sso(auth0): drive real @auth0/auth0-react SDK against mock IdP (kills __omTestAuth0 shim)

[chirag-madlani]

Stacked on top of #31675

This PR targets the base branch of #31675 (azure-oidc-session-invalidated-on-restart) so its diff is only the incremental changes: fully review-able in isolation, merges back into the parent PR when you're happy.

Summary

Closes Copilot review finding #8 (__omTestAuth0 shim in Auth0Authenticator.tsx) by rewriting the auth0-mock Playwright fixture to drive the real @auth0/auth0-react SDK against the mock IdP the parent PR already extended with Auth0-shape URL aliases (7de47070342). Same fixture slug (auth0-mock), same --grep @auth0-mock filter — no CI matrix rename.

What lands

File	Change
playwright/utils/sso-providers/auth0.ts	NEW — real-SDK fixture. Configures OM with authority = MOCK_AUTH0_DOMAIN, clicks "Sign in with Auth0", waits on the app-shell. All PKCE handled by @auth0/auth0-react.
playwright/utils/sso-providers/auth0-mock.ts	DELETED — shim fixture, superseded.
src/components/Auth/AppAuthenticators/Auth0Authenticator.tsx	Dropped window.__omTestAuth0 runtime read + isPlaywrightBuild() gate. useAuth0() is now the sole source of truth in every build.
playwright/utils/mockOidc.ts	Exports MOCK_AUTH0_CLIENT_ID, MOCK_AUTH0_DOMAIN, MOCK_OIDC_INTERNAL_JWKS_URL.
.github/workflows/playwright-sso-login-nightly.yml	Adds Start Mock OIDC provider step under needs_docker: mock-oidc; auth0-mock leg is the first to use it. Attaches mock container to ometa_network, passes MOCK_OIDC_URL + MOCK_OIDC_INTERNAL_URL env vars to the test run, adds --profile sso-test down to cleanup.

Test evidence

• Jest: Auth0Authenticator suite 8/8 pass with the shim removed.
• ESLint + TypeScript: clean on all changed files.
• The auth0-mock Playwright leg runs in the nightly SSO CI for real validation — this PR is the trigger.

Not in this PR (deserves its own)

• MSAL parallel migration (__omTestMsal shim removal). Requires teaching updateAuthInstance in AuthProvider.tsx to add knownAuthorities + protocolMode: 'OIDC' when the authority is non-Microsoft; the current otherConfigs as unknown as Configuration cast in that path is loose enough that changing it needs a dedicated PR with real Azure AD validation. Filed as follow-up.

Test plan

• Nightly SSO CI leg auth0-mock goes green on the first run against this branch.
• The mock IdP Start Mock OIDC provider step boots cleanly, curl http://localhost:9090/health returns 200.
• docker network connect ometa_network mock_oidc_provider doesn't error.
• All 9 scenarios (1-9) still pass for the auth0-mock fixture under the real SDK.

🤖 Generated with Claude Code

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[github-actions]

Jest test Coverage

UI tests summary

Lines	Statements	Branches	Functions
	72.43% (98898/136536)	56.88% (58194/102301)	58.17% (19476/33478)

[github-actions]

✅ Playwright Results — workflow succeeded

Validated commit f3564c5ad1c84543179a5d5024f2d936c1693670 in Playwright run 34581055148, attempt 1.

✅ 812 passed · ❌ 0 failed · 🟡 1 flaky · ⏭️ 0 skipped · 🧰 0 lifecycle flaky

Performance

Blocking targets: ✅ met · Optimization targets: 🟡 in progress

Shard-job maxima below are not the full workflow wall time; the linked run includes build, fixture, planning, and reporting.

🕒 Full workflow signal wall (to summary) 55m 40s

⏱️ Max setup 4m 46s · max shard execution 19m 48s · max shard-job elapsed before upload 23m 27s · reporting 5s

🌐 239.30 requests/attempt · 2.30 app boots/UI scenario · 28.70% common-shard skew

Optimization targets still in progress:

• Common shard skew was 28.7% (convergence target: at most 15%).
• Browser traffic was 239.3 requests per attempt (convergence target: fewer than 200).
• Application boot ratio was 2.3 per UI scenario (2191 boots / 952 scenarios; convergence target: at most 1).

Shard	Passed	Failed	Flaky	Skipped	Lifecycle failed	Lifecycle flaky
🟡 Shard chromium-01	161	0	1	0	0	0
✅ Shard chromium-02	160	0	0	0	0	0
✅ Shard chromium-03	151	0	0	0	0	0
✅ Shard chromium-04	157	0	0	0	0	0
✅ Shard data-asset-rules-01	65	0	0	0	0	0
✅ Shard domain-isolation-01	16	0	0	0	0	0
✅ Shard global-state-01	34	0	0	0	0	0
✅ Shard import-export-01	17	0	0	0	0	0
✅ Shard ingestion-01	9	0	0	0	0	0
✅ Shard reindex-01	2	0	0	0	0	0
✅ Shard search-01	11	0	0	0	0	0
✅ Shard search-rbac-01	29	0	0	0	0	0

🟡 1 flaky test(s) (passed on retry)

• Pages/Entity.spec.ts › Tag Add, Update and Remove for child entities (shard chromium-01, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace

[gitar-bot]

Code Review ✅ Approved

Removes the __omTestAuth0 shim by rewriting the Playwright fixture to drive the real @auth0/auth0-react SDK against the mock IdP, eliminating runtime conditionals and test-only code paths. Auth0Authenticator now uses useAuth0() as the sole source of truth across all builds. No issues found.

Options

Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[github-actions]

⚠️ UI Checkstyle passed — lint findings in changed files

🔍 ESLint findings in this PR's files — 0 error(s), 1 warning(s)

Errors block the build. Warnings do not yet — they are rules whose backlog is still
being worked down, listed so this PR does not add to it. See docs/ui-code-quality-gate.md.

0 error(s), 1 warning(s) across 1 changed file(s).

Count	Rule
1	openmetadata-imports/no-internal-barrel-imports

All findings

	Location	Rule	Message
🟡	src/components/Auth/AppAuthenticators/Auth0Authenticator.tsx:23:1	openmetadata-imports/no-internal-barrel-imports	Import the internal module directly instead of its index barrel so unrelated siblings do not enter the bundle graph.

---

Fix locally (fast - only checks files changed in this branch):

make ui-checkstyle-changed

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ui'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud