MOSIP-45381 - Automated the testcases for KYC exchange and KYC auth endpoints

api-test/src/main/java/io/mosip/testrig/apirig/auth/testscripts/BioAuth.java

@@ -91,6 +91,12 @@ public void test(TestCaseDTO testCaseDTO) throws AuthenticationTestException, Ad
 			testCaseDTO.setEndPoint(replaceIdWithAutogeneratedId(testCaseDTO.getEndPoint(), "$ID:"));
 			PartnerRegistration.appendEkycOrRp.set("rp-");
 		}
+		if (testCaseDTO.getEndPoint().contains("$kycDelegationDisabledPartnerKeyUrl$")) {
+			testCaseDTO.setEndPoint(testCaseDTO.getEndPoint().replace("$kycDelegationDisabledPartnerKeyUrl$",
+					IdAuthenticationUtil.generateAndGetKycDelegationDisabledPartnerKeyUrl()));
+			testCaseDTO.setEndPoint(replaceIdWithAutogeneratedId(testCaseDTO.getEndPoint(), "$ID:"));
+			PartnerRegistration.appendEkycOrRp.set("rp-");
+		}
 		if (testCaseDTO.getEndPoint().contains("$ekycPartnerKeyURL$")) {
 			testCaseDTO.setEndPoint(testCaseDTO.getEndPoint().replace("$ekycPartnerKeyURL$", ekycPartnerKeyURL));
 			PartnerRegistration.appendEkycOrRp.set("ekyc-");

api-test/src/main/java/io/mosip/testrig/apirig/auth/testscripts/KycExchange.java

@@ -89,6 +89,12 @@ public void test(TestCaseDTO testCaseDTO)
 
 			PartnerRegistration.appendEkycOrRp.set("rp-");
 		}
+		if (testCaseDTO.getEndPoint().contains("$kycDelegationDisabledPartnerKeyUrl$")) {
+			testCaseDTO.setEndPoint(testCaseDTO.getEndPoint().replace("$kycDelegationDisabledPartnerKeyUrl$",
+					IdAuthenticationUtil.generateAndGetKycDelegationDisabledPartnerKeyUrl()));
+			testCaseDTO.setEndPoint(replaceIdWithAutogeneratedId(testCaseDTO.getEndPoint(), "$ID:"));
+			PartnerRegistration.appendEkycOrRp.set("rp-");
+		}
 		if (testCaseDTO.getEndPoint().contains("$ekycPartnerKeyURL$")) {
 			testCaseDTO.setEndPoint(testCaseDTO.getEndPoint().replace("$ekycPartnerKeyURL$", ekycPartnerKeyURL));
 			PartnerRegistration.appendEkycOrRp.set("ekyc-");

api-test/src/main/java/io/mosip/testrig/apirig/auth/utils/IdAuthenticationUtil.java

