chore: test fixes

e2e/freight/scripts/e2e.mjs

@@ -16,6 +16,7 @@
  */
 
 import { execFileSync, spawnSync } from "node:child_process";
+import { generateKeyPairSync } from "node:crypto";
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:net";
 import { dirname, join, resolve } from "node:path";
@@ -110,6 +111,24 @@ async function resolvePorts() {
   return ports;
 }
 
+/**
+ * Throwaway RSA JWK for FAYDA_PRIVATE_KEY_BASE64 — signs a client_assertion
+ * JWT that fayda-mock-e2e never verifies (see docker-compose.e2e.yaml), so
+ * a fresh one every launch is fine; nothing needs it to stay stable across
+ * runs the way ports do. Generated here instead of committed as a literal
+ * blob in the compose file so nothing that looks like a private key sits in
+ * git history, even though this one only unlocks a local mock.
+ */
+function fakeFaydaPrivateKeyBase64() {
+  const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+  const jwk = privateKey.export({ format: "jwk" });
+  jwk.kty = "RSA";
+  jwk.use = "sig";
+  jwk.alg = "RS256";
+  jwk.kid = "e2e-fayda-mock";
+  return Buffer.from(JSON.stringify(jwk)).toString("base64");
+}
+
 function envFor(ports) {
   return {
     ...process.env,
@@ -120,6 +139,8 @@ function envFor(ports) {
     CYPRESS_API_URL: `http://localhost:${ports.E2E_API_PORT}`,
     CYPRESS_PORTAL_URL: `http://localhost:${ports.E2E_PORTAL_PORT}`,
     E2E_DB_URL: `postgres://edr_e2e:edr_e2e@localhost:${ports.E2E_DB_PORT}/edr_freight_e2e`,
+    FAYDA_PRIVATE_KEY_BASE64:
+      process.env.FAYDA_PRIVATE_KEY_BASE64 ?? fakeFaydaPrivateKeyBase64(),
   };
 }