Test matrix-livekit-jwt-service with Molecule

.github/renovate.json

@@ -144,6 +144,7 @@
         "roles/custom/matrix-client-fluffychat/defaults/main.yml",
         "roles/custom/matrix-element-admin/defaults/main.yml",
         "roles/custom/matrix-ketesa/defaults/main.yml",
+        "roles/custom/matrix-livekit-jwt-service/defaults/main.yml",
         "roles/custom/matrix-static-files/defaults/main.yml",
         "roles/custom/matrix-synapse/defaults/main.yml",
         "roles/custom/matrix-synapse-auto-compressor/defaults/main.yml"
@@ -164,6 +165,7 @@
         "roles/custom/matrix-bridge-mautrix-slack/defaults/main.yml",
         "roles/custom/matrix-client-fluffychat/defaults/main.yml",
         "roles/custom/matrix-element-admin/defaults/main.yml",
+        "roles/custom/matrix-livekit-jwt-service/defaults/main.yml",
         "roles/custom/matrix-static-files/defaults/main.yml",
         "roles/custom/matrix-synapse-auto-compressor/defaults/main.yml"
       ],

roles/custom/matrix-livekit-jwt-service/molecule/default/converge.yml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Include roles for matrix-livekit-jwt-service Molecule tests
+  hosts: all
+  become: true
+  vars_files:
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
+  gather_facts: true
+  tasks:
+    - name: Include roles for matrix-livekit-jwt-service Molecule tests
+      ansible.builtin.include_role:
+        name: "{{ role_name }}"
+        public: true
+      loop:
+        - com.devture.ansible.role.playbook_help
+        - com.devture.ansible.role.systemd_docker_base
+        - "custom/{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
+      loop_control:
+        loop_var: role_name
+
+# The component role installs the unit; systemd_service_manager starts it in a
+# full deployment. Start it directly at that same role-scoped boundary.
+- name: Ensure matrix-livekit-jwt-service is started
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Ensure systemd daemon is reloaded
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+
+    - name: Ensure matrix-livekit-jwt-service is started
+      ansible.builtin.systemd_service:
+        name: matrix-livekit-jwt-service.service
+        state: started

roles/custom/matrix-livekit-jwt-service/molecule/default/files/openid-fixture.py

@@ -0,0 +1,53 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+"""Small HTTPS Matrix federation OpenID userinfo fixture for Molecule."""
+
+import json
+import ssl
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import parse_qs, urlparse
+
+
+KNOWN_TOKEN = "known-openid-token"
+KNOWN_SUBJECT = "@alice:matrix-openid-fixture:8443"
+REQUESTS = []
+
+
+class OpenIDHandler(BaseHTTPRequestHandler):
+    def send_json(self, status, document):
+        body = json.dumps(document, separators=(",", ":")).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):  # noqa: N802 - BaseHTTPRequestHandler API
+        parsed = urlparse(self.path)
+        if parsed.path == "/_molecule/requests":
+            self.send_json(200, {"requests": REQUESTS})
+            return
+
+        if parsed.path != "/_matrix/federation/v1/openid/userinfo":
+            self.send_json(404, {"errcode": "M_NOT_FOUND"})
+            return
+
+        token = parse_qs(parsed.query).get("access_token", [""])[0]
+        REQUESTS.append({"path": parsed.path, "access_token": token})
+        if token == KNOWN_TOKEN:
+            self.send_json(200, {"sub": KNOWN_SUBJECT})
+            return
+
+        self.send_json(401, {"errcode": "M_UNAUTHORIZED", "error": "unknown token"})
+
+    def log_message(self, message, *args):
+        print("openid-fixture:", message % args, flush=True)
+
+
+server = ThreadingHTTPServer(("0.0.0.0", 8443), OpenIDHandler)
+tls_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+tls_context.load_cert_chain("/fixture/cert.pem", "/fixture/key.pem")
+server.socket = tls_context.wrap_socket(server.socket, server_side=True)
+server.serve_forever()

roles/custom/matrix-livekit-jwt-service/molecule/default/molecule.yml

@@ -0,0 +1,95 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+dependency:
+  name: galaxy
+  options:
+    requirements-file: requirements.yml
+    force: true
+driver:
+  name: docker
+platforms:
+  - name: matrix-livekit-jwt-service-${MOLECULE_DISTRO:-ubuntu2604}-default
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2604}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      callback_result_format: yaml
+  inventory:
+    group_vars:
+      all:
+        matrix_livekit_jwt_service_enabled: true
+
+        # Exercise role-controlled paths and networking with values which differ
+        # from both the role and image defaults.
+        matrix_livekit_jwt_service_base_path: /matrix/molecule-livekit-jwt-service
+        matrix_livekit_jwt_service_container_network: matrix-livekit-jwt-service-molecule
+        matrix_livekit_jwt_service_container_port: 8097
+        matrix_livekit_jwt_service_environment_variable_livekit_jwt_bind: ":8097"
+
+        matrix_livekit_jwt_service_environment_variable_livekit_key: molecule-livekit-api-key
+        matrix_livekit_jwt_service_environment_variable_livekit_secret: molecule-livekit-signing-secret-32-bytes-long
+        matrix_livekit_jwt_service_environment_variable_livekit_url: wss://sfu.livekit.molecule.invalid:7881/rtc
+
+        # The OpenID fixture's origin is deliberately absent. This makes the
+        # successful request a restricted-user flow, so no SFU is contacted.
+        matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_default:
+          - full-access.molecule.local
+        matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom:
+          - second-full-access.molecule.local
+
+        matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom:
+          "matrix-openid-fixture:8443": https://client-api.override.molecule.invalid
+
+        # The scenario-local OpenID endpoint uses a self-signed certificate.
+        matrix_livekit_jwt_service_environment_variables_extension: |
+          LIVEKIT_INSECURE_SKIP_VERIFY_TLS=YES_I_KNOW_WHAT_I_AM_DOING
+          LIVEKIT_LOG_LEVEL=debug
+          MOLECULE_LIVEKIT_MARKER=environment-reached
+
+        # v0.6.0 ships a malformed image healthcheck. The role intentionally
+        # disables it until upstream fixes its LIVEKIT_JWT_BIND interpolation.
+        matrix_livekit_jwt_service_container_healthcheck_enabled: false
+
+        matrix_livekit_jwt_service_hostname: jwt.livekit.molecule.local
+        matrix_livekit_jwt_service_path_prefix: /matrix-rtc/jwt
+        matrix_livekit_jwt_service_container_labels_traefik_enabled: true
+        matrix_livekit_jwt_service_container_labels_traefik_priority: 847
+        matrix_livekit_jwt_service_container_labels_traefik_entrypoints: web
+        matrix_livekit_jwt_service_container_labels_traefik_tls: false
+        matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_custom:
+          X-Molecule-LiveKit: jwt-service
+        matrix_livekit_jwt_service_container_labels_additional_labels: |
+          molecule.livekit-jwt.coverage=enabled
+
+        # Prove the approved generic Docker-argument escape hatch reaches runtime.
+        matrix_livekit_jwt_service_container_extra_arguments:
+          - --hostname=livekit-jwt-molecule-runtime
+          - --label=molecule.livekit-jwt.extra-argument=reached
+  env:
+    # Workaround for https://github.com/ansible/molecule/issues/4391
+    ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/../..:/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:${ANSIBLE_HOME:-~/.ansible}/roles
+scenario:
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - cleanup
+    - destroy
+verifier:
+  name: ansible

roles/custom/matrix-livekit-jwt-service/molecule/default/prepare.yml

@@ -0,0 +1,121 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Prepare matrix-livekit-jwt-service Molecule tests
+  hosts: all
+  become: true
+  vars_files:
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
+  gather_facts: true
+  tasks:
+    - name: Ensure apt cache is updated
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 600
+      when: ansible_facts['os_family'] == 'Debian'
+
+    - name: Ensure required packages are installed
+      ansible.builtin.package:
+        name:
+          - python3-requests
+          - fuse-overlayfs
+          - openssl
+        state: present
+
+    - name: Ensure Docker is installed
+      ansible.builtin.include_role:
+        name: ansible-role-docker
+      vars:
+        docker_daemon_options:
+          storage-driver: fuse-overlayfs
+
+    - name: Ensure the matrix group exists
+      ansible.builtin.group:
+        name: "{{ matrix_group_name }}"
+        gid: "{{ matrix_user_gid }}"
+        state: present
+
+    - name: Ensure the matrix user exists
+      ansible.builtin.user:
+        name: "{{ matrix_user_name }}"
+        uid: "{{ matrix_user_uid }}"
+        group: "{{ matrix_group_name }}"
+        create_home: false
+        system: true
+        state: present
+
+    - name: Ensure the base data path exists
+      ansible.builtin.file:
+        path: "{{ matrix_base_data_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        mode: "0750"
+
+    - name: Ensure the OpenID fixture directory exists
+      ansible.builtin.file:
+        path: /matrix/molecule-livekit-openid-fixture
+        state: directory
+        mode: "0755"
+
+    - name: Install the OpenID fixture server
+      ansible.builtin.copy:
+        src: openid-fixture.py
+        dest: /matrix/molecule-livekit-openid-fixture/openid-fixture.py
+        mode: "0644"
+
+    - name: Generate a self-signed certificate for the OpenID fixture
+      ansible.builtin.command:
+        argv:
+          - openssl
+          - req
+          - -x509
+          - -newkey
+          - rsa:2048
+          - -nodes
+          - -keyout
+          - /matrix/molecule-livekit-openid-fixture/key.pem
+          - -out
+          - /matrix/molecule-livekit-openid-fixture/cert.pem
+          - -days
+          - "2"
+          - -subj
+          - /CN=matrix-openid-fixture
+        creates: /matrix/molecule-livekit-openid-fixture/key.pem
+
+    - name: Ensure the scenario container network exists
+      ansible.builtin.command:
+        argv:
+          - docker
+          - network
+          - create
+          - "{{ matrix_livekit_jwt_service_container_network }}"
+      register: matrix_livekit_jwt_service_molecule_network
+      changed_when: matrix_livekit_jwt_service_molecule_network.rc == 0
+      failed_when:
+        - matrix_livekit_jwt_service_molecule_network.rc != 0
+        - "'already exists' not in matrix_livekit_jwt_service_molecule_network.stderr"
+
+    - name: Ensure the HTTPS OpenID fixture is running
+      community.docker.docker_container:
+        name: matrix-livekit-jwt-openid-fixture
+        image: "{{ molecule_shared_image_python }}"
+        pull: always
+        command:
+          - python3
+          - /fixture/openid-fixture.py
+        mounts:
+          - source: /matrix/molecule-livekit-openid-fixture
+            target: /fixture
+            type: bind
+            read_only: true
+        networks:
+          - name: "{{ matrix_livekit_jwt_service_container_network }}"
+            aliases:
+              - matrix-openid-fixture
+        comparisons:
+          networks: strict
+        state: started

roles/custom/matrix-livekit-jwt-service/molecule/default/requirements.yml

@@ -0,0 +1 @@
+../../../../../molecule-shared/requirements.yml

roles/custom/matrix-livekit-jwt-service/molecule/default/verify.yml

@@ -0,0 +1,509 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Verify matrix-livekit-jwt-service
+  hosts: all
+  become: true
+  vars_files:
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/vars.yml"
+    - "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/../../../molecule-shared/playbook-context.yml"
+  vars:
+    matrix_livekit_jwt_service_runtime: "{{ (matrix_livekit_jwt_service_container_inspect.stdout | from_json) | first }}"
+    matrix_livekit_jwt_service_valid_request:
+      room_id: "!call-room:molecule.local"
+      slot_id: molecule-slot
+      openid_token:
+        access_token: known-openid-token
+        token_type: Bearer
+        matrix_server_name: "matrix-openid-fixture:8443"
+        expires_in: 3600
+      member:
+        id: member-molecule-01
+        claimed_user_id: "@alice:matrix-openid-fixture:8443"
+        claimed_device_id: DEVICE_MOLECULE
+  gather_facts: false
+
+  tasks:
+    - name: Load the role's defaults under a separate name
+      ansible.builtin.include_vars:
+        file: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/main.yml"
+        name: matrix_livekit_jwt_service_role_defaults
+
+    - name: Wait for the LiveKit JWT service to become active
+      ansible.builtin.systemd_service:
+        name: matrix-livekit-jwt-service.service
+      register: matrix_livekit_jwt_service_service
+      until: matrix_livekit_jwt_service_service.status.ActiveState == 'active'
+      retries: 30
+      delay: 5
+      failed_when: false
+
+    # Restart=always keeps a crash-looping service nominally active.
