test(e2e): add comprehensive e2e tests for rh-identity authentication

[major]

Description

Add comprehensive end-to-end tests for the rh-identity authentication module. These tests cover all validation paths in src/authentication/rh_identity.py, ensuring proper error handling for malformed headers, missing fields, and entitlement validation.

Test Scenarios (17 total)

Header-level validation:

• Missing x-rh-identity header (401)
• Invalid base64 encoding (400)
• Invalid JSON content (400)

Identity structure validation:

• Missing identity field (400)
• Null identity field (400)
• Missing identity type field (400)
• Unsupported identity type (400)

User identity validation:

• Missing user field (400)
• Missing user_id (400)
• Missing username (400)

System identity validation:

• Missing system field (400)
• Missing cn (400)
• Missing account_number (400)

Entitlement validation:

• Missing required entitlement (403)
• Empty entitlements (403)
• Entitlement with is_entitled=false (403)

Success cases:

• Valid User identity with required entitlements (200)
• Valid System identity with required entitlements (200)

Type of change

• End to end tests improvement

Tools used to create PR

• Assisted-by: Claude (Anthropic)
• Generated by: N/A

Related Tickets & Documents

• Related Issue # N/A
• Closes # N/A

Checklist before requesting a review

• I have performed a self-review of my code.
• PR has passed all pre-merge test jobs.
• If it is a core feature, I have added thorough tests.

Testing

1. Run the e2e tests with rh-identity feature:

   uv run behave tests/e2e/features/authorized_rh_identity.feature

2. Or run all e2e tests:

   uv run make test-e2e

3. All 17 scenarios should pass, validating each error path and success case in the rh-identity authentication module.

Summary by CodeRabbit

• Tests
  • Added comprehensive end-to-end coverage for RH Identity authentication: header validation, identity field checks, entitlement scenarios, and positive/negative flows.
• Chores
  • Added mode-specific test configurations and test harness support to enable RH Identity scenarios and include the new feature in test runs.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Adds end-to-end RH Identity authentication tests and mode-specific configs, plus test harness hooks and step implementations to set and validate x-rh-identity headers across many scenarios.

Changes

Cohort / File(s)	Summary
Configuration Files tests/e2e/configuration/library-mode/lightspeed-stack-auth-rh-identity.yaml, tests/e2e/configuration/server-mode/lightspeed-stack-auth-rh-identity.yaml	New mode-specific LCS YAML configs enabling RH Identity auth, auth settings, logging, user-data collection, SQLite conversation cache, and required entitlements.
Feature Test Definition tests/e2e/features/authorized_rh_identity.feature	New Gherkin feature (~293 lines) with numerous scenarios covering missing/invalid/malformed x-rh-identity headers, User/System identity success cases, and entitlement-related failures.
Test Environment Setup tests/e2e/features/environment.py	Adds RHIdentity feature-tag hooks that back up current config, apply mode-specific RH Identity config, restart lightspeed-stack, and restore afterwards.
Test Step Implementations tests/e2e/features/steps/auth.py	Adds _encode_rh_identity helper and multiple new steps to set/remove x-rh-identity in raw/base64/JSON/User/System forms and to remove Authorization header.
Test Registry tests/e2e/test_list.txt	Registers the new feature file in the E2E test list.

Sequence Diagram(s)

(omitted — changes are test/config additions and do not introduce new multi-component runtime control flow requiring visualization)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~30 minutes

Possibly related PRs

• LCORE-261: Add RH identity header auth #814 — RH Identity authentication implementation that these E2E tests validate.
• LCORE-166: add e2e tests for the endpoints #425 — Changes to E2E auth step handlers and authorized-endpoint tests (overlaps in steps/auth.py).
• LCORE-598: RBAC E2E tests #1017 — Modifications to test environment hooks/config switching similar to environment.py changes.

Suggested labels

ok-to-test

Suggested reviewers

• tisnik
• radofuchs

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately summarizes the main change: adding comprehensive end-to-end tests for rh-identity authentication.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}