AVP-555 Integration Test Migration Plan

Goal

Migrate IDM integration tests to the shared Core test containers platform and make the test runtime independent from shared AVA environments.

The target state is:

• IDM integration tests use ASOL.Core.QA.TestSupport.Testcontainers.Platform.
• Required AVA dependencies run locally as test containers.
• Test runtime configuration does not depend on alpha.avaplace.com or beta.avaplace.com.
• Check pipeline keeps integration tests enabled.
• User secrets contain only machine-specific values that cannot be safely committed.

Scope

This migration includes both the package/API migration and the local test topology work needed to remove remote AVA environment dependencies.

In scope:

• replace the IDM-local copy of generic test container infrastructure with Core
• keep IDM-specific test startup, multi-instance, and diagnostics code in IDM
• add local service containers for dependencies used by integration tests
• replace remote auth and service URLs with local container wiring
• reduce user secrets to the minimum required machine-local configuration
• replace temporary local project references with NuGet package references after package publication

Out of scope:

• production runtime behavior changes
• LocalDev tooling changes in the IDM repository
• unrelated integration test rewrites
• new Jira subtasks unless tracking needs change

Current State

The temporary local Core reference workaround has been replaced with published Core NuGet packages.

• Branch: feat/AVP-555-core-integration-test-platform
• Core packages:
  • ASOL.Core.QA.TestSupport 3.4.0
  • ASOL.Core.QA.TestSupport.ApiService 3.4.0
  • ASOL.Core.QA.TestSupport.Testcontainers.Idp 3.4.0
  • ASOL.Core.QA.TestSupport.Testcontainers.Platform 3.4.0
• Local ProjectReference entries to C:\Dev\Repos\Asseco\Plaza\Core were removed.
• Dependency alignment required by the Core QA packages is constrained to the integration-test project with VersionOverride; production project package versions are not intentionally upgraded by this step.
• Validation already performed:
  • dotnet restore 'ASOL.IdentityManager.IntegrationTests/ASOL.IdentityManager.IntegrationTests.csproj'
  • dotnet build 'ASOL.IdentityManager.IntegrationTests/ASOL.IdentityManager.IntegrationTests.csproj' --no-restore

Execution Plan

1. Service Inventory

Create a concrete inventory of every remote dependency used by the integration test project.

Inputs:

• backend/ASOL.IdentityManager.IntegrationTests/appsettings.json
• backend/ASOL.IdentityManager.IntegrationTests/Platform/Helpers/ServiceEnvironmentHelper.cs
• existing test usage and test collections
• shared LocalDev service definitions in C:\Dev\Repos\Asseco\Plaza\DevelopmentTools\LocalDev
• Core test support sources in C:\Dev\Repos\Asseco\Plaza\Core\TestSupport\backend

For each dependency, capture:

• configuration section
• current URL source
• target local service or stub
• image repository and tag source
• internal port
• health endpoint
• Mongo, RabbitMQ, Redis, or other infrastructure needs
• seed data needs
• whether Core AddService() is enough or a specialized helper is needed

Inventory result:

Dependency	Configuration sections	Current source	Target local topology	Image or tag source	Port and health	Infrastructure and seed needs	Core approach
Identity Provider and auth	SsoAuth, UserTokenSsoAuth, ClientTokenSsoAuth, IdentityProviderClientOptions, AuthorizationServiceOptions	Integration-test config and user secrets currently point auth to shared AVA environments	Local IDP container with deterministic test OIDC clients and test users	Prefer Core IDP helper default repository or LocalDev ECR_VERSION_IDP	Core IDP helper uses its own HTTP/HTTPS wiring; raw AddService() would use LocalDev-style port 8080 and /health/liveness	MongoDB, RabbitMQ, OIDC application seed, local signing certificate assumptions	Prefer ASOL.Core.QA.TestSupport.Testcontainers.Idp; fall back to Core AddService() only if helper cannot seed IDM needs
Subject Manager	SubjectManagerClientOptions, SubjectManagerMasterClientOptions	Test factory already registers a local service for SubjectManagerClientOptions; master URL can still come from remote config	Local Subject Manager container	LocalDev ava/asol.subjectmanager.api with ECR_VERSION_IDMSM	8080, /health/liveness	MongoDB and messaging configuration	Core AddService() with additional config for both client sections
Store	PlatformStoreStoreClientOptions	Test factory already registers a local service	Local Store container	LocalDev ava/asol.platformstore.store.api with ECR_VERSION_STORE	8080, /health/liveness	MongoDB and messaging configuration	Core AddService()
Order	PlatformStoreOrderClientOptions	Test factory already registers a local service	Local Order container	LocalDev ava/asol.platformstore.order.api with ECR_VERSION_ORDER	8080, /health/liveness	MongoDB and messaging configuration	Core AddService()
PDM	PlatformStorePdmClientOptions	Test factory already registers a local service	Local PDM container	LocalDev ava/asol.platformstore.pdm.api with ECR_VERSION_PDM	8080, /health/liveness	MongoDB and messaging configuration	Core AddService()
Message Provider	MessageProviderClientOptions	Runtime config can point to shared AVA environment	Local Message Provider container or test stub if exercised scenarios only need successful sends	LocalDev ava/asol.messageprovider.api with ECR_VERSION_MP	8080, /health/liveness	MongoDB and messaging configuration; test data depends on invitation flows	Start with Core AddService() unless tests prove a smaller stub is enough
Content Manager	ContentManagerClientOptions	Runtime config can point to shared AVA environment	Local Content Manager container	LocalDev ava/asol.contentmanager.api with ECR_VERSION_CNT	8080, /health/liveness	MongoDB and messaging configuration	Core AddService()
Custom Attributes	CustomAttributesClientOptions	Runtime config is prepared by IDM-local helper, but the current factory does not register the service	Local Custom Attributes container if tests require it	LocalDev ava/asol.customattributes.api with ECR_VERSION_CUATT	8080, /health/liveness	MongoDB and messaging configuration	Core AddService() when a test path requires it
Data Service	DataServiceClientOptions	Runtime config can point to shared AVA environment	Local Data Service container if tests require it	LocalDev ava/asol.dataservice.api with ECR_VERSION_DS	8080, /health/liveness	MongoDB and messaging configuration	Core AddService() when a test path requires it
Product App	ProductAppClientOptions	IDM-local helper has a registration shape, but LocalDev platform inventory does not provide a direct product-app service	Local stub or omitted until exercised by a test path	No confirmed LocalDev image in the checked inventory	To be decided only if required	Seed depends on product/license scenarios	Do not add until a concrete test requires it
Workflow and Scheduler	WorkflowClientOptions, SchedulerClientOptions	IDM-local helper has workflow wiring; scheduler URL requires extra configuration	Local Workflow/Scheduler container or contributor if exercised	LocalDev workflow repository setting exists in IDM test config; no LocalDev service entry was confirmed in the checked inventory	Existing IDM helper uses service health /health; LocalDev-style services use /health/liveness	MongoDB and messaging configuration; scheduler URL mapping must be explicit	Core AddService() plus custom configuration contributor if required
Message Gateway	MessageGatewayClientOptions	Service environment helper contains remote shared-environment gateway settings	Local stub, no-op, or local service only if a test exercises the client	No confirmed LocalDev image in the checked inventory	To be decided only if required	Avoid external message delivery during tests	Prefer no-op/stub unless a concrete integration path requires a container
Telemetry	Telemetry:Endpoint	Runtime config can point to shared AVA environment	Disable telemetry or use local no-op endpoint	LocalDev has a fake TMG service, but tests should not need telemetry assertions	No health dependency for IDM tests	No seed	Prefer disable/no-op configuration
Navigation hosts	NavigationServiceOptions	Runtime config contains shared AVA hostnames	Local deterministic test hostnames	Not an image-backed dependency	Not applicable	No seed	Static integration-test configuration
MongoDB	MongoDbConnectionOptions, MasterConnectionOptions, TestContainers Mongo settings	Existing test infrastructure creates Mongo and user secrets may currently override connection strings	Core platform Mongo container or restored Mongo image	Test config currently uses mongo:7.0.24; LocalDev uses mongo:7.0	MongoDB default container port	Existing restored image or dump archive support	Core platform infrastructure
RabbitMQ	Messaging:RabbitMq, TestContainers RabbitMQ settings	Existing test infrastructure creates RabbitMQ and user secrets may currently override host/port	Core platform RabbitMQ container	Test config and LocalDev use RabbitMQ 3.13 management image family	AMQP plus management ports	Default user/password are test-local only	Core platform infrastructure
Redis	RedisConnection and related distributed coordination config	Integration tests already have Redis container signals; mocked startup may replace coordination with in-memory/no-op behavior	Core or IDM-specific Redis test container for multi-instance paths	Test config uses redis:7-alpine; LocalDev uses Redis 8.4	Redis default container port	No seed	Keep real Redis for multi-instance tests, keep mocked/no-op startup behavior where intended

Open implementation checks from the inventory:

• Confirm whether the Core IDP helper already maps or generates every certificate needed by its default local OIDC configuration. If not, Step 3 must add an IDM-owned test certificate mapping or use AddService() with explicit configuration.
• Confirm whether the local IDP helper seed covers the exact IDM integration-test clients and users. Do not copy remote environment credentials into the seed.
• Use LocalDev default ECR image tags as the first baseline, but keep tag selection in normal test configuration so it is reviewable and not hidden in user secrets.
• Keep user secrets limited to machine-specific ECR credentials or optional archive paths after the migration.

2. Mechanical Core API Migration

Migrate the generic platform wiring first while keeping the current topology as close as possible to the existing behavior.

Expected changes:

• update TestPlatformWebApplicationFactory<TStartup> to use Core TestContainersWebApplicationFactory<TStartup>
• use Core TestPlatformBuilder
• keep currently registered services initially
• keep IDM-specific code in IDM:
  • TestMockedStartup
  • MultiInstanceTestStartup
  • IdmTestInstanceFactory
  • performance and diagnostics helpers
  • service configuration helpers

Do not delete IDM-local platform files until the Core-based build is green and all call sites are migrated.

3. Local IDP/Auth Topology

Remove remote authentication dependency before cleaning the rest of the topology.

Preferred approach:

• use ASOL.Core.QA.TestSupport.Testcontainers.Idp if the helper is complete enough
• otherwise register IDP through Core AddService() with IDM-owned configuration
• seed local test clients and test users deterministically
• wire local SsoAuth:Authority, IdentityProviderClientOptions:BaseUrl, and AuthorizationServiceOptions:BaseUrl

Important rule:

• test client secrets must be test-only local seed values, not copied remote environment credentials

4. Local Service Topology

Add required local services one by one.

Initial candidates:

Area	Config sections	Target approach	Notes
Identity Provider	SsoAuth, IdentityProviderClientOptions, AuthorizationServiceOptions	Core IDP helper or AddService()	Highest priority, removes remote auth dependency
Subject Manager	SubjectManagerClientOptions, SubjectManagerMasterClientOptions	AddService()	Already partially covered by current IDM topology
Store	PlatformStoreStoreClientOptions	AddService()	Existing service, migrate to Core registration
Order	PlatformStoreOrderClientOptions	AddService()	Existing service, migrate to Core registration
PDM	PlatformStorePdmClientOptions	AddService()	Existing service, migrate to Core registration
Message Provider	MessageProviderClientOptions	AddService() or local stub	Needed by tenant and invitation flows
Content Manager	ContentManagerClientOptions	AddService()	Needed by content/file dependent scenarios
Product App	ProductAppClientOptions	AddService() or local stub	Include only if exercised by tests
Data Service	DataServiceClientOptions	AddService() or skip health as healthy	Include only if exercised by tests
Workflow/Scheduler	WorkflowClientOptions, SchedulerClientOptions	AddService() or contributor	Requires careful URL wiring
Message Gateway	MessageGatewayClientOptions	AddService() or local stub	Include only if exercised by tests
Telemetry	Telemetry:Endpoint	disable or local no-op	Must not call shared environments
Navigation hosts	NavigationServiceOptions	local test config	Remove shared environment hostnames from runtime config

Each service should be added with a focused validation step before adding the next one.