+    - name: Assert the service is active and has not restarted
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_service.status.ActiveState == 'active'
+          - matrix_livekit_jwt_service_service.status.NRestarts is defined
+          - matrix_livekit_jwt_service_service.status.NRestarts | int == 0
+        fail_msg: >-
+          matrix-livekit-jwt-service.service is
+          {{ matrix_livekit_jwt_service_service.status.ActiveState | default('unknown') }} after
+          {{ matrix_livekit_jwt_service_service.status.NRestarts | default('?') }} restart(s)
+        success_msg: "matrix-livekit-jwt-service.service is active and has not restarted"
+
+    - name: Wait for the live health endpoint on the configured non-default port
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_livekit_jwt_service_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --output
+          - /dev/null
+          - --write-out
+          - "HTTP_STATUS=%{http_code}"
+          - http://matrix-livekit-jwt-service:8097/healthz
+      register: matrix_livekit_jwt_service_health
+      changed_when: false
+      until: matrix_livekit_jwt_service_health.stdout == 'HTTP_STATUS=200'
+      retries: 24
+      delay: 5
+      failed_when: false
+
+    - name: Assert the live service is healthy on the configured port
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_health.rc == 0
+          - matrix_livekit_jwt_service_health.stdout == 'HTTP_STATUS=200'
+        fail_msg: "The LiveKit JWT service did not answer /healthz on port 8097"
+        success_msg: "The LiveKit JWT service is healthy on its non-default port"
+
+    - name: Exercise the get_token CORS preflight
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_livekit_jwt_service_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --include
+          - --request
+          - OPTIONS
+          - --write-out
+          - "\nHTTP_STATUS=%{http_code}"
+          - http://matrix-livekit-jwt-service:8097/get_token
+      register: matrix_livekit_jwt_service_cors
+      changed_when: false
+      failed_when: false
+
+    - name: Assert get_token exposes its CORS contract
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_cors.rc == 0
+          - "'HTTP_STATUS=200' in matrix_livekit_jwt_service_cors.stdout_lines"
+          - "'access-control-allow-origin: *' in matrix_livekit_jwt_service_cors.stdout | lower"
+          - "'access-control-allow-methods: post' in matrix_livekit_jwt_service_cors.stdout | lower"
+          - "'access-control-allow-headers: accept, content-type, content-length, accept-encoding, x-csrf-token' in matrix_livekit_jwt_service_cors.stdout | lower"
+        fail_msg: "OPTIONS /get_token did not return the service's expected CORS headers"
+        success_msg: "OPTIONS /get_token exposes the expected CORS contract"
+
+    - name: Submit malformed JSON to get_token
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_livekit_jwt_service_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --header
+          - "Content-Type: application/json"
+          - --data-binary
+          - "{not-json"
+          - --write-out
+          - "\nHTTP_STATUS=%{http_code}"
+          - http://matrix-livekit-jwt-service:8097/get_token
+      register: matrix_livekit_jwt_service_malformed
+      changed_when: false
+      failed_when: false
+
+    - name: Assert malformed JSON is rejected structurally
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_malformed.rc == 0
+          - matrix_livekit_jwt_service_malformed.stdout_lines[-1] == 'HTTP_STATUS=400'
+          - matrix_livekit_jwt_service_malformed_document.errcode == 'M_NOT_JSON'
+          - matrix_livekit_jwt_service_malformed_document.error == 'Error reading request'
+        fail_msg: "Malformed JSON did not produce the expected Matrix error response"
+        success_msg: "Malformed JSON is rejected with M_NOT_JSON"
+      vars:
+        matrix_livekit_jwt_service_malformed_document: >-
+          {{ matrix_livekit_jwt_service_malformed.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}
+
+    - name: Ask get_token to validate an unknown OpenID token
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_livekit_jwt_service_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --header
+          - "Content-Type: application/json"
+          - --data-binary
+          - "{{ matrix_livekit_jwt_service_unknown_token_request | to_json }}"
+          - --write-out
+          - "\nHTTP_STATUS=%{http_code}"
+          - http://matrix-livekit-jwt-service:8097/get_token
+      register: matrix_livekit_jwt_service_unknown_token
+      changed_when: false
+      failed_when: false
+      vars:
+        matrix_livekit_jwt_service_unknown_token_request: >-
+          {{ matrix_livekit_jwt_service_valid_request | combine({'openid_token': matrix_livekit_jwt_service_valid_request.openid_token | combine({'access_token': 'unknown-openid-token'})}, recursive=True) }}
+
+    - name: Assert an unknown OpenID token is unauthorized
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_unknown_token.rc == 0
+          - matrix_livekit_jwt_service_unknown_token.stdout_lines[-1] == 'HTTP_STATUS=401'
+          - matrix_livekit_jwt_service_unknown_token_document.errcode == 'M_UNAUTHORIZED'
+          - matrix_livekit_jwt_service_unknown_token_document.error == 'The request could not be authorised.'
+        fail_msg: "An unknown OpenID token was not rejected as unauthorized"
+        success_msg: "The live service rejects an unknown OpenID token"
+      vars:
+        matrix_livekit_jwt_service_unknown_token_document: >-
+          {{ matrix_livekit_jwt_service_unknown_token.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}
+
+    - name: Ask get_token to validate a mismatched claimed user
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_livekit_jwt_service_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --header
+          - "Content-Type: application/json"
+          - --data-binary
+          - "{{ matrix_livekit_jwt_service_mismatched_user_request | to_json }}"
+          - --write-out
+          - "\nHTTP_STATUS=%{http_code}"
+          - http://matrix-livekit-jwt-service:8097/get_token
+      register: matrix_livekit_jwt_service_mismatched_user
+      changed_when: false
+      failed_when: false
+      vars:
+        matrix_livekit_jwt_service_mismatched_user_request: >-
+          {{ matrix_livekit_jwt_service_valid_request | combine({'member': matrix_livekit_jwt_service_valid_request.member | combine({'claimed_user_id': '@mallory:matrix-openid-fixture:8443'})}, recursive=True) }}
+
+    - name: Assert a valid token cannot impersonate another Matrix user
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_mismatched_user.rc == 0
+          - matrix_livekit_jwt_service_mismatched_user.stdout_lines[-1] == 'HTTP_STATUS=401'
+          - matrix_livekit_jwt_service_mismatched_user_document.errcode == 'M_UNAUTHORIZED'
+        fail_msg: "The OpenID subject and claimed Matrix user mismatch was not rejected"
+        success_msg: "The live service rejects a claimed-user mismatch"
+      vars:
+        matrix_livekit_jwt_service_mismatched_user_document: >-
+          {{ matrix_livekit_jwt_service_mismatched_user.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}
+
+    # The request's server is not in FULL_ACCESS, so this validates OpenID and
+    # signs a join token without trying to create a room on the absent SFU.
+    - name: Request a real restricted-user LiveKit JWT
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_livekit_jwt_service_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --header
+          - "Content-Type: application/json"
+          - --data-binary
+          - "{{ matrix_livekit_jwt_service_valid_request | to_json }}"
+          - --write-out
+          - "\nHTTP_STATUS=%{http_code}"
+          - http://matrix-livekit-jwt-service:8097/get_token
+      register: matrix_livekit_jwt_service_token_response
+      changed_when: false
+      failed_when: false
+
+    - name: Parse the successful token response
+      ansible.builtin.set_fact:
+        matrix_livekit_jwt_service_token_document: >-
+          {{ matrix_livekit_jwt_service_token_response.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}
+
+    - name: Assert the live service returns a JWT for the configured SFU URL
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_token_response.rc == 0
+          - matrix_livekit_jwt_service_token_response.stdout_lines[-1] == 'HTTP_STATUS=200'
+          - matrix_livekit_jwt_service_token_document.keys() | sort == ['jwt', 'url']
+          - matrix_livekit_jwt_service_token_document.url == matrix_livekit_jwt_service_environment_variable_livekit_url
+          - matrix_livekit_jwt_service_token_document.jwt.split('.') | length == 3
+        fail_msg: "The restricted-user exchange did not return a JWT and configured SFU URL"
+        success_msg: "The restricted-user exchange returns a real JWT for the configured SFU"
+
+    - name: Decode and authenticate the returned LiveKit JWT
+      ansible.builtin.command:
+        argv:
+          - python3
+          - -c
+          - >-
+            import base64, hashlib, hmac, json, sys;
+            parts = sys.argv[1].split('.');
+            decode = lambda value: json.loads(base64.urlsafe_b64decode(value + '=' * (-len(value) % 4)));
+            signature = base64.urlsafe_b64decode(parts[2] + '=' * (-len(parts[2]) % 4));
+            expected = hmac.new(sys.argv[2].encode(), (parts[0] + '.' + parts[1]).encode(), hashlib.sha256).digest();
+            print(json.dumps({'header': decode(parts[0]), 'claims': decode(parts[1]), 'signature_valid': hmac.compare_digest(signature, expected)}))
+          - "{{ matrix_livekit_jwt_service_token_document.jwt }}"
+          - "{{ matrix_livekit_jwt_service_environment_variable_livekit_secret }}"
+      register: matrix_livekit_jwt_service_jwt_decode
+      changed_when: false
+      no_log: true
+
+    - name: Assert the JWT signature, identity, room and restricted grant
