test: unauthenticated requests to edges proxy return 401 (#77) (#95)

Add e2e test ProxyUnauthenticated that verifies requests without a Bearer
token are rejected with 401/403 by the edges proxy handler.

The handler (pkg/virtual/builder/edges_proxy_builder.go) checks for a
valid bearer token as the very first step, before any path parsing or
cluster lookup. The test hits the /services/edges-proxy/ path without an
Authorization header and asserts the response is 401 or 403.

The test is registered in the standalone suite so it runs without any
OIDC or agent infrastructure — only a reachable hub is required.

Closes #77

Co-authored-by: OpenClaw Bot <bot@openclaw.ai>
Co-authored-by: Mangirdas Judeikis <mangirdas@judeikis.lt>

Author: 3 people

test/e2e/cases/auth.go

@@ -82,6 +82,39 @@ func fakeBearerJWT() string {
 	return "Bearer " + header + "." + payload + "." + sig
 }
 
+// ProxyUnauthenticated verifies that a request to the edges proxy without a
+// Bearer token is rejected with HTTP 401 Unauthorized.
+//
+// The edges proxy handler (pkg/virtual/builder/edges_proxy_builder.go) checks
+// for a valid bearer token as its very first step — before any path parsing or
+// cluster lookup — so this test does not require a running agent or edge
+// resource: it only needs a reachable hub.
+func ProxyUnauthenticated() features.Feature {
+	return features.New("Auth/ProxyUnauthenticated").
+		Assess("no_token_returns_401", func(ctx context.Context, t *testing.T, cfg *envconf.Config) context.Context {
+			clusterEnv := framework.ClusterEnvFrom(ctx)
+			if clusterEnv == nil {
+				t.Fatal("cluster environment not found in context")
+			}
+
+			// Hit the edges proxy with no Authorization header.
+			// The handler rejects requests with an empty bearer token with 401
+			// before any path parsing or cluster lookup occurs, so the cluster
+			// and edge name here are arbitrary placeholders.
+			proxyURL := clusterEnv.HubURL + "/services/edges-proxy/clusters/test/apis/kedge.faros.sh/v1alpha1/edges/nonexistent/k8s"
+			code, err := framework.HTTPGet(ctx, proxyURL)
+			if err != nil {
+				t.Fatalf("HTTP GET to edges proxy failed: %v", err)
+			}
+			if code != http.StatusUnauthorized && code != http.StatusForbidden {
+				t.Fatalf("expected 401 or 403 for unauthenticated edges proxy request, got %d", code)
+			}
+			t.Logf("edges proxy correctly rejected unauthenticated request with HTTP %d", code)
+			return ctx
+		}).
+		Feature()
+}
+
 // ProxyInvalidToken verifies that the edges-proxy handler rejects requests
 // carrying invalid Bearer tokens with HTTP 401 or 403.
 //

test/e2e/suites/standalone/standalone_test.go

@@ -35,6 +35,7 @@ func TestK8sProxyAccess(t *testing.T)       { testenv.Test(t, cases.K8sProxyAcce
 func TestK8sProxyWrite(t *testing.T)        { testenv.Test(t, cases.K8sProxyWrite()) }
 func TestK8sProxyExec(t *testing.T)         { testenv.Test(t, cases.K8sProxyExec()) }
 func TestWorkloadDeployment(t *testing.T)   { testenv.Test(t, cases.WorkloadDeployment()) }
+func TestProxyUnauthenticated(t *testing.T) { testenv.Test(t, cases.ProxyUnauthenticated()) }
 
 // Multi-edge tests — require 2 agent clusters (DefaultAgentCount=2).
 func TestTwoAgentsJoin(t *testing.T)         { testenv.Test(t, cases.TwoAgentsJoin()) }