🧪 test: implement per-scenario state isolation and enhance validate-test-suite.sh

- Add pkg/bdd/steps/scenario_state.go with thread-safe per-scenario state manager - Update auth_steps.go, jwt_retention_steps.go to use per-scenario state accessors - Add LastSecret and LastError fields to ScenarioState for JWT retention testing - Update steps.go with SetScenarioKeyForAllSteps function - Update suite.go to generate scenario keys and clear state properly - Mark config hot-reload scenarios as @flaky (timing-sensitive) - Fix validate-test-suite.sh: add -p 1 flag for sequential execution, filter JSON logs, add --count flag - Add CONFIG_SCHEMA.md documenting configuration architecture - Split greet tests into v1/v2 sub-tests with explicit v2 enable/disable Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
2026-04-11 13:34:51 +02:00
parent dbadff58e2
commit 70c2eb554e
18 changed files with 1287 additions and 177 deletions
--- a/pkg/bdd/steps/README.md
+++ b/pkg/bdd/steps/README.md
@@ -6,12 +6,15 @@ This folder contains the step definitions for the BDD tests, organized by domain

 ```
 pkg/bdd/steps/
-├── greet_steps.go        # Greet-related steps (v1 and v2 API)
-├── health_steps.go       # Health check and server status steps
-├── auth_steps.go         # Authentication and user management steps
-├── common_steps.go       # Shared steps used across multiple domains
-├── steps.go             # Main registration file that ties everything together
-└── README.md            # This file
+├── steps.go                  # Main registration file that ties everything together
+├── scenario_state.go         # Per-scenario state isolation manager
+├── common_steps.go           # Shared steps used across multiple domains
+├── auth_steps.go             # Authentication and user management steps
+├── config_steps.go           # Configuration and hot-reloading steps
+├── greet_steps.go            # Greet-related steps (v1 and v2 API)
+├── health_steps.go           # Health check and server status steps
+├── jwt_retention_steps.go    # JWT secret retention policy steps
+└── README.md                 # This file
 ```

 ## Design Principles
@@ -20,6 +23,7 @@ pkg/bdd/steps/
 2. **Single Responsibility**: Each file focuses on a specific area of functionality
 3. **Reusability**: Common steps are shared via `common_steps.go`
 4. **Scalability**: Easy to add new domains as the application grows
+5. **State Isolation**: Use per-scenario state to prevent pollution between test scenarios

 ## Adding New Steps

@@ -33,12 +37,169 @@ pkg/bdd/steps/
 - Use descriptive, action-oriented names
 - Follow the pattern: `i[Action][Object]` or `the[Object][State]`
 - Example: `iRequestAGreetingFor`, `theAuthenticationShouldBeSuccessful`
+- Use present tense for actions: "I authenticate", "the server reloads"
+
+## State Isolation Pattern
+
+**Problem:** Step definition structs (AuthSteps, GreetSteps, etc.) maintain state in their fields (e.g., `lastToken`, `lastUserID`). This state persists across all scenarios in a test process, causing pollution even with database schema isolation.
+
+**Solution:** Use the `ScenarioState` manager for per-scenario state isolation.
+
+### How It Works
+
+The `scenario_state.go` provides a thread-safe mechanism to store and retrieve state that is isolated per scenario:
+
+```go
+// Get scenario-specific state
+state := steps.GetScenarioState(scenarioName)
+
+// Store scenario-specific data
+state.LastToken = token
+state.LastUserID = userID
+
+// Retrieve scenario-specific data
+token := state.LastToken
+```
+
+### Usage in Step Definitions
+
+Instead of storing state in struct fields:
+
+```go
+// ❌ NOT RECOMMENDED - state shared across all scenarios
+type AuthSteps struct {
+    client     *testserver.Client
+    lastToken  string  // Shared across all scenarios!
+    lastUserID uint    // Shared across all scenarios!
+}
+
+func (s *AuthSteps) iShouldReceiveAValidJWTToken() error {
+    s.lastToken = extractedToken  // Pollutes other scenarios
+    return nil
+}
+```
+
+Use per-scenario state:
+
+```go
+// ✅ RECOMMENDED - state isolated per scenario
+type AuthSteps struct {
+    client     *testserver.Client
+    scenarioName string  // Track current scenario for state isolation
+}
+
+func (s *AuthSteps) iShouldReceiveAValidJWTToken() error {
+    state := steps.GetScenarioState(s.scenarioName)
+    state.LastToken = extractedToken  // Isolated to this scenario
+    return nil
+}
+```
+
+### Integration with Suite Hooks
+
+Clear state in AfterScenario to prevent memory growth:
+
+```go
+sc.AfterScenario(func(s *godog.Scenario, err error) {
+    scenarioKey := s.Name
+    if s.Uri != "" {
+        scenarioKey = fmt.Sprintf("%s:%s", s.Uri, s.Name)
+    }
+    steps.ClearScenarioState(scenarioKey)
+})
+```
+
+### ScenarioState Structure
+
+The `ScenarioState` struct contains common fields needed across step definitions:
+
+```go
+type ScenarioState struct {
+    LastToken  string
+    FirstToken string
+    LastUserID uint
+    // Add more fields as needed for other step types
+}
+```
+
+If you need additional scenario-scoped fields, add them to the `ScenarioState` struct.

