Fixes rossoctl#616 Every login to the control plane is GitHub's device flow, which needs a person with a browser. smoke.sh works around that by minting an API token inside the control-plane pod with the signing key, which skips refresh.issue(), rolesFor() and the audit login entry -- so the smoke authenticates in a shape no real user has, and needs kubectl exec to do it. Multi-user behaviour (per-subject credentials, cross-user session denial) had no automated coverage above one user. With SH_TEST_USERS=N the control plane now serves logins for N synthetic subjects test:1..test:N via POST /v1/auth/test-token, and `mocactl login --test-user N` drives it. A test user is configured exactly like a GitHub user: the handler makes the same two calls as completeDeviceAuth -- refresh.issue() then loginBody() -- so token TTLs, rotation, roles, ownership, audit and credential storage cannot tell them apart. Only the way identity is established differs. The path is gated by SH_TEST_USER_SECRET, which the client presents and the control plane compares in constant time (both sides hashed to 32 bytes first, so a length mismatch is neither an exception nor an oracle). The endpoint issues a real login for an arbitrary subject, so without a secret anyone who could route to the control plane would be every test user -- including a compromised sandbox. The secret is a credential FILE via CONTROL_PLANE_SECRETS, never an env line a kubectl child inherits, and setup.sh generates it into moca-mu1 without rotating it on a re-run. Fails closed: 404 when SH_TEST_USERS is unset (indistinguishable from an unrouted path), the route is not mounted on the sandbox profile at all and the control plane refuses to boot if the two are combined, N is capped at 1000, the secret must be at least 16 characters, and a warning names the count at boot and on every setup run. deploy/k8s/test-users.py drives N users (default 10) through real mocactl commands, one XDG_CONFIG_HOME each -- auth.json holds exactly one login, so one directory cannot hold ten -- and asserts the cross-user claims: user 2 is refused user 1's real session, user 1 still resumes it, and each list holds only its owner's sessions. --api runs the same claims over HTTP as a reference for a non-CLI client. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Aleksander Slominski <aslom@us.ibm.com>

Commits

Commits on Oct 27, 2026

feat(control-plane): test-user logins behind a shared secret