test(e2e): serialize OIDC PKCE scenarios

Signed-off-by: Johnny Greco <jogreco@nvidia.com>

Author: johnnygreco

e2e/rust/tests/oidc_pkce.rs

@@ -22,6 +22,7 @@ use std::time::{Duration, Instant};
 use base64::Engine as _;
 use openshell_e2e::harness::binary::openshell_cmd;
 use serde_json::Value;
+use serial_test::serial;
 use tokio::process::Command;
 use tokio::sync::Mutex;
 use url::Url;
@@ -64,6 +65,7 @@ struct LoginSession {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn admin_can_list_sandboxes() {
     let session = login_identity(ADMIN).await;
     assert_allowed(
@@ -75,6 +77,7 @@ async fn admin_can_list_sandboxes() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_can_report_gateway_validated_identity() {
     let session = login_identity(USER).await;
     let output = assert_allowed(
@@ -102,6 +105,7 @@ async fn user_can_report_gateway_validated_identity() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_can_list_sandboxes() {
     const WORKSPACE: &str = "oidc-user-list-sb";
     let user = login_identity(USER).await;
@@ -118,13 +122,15 @@ async fn user_can_list_sandboxes() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn admin_can_create_sandbox() {
     let session = login_identity(ADMIN).await;
     let _lifecycle = SANDBOX_LIFECYCLE_LOCK.lock().await;
     assert_can_create_sandbox(&session, "default", "oidc-admin-create").await;
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_can_create_sandbox() {
     const WORKSPACE: &str = "oidc-user-create";
     let user = login_identity(USER).await;
@@ -138,6 +144,7 @@ async fn user_can_create_sandbox() {
 /// Workspace users must be able to create sandboxes with inferred-provider
 /// commands (e.g. `claude`) without requiring Platform Admin access.
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_can_create_sandbox_with_inferred_provider_command() {
     const WORKSPACE: &str = "oidc-inferred-cmd";
     let user = login_identity(USER).await;
@@ -187,13 +194,15 @@ async fn user_can_create_sandbox_with_inferred_provider_command() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn admin_can_delete_sandbox() {
     let session = login_identity(ADMIN).await;
     let _lifecycle = SANDBOX_LIFECYCLE_LOCK.lock().await;
     assert_can_delete_sandbox(&session, "default", "oidc-admin-delete").await;
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_can_delete_sandbox() {
     const WORKSPACE: &str = "oidc-user-delete";
     let user = login_identity(USER).await;
@@ -205,6 +214,7 @@ async fn user_can_delete_sandbox() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn admin_can_inspect_gateway() {
     let session = login_identity(ADMIN).await;
     let output = assert_allowed(&session, &["gateway", "info"], "inspect gateway info").await;
@@ -219,6 +229,7 @@ async fn admin_can_inspect_gateway() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_cannot_inspect_gateway() {
     let session = login_identity(USER).await;
     let output = run_session_cli(&session, &["gateway", "info"]).await;
@@ -235,6 +246,7 @@ async fn user_cannot_inspect_gateway() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn admin_can_list_providers() {
     let session = login_identity(ADMIN).await;
     assert_allowed(
@@ -246,6 +258,7 @@ async fn admin_can_list_providers() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_can_list_providers() {
     const WORKSPACE: &str = "oidc-user-list-pr";
     let user = login_identity(USER).await;
@@ -262,6 +275,7 @@ async fn user_can_list_providers() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn admin_can_manage_provider() {
     const PROVIDER: &str = "oidc-pkce-admin-provider";
     let session = login_identity(ADMIN).await;
@@ -298,6 +312,7 @@ async fn admin_can_manage_provider() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_cannot_create_provider() {
     const WORKSPACE: &str = "oidc-user-no-create";
     let user = login_identity(USER).await;
@@ -323,6 +338,7 @@ async fn user_cannot_create_provider() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_cannot_delete_provider() {
     const PROVIDER: &str = "oidc-pkce-user-delete-target";
     const WORKSPACE: &str = "oidc-user-no-delete";
@@ -360,6 +376,7 @@ async fn user_cannot_delete_provider() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn admin_can_create_workspace() {
     const WORKSPACE: &str = "oidc-admin-create";
     let admin = login_identity(ADMIN).await;
@@ -381,6 +398,7 @@ async fn admin_can_create_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_cannot_create_workspace() {
     let user = login_identity(USER).await;
     let denied = run_session_cli(
@@ -392,6 +410,7 @@ async fn user_cannot_create_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn admin_can_delete_workspace() {
     const WORKSPACE: &str = "oidc-admin-delete";
     let admin = login_identity(ADMIN).await;
@@ -406,6 +425,7 @@ async fn admin_can_delete_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn user_cannot_delete_workspace() {
     const WORKSPACE: &str = "oidc-user-del-deny";
     let admin = login_identity(ADMIN).await;
@@ -423,6 +443,7 @@ async fn user_cannot_delete_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_user_can_read_workspace() {
     const WORKSPACE: &str = "oidc-ws-user-read";
     let user = login_identity(USER).await;
@@ -454,6 +475,7 @@ async fn workspace_user_can_read_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_user_cannot_manage_members() {
     const WORKSPACE: &str = "oidc-ws-user-deny";
     let user = login_identity(USER).await;