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_jwt.signature_valid is sameas true
+          - matrix_livekit_jwt_service_jwt.header.alg == 'HS256'
+          - matrix_livekit_jwt_service_jwt.claims.iss == matrix_livekit_jwt_service_environment_variable_livekit_key
+          - matrix_livekit_jwt_service_jwt.claims.sub == 'BE7ZK/J/c3LsogjI1JLni7qtWV/DP6c+ev68BvHem0Y'
+          - matrix_livekit_jwt_service_jwt.claims.video.room == 'diNaPECp1jHt2l0dLdiDxi+dgNzgucxPYMD0lCs1tEQ'
+          - matrix_livekit_jwt_service_jwt.claims.video.roomJoin is sameas true
+          - "'roomCreate' not in matrix_livekit_jwt_service_jwt.claims.video"
+          - matrix_livekit_jwt_service_jwt.claims.video.canPublish is sameas true
+          - matrix_livekit_jwt_service_jwt.claims.video.canSubscribe is sameas true
+          - matrix_livekit_jwt_service_jwt.claims.video.canUpdateOwnMetadata is sameas true
+          - matrix_livekit_jwt_service_jwt.claims.exp | int - matrix_livekit_jwt_service_jwt.claims.nbf | int == 3600
+        fail_msg: "The returned JWT lost its authenticated MSC4195 identity, room or restricted join grant"
+        success_msg: "The returned JWT has a valid signature and restricted MSC4195 grant"
+      vars:
+        matrix_livekit_jwt_service_jwt: "{{ matrix_livekit_jwt_service_jwt_decode.stdout | from_json }}"
+
+    - name: Read the OpenID fixture's observed requests
+      ansible.builtin.command:
+        argv:
+          - docker
+          - run
+          - --rm
+          - --network={{ matrix_livekit_jwt_service_container_network }}
+          - "{{ molecule_shared_image_curl }}"
+          - --silent
+          - --show-error
+          - --insecure
+          - https://matrix-livekit-jwt-openid-fixture:8443/_molecule/requests
+      register: matrix_livekit_jwt_service_openid_requests_command
+      changed_when: false
+
+    - name: Assert the live service exercised both OpenID fixture outcomes
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_openid_requests.requests | length >= 3
+          - matrix_livekit_jwt_service_openid_requests.requests | map(attribute='path') | unique | list == ['/_matrix/federation/v1/openid/userinfo']
+          - matrix_livekit_jwt_service_openid_requests.requests[-3:] | map(attribute='access_token') | list == ['unknown-openid-token', 'known-openid-token', 'known-openid-token']
+        fail_msg: "The OpenID fixture did not observe the expected unknown and known token exchanges"
+        success_msg: "The service exercised both HTTPS OpenID fixture outcomes"
+      vars:
+        matrix_livekit_jwt_service_openid_requests: "{{ matrix_livekit_jwt_service_openid_requests_command.stdout | from_json }}"
+
+    - name: Read the environment file the role rendered
+      ansible.builtin.slurp:
+        src: "{{ matrix_livekit_jwt_service_base_path }}/env"
+      register: matrix_livekit_jwt_service_env_file
+
+    - name: Initialize the parsed environment
+      ansible.builtin.set_fact:
+        matrix_livekit_jwt_service_env_parsed: {}
+
+    - name: Parse the rendered environment
+      ansible.builtin.set_fact:
+        matrix_livekit_jwt_service_env_parsed: >-
+          {{ matrix_livekit_jwt_service_env_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}
+      loop: "{{ (matrix_livekit_jwt_service_env_file.content | b64decode).splitlines() | reject('equalto', '') }}"
+      when: "'=' in item"
+      no_log: true
+
+    - name: Assert the rendered environment carries every scenario setting
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_JWT_BIND == ':8097'
+          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_KEY == 'molecule-livekit-api-key'
+          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_SECRET == 'molecule-livekit-signing-secret-32-bytes-long'
+          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_URL == 'wss://sfu.livekit.molecule.invalid:7881/rtc'
+          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_FULL_ACCESS_HOMESERVERS == 'full-access.molecule.local,second-full-access.molecule.local'
+          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_CS_API_URL_OVERRIDES == 'matrix-openid-fixture:8443=https://client-api.override.molecule.invalid'
+          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_INSECURE_SKIP_VERIFY_TLS == 'YES_I_KNOW_WHAT_I_AM_DOING'
+          - matrix_livekit_jwt_service_env_parsed.LIVEKIT_LOG_LEVEL == 'debug'
+          - matrix_livekit_jwt_service_env_parsed.MOLECULE_LIVEKIT_MARKER == 'environment-reached'
+        fail_msg: "The parsed environment file does not carry the scenario's complete contract"
+        success_msg: "The parsed environment file carries every scenario setting"
+      no_log: true
+
+    - name: Read the labels file the role rendered
+      ansible.builtin.slurp:
+        src: "{{ matrix_livekit_jwt_service_base_path }}/labels"
+      register: matrix_livekit_jwt_service_labels_file
+
+    - name: Initialize the parsed labels
+      ansible.builtin.set_fact:
+        matrix_livekit_jwt_service_labels_parsed: {}
+
+    - name: Parse the rendered labels
+      ansible.builtin.set_fact:
+        matrix_livekit_jwt_service_labels_parsed: >-
+          {{ matrix_livekit_jwt_service_labels_parsed | combine({item.split('=', 1)[0]: item.split('=', 1)[1]}) }}
+      loop: "{{ (matrix_livekit_jwt_service_labels_file.content | b64decode).splitlines() | reject('equalto', '') }}"
+      when: "'=' in item"
+      no_log: true
+
+    - name: Assert the rendered labels carry the public routing contract
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_labels_parsed['traefik.enable'] == 'true'
+          - matrix_livekit_jwt_service_labels_parsed['traefik.docker.network'] == matrix_livekit_jwt_service_container_network
+          - matrix_livekit_jwt_service_labels_parsed['traefik.http.services.matrix-livekit-jwt-service.loadbalancer.server.port'] == '8097'
+          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.rule'] == 'Host(`jwt.livekit.molecule.local`) && PathPrefix(`/matrix-rtc/jwt`)'
+          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.priority'] == '847'
+          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.entrypoints'] == 'web'
+          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.tls'] == 'false'
+          - matrix_livekit_jwt_service_labels_parsed['traefik.http.routers.matrix-livekit-jwt-service.middlewares'] == 'matrix-livekit-jwt-service-slashless-redirect,matrix-livekit-jwt-service-strip-prefix,matrix-livekit-jwt-service-add-headers'
+          - matrix_livekit_jwt_service_labels_parsed['traefik.http.middlewares.matrix-livekit-jwt-service-add-headers.headers.customresponseheaders.X-Molecule-LiveKit'] == 'jwt-service'
+          - matrix_livekit_jwt_service_labels_parsed['molecule.livekit-jwt.coverage'] == 'enabled'
+        fail_msg: "The parsed labels do not carry the scenario's routing contract"
+        success_msg: "The parsed labels carry the scenario's complete routing contract"
+
+    - name: Inspect the running LiveKit JWT service container
+      ansible.builtin.command:
+        argv:
+          - docker
+          - container
+          - inspect
+          - matrix-livekit-jwt-service
+      register: matrix_livekit_jwt_service_container_inspect
+      changed_when: false
+
+    - name: Assert the configured environment reached the running container
+      ansible.builtin.assert:
+        that:
+          - "'LIVEKIT_JWT_BIND=:8097' in matrix_livekit_jwt_service_runtime.Config.Env"
+          - "'LIVEKIT_FULL_ACCESS_HOMESERVERS=full-access.molecule.local,second-full-access.molecule.local' in matrix_livekit_jwt_service_runtime.Config.Env"
+          - "'LIVEKIT_CS_API_URL_OVERRIDES=matrix-openid-fixture:8443=https://client-api.override.molecule.invalid' in matrix_livekit_jwt_service_runtime.Config.Env"
+          - "'LIVEKIT_INSECURE_SKIP_VERIFY_TLS=YES_I_KNOW_WHAT_I_AM_DOING' in matrix_livekit_jwt_service_runtime.Config.Env"
+          - "'MOLECULE_LIVEKIT_MARKER=environment-reached' in matrix_livekit_jwt_service_runtime.Config.Env"
+        fail_msg: "The running container environment lost role-rendered settings"
+        success_msg: "The role-rendered environment reached the running container"
+
+    - name: Assert the configured labels reached the running container
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.enable'] == 'true'
+          - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.docker.network'] == matrix_livekit_jwt_service_container_network
+          - matrix_livekit_jwt_service_runtime.Config.Labels['traefik.http.routers.matrix-livekit-jwt-service.priority'] == '847'
+          - matrix_livekit_jwt_service_runtime.Config.Labels['molecule.livekit-jwt.coverage'] == 'enabled'
+          - matrix_livekit_jwt_service_runtime.Config.Labels['molecule.livekit-jwt.extra-argument'] == 'reached'
+        fail_msg: "The running container lost role-rendered or extra-argument labels"
+        success_msg: "The configured labels reached the running container"
+
+    - name: Assert the running container uses the exact image and version the role pins
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_runtime.Config.Image == matrix_livekit_jwt_service_expected_image
+        fail_msg: >-
+          The running container uses {{ matrix_livekit_jwt_service_runtime.Config.Image }},
+          expected {{ matrix_livekit_jwt_service_expected_image }}
