chore: test fixes

docker-compose.e2e.yaml

@@ -61,6 +61,71 @@ services:
       - mc alias set e2e http://minio-e2e:9000 e2e-minio e2e-minio-secret && mc mb --ignore-existing e2e/fhc
     restart: "no"
 
+  # Stand-in for eSignet's token/userinfo endpoints (see fayda-mock/server.js).
+  # The real Fayda authorization step (phone + SMS OTP) can't run in e2e —
+  # Cypress bypasses the popup and drives POST start / POST complete directly,
+  # so this only needs to answer the token exchange + userinfo calls that
+  # `completeVerification` makes server-side.
+  fayda-mock-e2e:
+    image: node:20-alpine
+    volumes:
+      - ./e2e/freight/fayda-mock:/app:ro
+    working_dir: /app
+    command: ["node", "server.js"]
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "fetch('http://localhost:4400/userinfo').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
+        ]
+      interval: 3s
+      timeout: 3s
+      retries: 10
+
+  # Stand-in for https://etrade.gov.et — ETradeService's base URL is
+  # hardcoded (not env-configurable like Fayda's endpoints), so this is
+  # reached by DNS alias instead: the "etrade.gov.et" network alias below
+  # makes freight-api-e2e's real hardcoded requests land here. See
+  # etrade-mock/server.js.
+  etrade-mock-e2e:
+    # Debian-based (not -alpine): ships openssl in the base image, so the
+    # self-signed cert below needs no package install at container start
+    # (alpine's apk would have to fetch it from the network every boot).
+    image: node:20
+    volumes:
+      - ./e2e/freight/etrade-mock:/app:ro
+    working_dir: /app
+    environment:
+      TLS_CERT_PATH: /tmp/etrade-mock/cert.pem
+      TLS_KEY_PATH: /tmp/etrade-mock/key.pem
+    # Throwaway self-signed cert generated fresh into /tmp on every
+    # container start — nothing shaped like a key/cert is committed (the
+    # code mount above is :ro, so this couldn't write there anyway).
+    command:
+      - sh
+      - -c
+      - >
+        mkdir -p /tmp/etrade-mock &&
+        openssl req -x509 -newkey rsa:2048 -keyout "$$TLS_KEY_PATH" -out "$$TLS_CERT_PATH" -days 1 -nodes -subj "/CN=etrade.gov.et" 2>/dev/null &&
+        node server.js
+    networks:
+      default:
+        aliases:
+          - etrade.gov.et
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "node",
+          "-e",
+          "require('https').get({hostname:'localhost',port:443,path:'/api/BusinessMain/GetBusinessByLicenseNo?LicenseNo=x&Tin=x&Lang=en',rejectUnauthorized:false},r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))",
+        ]
+      interval: 3s
+      timeout: 3s
+      retries: 10
+
   freight-api-e2e:
     build:
       context: .
@@ -74,6 +139,10 @@ services:
         condition: service_healthy
       minio-init-e2e:
         condition: service_completed_successfully
+      fayda-mock-e2e:
+        condition: service_healthy
+      etrade-mock-e2e:
+        condition: service_healthy
     environment:
       PORT: "3001"
       DB_HOST: postgres-freight-e2e
@@ -104,7 +173,21 @@ services:
       MINIO_REGION: us-east-1
       # External integrations off
       RABBITMQ_ENABLED: "false"
-      FAYDA_ENABLED: "false"
+      # Fayda ON, pointed at the local mock (fayda-mock-e2e) instead of the
+      # real eSignet infra — see that service's comment above. Cypress drives
+      # verification via the API (start + complete), never the real popup.
+      FAYDA_ENABLED: "true"
+      FAYDA_CLIENT_ID: e2e-fayda-client
+      FAYDA_AUTHORIZATION_ENDPOINT: http://fayda-mock-e2e:4400/authorize
+      FAYDA_TOKEN_ENDPOINT: http://fayda-mock-e2e:4400/token
+      FAYDA_USERINFO_ENDPOINT: http://fayda-mock-e2e:4400/userinfo
+      FAYDA_REDIRECT_URI: http://localhost:${E2E_PORTAL_PORT:-5373}/callback
+      FAYDA_PORTAL_REDIRECT_URI: http://localhost:${E2E_PORTAL_PORT:-5373}/callback
+      # Throwaway e2e-only RSA JWK (client_assertion signing) — the mock
+      # never verifies the signature, this just has to be well-formed.
+      # Generated fresh per launch by e2e.mjs (fakeFaydaPrivateKeyBase64),
+      # not committed here, so nothing shaped like a private key sits in git.
+      FAYDA_PRIVATE_KEY_BASE64: ${FAYDA_PRIVATE_KEY_BASE64}
       # SMS strategy has no kill switch and defaults to a real dev endpoint —
       # blackhole it so e2e never sends SMS (failures are logged, non-fatal).
       OZIKING_SMS_URL: http://127.0.0.1:9/sms