@@ -479,6 +501,7 @@ async fn workspace_user_cannot_manage_members() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_can_read_workspace() {
     const WORKSPACE: &str = "oidc-wsa-read";
     let user = login_identity(USER).await;
@@ -496,6 +519,7 @@ async fn workspace_admin_can_read_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_can_create_sandbox() {
     const WORKSPACE: &str = "oidc-wsa-create-sb";
     let user = login_identity(USER).await;
@@ -507,6 +531,7 @@ async fn workspace_admin_can_create_sandbox() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_can_delete_sandbox() {
     const WORKSPACE: &str = "oidc-wsa-delete-sb";
     let user = login_identity(USER).await;
@@ -518,6 +543,7 @@ async fn workspace_admin_can_delete_sandbox() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_can_create_provider() {
     const WORKSPACE: &str = "oidc-wsa-create-pr";
     const PROVIDER: &str = "oidc-wsa-create-provider";
@@ -552,6 +578,7 @@ async fn workspace_admin_can_create_provider() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_can_delete_provider() {
     const WORKSPACE: &str = "oidc-wsa-delete-pr";
     const PROVIDER: &str = "oidc-wsa-delete-provider";
@@ -585,6 +612,7 @@ async fn workspace_admin_can_delete_provider() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_can_add_user_member() {
     const WORKSPACE: &str = "oidc-wsa-add-user";
     let workspace_admin = login_identity(USER).await;
@@ -619,6 +647,7 @@ async fn workspace_admin_can_add_user_member() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_can_remove_user_member() {
     const WORKSPACE: &str = "oidc-wsa-rm-user";
     let workspace_admin = login_identity(USER).await;
@@ -662,6 +691,7 @@ async fn workspace_admin_can_remove_user_member() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_cannot_grant_admin() {
     const WORKSPACE: &str = "oidc-ws-admin-deny";
     let user = login_identity(USER).await;
@@ -687,6 +717,7 @@ async fn workspace_admin_cannot_grant_admin() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_cannot_create_workspace() {
     const WORKSPACE: &str = "oidc-wsa-no-create";
     let user = login_identity(USER).await;
@@ -700,6 +731,7 @@ async fn workspace_admin_cannot_create_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_cannot_delete_workspace() {
     const WORKSPACE: &str = "oidc-wsa-no-delete";
     let user = login_identity(USER).await;
@@ -712,6 +744,7 @@ async fn workspace_admin_cannot_delete_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_cannot_inspect_gateway() {
     const WORKSPACE: &str = "oidc-wsa-no-gw-info";
     let user = login_identity(USER).await;
@@ -724,6 +757,7 @@ async fn workspace_admin_cannot_inspect_gateway() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_cannot_read_another_workspace() {
     const WORKSPACE_A: &str = "oidc-wsa-xread-a";
     const WORKSPACE_B: &str = "oidc-wsa-xread-b";
@@ -738,6 +772,7 @@ async fn workspace_admin_cannot_read_another_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_cannot_manage_another_workspace_members() {
     const WORKSPACE_A: &str = "oidc-wsa-xmem-a";
     const WORKSPACE_B: &str = "oidc-wsa-xmem-b";
@@ -769,6 +804,7 @@ async fn workspace_admin_cannot_manage_another_workspace_members() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_admin_cannot_manage_another_workspace_providers() {
     const WORKSPACE_A: &str = "oidc-wsa-xprov-a";
     const WORKSPACE_B: &str = "oidc-wsa-xprov-b";
@@ -800,6 +836,7 @@ async fn workspace_admin_cannot_manage_another_workspace_providers() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn membership_removal_revokes_workspace_access() {
     const WORKSPACE: &str = "oidc-ws-revoke";
     let user = login_identity(USER).await;
@@ -825,6 +862,7 @@ async fn membership_removal_revokes_workspace_access() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_user_cannot_read_another_users_workspace() {
     const WORKSPACE_A: &str = "oidc-xread-a";
     const WORKSPACE_B: &str = "oidc-xread-b";
@@ -838,6 +876,7 @@ async fn workspace_user_cannot_read_another_users_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn second_workspace_user_cannot_read_first_users_workspace() {
     const WORKSPACE_A: &str = "oidc-xread2-a";
     const WORKSPACE_B: &str = "oidc-xread2-b";
@@ -851,6 +890,7 @@ async fn second_workspace_user_cannot_read_first_users_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_list_hides_another_users_workspace() {
     const WORKSPACE_A: &str = "oidc-xlist-a";
     const WORKSPACE_B: &str = "oidc-xlist-b";
@@ -877,6 +917,7 @@ async fn workspace_list_hides_another_users_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_user_cannot_list_another_workspace_sandboxes() {
     const WORKSPACE_A: &str = "oidc-xsbox-a";
     const WORKSPACE_B: &str = "oidc-xsbox-b";
@@ -895,6 +936,7 @@ async fn workspace_user_cannot_list_another_workspace_sandboxes() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_user_cannot_create_sandbox_in_another_workspace() {
     const WORKSPACE_A: &str = "oidc-xcreate-a";
     const WORKSPACE_B: &str = "oidc-xcreate-b";
@@ -922,6 +964,7 @@ async fn workspace_user_cannot_create_sandbox_in_another_workspace() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_user_cannot_list_another_workspace_providers() {
     const WORKSPACE_A: &str = "oidc-xprov-a";
     const WORKSPACE_B: &str = "oidc-xprov-b";
@@ -940,6 +983,7 @@ async fn workspace_user_cannot_list_another_workspace_providers() {
 }
 
 #[tokio::test]
+#[serial(oidc_pkce)]
 async fn workspace_user_cannot_list_another_workspace_members() {
     const WORKSPACE_A: &str = "oidc-xmember-a";
     const WORKSPACE_B: &str = "oidc-xmember-b";