Add configurable admin password via environment variable

.gitlab-ci.yml

@@ -15,6 +15,7 @@ variables:
   STAGE_RDS_HOST: orchard-stage.cluster-cvw3jzjkozoc.us-gov-west-1.rds.amazonaws.com
   STAGE_RDS_DBNAME: postgres
   STAGE_SECRET_ARN: "arn:aws-us-gov:secretsmanager:us-gov-west-1:052673043337:secret:rds!cluster-a573672b-1a38-4665-a654-1b7df37b5297-IaeFQL"
+  STAGE_AUTH_SECRET_ARN: "arn:aws-us-gov:secretsmanager:us-gov-west-1:052673043337:secret:orchard-stage-creds-SMqvQx"
   STAGE_S3_BUCKET: orchard-artifacts-stage
   AWS_REGION: us-gov-west-1
   # Shared pip cache directory
@@ -117,6 +118,9 @@ release:
     - pip install --index-url "$PIP_INDEX_URL" pytest pytest-asyncio httpx
   script:
     - cd backend
+    # Debug: Print environment variables for test configuration
+    - echo "ORCHARD_TEST_URL=$ORCHARD_TEST_URL"
+    - echo "ORCHARD_TEST_PASSWORD is set to '${ORCHARD_TEST_PASSWORD:-NOT SET}'"
     # Run full integration test suite, excluding:
     # - large/slow tests
     # - requires_direct_s3 tests (can't access MinIO from outside K8s cluster)
@@ -196,14 +200,13 @@ release:
           sys.exit(0)
       PYTEST_SCRIPT
 
-# Integration tests for stage deployment (full suite)
-# Reset stage template - shared by pre and post test reset jobs
+# Reset stage template - runs from CI runner, uses CI variable for auth
 # Calls the /api/v1/admin/factory-reset endpoint which handles DB and S3 cleanup
 .reset_stage_template: &reset_stage_template
   stage: deploy
   image: deps.global.bsf.tools/docker/python:3.12-slim
   timeout: 5m
-  retry: 1  # Retry once on transient failures
+  retry: 1
   before_script:
     - pip install --index-url "$PIP_INDEX_URL" httpx
   script:
@@ -216,19 +219,22 @@ release:
 
       BASE_URL = os.environ.get("STAGE_URL", "")
       ADMIN_USER = "admin"
-      ADMIN_PASS = "changeme123"  # Default admin password
+      ADMIN_PASS = os.environ.get("STAGE_ADMIN_PASSWORD", "")
       MAX_RETRIES = 3
-      RETRY_DELAY = 5  # seconds
+      RETRY_DELAY = 5
 
       if not BASE_URL:
-          print("ERROR: STAGE_URL environment variable not set")
+          print("ERROR: STAGE_URL not set")
+          sys.exit(1)
+
+      if not ADMIN_PASS:
+          print("ERROR: STAGE_ADMIN_PASSWORD not set")
           sys.exit(1)
 
       print(f"=== Resetting stage environment at {BASE_URL} ===")
 
       def do_reset():
           with httpx.Client(base_url=BASE_URL, timeout=120.0) as client:
-              # Login as admin
               print("Logging in as admin...")
               login_response = client.post(
                   "/api/v1/auth/login",
@@ -238,7 +244,6 @@ release:
                   raise Exception(f"Login failed: {login_response.status_code} - {login_response.text}")
               print("Login successful")
 
-              # Call factory reset endpoint
               print("Calling factory reset endpoint...")
               reset_response = client.post(
                   "/api/v1/admin/factory-reset",
@@ -256,7 +261,6 @@ release:
               else:
                   raise Exception(f"Factory reset failed: {reset_response.status_code} - {reset_response.text}")
 
-      # Retry loop
       for attempt in range(1, MAX_RETRIES + 1):
           try:
               print(f"Attempt {attempt}/{MAX_RETRIES}")
@@ -280,12 +284,14 @@ reset_stage_pre:
   <<: *reset_stage_template
   needs: [deploy_stage]
 
-# Integration tests for stage deployment (full suite)
+# Integration tests for stage deployment
+# Uses CI variable STAGE_ADMIN_PASSWORD (set in GitLab CI/CD settings)
 integration_test_stage:
   <<: *integration_test_template
   needs: [reset_stage_pre]
   variables:
     ORCHARD_TEST_URL: $STAGE_URL
+    ORCHARD_TEST_PASSWORD: $STAGE_ADMIN_PASSWORD
   rules:
     - if: '$CI_COMMIT_BRANCH == "main"'
       when: on_success
@@ -297,11 +303,13 @@ reset_stage:
   allow_failure: true  # Don't fail pipeline if reset has issues
 
 # Integration tests for feature deployment (full suite)
+# Uses DEV_ADMIN_PASSWORD CI variable (same as deploy_feature)
 integration_test_feature:
   <<: *integration_test_template
   needs: [deploy_feature]
   variables:
     ORCHARD_TEST_URL: https://orchard-$CI_COMMIT_REF_SLUG.common.global.bsf.tools
+    ORCHARD_TEST_PASSWORD: $DEV_ADMIN_PASSWORD
   rules:
     - if: '$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != "main"'
       when: on_success
@@ -453,6 +461,7 @@ deploy_feature:
         --namespace $NAMESPACE \
         -f $VALUES_FILE \
         --set image.tag=git.linux-amd64-$CI_COMMIT_SHA \
+        --set orchard.auth.adminPassword=$DEV_ADMIN_PASSWORD \
         --set ingress.hosts[0].host=orchard-$CI_COMMIT_REF_SLUG.common.global.bsf.tools \
         --set ingress.tls[0].hosts[0]=orchard-$CI_COMMIT_REF_SLUG.common.global.bsf.tools \
         --set ingress.tls[0].secretName=orchard-$CI_COMMIT_REF_SLUG-tls \