@@ -23,6 +23,7 @@
 import io.mosip.testrig.apirig.utils.JWKKeyUtil;
 import io.mosip.testrig.apirig.utils.KeyCloakUserAndAPIKeyGeneration;
 import io.mosip.testrig.apirig.utils.KeycloakUserManager;
+import io.mosip.testrig.apirig.utils.MispPartnerAndLicenseKeyGeneration;
 import io.mosip.testrig.apirig.utils.PartnerRegistration;
 import io.mosip.testrig.apirig.utils.RestClient;
 import io.mosip.testrig.apirig.utils.SkipTestCaseHandler;
@@ -83,6 +84,14 @@ public static String isTestCaseValidForExecution(TestCaseDTO testCaseDTO) {
 				&& (!isElementPresent(globalRequiredFields, individualBiometrics))) {
 			throw new SkipException(GlobalConstants.FEATURE_NOT_SUPPORTED_MESSAGE);
 		} else if (testCaseName.startsWith("auth_") && testCaseName.contains("_DemoAuthDelegated") || testCaseName.contains("_DemoAuthKycExchange")) {
+			// Intentional skip: app rejects DEMO on delegated flow per client AMR config (confirmed on qa11new for base/Neg/V2/V2Neg alike via IDA-MPA-029), not a code gap.
+			throw new SkipException(GlobalConstants.FEATURE_NOT_SUPPORTED_MESSAGE);
+		} else if (testCaseDTO.getUniqueIdentifier() != null
+				&& (testCaseDTO.getUniqueIdentifier().equals("TC_IDA_KycExchangeNeg_10")
+						|| testCaseDTO.getUniqueIdentifier().equals("TC_IDA_KycExchangeNeg_11")
+						|| testCaseDTO.getUniqueIdentifier().equals("TC_IDA_KycExchangeNeg_12")
+						|| testCaseDTO.getUniqueIdentifier().equals("TC_IDA_KycExchangeNeg_13"))) {
+			// These consume a kycToken minted by DemoAuthDelegated (skipped above), so skip cleanly instead of failing on the downstream dependency-resolution error.
 			throw new SkipException(GlobalConstants.FEATURE_NOT_SUPPORTED_MESSAGE);
 		} else if (testCaseName.startsWith("auth_")
 				&& ((testCaseName.contains("_DeactivateUINs_")) || (testCaseName.contains("PublishDraft_")))
@@ -199,6 +208,158 @@ public static String replaceKeywordValue(String jsonString, String keyword, Stri
 		}
 	}
 