Implementation note:

• Added local Core service registrations for Content Manager, Custom Attributes, and Data Service because the IDM test helper already contains their environment configuration and the integration-test appsettings contains their ECR repository URIs.
• Message Provider is not registered in this step. LocalDev has an image, but the IDM test helper does not yet define a service configuration for it and the LocalDev topology includes SMTP and Redis assumptions that need a focused runtime validation before turning it into an always-on integration-test dependency.
• Workflow/Scheduler is not registered in this step. The helper contains workflow configuration, but the checked LocalDev topology did not confirm an equivalent service entry and scheduler URL wiring needs a separate validation pass.
• Product App and Message Gateway remain out of scope until a concrete test path requires a container or an explicit stub.

5. Runtime Configuration Cleanup

Remove remote environment URLs from integration test runtime configuration.

Rules:

• do not pass remote BaseUrl values into Core service registrations
• let Core provide local service URLs where possible
• use a custom environment contributor for non-standard keys
• keep intentional external public APIs explicit and separate from AVA environment dependencies

Required check:

rg -n 'alpha\.avaplace\.com|beta\.avaplace\.com' 'backend/ASOL.IdentityManager.IntegrationTests'

The target result is no runtime configuration dependency on shared AVA environments.

6. User Secrets Cleanup

User secrets must not be the integration point to shared AVA environments.

Target split:

Commit to normal test configuration:

• non-secret local test settings
• test-only client IDs
• test-only local client secrets if they are generated or seeded only for local containers
• ECR region
• image names and tags if they are not machine-specific
• local health-check behavior and test-only feature flags

Allow in user secrets only when needed:

• ECR access key ID
• ECR secret access key
• ECR session token if temporary credentials are used
• machine-local image archive path if archive fallback remains supported
• machine-local dump archive path if dump archive fallback remains supported

Remove from user secrets after migration:

• remote user-token SSO settings
• remote client-token SSO settings
• remote SsoAuth settings
• remote platform client secrets
• manually captured MongoDB container connection strings
• manually captured RabbitMQ host and port values

MongoDB, RabbitMQ, Redis, service base URLs, and auth authority should be produced by the test platform at runtime.

Implemented boundary:

Commit to ASOL.IdentityManager.IntegrationTests/appsettings.json:

• non-secret local auth defaults such as the test client ID and local fallback URLs
• ECR region
• container image names and ECR repository URIs
• RabbitMQ local defaults used by the test platform
• empty optional defaults for ImagesPath, DumpsPath, and AWS credentials so missing user secrets do not look like real values

Allow in user secrets after this migration only when needed:

• TestContainers:AwsEcr:AccessKeyId
• TestContainers:AwsEcr:SecretAccessKey
• TestContainers:AwsEcr:SessionToken for temporary AWS credentials
• TestContainers:ImagesPath for a machine-local image archive fallback
• TestContainers:DumpsPath for a machine-local Mongo dump archive fallback

Do not keep these integration-test settings in user secrets after this migration:

• UserTokenSsoAuth
• ClientTokenSsoAuth
• remote SsoAuth values
• remote platform client secrets
• manually captured MongoDB connection strings
• manually captured RabbitMQ host, port, user name, or password values

7. Remove IDM-Local Generic Platform Fork

After all call sites are migrated, remove unused IDM-local generic platform files.

Likely removal candidates:

• Platform/TestPlatformBuilder.cs
• Platform/TestPlatformEnvironment.cs
• Platform/InfrastructureManager.cs
• Platform/ImageResolver.cs
• Platform/ContainerDisposer.cs
• Platform/ServiceRuntimeInfo.cs
• Platform/ServiceRegistration.cs
• generic environment builder files replaced by Core

Keep IDM-specific helpers that express IDM test behavior.

Implementation note:

• Removed the IDM-local generic test platform builder, environment, image resolver, infrastructure manager, service registration, disposer, process runner, constants, and fluent registration types.
• Kept IDM-specific test behavior:
  • TestPlatformWebApplicationFactory<TStartup>
  • IdmTestPlatformInfrastructureManager
  • IdmTestInstanceFactory
  • TestMockedStartup
  • MultiInstanceTestStartup
  • diagnostics and service environment helpers

8. Replace Temporary References With NuGet Packages

After Core packages are published:

• remove local ProjectReference workaround
• add PackageReference for ASOL.Core.QA.TestSupport.Testcontainers.Platform
• add central PackageVersion
• add ASOL.Core.QA.TestSupport.Testcontainers.Idp only if the migration uses it
• re-run restore and build

The final repository state must not depend on C:\Dev\Repos\Asseco\Plaza\Core.

Implementation note:

• Replaced temporary Core ProjectReference entries with published PackageReference entries for ASOL.Core.QA.TestSupport.Testcontainers.Platform and ASOL.Core.QA.TestSupport.Testcontainers.Idp.
• Added central PackageVersion entries for the Core QA 3.4.0 packages.
• Kept higher ASOL.Core.ApiConnector, ASOL.Core.Messaging, ASOL.Core.Messaging.RabbitMq, ASOL.Core.Persistence.Abstractions, and Microsoft.Net.Http.Headers versions as test-only VersionOverride entries in ASOL.IdentityManager.IntegrationTests.csproj, so this step does not intentionally upgrade production project dependencies.
• Updated IDM integration-test imports from the temporary local TestContainers.Platform namespace casing to the published Testcontainers.Platform namespace casing.
• Configured local IDP to run over plain HTTP on port 80 with OIDCOptions__RequireHttps=false. The current Core IdpBuilder still maps a Kestrel PFX file during container startup, so IDM generates a test-only Certificates/idp.pfx in the test output directory when it is missing. This is an implementation workaround, not a user secret or a committed certificate.

9. Validation

Minimum validation stack:

dotnet restore 'ASOL.IdentityManager.IntegrationTests/ASOL.IdentityManager.IntegrationTests.csproj'
dotnet build 'ASOL.IdentityManager.IntegrationTests/ASOL.IdentityManager.IntegrationTests.csproj' --no-restore
dotnet test 'ASOL.IdentityManager.IntegrationTests/ASOL.IdentityManager.IntegrationTests.csproj' --no-build
rg -n 'alpha\.avaplace\.com|beta\.avaplace\.com' 'backend/ASOL.IdentityManager.IntegrationTests'
git diff --check

If the full integration test project is too broad during development, use focused test filters first and run the full project before PR.

10. Pull Request Readiness

The PR is ready when:

• Core test support packages are used instead of IDM-local generic platform code
• local service topology covers the integration test runtime
• tests no longer require shared AVA environments
• user secrets requirements are documented and minimal
• check pipeline still has integration tests enabled
• temporary project references are replaced by package references

Follow-up Core Extraction Candidates

During the AVP-555 migration review, several remaining ASOL.IdentityManager.IntegrationTests helpers were identified as possible candidates for shared Core test-support extraction. These follow-ups are not required to finish AVP-555. AVP-555 should stay focused on the IDM migration, the removal of shared AVA environment dependencies, and the final replacement of temporary Core ProjectReference entries with published NuGet packages.

