Salmon
@dataverket/salmonv2026.10.27.1
01README
A throwaway Salmon for end-to-end tests of anything that takes Salmon's tokens: database validators, message brokers, services.
@dataverket/salmon/stack runs the published Salmon image with a Postgres and an OpenLDAP seeded with Salmon's reference directory, as one docker compose project generated in code, and waits until Salmon's discovery document answers. @dataverket/salmon/fixture writes the team, apps, trust and grants a test needs into that Salmon, with ids stable across runs, and revokes a grant to test refusals. @dataverket/salmon/token-exchange mints a Kubernetes ServiceAccount token, exchanges it at Salmon (RFC 8693) for a token for one app, and records the token's subject and roles, never the token.
02Behaviors
@dataverket/salmon/stackv2026.10.26.1stack.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| project? | string | docker compose project name; one stack per name |
| image? | string | Salmon image; pin a sha-<short> tag for reproducible runs |
| issuerUrl? | string | Salmon's issuer URL as its clients will reach it |
| port? | number | Host port Salmon is published on |
| networks? | array | Existing docker networks Salmon also joins, e.g. kind, so it can fetch a cluster's ServiceAccount keys |
| startTimeoutSeconds? | number |
fn ensure()
Start Salmon, Postgres and the seeded LDAP, or leave them running, and wait for discovery
fn stop()
Remove the stack's containers, network and volumes
Resources
stack(infinite)— The stack's project, image and issuer URLs
@dataverket/salmon/fixturev2026.10.26.1fixture.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| project? | string | The stack's docker compose project |
| name? | string | Fixture name; ids are derived from it |
| team | object | |
| apps | array | |
| trust | object | |
| grants | array |
fn seed(timeoutSeconds?: number)
Replace the fixture's team, apps, trust and grants in the stack's database
| Argument | Type | Description |
|---|---|---|
| timeoutSeconds? | number | How long to wait for Salmon to have migrated its schema |
fn revoke(app: string)
Delete the trust's grants at one app
| Argument | Type | Description |
|---|---|---|
| app | string | Key of the app whose grants to delete |
Resources
fixture(infinite)— Ids of the seeded team, apps, trust and grants
@dataverket/salmon/token-exchangev2026.10.26.1token_exchange.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| issuerUrl? | string | Salmon issuer URL; the token endpoint is read from its discovery document |
| kubeContext | string | kubeconfig context of the cluster that mints the subject token |
| namespace? | string | |
| serviceAccount? | string | |
| trustId | string | Salmon trust id, sent as client_id |
| requestAudience? | string | App id sent as the RFC 8693 audience; its roles are recorded |
| audience? | string | Audience of the minted ServiceAccount token (defaults to issuerUrl with a trailing slash) |
| scope? | string | |
| tokenDuration? | string | |
| kubectlBinary? | string |
fn test()
Exchange a ServiceAccount token for a Salmon access token and fail unless one is issued
Resources
result(infinite)— Outcome of the last successful token exchange
03Previous Versions
2026.10.26.2
2026.10.26.1
04Stats
A
100 / 100
Downloads
3
Archive size
30.1 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Docs keep secrets in a vault1/1earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned
06Platforms
07Labels