+	// Module-local MISP partner/policy with delegation disabled, for IDA-MPA-030/031 only.
+	public static String kycDelegationDisabledMispLicKey = "";
+	public static String kycDelegationDisabledPartnerKeyUrl = null;
+	private static final String KYC_DELEGATION_DISABLED_PARTNER_ID = "mosip-nodeleg-" + AdminTestUtil.timeStamp;
+	private static final String KYC_DELEGATION_DISABLED_POLICY_GROUP = "mosip misp no deleg policy group "
+			+ AdminTestUtil.timeStamp;
+	private static final String KYC_DELEGATION_DISABLED_POLICY_NAME = "mosip misp no deleg policy "
+			+ AdminTestUtil.timeStamp;
+
+	// Fails fast with the response body when "response" is missing/null or lacks "id"; scope to policy/partner-setup responses only, never authentication responses.
+	private static String extractIdOrFail(Response response, String step) {
+		String body = response.getBody().asString();
+		org.json.JSONObject json = new org.json.JSONObject(body);
+		if (json.isNull(GlobalConstants.RESPONSE)
+				|| !json.getJSONObject(GlobalConstants.RESPONSE).has("id")) {
+			throw new RuntimeException(step + " failed: " + body);
+		}
+		return json.getJSONObject(GlobalConstants.RESPONSE).getString("id");
+	}
+
+	// Cached terminal failure so a retry rethrows the original cause instead of resending fixed names and hitting a duplicate-name error.
+	private static RuntimeException kycDelegationDisabledSetupFailure = null;
+
+	public static synchronized String generateAndGetKycDelegationDisabledPartnerKeyUrl() {
+		if (kycDelegationDisabledPartnerKeyUrl != null) {
+			return kycDelegationDisabledPartnerKeyUrl;
+		}
+		if (kycDelegationDisabledSetupFailure != null) {
+			throw kycDelegationDisabledSetupFailure;
+		}
+		try {
+			return createKycDelegationDisabledPartner();
+		} catch (RuntimeException e) {
+			kycDelegationDisabledSetupFailure = e;
+			throw e;
+		}
+	}
+
+	@SuppressWarnings("unchecked")
+	private static String createKycDelegationDisabledPartner() {
+		String token = kernelAuthLib.getTokenByRole(GlobalConstants.PARTNER);
+
+		// dedicated policy group, isolated from the one the rest of the suite uses
+		String policyGroupUrl = ApplnURI + properties.getProperty("policyGroupUrl");
+		org.json.simple.JSONObject groupRequest = new org.json.simple.JSONObject();
+		groupRequest.put("desc", "desc mosip misp no-delegation policy group");
+		groupRequest.put("name", KYC_DELEGATION_DISABLED_POLICY_GROUP);
+
+		org.json.simple.JSONObject groupBody = new org.json.simple.JSONObject();
+		groupBody.put("id", GlobalConstants.STRING);
+		groupBody.put(GlobalConstants.METADATA, new HashMap<>());
+		groupBody.put(GlobalConstants.REQUEST, groupRequest);
+		groupBody.put(GlobalConstants.REQUESTTIME, generateCurrentUTCTimeStamp());
+		groupBody.put(GlobalConstants.VERSION, GlobalConstants.STRING);
+
+		Response groupResponse = RestClient.postRequestWithCookie(policyGroupUrl, groupBody,
+				MediaType.APPLICATION_JSON, MediaType.APPLICATION_JSON, GlobalConstants.AUTHORIZATION, token);
+		String policyGroupId = extractIdOrFail(groupResponse, "no-delegation policy group creation");
+
+		// same shape as config/mispPolicy.json but with allowKycRequestDelegation false
+		org.json.simple.JSONObject noDelegationPolicies = new org.json.simple.JSONObject();
+		noDelegationPolicies.put("trustBindedAuthVerificationToken", true);
+		noDelegationPolicies.put("allowAuthRequestDelegation", true);
+		noDelegationPolicies.put("allowKycRequestDelegation", false);
+		noDelegationPolicies.put("allowKeyBindingDelegation", true);
+		noDelegationPolicies.put("allowVciRequestDelegation", true);
+
+		org.json.simple.JSONObject policyRequest = new org.json.simple.JSONObject();
+		policyRequest.put("name", KYC_DELEGATION_DISABLED_POLICY_NAME);
+		policyRequest.put("policyGroupName", KYC_DELEGATION_DISABLED_POLICY_GROUP);
+		policyRequest.put("desc", "desc mosip misp no-delegation policy");
+		policyRequest.put("policyType", "MISP");
+		// required field, missing here previously caused policy creation to fail server-side
+		policyRequest.put(GlobalConstants.VERSION, "1.0");
+		policyRequest.put("policies", noDelegationPolicies);
+
+		org.json.simple.JSONObject policyBody = new org.json.simple.JSONObject();
+		policyBody.put("id", GlobalConstants.STRING);
+		policyBody.put(GlobalConstants.METADATA, new HashMap<>());
+		policyBody.put(GlobalConstants.REQUEST, policyRequest);
+		policyBody.put(GlobalConstants.REQUESTTIME, generateCurrentUTCTimeStamp());
+		policyBody.put(GlobalConstants.VERSION, GlobalConstants.STRING);
+
+		String authPolicyUrl = ApplnURI + properties.getProperty("authPolicyUrl");
+		Response policyResponse = RestClient.postRequestWithCookie(authPolicyUrl, policyBody,
+				MediaType.APPLICATION_JSON, MediaType.APPLICATION_JSON, GlobalConstants.AUTHORIZATION, token);
+		String policyId = extractIdOrFail(policyResponse, "no-delegation policy creation");
+
+		// publish - not enforced until published
+		String publishPolicyURL = ApplnURI + properties.getProperty("publishPolicyurl");
+		if (publishPolicyURL.contains("POLICYID")) {
+			publishPolicyURL = publishPolicyURL.replace("POLICYID", policyId).replace("POLICYGROUPID", policyGroupId);
+		}
+		RestClient.postRequestWithCookie(publishPolicyURL, MediaType.APPLICATION_JSON, MediaType.APPLICATION_JSON,
+				GlobalConstants.AUTHORIZATION, token);
+
+		// new MISP partner mapped to that policy group; Auth-Partner-ID/OIDC-Client-Id stay unchanged
+		String partnersUrl = ApplnURI + "/v1/partnermanager/partners";
+		org.json.simple.JSONObject partnerRequest = new org.json.simple.JSONObject();
+		partnerRequest.put("address", "Bangalore");
+		partnerRequest.put("contactNumber", "8553967572");
+		partnerRequest.put("emailId", "mosip_nodeleg" + AdminTestUtil.timeStamp + "@gmail.com");
+		partnerRequest.put("organizationName", KYC_DELEGATION_DISABLED_PARTNER_ID);
+		partnerRequest.put(GlobalConstants.PARTNERID, KYC_DELEGATION_DISABLED_PARTNER_ID);
+		partnerRequest.put(GlobalConstants.PARTNERTYPE, "Misp_Partner");
+		partnerRequest.put("policyGroup", KYC_DELEGATION_DISABLED_POLICY_GROUP);
+
+		org.json.simple.JSONObject partnerBody = new org.json.simple.JSONObject();
+		partnerBody.put("id", GlobalConstants.STRING);
+		partnerBody.put(GlobalConstants.METADATA, new HashMap<>());
+		partnerBody.put(GlobalConstants.REQUEST, partnerRequest);
+		partnerBody.put(GlobalConstants.REQUESTTIME, generateCurrentUTCTimeStamp());
+		partnerBody.put(GlobalConstants.VERSION, GlobalConstants.STRING);
+
+		RestClient.postRequestWithCookie(partnersUrl, partnerBody, MediaType.APPLICATION_JSON,
+				MediaType.APPLICATION_JSON, GlobalConstants.AUTHORIZATION, token);
+
+		// MispPartnerAndLicenseKeyGeneration.getCertificates() hardcodes keyFileNameByPartnerName=false (reuses the first partner's cached certs), so go straight to AuthTestsUtil with true for a cert chain unique to this partner id
+		io.mosip.testrig.apirig.dto.CertificateChainResponseDto certChain;
+		try {
+			certChain = new io.mosip.testrig.apirig.utils.AuthTestsUtil().generatePartnerKeys(
+					io.mosip.testrig.apirig.utils.PartnerTypes.MISP, KYC_DELEGATION_DISABLED_PARTNER_ID, true, null,
+					BaseTestCase.certsForModule, ApplnURI.replace("https://", ""));
+		} catch (Exception e) {
+			throw new RuntimeException("failed to generate no-delegation partner keys", e);
+		}
+		MispPartnerAndLicenseKeyGeneration.uploadCACertificate(certChain.getCaCertificate(), "Auth");
+		MispPartnerAndLicenseKeyGeneration.uploadIntermediateCertificate(certChain.getInterCertificate(), "Auth");
+		org.json.JSONObject signedCertificateValue = MispPartnerAndLicenseKeyGeneration.uploadPartnerCertificate(
+				certChain.getPartnerCertificate(), "Auth", KYC_DELEGATION_DISABLED_PARTNER_ID);
+		// MispPartnerAndLicenseKeyGeneration.uploadSignedCertificate() hardcodes partnerName=null/keyFileNameByPartnerName=false (would update the wrong generic key file), so call AuthTestsUtil directly with the same params used above
+		HashMap<String, String> signedCertRequest = new HashMap<>();
+		signedCertRequest.put("certData", signedCertificateValue.getString("signedCertificateData"));
+		try {
+			new io.mosip.testrig.apirig.utils.AuthTestsUtil().updatePartnerCertificate(
+					io.mosip.testrig.apirig.utils.PartnerTypes.MISP, KYC_DELEGATION_DISABLED_PARTNER_ID, true,
+					signedCertRequest, null, BaseTestCase.certsForModule, ApplnURI.replace("https://", ""));
+		} catch (Exception e) {
+			throw new RuntimeException("failed to update no-delegation partner certificate", e);
+		}
+
+		String mappingKey = KeyCloakUserAndAPIKeyGeneration.submitPartnerAndGetMappingKey(
+				KYC_DELEGATION_DISABLED_PARTNER_ID, KYC_DELEGATION_DISABLED_POLICY_NAME);
+		KeyCloakUserAndAPIKeyGeneration.approvePartnerAPIKey(mappingKey);
+
+		kycDelegationDisabledMispLicKey = MispPartnerAndLicenseKeyGeneration
+				.generateMispLicKey(KYC_DELEGATION_DISABLED_PARTNER_ID);
+
+		kycDelegationDisabledPartnerKeyUrl = kycDelegationDisabledMispLicKey + "/" + PartnerRegistration.partnerId;
+		return kycDelegationDisabledPartnerKeyUrl;
+	}
+
 	/**
 	 * Fails fast with a SkipException when a setup REST call did not succeed,
 	 * instead of letting the caller hit an opaque JSONException while parsing

