W-22698013: DPoP automated UI tests (Phase 5) - #2959
Merged
Conversation
… toggle - Add 'Use DPoP' toggle to LoginOptionsActivity (wires to SalesforceSDKManager.setUseDPoP); add string resource for its content description - Remove unconditional setUseDPoP(true) from AuthFlowTesterApplication so non-DPoP tests are unaffected - Add DPOP_AUTH to KnownLoginHostConfig, ECA_JWT_DPOP to KnownAppConfig, isDpop to AppConfig in UITestConfig.kt - Add enableDPoP/disableDPoP to LoginOptionsPageObject - Add useDPoP param to loginAndValidate(); reset setUseDPoP(false) in cleanup() in AuthFlowTest - Rewrite DPoPLoginTests to follow RTRLoginTests pattern: driven by ui_test_config.json dpop_auth host + eca_jwt_dpop app config - Add dpop_auth + eca_jwt_dpop entries to ui_test_config.json.sample
…AUTH - AuthorizationPageObject: add DPOP_AUTH branch to when(knownLoginHostConfig) (uses Custom Tab path, same as ADVANCED_AUTH) - MultiUserLoginTests: pass useDPoP = false explicitly to avoid positional mismatch after new parameter insertion - RefreshTokenMigrationTests: add useDPoP to override signature and super call to match updated AuthFlowTest.loginAndValidate
Generated by 🚫 Danger |
Job Summary for GradlePull Request :: test-android
|
…migration test suites Config changes: - Remove dpop_auth login host (DPoP is an ECA property, same org as regular_auth) - Add ECA_JWT_DPOP_RTR to KnownAppConfig for DPoP+RTR combined testing - Update eca_jwt_dpop redirectUri to ecajwtdpop://success/done and align scopes with eca_jwt_rtr; add eca_jwt_dpop_rtr entry to sample config Infrastructure fixes: - Remove DPOP_AUTH from KnownLoginHostConfig (no separate login host needed) - Fix RefreshTokenMigrationTests override: forward useHybridAuthToken param instead of hardcoding false - Add useDPoP param to addOtherUserAndValidate() in AuthFlowTest - Revert AuthorizationPageObject to two-branch when (DPOP_AUTH removed) - Fix DPoPLoginTests: drop knownLoginHostConfig=DPOP_AUTH (uses REGULAR_AUTH) New tests: - RTRLoginTests: testECAJwtDPoPRtr_Hybrid, testECAJwtDPoPRtr_NoHybrid - MultiUserLoginTests: testECAJwtDPoP_MultiUser_UniqueTokens - RefreshTokenMigrationTests: testMigrate_ECAJwtDPoP_AddMoreScopes, testMigrate_ECAJwtDPoP_To_ECAJwtDPoPRtr
…ests Verifies that the DPoP key pair stored in AndroidKeyStore survives a process kill/relaunch and that revoke+refresh still works after restart.
Add DPoPLoginTests suite section, expand RTRLoginTests/MultiUserLoginTests/ RefreshTokenMigrationTests/LoginWithRestartTests tables with DPoP entries, add Use DPoP toggle to Login Options docs, and add ECA_JWT_DPOP/ECA_JWT_DPOP_RTR to KnownAppConfig list.
… tests Add OAuth Token Type row and DPoP section (with nonce) to UserCredentialsView, wired to DPoPNonceCache. Add getDpopInfo() to AuthFlowTesterPageObject and extend validateOAuthValues to assert tokenType=="DPoP" and nonce non-empty for DPoP apps. Add isDpop param to assertRevokeAndRefreshWorks; asserts the nonce changes after each token refresh cycle, proving the server processed the DPoP proof header. All DPoP test call sites updated to pass isDpop=true.
RefreshTokenMigrationTests: add testMigrateCAUserAgent_To_ECAExtendedWebServer and testMigrateCAUserAgent_To_BeaconExtendedWebServer. MultiUserLoginTests: add testMultiUser_revokeOtherUserRefreshToken and testAdvancedAuthUser_HasBWFlag_ RegularAuthUser_DoesNot. RTRLoginTests: annotate testECAJwtRtr_Hybrid as @ignore (W-22512846). All config enums were already in sync.
…edAuthentication Replace private field + isUseDPoP()/setUseDPoP() with a public Kotlin var. Use @get:JvmName("isUseDPoP") so Java callers (OAuth2.java, RestClient.java, unit test mocks) remain unchanged. Kotlin call sites in LoginOptionsActivity and AuthFlowTest now use property syntax (= value) matching all other SalesforceSDKManager toggles.
Job Summary for GradlePull Request :: test-android
|
Move DPoP-related tests from RTRLoginTests, MultiUserLoginTests, RefreshTokenMigrationTests, and LoginWithRestartTests into DPoPLoginTests, which now owns all DPoP coverage end-to-end (basic login, RTR, multi-user, migration, restart). This mirrors how RTRLoginTests owns all RTR scenarios. Update README, spec, and plan to reflect the consolidated structure.
Job Summary for GradlePull Request :: test-android
|
Extends adminLoginAndValidate with knownAppConfig and useDPoP parameters, then adds testLoginForAdmin_DPoP verifying that the Login for Admins Custom Tab hand-off works end-to-end with a DPoP-enabled ECA.
Job Summary for GradlePull Request :: test-android
|
The useDPoP property conversion (from isUseDPoP()/setUseDPoP()) means
Kotlin callers must mock the property getter with `every { useDPoP }`
rather than `every { isUseDPoP() }`. Java callers still use isUseDPoP()
via the @get:JvmName annotation, but MockK stubs in Kotlin files need
the property syntax.
sfdctaka
reviewed
Jul 10, 2026
brandonpage
approved these changes
Jul 10, 2026
Comment on lines
+359
to
+364
| knownAppConfig = knownAppConfig, | ||
| scopeSelection = scopeSelection, | ||
| useWebServerFlow = useWebServerFlow, | ||
| useHybridAuthToken = useHybridAuthToken, | ||
| useDPoP = useDPoP, | ||
| knownLoginHostConfig = knownLoginHostConfig, |
Comment on lines
+214
to
+215
| useHybridAuthToken = false, | ||
| useHybridAuthToken = useHybridAuthToken, |
Contributor
There was a problem hiding this comment.
Weren't we waiting for a server side bug to be fixed before useHybridAuthToken could be used?
…HybridAuthToken workaround Revert unnecessary named-argument conversion in MultiUserLoginTests. Restore useHybridAuthToken = false in RefreshTokenMigrationTests with a TODO referencing W-20524841 (server bug blocking hybrid auth token use).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
W-22698013: End-to-end automated UI tests for DPoP login flows in AuthFlowTester.
setUseDPoP(true)fromApplication.onCreate(); tests toggle DPoP on/off through the existing Login Options screen, so all non-DPoP tests are unaffectedregular_auth(sdb38):ECA_JWT_DPOP(ecajwtdpop://success/done) andECA_JWT_DPOP_RTR(ecajwtdpoprtr://success/done)useDPoPKotlin property: converted from Java-style field +isUseDPoP()/setUseDPoP()to@get:JvmName("isUseDPoP") var useDPoP: Boolean = falsefor consistency withforceAdvancedAuthenticationUserCredentialsViewnow showsOAuth Token Typerow and aDPoPsection (nonce) for DPoP sessionsvalidateOAuthValuesassertstokenType == "DPoP"and nonce non-empty;assertRevokeAndRefreshWorks(isDpop = true)asserts the nonce changes after each token refresh (proves server processed the DPoP proof)DPoPLoginTests: basic login (hybrid/no-hybrid), DPoP+RTR, multi-user, migration, and restart — one suite owns the feature end-to-end, mirroring howRTRLoginTestsowns all RTR scenariosTest Coverage
testECAJwtDPoP_HybridtestECAJwtDPoP_NoHybridtestECAJwtDPoPRtr_HybridtestECAJwtDPoPRtr_NoHybridtestECAJwtDPoP_MultiUser_UniqueTokenstestMigrate_ECAJwtDPoP_AddMoreScopestestMigrate_ECAJwtDPoP_To_ECAJwtDPoPRtrtestECAJwtDPoP_WithRestartTest plan
AuthFlowTesterwithout errorsDPoPLoginTests— all 8 DPoP tests passRTRLoginTests— non-DPoP RTR tests still passMultiUserLoginTests— non-DPoP multi-user tests still passRefreshTokenMigrationTests— non-DPoP migration tests still passLoginWithRestartTests— non-DPoP restart tests still pass