High-confidence candidates for ASOL.Core.QA.TestSupport.Testcontainers.Platform or the Core IDP test helper:

Candidate	Current IDM location	Follow-up direction
Local IDP startup with generated service-client credentials	Platform/IdmTestPlatformInfrastructureManager.cs	Move into a shared Core IDP/platform API so app tests can register local IDP without a custom IInfrastructureManager.
OIDC client seed update for generated secrets	Platform/IdmTestPlatformInfrastructureManager.cs	Move into the Core IDP helper. App tests should not need to patch the IDP Mongo seed manually through mongosh.
Sensitive service environment log redaction	Platform/IdmTestPlatformInfrastructureManager.cs	Move into the Core platform infrastructure logging path because environment logging is generic and must not print secret-shaped values.
Explicit pinned image reference support	Platform/IdmTestPlatformInfrastructureManager.cs, TestContainers:IdentityProviderRepositoryUri	The pinned IDP image tag is a temporary IDM workaround until AVP-604 is done. Core image resolution should support explicit tags or digests directly instead of forcing app-specific pull logic around the default ECR latest-by-push-date behavior.
Host-side local IDP token acquisition	Platform/LocalIdpClientTokenProvider.cs, Platform/TestMockedStartup.cs	Move into Core IDP or API test support so app tests can obtain tenant-scoped client-credentials tokens from a locally mapped IDP while accepting the container-internal issuer used in the JWT.
HTTP-only IDP startup without mandatory Kestrel PFX mapping	Platform/IdmTestPlatformInfrastructureManager.cs	Core IdpBuilder currently maps Certificates/idp.pfx even when the test topology uses plain HTTP. Move the conditional certificate generation or the HTTP-only startup mode into Core so app tests do not need to create a local output certificate just to start the container.

Medium-confidence candidates:

Candidate	Current IDM location	Follow-up direction
AVA service environment recipes	Platform/Helpers/ServiceEnvironmentHelper.cs	Split into smaller service-specific recipes or contributors for IDP, IDMSM, Store, Order, PDM, Content Manager, Custom Attributes, and Data Service. Do not move the current class as-is because it mixes shared defaults, IDM topology overrides, and service-specific business settings.
Container and runtime diagnostics	Platform/ContainerDiagnosticsCollector.cs, Platform/Diagnostics/*	Consider a Core QA diagnostics package after replacing the IDM-specific environment variable name and using Core container CLI abstraction instead of hard-coded docker calls.
Redis-only test fixture	RedisTestContainerFixture.cs	Either replace local usage with Core WithRedis() where a full platform is acceptable, or add a small shared Redis-only fixture for focused tests.

Candidate for Core API test support rather than Testcontainers.Platform:

Candidate	Current IDM location	Follow-up direction
Claims, tenant, localization, security, and trace context test helpers	Support/ServiceProviderHelper.cs	Consider moving a generalized helper into ASOL.Core.QA.TestSupport.ApiService, because this is about Core Identity and Multitenancy test setup rather than container orchestration.

Keep in IDM:

• IDM-specific test platform composition in Platform/TestPlatformWebApplicationFactory.cs.
• IDM multi-instance host and connector wiring in Platform/IdmTestInstanceFactory.cs and MultiInstanceIdmTestPlatformFixture.cs.
• IDM startup overrides in Platform/TestMockedStartup.cs, Platform/MultiInstanceTestStartup.cs, and IDM-specific no-op distributed service replacements.
• Domain and behavior tests under ASOL.IdentityManager.IntegrationTests.
• Redis coordination diagnostics while they depend directly on IDM distributed services.

Cleanup candidate inside IDM:

• TestMockedStartup.cs in the integration-test project root appears to be an unused historical startup. Current tests use Platform/TestMockedStartup.cs. Remove it in a focused cleanup commit after confirming the build with the published Core packages.

Follow-up timing:

1. Step 8 is complete with published Core NuGet packages.
2. Validate IDM integration tests against the published packages.
3. Create separate Core follow-up work for confirmed shared extraction candidates.
4. Use IDM plus at least one additional app migration as evidence before moving medium-confidence service recipes into Core.

Commit Strategy

Keep commits reviewable:

1. temporary references and dependency alignment
2. migration plan and inventory
3. Core API migration without topology expansion
4. local IDP/Auth topology
5. remaining local services and runtime config cleanup
6. remove unused IDM-local generic platform code
7. replace temporary references with NuGet package references

Each implementation commit should build independently where practical.