api-test/src/main/resources/config/testCaseInterDependency.json

@@ -482,9 +482,11 @@
     ],
     "TC_IDA_AuthUnlock_": ["TC_DependentModule_IdRepo_15"],
     "TC_IDA_DemoAuth_04": [
-        "TC_IDA_GenerateVID_13",
         "TC_IDA_GenerateVID_01",
-        "TC_DependentModule_IdRepo_06",
+        "TC_DependentModule_IdRepo_06"
+    ],
+    "TC_IDA_DemoAuth_72": [
+        "TC_IDA_GenerateVID_13",
         "TC_DependentModule_IdRepo_62"
     ],
     "TC_IDA_DemoAuth_01": ["TC_DependentModule_IdRepo_01"],
@@ -531,10 +533,8 @@
         "TC_IDA_GenerateVID_01",
         "TC_DependentModule_IdRepo_06"
     ],
-    "TC_IDA_HotlistAPI_Unblock_09": [
-        "TC_IDA_HotlistAPI_17",
-        "TC_IDA_HotlistAPI_16"
-    ],
+    "TC_IDA_HotlistAPI_Unblock_09": ["TC_IDA_HotlistAPI_16"],
+    "TC_IDA_HotlistAPI_Unblock_10": ["TC_IDA_HotlistAPI_17"],
     "TC_IDA_BioAuth_41": [
         "TC_IDA_GenerateVID_01",
         "TC_DependentModule_IdRepo_06"
@@ -595,6 +595,7 @@
     "TC_IDA_AuthInternalLock_09": ["TC_DependentModule_IdRepo_28"],
     "TC_IDA_AuthInternalLock_08": ["TC_DependentModule_IdRepo_27"],
     "TC_IDA_AuthInternalLock_07": ["TC_DependentModule_IdRepo_26"],
+    "TC_IDA_AuthInternalLock_11": ["TC_DependentModule_IdRepo_Delegated_11"],
     "TC_IDA_AuthInternalLock_06": ["TC_DependentModule_IdRepo_17"],
     "TC_IDA_AuthInternalLock_05": ["TC_DependentModule_IdRepo_16"],
     "TC_IDA_AuthInternalLock_04": ["TC_DependentModule_IdRepo_15"],
@@ -803,10 +804,8 @@
         "TC_IDA_GenerateVID_05"
     ],
     "TC_IDA_AuthLock_02": ["TC_DependentModule_IdRepo_20"],
-    "TC_IDA_AuthLock_01": [
-        "TC_DependentModule_IdRepo_19",
-        "TC_DependentModule_IdRepo_34"
-    ],
+    "TC_IDA_AuthLock_01": ["TC_DependentModule_IdRepo_19"],
+    "TC_IDA_AuthLock_10": ["TC_DependentModule_IdRepo_34"],
     "TC_IDA_DemoAuth_73": ["TC_DependentModule_IdRepo_61"],
     "TC_IDA_DemoAuth_70": ["TC_DependentModule_IdRepo_37"],
     "TC_IDA_AuthLock_09": ["TC_DependentModule_IdRepo_53"],
@@ -930,11 +929,11 @@
         "TC_IDA_GenerateVID_01",
         "TC_DependentModule_IdRepo_06"
     ],
-    "TC_IDA_AuthTransaction_01": [
-        "TC_DependentModule_IdRepo_07",
-        "TC_DependentModule_IdRepo_06",
-        "TC_DependentModule_IdRepo_09"
-    ],
+    "TC_IDA_AuthTransaction_01": ["TC_DependentModule_IdRepo_06"],
+    "TC_IDA_AuthTransaction_27": ["TC_DependentModule_IdRepo_07"],
+    "TC_IDA_AuthTransaction_28": ["TC_DependentModule_IdRepo_09"],
+    "TC_IDA_CreateVID_01": ["TC_DependentModule_IdRepo_06"],
+    "TC_IDA_CreateVID_04": ["TC_DependentModule_IdRepo_24"],
     "TC_IDA_MultiFactorAuth_31": ["TC_DependentModule_IdRepo_06"],
     "TC_IDA_MultiFactorAuth_32": [
         "TC_IDA_GenerateVID_01",

api-test/src/main/resources/ida/AuthInternalLock/AuthInternalLock.yml

@@ -199,7 +199,7 @@ AuthInternalLock:
 
   auth_AuthInternal_Permanent_Lock_DemoAuthDelegate_Valid_Smoke_Pos:
       endPoint: /idrepository/v1/identity/authtypes/status
-      uniqueIdentifier: TC_IDA_AuthInternalLock_07
+      uniqueIdentifier: TC_IDA_AuthInternalLock_11
       description: lock Demo authType Permanently for UIN and demo auth shoud fail with the same UIN
       role: idrepo
       restMethod: post

api-test/src/main/resources/ida/AuthLock/createAuthLock.yml

@@ -34,7 +34,7 @@ AuthLock:
 }'
    auth_AuthLock_Valid_UIN_locked_All:
       endPoint: /resident/v1/req/auth-lock
-      uniqueIdentifier: TC_IDA_AuthLock_01
+      uniqueIdentifier: TC_IDA_AuthLock_10
       description: Validate the behavior of the authentication lock service when a valid UIN that is already locked is processed
       role: resident
       checkErrorsOnlyInResponse: true

api-test/src/main/resources/ida/AuthTransaction/AuthTransaction.yml

@@ -112,25 +112,10 @@ AuthTransaction:
 }'
       output: '{
         "referenceIdType": "UIN"
-}'
-   auth_AuthTransaction_allValid_UIN3:
-      endPoint: /idauthentication/v1/internal/authTransactions/individualId/{individualId}
-      uniqueIdentifier: TC_IDA_AuthTransaction_01
-      description: Validate the successful processing of an authentication transaction for a UIN when all input parameters are valid
-      role: resident
-      checkErrorsOnlyInResponse: true
-      restMethod: get
-      inputTemplate: ida/AuthTransaction/authTransaction
-      outputTemplate: ida/AuthTransaction/authTransactionResult
-      input: '{
-      "individualId":"$ID:AddIdentity_ValidParam_smoke_Pos_UIN$"
-}'
-      output: '{
-        "referenceIdType": "UIN"
 }'
    auth_AuthTransaction_allValid_UIN4:
       endPoint: /idauthentication/v1/internal/authTransactions/individualId/{individualId}
-      uniqueIdentifier: TC_IDA_AuthTransaction_01
+      uniqueIdentifier: TC_IDA_AuthTransaction_27
       description: Validate the successful processing of an authentication transaction for a UIN when all input parameters are valid
       role: resident
       checkErrorsOnlyInResponse: true
@@ -145,7 +130,7 @@ AuthTransaction:
 }'
    auth_AuthTransaction_allValid_UIN5:
       endPoint: /idauthentication/v1/internal/authTransactions/individualId/{individualId}
-      uniqueIdentifier: TC_IDA_AuthTransaction_01
+      uniqueIdentifier: TC_IDA_AuthTransaction_28
       description: Validate the successful processing of an authentication transaction for a UIN when all input parameters are valid
       role: resident
       checkErrorsOnlyInResponse: true