tests: add test infra to speed up tests

Author: bordumb

crates/auths-cli/src/commands/id/identity.rs

@@ -402,6 +402,7 @@ pub fn handle_id(
                 passphrase_provider.as_ref(),
                 &get_platform_keychain()?,
                 None,
+                auths_crypto::CurveType::default(),
             ) {
                 Ok((controller_did_keri, alias)) => {
                     println!("\n✅ Identity created.");

crates/auths-cli/src/commands/id/migrate.rs

@@ -436,6 +436,7 @@ fn perform_gpg_migration(
         &passphrase_provider,
         keychain.as_ref(),
         None,
+        auths_crypto::CurveType::default(),
     ) {
         Ok((controller_did, alias)) => {
             out.print_success(&format!("Created Auths identity: {}", controller_did));
@@ -832,6 +833,7 @@ fn perform_ssh_migration(
         &passphrase_provider,
         keychain.as_ref(),
         None,
+        auths_crypto::CurveType::default(),
     ) {
         Ok((controller_did, alias)) => {
             out.print_success(&format!("Created Auths identity: {}", controller_did));

crates/auths-cli/src/commands/org.rs

@@ -319,6 +319,7 @@ pub fn handle_org(
                 passphrase_provider.as_ref(),
                 &get_platform_keychain()?,
                 None,
+                auths_crypto::CurveType::default(),
             )
             .context("Failed to initialize org identity")?;
 

crates/auths-id/src/agent_identity.rs

@@ -261,8 +261,14 @@ fn get_or_create_identity(
         return Ok(did);
     }
 
-    let (did, _) =
-        initialize_registry_identity(backend, key_alias, passphrase_provider, keychain, None)?;
+    let (did, _) = initialize_registry_identity(
+        backend,
+        key_alias,
+        passphrase_provider,
+        keychain,
+        None,
+        auths_crypto::CurveType::default(),
+    )?;
 
     Ok(did)
 }

crates/auths-id/src/identity/initialize.rs

@@ -5,6 +5,7 @@
 
 use std::sync::Arc;
 
+use crate::keri::inception::create_keri_identity_with_curve;
 use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
 use git2::Repository;
 use std::path::Path;
@@ -14,7 +15,7 @@ use crate::error::InitError;
 use crate::identity::helpers::{encode_seed_as_pkcs8, extract_seed_bytes};
 use crate::keri::{
     CesrKey, Event, IcpEvent, KeriSequence, Prefix, Said, Threshold, VersionString,
-    create_keri_identity, finalize_icp_event, serialize_for_signing,
+    finalize_icp_event, serialize_for_signing,
 };
 use crate::storage::identity::IdentityStorage;
 use crate::storage::registry::RegistryBackend;
@@ -41,6 +42,7 @@ use auths_core::{
 /// ```ignore
 /// let (did, alias) = initialize_keri_identity(&path, "my-key", None, &provider, &storage, &keychain)?;
 /// ```
+#[allow(clippy::too_many_arguments)]
 pub fn initialize_keri_identity(
     repo_path: &Path,
     local_key_alias: &KeyAlias,
@@ -49,10 +51,11 @@ pub fn initialize_keri_identity(
     identity_storage: &dyn IdentityStorage,
     keychain: &(dyn KeyStorage + Send + Sync),
     now: chrono::DateTime<chrono::Utc>,
+    curve: auths_crypto::CurveType,
 ) -> Result<(IdentityDID, KeyAlias), InitError> {
     let repo = Repository::open(repo_path)?;
-    let result =
-        create_keri_identity(&repo, None, now).map_err(|e| InitError::Keri(e.to_string()))?;
+    let result = create_keri_identity_with_curve(&repo, None, now, curve)
+        .map_err(|e| InitError::Keri(e.to_string()))?;
     #[allow(clippy::disallowed_methods)]
     // INVARIANT: create_keri_identity returns a valid did:keri: DID
     let controller_did = IdentityDID::new_unchecked(result.did());
@@ -127,14 +130,12 @@ pub fn initialize_registry_identity(
     passphrase_provider: &dyn PassphraseProvider,
     keychain: &(dyn KeyStorage + Send + Sync),
     witness_config: Option<&WitnessConfig>,
+    curve: auths_crypto::CurveType,
 ) -> Result<(IdentityDID, KeyAlias), InitError> {
     backend
         .init_if_needed()
         .map_err(|e| InitError::Registry(e.to_string()))?;
 
-    // Generate keypairs using P-256 (default curve)
-    let curve = auths_crypto::CurveType::default();
-
     let current = crate::keri::inception::generate_keypair_for_init(curve)
         .map_err(|e| InitError::Crypto(e.to_string()))?;
     let next = crate::keri::inception::generate_keypair_for_init(curve)

crates/auths-id/tests/cases/lifecycle.rs

@@ -41,6 +41,7 @@ fn init_identity(
         &identity_storage,
         keychain,
         chrono::Utc::now(),
+        auths_crypto::CurveType::Ed25519,
     )
     .expect("Failed to initialize identity");
     (did.to_string(), alias.into_inner())

crates/auths-infra-rekor/src/client.rs

@@ -508,11 +508,15 @@ fn pubkey_to_pem(raw: &[u8]) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::sync::LazyLock;
+
+    /// Shared RekorClient — TLS client construction is expensive (~10s).
+    static TEST_CLIENT: LazyLock<RekorClient> = LazyLock::new(|| RekorClient::public().unwrap());
 
     #[test]
     fn payload_size_limit() {
         let big = vec![0u8; MAX_PAYLOAD_SIZE + 1];
-        let client = RekorClient::public().unwrap();
+        let client = &*TEST_CLIENT;
         let rt = tokio::runtime::Runtime::new().unwrap();
         let result = rt.block_on(client.submit(&big, b"pk", b"sig"));
         match result {
@@ -525,7 +529,7 @@ mod tests {
 
     #[test]
     fn dsse_format() {
-        let client = RekorClient::public().unwrap();
+        let client = &*TEST_CLIENT;
         let entry = client.build_dsse(b"test data", b"public_key", b"signature");
 
         assert_eq!(entry.kind, "dsse");

crates/auths-infra-rekor/tests/cases/rekor_integration.rs

@@ -3,8 +3,13 @@
 //! Tests that require real Rekor are gated on `AUTHS_TEST_REKOR=1`.
 //! Tests using the FakeTransparencyLog run always.
 
+use std::sync::LazyLock;
+
 use auths_core::ports::transparency_log::{LogError, TransparencyLog};
 use auths_infra_rekor::RekorClient;
+
+/// Shared RekorClient across all integration tests in this file.
+static TEST_REKOR: LazyLock<RekorClient> = LazyLock::new(|| RekorClient::public().unwrap());
 use auths_transparency::TrustConfig;
 use auths_transparency::merkle::hash_leaf;
 use ring::signature::KeyPair;
@@ -25,7 +30,7 @@ async fn rekor_happy_path_submit_and_verify() {
         return;
     }
 
-    let client = RekorClient::public().unwrap();
+    let client = &*TEST_REKOR;
 
     // Generate a throwaway Ed25519 key
     let keypair = ring::signature::Ed25519KeyPair::from_seed_unchecked(&[99u8; 32]).unwrap();
@@ -68,7 +73,7 @@ async fn rekor_get_checkpoint() {
         return;
     }
 
-    let client = RekorClient::public().unwrap();
+    let client = &*TEST_REKOR;
     let checkpoint = client.get_checkpoint().await;
     assert!(checkpoint.is_ok(), "should fetch Rekor checkpoint");
     let cp = checkpoint.unwrap();
@@ -88,7 +93,7 @@ async fn unreachable_endpoint_returns_network_error() {
 
 #[tokio::test]
 async fn payload_size_rejection_is_local() {
-    let client = RekorClient::public().unwrap();
+    let client = &*TEST_REKOR;
     let big = vec![0u8; 101 * 1024]; // > 100KB
     let result = client.submit(&big, b"pk", b"sig").await;
     match result {
@@ -226,9 +231,9 @@ async fn pluggability_same_flow_different_backends() {
         let real_pk = keypair.public_key().as_ref();
         let real_sig = keypair.sign(attestation);
 
-        let rekor = RekorClient::public().unwrap();
+        let rekor = &*TEST_REKOR;
         let rekor_result =
-            submit_attestation_to_log(attestation, real_pk, real_sig.as_ref(), &rekor).await;
+            submit_attestation_to_log(attestation, real_pk, real_sig.as_ref(), rekor).await;
 
         match rekor_result {
             Ok(bundle) => {

crates/auths-mcp-server/tests/cases/helpers.rs

@@ -79,9 +79,25 @@ static KEYS: LazyLock<TestKeys> = LazyLock::new(|| {
     }
 });
 
+/// Shared mock JWKS server — started once per process, reused across tests.
+static SHARED_JWKS_URL: tokio::sync::OnceCell<String> = tokio::sync::OnceCell::const_new();
+
 /// Starts a mock JWKS server serving the static test key.
-/// Returns (base_url, join_handle).
+/// First call starts the server; subsequent calls return the cached URL.
 pub(super) async fn start_mock_jwks_server() -> (String, tokio::task::JoinHandle<()>) {
+    let url = SHARED_JWKS_URL
+        .get_or_init(|| async {
+            let (url, handle) = start_mock_jwks_server_inner().await;
+            std::mem::forget(handle); // keep server alive for process lifetime
+            url
+        })
+        .await
+        .clone();
+    let noop_handle = tokio::spawn(async {});
+    (url, noop_handle)
+}
+
+async fn start_mock_jwks_server_inner() -> (String, tokio::task::JoinHandle<()>) {
     let jwks = KEYS.jwks_json.clone();
 
     let app = axum::Router::new().route(

crates/auths-sdk/src/domains/identity/provision.rs

@@ -154,6 +154,7 @@ pub fn enforce_identity_state(
         passphrase_provider,
         keychain,
         witness_config.as_ref(),
+        auths_crypto::CurveType::default(),
     )
     .map_err(|e| ProvisionError::IdentityInit(e.to_string()))?;