canonical / canonical/authd

e2e browser-login test flakily fails with repeated "Wrong code. Try again." on the Google 2FA page

Open
#1,777 0 comments 0 reactions 0 assignees View on GitHub
e2e-tests jira
Dominant language
Go
Stars
308
Forks
41
Avg merge
2d 4h
Merged PRs (30d)
58

Description

The Google device-code browser-login e2e test intermittently fails during the TOTP (2FA) step. In the webview recording of a failing run:

1. The device code, email, and password are entered normally.
2. On the 2FA page, a 6-digit TOTP code is entered.
3. The page responds with "Wrong code. Try again."
4. The browser login flow restarts from scratch: device code, email, and password are re-entered (taking several seconds), followed by a new TOTP code on the 2FA page.
5. That code is also rejected with "Wrong code. Try again."
6. This repeats several times until the test gives up and fails with "Browser login failed".

Example run: https://authd-e2e-test-logs.adrian-dombeck.workers.dev/pr-1720/run-31576311690-1/noble-authd-google/log.html#s1-s2

## Investigation update

The strongest current evidence indicates that the failure is caused by concurrent `authd-google` CI jobs logging into the same Google test account, rather than by stale or clock-skewed TOTP codes.

In [run 31595036825](https://github.com/canonical/authd/actions/runs/31595036825), the `devel` job rejected fresh TOTP codes while the identical code and TOTP time step were accepted by the concurrent `resolute` job. The workflow runs `noble`, `resolute`, and `devel` concurrently and inherits the same Google credentials and TOTP secret for each matrix job. This points to account-level interference between concurrent Google login challenges.

Potential fixes are to use a distinct Google account/TOTP secret per matrix job or serialize the Google e2e jobs.

Evidence:

- [devel job log](https://github.com/canonical/authd/actions/runs/31595036825/job/94108581813)
- [resolute job log](https://github.com/canonical/authd/actions/runs/31595036825/job/94108682447)
- [detailed devel e2e log](https://authd-e2e-test-logs.adrian-dombeck.workers.dev/pr-1778/run-31595036825-1/devel-authd-google/log.html)
- [detailed resolute e2e log](https://authd-e2e-test-logs.adrian-dombeck.workers.dev/pr-1778/run-31595036825-1/resolute-authd-google/log.html)
- [workflow matrix and inherited secrets](https://github.com/canonical/authd/blob/79cc5aa324cf8c3d05a40b93b1573f89b7a421b1/.github/workflows/e2e-tests.yaml#L105-L130)

Contributor guide

Open the contributing guide

Research direction

Start with the workflow matrix and inherited secrets in .github/workflows/e2e-tests.yaml at lines 105-130, then compare the linked devel and resolute job logs and detailed e2e recordings. The work is done when concurrent Google e2e jobs no longer interfere with one another and the browser-login test passes reliably.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, go
Domain
authentication, ci-cd, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.