
    # Note: distroless image has no shell/wget, healthcheck done by make up
    # For credential issuance tests, start VC services overlay:
    #   docker compose -f docker-compose.test.yml -f docker-compose.vc-services.yml up -d

  # env-admin - the privileged in-environment actor behind the dashboard's
  # "Clear all data" button, `make storage-clear` and the boot manager's
  # Storage panel (see env-admin/server.py). Reached same-origin through
  # wallet-frontend's nginx at /_admin/ (nginx-e2e.conf), never directly.
  # Needs the Docker socket to stop/start the stack's containers around a
  # wipe - the standard dev-tooling pattern. It discovers at request time
  # which consumers (wallet-backend, vc services, conformance suite) exist,
  # so no per-mode wiring is needed here: without VC=yes there is no Mongo
  # and a reset is just a wallet-backend restart, which empties its
  # in-memory store.
  env-admin:
    build:
      context: .
      dockerfile: env-admin/Dockerfile
    image: sirosid-env-admin:local
    container_name: env-admin-e2e
    # Loopback only: the host-side tooling (scripts/storage.py, the boot
    # manager, `make status`) talks to localhost:3002; everything else goes
    # through the /_admin/ proxy. Publishing on 0.0.0.0 would put the reset
    # API itself on the LAN under DOMAIN=... - the token would still guard
    # it, but there is no reason to expose it at all.
    ports:
      - "127.0.0.1:3002:3002"
    environment:
      - ENV_ADMIN_PLATFORM=docker
      # The token wallet-backend's admin API accepts in this mode - the
      # Makefile resolves PDP=helm's generated secret vs the fixed compose
      # value (see _EFFECTIVE_ADMIN_TOKEN there).
      - ENV_ADMIN_TOKEN=${ENV_ADMIN_TOKEN:-e2e-test-admin-token-for-testing-purposes-only}
      - ENV_ADMIN_ENV_NAME=${ENV_ADMIN_ENV_NAME:-local}
      - MONGO_URI=mongodb://mongodb:27017
      - ADMIN_URL=http://wallet-backend:8081
      # Registered after a reset under the identity vc-apigw advertises -
      # the Makefile swaps in the tunnel URL under TUNNELS=yes.
      - ISSUER_URL=${ENV_ADMIN_ISSUER_URL:-http://vc-apigw.localhost:9003}
      - VERIFIER_URL=${ENV_ADMIN_VERIFIER_URL:-http://vc-verifier.localhost:9001}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - e2e-test-network

  # Reverse proxy that serves /.well-known/assetlinks.json for Android passkey
  # validation, proxying all other requests to wallet-backend.
  # Point ngrok at port 8090 instead of 8080 when testing with Android SDK.
  wallet-proxy:
    image: nginx:alpine
    container_name: wallet-proxy-e2e
    ports:
      - "8090:8090"
      - "8091:8091"
    volumes:
      - ./fixtures/wallet-proxy.conf:/etc/nginx/conf.d/default.conf:ro
      - ./fixtures/well-known/assetlinks.json:/etc/nginx/well-known/assetlinks.json:ro
    depends_on:
      - wallet-backend
    networks:
      - e2e-test-network

  # Mock AuthZEN Trust PDP
  mock-trust-pdp:
    build:
      context: ./mocks/trust-pdp
      dockerfile: Dockerfile
    image: mock-trust-pdp-e2e-test:local
    container_name: mock-trust-pdp-e2e-test
    ports:
      - "9081:9081"
    environment:
      - PORT=9081
      - PDP_ID=http://localhost:9081
      - TRUSTED_ISSUERS=http://localhost:9003,http://vc-issuer:8080,http://localhost:9000,http://vc-apigw:8080,http://vc-apigw.localhost:9003,https://vc-proxy:8443
      - TRUSTED_VERIFIERS=http://localhost:9011,http://mock-verifier:9011,http://localhost:9001,http://vc-verifier:8080,http://vc-verifier.localhost:9001
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:9081/health"]
      interval: 3s
      timeout: 3s
      retries: 10
    networks:
      - e2e-test-network

  # Mock OpenID4VP Verifier
  mock-verifier:
    build:
      context: ./mocks/verifier
      dockerfile: Dockerfile
    image: mock-verifier-e2e-test:local
    container_name: mock-verifier-e2e-test
    ports:
      - "9011:9011"
    environment:
      - PORT=9011
      - VERIFIER_ID=http://localhost:9011
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:9011/health"]
      interval: 3s
      timeout: 3s
      retries: 10
    networks:
      - e2e-test-network

networks:
  e2e-test-network:
    name: e2e-test-network
    external: true