+        success_msg: "The running container uses the exact image and version defaults/main.yml pins"
+      vars:
+        matrix_livekit_jwt_service_expected_image: >-
+          {{ matrix_livekit_jwt_service_role_defaults.matrix_livekit_jwt_service_container_image_registry_prefix_upstream_default }}element-hq/lk-jwt-service:{{ matrix_livekit_jwt_service_role_defaults.matrix_livekit_jwt_service_version }}
+
+    - name: Assert the running container identity and image command
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_runtime.Config.User == (matrix_user_uid | string) ~ ':' ~ (matrix_user_gid | string)
+          - matrix_livekit_jwt_service_runtime.Config.Entrypoint | default([], true) | length == 0
+          - matrix_livekit_jwt_service_runtime.Config.Cmd == ['/lk-jwt-service']
+          - matrix_livekit_jwt_service_runtime.HostConfig.RestartPolicy.Name == 'no'
+          - matrix_livekit_jwt_service_runtime.HostConfig.AutoRemove is sameas true
+          - matrix_livekit_jwt_service_runtime.HostConfig.LogConfig.Type == 'none'
+        fail_msg: "The running container has an unexpected identity, command or Docker lifecycle"
+        success_msg: "The running container uses the configured identity, command and Docker lifecycle"
+
+    - name: Assert the running container security and filesystem contract
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_runtime.HostConfig.Privileged is sameas false
+          - matrix_livekit_jwt_service_runtime.HostConfig.CapAdd | default([], true) | length == 0
+          - matrix_livekit_jwt_service_runtime.HostConfig.CapDrop == ['ALL']
+          - matrix_livekit_jwt_service_runtime.HostConfig.ReadonlyRootfs is sameas false
+          - matrix_livekit_jwt_service_runtime.Mounts | length == 0
+          - matrix_livekit_jwt_service_runtime.HostConfig.Binds | default([], true) | length == 0
+        fail_msg: "The running container differs from the role's capability and mount contract"
+        success_msg: "The running container has all capabilities dropped and no mounts"
+
+    - name: Assert the broken upstream healthcheck is disabled
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_runtime.Config.Healthcheck is mapping
+          - matrix_livekit_jwt_service_runtime.Config.Healthcheck.Test == ['NONE']
+          - matrix_livekit_jwt_service_runtime.State.Health.Status is not defined
+        fail_msg: "The v0.6.0 image healthcheck was not disabled by the role"
+        success_msg: "The broken v0.6.0 image healthcheck is disabled"
+
+    - name: Assert the running container is attached only to its dedicated network
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_runtime.HostConfig.NetworkMode == matrix_livekit_jwt_service_container_network
+          - matrix_livekit_jwt_service_runtime.NetworkSettings.Networks is mapping
+          - matrix_livekit_jwt_service_runtime.NetworkSettings.Networks | length == 1
+          - matrix_livekit_jwt_service_container_network in matrix_livekit_jwt_service_runtime.NetworkSettings.Networks
+        fail_msg: >-
+          LiveKit JWT service has unexpected network attachments:
+          {{ matrix_livekit_jwt_service_runtime.NetworkSettings.Networks.keys() | list }}
+        success_msg: "The running container is attached only to its dedicated network"
+
+    - name: Assert the observable extra runtime argument reached Docker
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_runtime.Config.Hostname == 'livekit-jwt-molecule-runtime'
+        fail_msg: "The configured hostname extra argument did not reach Docker"
+        success_msg: "The approved container extra-argument setting reached Docker"
+
+    - name: Ask Docker for the service's published ports
+      ansible.builtin.command:
+        argv:
+          - docker
+          - container
+          - port
+          - matrix-livekit-jwt-service
+      register: matrix_livekit_jwt_service_published_ports
+      changed_when: false
+      failed_when: false
+
+    - name: Assert the role publishes no host ports
+      ansible.builtin.assert:
+        that:
+          - matrix_livekit_jwt_service_runtime.Config.ExposedPorts.keys() | list == ['8080/tcp']
+          - matrix_livekit_jwt_service_runtime.HostConfig.PortBindings | default({}, true) | length == 0
+          - matrix_livekit_jwt_service_published_ports.rc == 0
+          - matrix_livekit_jwt_service_published_ports.stdout | trim | length == 0
+        fail_msg: >-
+          LiveKit JWT service unexpectedly publishes a host port:
+          {{ matrix_livekit_jwt_service_published_ports.stdout | default('unknown') }}
+        success_msg: "The role leaves the image's declared port unpublished"