Fixes 33545: serve JWKS from the JDK HttpServer and drop mockwebserver

[harshach]

Describe your changes:

Fixes #33545. Salvaged from the closed PR #33248 (tracking: #33528).

openmetadata-mcp declared com.squareup.okhttp3:mockwebserver:4.12.0 for exactly one test class,
which used it to serve a static JWKS document. The JDK's com.sun.net.httpserver.HttpServer does
that in a few lines, so the dependency is removed — no source in the module references it any more.

This also removes a latent trap. MockWebServer.enqueue is a one-shot queue: each enqueued
response is consumed by a single request. The test enqueued one JWKS response in setUp and a second
inside testValidateAndDecode_NoAudienceValidationWhenNull. Any change causing an extra JWKS fetch —
a retry, a cache miss, a second validator instance — would have drawn from an empty queue and failed
as a JWKS parse error rather than an obviously missing stub. The HttpServer handler serves the
same body to every request, so the test no longer depends on how many times the validator fetches.

Type of change:

• Improvement

High-level design:

The server binds 127.0.0.1:0 (ephemeral port, read back via getAddress().getPort()), registers a
single /jwks context that writes the pre-encoded body, and is stopped in @AfterEach. No behaviour
under test changes — only how the JWKS endpoint is stood up.

Tests:

Use cases covered

• ID token validation against a JWKS endpoint: valid token, wrong issuer, wrong audience, expired,
  unknown key id, and the no-audience-validation path.

Unit tests

No new tests. All 10 existing tests in IdTokenValidatorTest pass unchanged:

Tests run: 10, Failures: 0, Errors: 0 -- IdTokenValidatorTest

Backend integration tests

Not applicable — no API change.

Ingestion integration tests

Not applicable.

Playwright (UI) tests

Not applicable.

Manual testing performed

1. mvn -pl openmetadata-mcp test -Dtest=IdTokenValidatorTest — 10 tests, BUILD SUCCESS.
2. grep -rn 'mockwebserver\|MockWebServer' openmetadata-mcp/ — no matches outside target/.
3. mvn spotless:apply -pl openmetadata-mcp — 136 files clean, 0 changed.
4. Checked the ported test file for comment-reflow damage from the source branch — no comment lines
   are changed by this diff.

UI screen recording / screenshots:

Not applicable.

Checklist:

• I have read the CONTRIBUTING document.
• My PR title is Fixes <issue-number>: <short explanation>
• My PR is linked to a GitHub issue via Fixes #33545.
• I have commented on my code, particularly in hard-to-understand areas.
• For JSON Schema changes: not applicable.
• For UI changes: not applicable.
• I have added tests: existing tests cover this; no behaviour change.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; the test-only server replacement preserves the JWKS fixture behavior while removing its one-response limitation.

Summary

Replaces the one-shot MockWebServer JWKS fixture with a reusable loopback JDK HttpServer and removes the now-unused test dependency.

• Serves the same static JWKS response for every request on an ephemeral loopback port.
• Reuses the generated JWKS URL when constructing the no-audience validator.
• Stops the fixture server after each test.
• Leaves production authentication behavior and public contracts unchanged.

_{Reviews (1) · Last reviewed commit: "Fixes 33545: serve JWKS from the JDK Htt..."}

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• Linked issue openmetadata-mcp depends on mockwebserver for one test the JDK HttpServer can serve #33545 is not added to the Shipping project.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[gitar-bot]

Code Review ✅ Approved

Replaces MockWebServer with JDK's HttpServer to serve JWKS in tests, eliminating an unused dependency and removing a latent trap where the one-shot queue could fail silently on unexpected JWKS fetches. All 10 existing tests pass unchanged.

Review coverage

Rules No rules evaluated

Functional validation Not enabled · Set up

Auto-approval Not enabled · Set up

Options

Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[github-actions]

✅ Playwright Results — workflow succeeded

Validated commit d56bd3966a7bc2ba5e519341820a2b456889ec97 in Playwright run 35293272834, attempt 1.

✅ 4477 passed · ❌ 0 failed · 🟡 4 flaky · ⏭️ 1 skipped · 🧰 0 lifecycle flaky

Performance

Blocking targets: ✅ met · Optimization targets: 🟡 in progress

Shard-job maxima below are not the full workflow wall time; the linked run includes build, fixture, planning, and reporting.

🕒 Full workflow signal wall (to summary) 34m 41s

⏱️ Max setup 5m 18s · max shard execution 21m 5s · max shard-job elapsed before upload 25m 12s · reporting 18s

🌐 219.60 requests/attempt · 2.23 app boots/UI scenario · 39.37% common-shard skew

Optimization targets still in progress:

• Common shard skew was 39.37% (convergence target: at most 15%).
• Browser traffic was 219.6 requests per attempt (convergence target: fewer than 200).
• Application boot ratio was 2.23 per UI scenario (10621 boots / 4762 scenarios; convergence target: at most 1).

Shard	Passed	Failed	Flaky	Skipped	Lifecycle failed	Lifecycle flaky
✅ Shard advanced-search-01	67	0	0	0	0	0
✅ Shard advanced-search-02	63	0	0	0	0	0
✅ Shard chromium-01	163	0	0	0	0	0
✅ Shard chromium-02	155	0	0	0	0	0
✅ Shard chromium-03	166	0	0	0	0	0
🟡 Shard chromium-04	176	0	1	0	0	0
✅ Shard chromium-05	145	0	0	0	0	0
✅ Shard chromium-06	163	0	0	0	0	0
🟡 Shard chromium-07	142	0	1	0	0	0
✅ Shard chromium-08	169	0	0	0	0	0
✅ Shard chromium-09	172	0	0	0	0	0
✅ Shard chromium-10	199	0	0	0	0	0
✅ Shard chromium-11	162	0	0	1	0	0
🟡 Shard chromium-12	166	0	1	0	0	0
✅ Shard chromium-13	170	0	0	0	0	0
✅ Shard chromium-14	145	0	0	0	0	0
✅ Shard chromium-15	140	0	0	0	0	0
✅ Shard chromium-16	165	0	0	0	0	0
✅ Shard chromium-17	182	0	0	0	0	0
✅ Shard chromium-18	168	0	0	0	0	0
✅ Shard chromium-19	159	0	0	0	0	0
✅ Shard chromium-20	153	0	0	0	0	0
🟡 Shard chromium-21	168	0	1	0	0	0
✅ Shard chromium-22	150	0	0	0	0	0
✅ Shard chromium-23	166	0	0	0	0	0
✅ Shard chromium-24	171	0	0	0	0	0
✅ Shard data-asset-rules-01	65	0	0	0	0	0
✅ Shard domain-isolation-01	16	0	0	0	0	0
✅ Shard global-state-01	34	0	0	0	0	0
✅ Shard import-export-01	66	0	0	0	0	0
✅ Shard import-export-02	84	0	0	0	0	0
✅ Shard ingestion-01	49	0	0	0	0	0
✅ Shard ingestion-02	49	0	0	0	0	0
✅ Shard reindex-01	28	0	0	0	0	0
✅ Shard search-01	12	0	0	0	0	0
✅ Shard search-rbac-01	29	0	0	0	0	0

🟡 4 flaky test(s) (passed on retry)

• Pages/ExplorePageRightPanel.spec.ts › Should verify deleted tag not visible in tag selection for databaseSchema (shard chromium-04, 1 retry)
• Features/ContextCenterArticles.spec.ts › multiple articles hold independent drafts simultaneously (shard chromium-07, 1 retry)
• Pages/EntityDataSteward.spec.ts › Tag Add, Update and Remove for child entities (shard chromium-12, 1 retry)
• Pages/ExplorePageRightPanel_KnowledgeCenter.spec.ts › Should remove user owner for knowledgeCenter (shard chromium-21, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace