fix: 2288 correct captcha version, module names, P12 paths, and mock-rp OIDC config

.github/workflows/helmsman_esignet.yml

@@ -71,6 +71,8 @@ jobs:
       name: ${{ github.ref_name }}
     steps:
       - name: Validate required variables
+        env:
+          IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }}
         run: |
           errors=()
           PROFILE="${{ github.event.inputs.profile }}"
@@ -94,6 +96,15 @@ jobs:
           if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then
             MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}"
             MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}"
+            if [ -z "$MOSIPID1_DOMAIN" ]; then
+              echo "❌ mosipid1_domain_name is required for standalone profiles"
+              exit 1
+            fi
+            if [ "$IN_ENABLE_MOSIPID2" = "true" ] &&
+               [ -z "$MOSIPID2_DOMAIN" ]; then
+              echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true"
+              exit 1
+            fi
             echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)"
             echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)"
             MOSIPID1_SPRING_LABEL="${{ vars.ESIGNET_MOSIPID1_SPRING_CONFIG_LABEL }}"
@@ -326,7 +337,7 @@ jobs:
           kubectl cluster-info
 
       - name: Check if mosip-dsf label is completed
-        if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(github.event.inputs.profile, 'esignet-standalone') }}
+        if: ${{ github.event.inputs.skip_mosip_dsf_check != 'true' && vars.ESIGNET_STANDALONE_MODE != 'true' && !startsWith(env.PROFILE, 'esignet-standalone') }}
         run: |
           STATUS=$(kubectl get namespace default -o jsonpath='{.metadata.labels.mosip-dsf}' 2>/dev/null || echo "")
           if [[ "$STATUS" != "completed" ]]; then

.github/workflows/helmsman_testrigs.yml

@@ -73,6 +73,12 @@ jobs:
       name: ${{ github.ref_name }}
     steps:
       - name: Validate required variables
+        env:
+          IN_MOSIPID1_DOMAIN: ${{ github.event.inputs.mosipid1_domain_name }}
+          IN_MOSIPID2_DOMAIN: ${{ github.event.inputs.mosipid2_domain_name }}
+          VAR_MOSIPID1_DOMAIN: ${{ vars.MOSIPID1_DOMAIN_NAME }}
+          VAR_MOSIPID2_DOMAIN: ${{ vars.MOSIPID2_DOMAIN_NAME }}
+          IN_ENABLE_MOSIPID2: ${{ github.event.inputs.enable_mosipid2 }}
         run: |
           errors=()
           PROFILE="${{ github.event.inputs.profile }}"
@@ -100,13 +106,22 @@ jobs:
           # mosipid1_domain_name and mosipid2_domain_name are esignet standalone only.
           # Push events always target the esignet profile (path filter); dispatch uses explicit profile input.
           if [ -z "$PROFILE" ] || [[ "$PROFILE" == esignet-standalone* ]]; then
-            MOSIPID1_DOMAIN="${{ github.event.inputs.mosipid1_domain_name || vars.MOSIPID1_DOMAIN_NAME }}"
-            MOSIPID2_DOMAIN="${{ github.event.inputs.mosipid2_domain_name || vars.MOSIPID2_DOMAIN_NAME }}"
+            MOSIPID1_DOMAIN="${IN_MOSIPID1_DOMAIN:-$VAR_MOSIPID1_DOMAIN}"
+            MOSIPID2_DOMAIN="${IN_MOSIPID2_DOMAIN:-$VAR_MOSIPID2_DOMAIN}"
+            if [ -z "$MOSIPID1_DOMAIN" ]; then
+              echo "❌ mosipid1_domain_name is required for standalone profiles"
+              exit 1
+            fi
+            if [ "$IN_ENABLE_MOSIPID2" = "true" ] &&
+               [ -z "$MOSIPID2_DOMAIN" ]; then
+              echo "❌ mosipid2_domain_name is required when enable_mosipid2 is true"
+              exit 1
+            fi
             echo "✓ mosipid1_domain_name = $MOSIPID1_DOMAIN (esignet standalone)"
             echo "✓ mosipid2_domain_name = $MOSIPID2_DOMAIN (esignet standalone)"
           else
-            MOSIPID1_PROVIDED="${{ github.event.inputs.mosipid1_domain_name }}"
-            MOSIPID2_PROVIDED="${{ github.event.inputs.mosipid2_domain_name }}"
+            MOSIPID1_PROVIDED="$IN_MOSIPID1_DOMAIN"
+            MOSIPID2_PROVIDED="$IN_MOSIPID2_DOMAIN"
             if [ -n "$MOSIPID1_PROVIDED" ] || [ -n "$MOSIPID2_PROVIDED" ]; then
               echo "⚠ mosipid1_domain_name / mosipid2_domain_name are only used for esignet standalone profile — ignoring for profile=$PROFILE"
             fi

Helmsman/dsf/esignet-standalone-2.0.0/testrigs-dsf.yaml

@@ -8,12 +8,12 @@ helmRepos:
   mosip: https://mosip.github.io/mosip-helm
 
 # Apitestrigs deploy into service namespaces (no dedicated testrig namespaces):
-#   esignet-apitestrig            → esignet ns
-#   esignet-mosipid1-apitestrig   → esignet-mosipid1 ns
-#   esignet-mosipid2-apitestrig   → esignet-mosipid2 ns
-#   esignet-sunbird-apitestrig    → esignet-sunbird ns
-#   esignet-signup-apitestrig     → signup ns        (disabled — enable if signup deployed)
-#   signup-uitestrig              → signup-uitestrig  (disabled — enable if signup deployed)
+#   esignet-apitestrig-go            → esignet-go-mock ns
+#   esignet-go-mosipid1-apitestrig   → esignet-go-mosipid1 ns
+#   esignet-go-mosipid2-apitestrig   → esignet-go-mosipid2 ns
+#   esignet-go-sunbird-apitestrig    → esignet-go-sunbird ns
+#   esignet-signup-apitestrig-go     → signup-go ns          (disabled — enable if signup deployed)
+#   signup-uitestrig-go              → signup-uitestrig-go   (disabled — enable if signup deployed)
 namespaces:
   esignet-go-mosipid1:
     protected: false
@@ -212,7 +212,7 @@ apps:
     priority: -2
     hooks:
       preInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/apitestrig-esignet-sunbird-setup.sh"
-      # postInstall: "$WORKDIR/hooks/esignet-standalone/trigger-test-jobs-esignet.sh"
+      # postInstall: "$WORKDIR/hooks/esignet-standalone-2.0.0/trigger-test-jobs-esignet.sh"
 
   # ---------------------------------------------------------------------------
   # Signup API Test Rig — disabled by default

Helmsman/dsf/esignet-standalone/esignet-dsf.yaml

@@ -443,6 +443,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge     
       istio.hosts[0]: "healthservices.${domain_name}"
     wait: true
     timeout: 480
@@ -463,6 +477,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid1.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid1.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid1.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-mosipid1.${domain_name}"
     wait: true
     timeout: 480
@@ -483,6 +511,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-mosipid2.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-mosipid2.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-mosipid2.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-mosipid2.${domain_name}"
     wait: true
     timeout: 480
@@ -503,6 +545,20 @@ apps:
       mock_relying_party_ui.REDIRECT_URI: "https://healthservices-sunbird.${domain_name}/userprofile"
       mock_relying_party_ui.REDIRECT_URI_REGISTRATION: "https://healthservices-sunbird.${domain_name}/registration"
       mock_relying_party_ui.SIGN_IN_BUTTON_PLUGIN_URL: "https://esignet-sunbird.${domain_name}/plugins/sign-in-button-plugin.js"
+      mock_relying_party_ui.mock_relying_party_ui_port: '5000'
+      mock_relying_party_ui.CLIENT_ID: 88Vjt34c5Twz1oJ
+      mock_relying_party_ui.ACRS: mosip:idp:acr:generated-code%20mosip:idp:acr:biometrics%20mosip:idp:acr:linked-wallet
+      mock_relying_party_ui.DISPLAY: page
+      mock_relying_party_ui.PROMPT: consent
+      mock_relying_party_ui.GRANT_TYPE: authorization_code
+      mock_relying_party_ui.CLAIMS_LOCALES: en
+      mock_relying_party_ui.SCOPE_USER_PROFILE: openid profile
+      mock_relying_party_ui.CLAIMS_USER_PROFILE: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.CLAIMS_REGISTRATION: '%7B%22userinfo%22:%7B%22given_name%22:%7B%22essential%22:true%7D,%22phone_number%22:%7B%22essential%22:false%7D,%22email%22:%7B%22essential%22:true%7D,%22picture%22:%7B%22essential%22:false%7D,%22gender%22:%7B%22essential%22:false%7D,%22birthdate%22:%7B%22essential%22:false%7D,%22address%22:%7B%22essential%22:false%7D%7D,%22id_token%22:%7B%7D%7D'
+      mock_relying_party_ui.DEFAULT_LANG: en
+      mock_relying_party_ui.FALLBACK_LANG: '%7B%22label%22%3A%22English%22%2C%22value%22%3A%22en%22%7D'
+      mock_relying_party_ui.AUTHORIZE_ENDPOINT: /v1/esignet/oauth2/authorize
+      mock_relying_party_ui.CODE_CHALLENGE: get_code_challenge      
       istio.hosts[0]: "healthservices-sunbird.${domain_name}"
     wait: true
     timeout: 480

Helmsman/dsf/esignet-standalone/external-dsf.yaml

@@ -512,7 +512,7 @@ apps:
   captcha:
     namespace: captcha
     enabled: true
-    version: 0.1.0-beta.1
+    version: 0.1.1
     chart: mosip/captcha
     set:
       metrics.serviceMonitor.enabled: "false"

Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid1-setup.sh

@@ -1,26 +1,38 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install Setup
+# eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install Setup
 # =============================================================================
-# Prepares the esignet-mosipid1 namespace for the esignet-mosipid1-apitestrig release.
+# Prepares the esignet-mosipid1 namespace for the esignet-go-mosipid1-apitestrig release.
 # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid1
-# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql
-# needs to be copied; stale testrig CMs are deleted so the chart recreates them.
+# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied,
+# and the s3-esignet-mosipid1-apitestrig / apitestrig-esignet-mosipid1-apitestrig
+# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create
+# them itself); stale testrig CMs are deleted so the chart recreates them.
 # =============================================================================
 set -euo pipefail
 
 NS=esignet-go-mosipid1
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
+MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}"
 
 echo "================================================"
-echo "eSignet 1.7.1 - eSignet-MOSIPID1 API Testrig Pre-install"
+echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID1 API Testrig Pre-install"
 echo "================================================"
 
 echo "Deleting stale testrig configmaps in $NS"
 kubectl -n "$NS" delete --ignore-not-found=true configmap s3
 kubectl -n "$NS" delete --ignore-not-found=true configmap db
 kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig
 
+echo "Creating s3-esignet-mosipid1-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic s3-esignet-mosipid1-apitestrig \
+  --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+echo "Creating apitestrig-esignet-mosipid1-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid1-apitestrig \
+  --dry-run=client -o yaml | kubectl apply -f -
+
 echo "Copying postgres-postgresql secret to $NS"
 $COPY_UTIL secret postgres-postgresql postgres "$NS"
 

Helmsman/hooks/esignet-standalone-2.0.0/apitestrig-esignet-mosipid2-setup.sh

@@ -1,26 +1,38 @@
 #!/bin/bash
 # =============================================================================
-# eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install Setup
+# eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install Setup
 # =============================================================================
-# Prepares the esignet-mosipid2 namespace for the esignet-mosipid2-apitestrig release.
+# Prepares the esignet-mosipid2 namespace for the esignet-go-mosipid2-apitestrig release.
 # keycloak-host and keycloak-client-secrets are already present in esignet-mosipid2
-# (copied by esignet-postinstall-keycloak-init.sh). Only postgres-postgresql
-# needs to be copied; stale testrig CMs are deleted so the chart recreates them.
+# (copied by esignet-postinstall-keycloak-init.sh). postgres-postgresql is copied,
+# and the s3-esignet-mosipid2-apitestrig / apitestrig-esignet-mosipid2-apitestrig
+# secrets referenced by extraEnvVarsSecret are created here (chart doesn't create
+# them itself); stale testrig CMs are deleted so the chart recreates them.
 # =============================================================================
 set -euo pipefail
 
 NS=esignet-go-mosipid2
 COPY_UTIL="$WORKDIR/utils/copy-cm-and-secrets/copy_cm_func.sh"
+MINIO_ROOT_PASSWORD_VAL="${MINIO_ROOT_PASSWORD:?ERROR: MINIO_ROOT_PASSWORD must be set}"
 
 echo "================================================"
-echo "eSignet 1.7.1 - eSignet-MOSIPID2 API Testrig Pre-install"
+echo "eSignet Standalone 2.0.0 - eSignet-MOSIPID2 API Testrig Pre-install"
 echo "================================================"
 
 echo "Deleting stale testrig configmaps in $NS"
 kubectl -n "$NS" delete --ignore-not-found=true configmap s3
 kubectl -n "$NS" delete --ignore-not-found=true configmap db
 kubectl -n "$NS" delete --ignore-not-found=true configmap apitestrig
 
+echo "Creating s3-esignet-mosipid2-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic s3-esignet-mosipid2-apitestrig \
+  --from-literal=s3-user-secret="$MINIO_ROOT_PASSWORD_VAL" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+echo "Creating apitestrig-esignet-mosipid2-apitestrig secret in $NS"
+kubectl -n "$NS" create secret generic apitestrig-esignet-mosipid2-apitestrig \
+  --dry-run=client -o yaml | kubectl apply -f -
+
 echo "Copying postgres-postgresql secret to $NS"
 $COPY_UTIL secret postgres-postgresql postgres "$NS"