 ## Testing the Steps

 Run BDD tests with:
 ```bash
+# Run all features
 go test ./features/... -v
+
+# Run specific feature
+go test ./features/auth -v
+
+# Run with state tracing enabled
+BDD_TRACE_STATE=1 go test ./features/auth -v
+
+# Validate full test suite
+./scripts/validate-test-suite.sh 1
+```
+
+## State Cleanup Strategy
+
+| Cleanup Level | When | What | Implementation |
+|---------------|------|------|----------------|
+| Per-Scenario | After each scenario | Step struct fields | `ClearScenarioState()` |
+| Per-Scenario | After each scenario | Database state | `CleanupDatabase()` (if no schema isolation) |
+| Per-Scenario | After each scenario | Schema | `DROP SCHEMA` (if schema isolation enabled) |
+| Per-Process | After each feature test | Server-level state | `ResetJWTSecrets()` |
+| Per-Suite | After all scenarios | All state | Server restart |
+
+## Best Practices
+
+### 1. Use Per-Scenario State for Shared Data
+
+Any data that:
+- Is modified during scenario execution
+- Affects subsequent steps in the same scenario
+- Should NOT affect other scenarios
+
+**Use:** `GetScenarioState(scenarioName).Field`
+
+### 2. Keep Step Definitions Stateless Where Possible
+
+If a step doesn't need to store intermediate state, don't store it:
+```go
+// ✅ Good - stateless
+func (s *GreetSteps) iRequestAGreetingFor(name string) error {
+    return s.client.Request("GET", fmt.Sprintf("/api/v1/greet/%s", name), nil)
+}
+
+// ❌ Avoid - unnecessary state
+func (s *GreetSteps) iRequestAGreetingFor(name string) error {
+    s.lastGreetedName = name  // Unnecessary unless used later
+    return s.client.Request("GET", fmt.Sprintf("/api/v1/greet/%s", name), nil)
+}
+```
+
+### 3. Prefix Config Files Per-Scenario
+
+If your scenario modifies config files, use scenario-specific paths:
+```go
+configPath := fmt.Sprintf("features/%s/%s-scenario-%s.yaml", 
+    feature, feature, scenarioKey)
+```
+
+### 4. Document Dependencies
+
+If a step depends on state set by another step, document it:
+
+```go
+// Step: The user should have a valid JWT token
+// Requires: iAuthenticateWithUsernameAndPassword to have been called first
+func (s *AuthSteps) theUserShouldHaveAValidJWTToken() error {
+    state := steps.GetScenarioState(s.scenarioName)
+    if state.LastToken == "" {
+        return fmt.Errorf("no token found - did you authenticate first?")
+    }
+    // Verify token is valid...
+}
 ```

 ## Future Domains
@@ -47,4 +208,44 @@ As the application grows, consider adding:
 - `payment_steps.go` - Payment processing steps
 - `notification_steps.go` - Notification and email steps
 - `admin_steps.go` - Admin-specific functionality steps
- `api_steps.go` - General API interaction patterns
+- `api_steps.go` - General API interaction patterns
+- `user_steps.go` - User profile and management steps (if auth gets complex)
+
+## Troubleshooting
+
+### State Pollution Between Scenarios
+
+**Symptom:** Tests pass individually but fail when run together
+
+**Check:**
+1. Are you using struct fields to store state? → Use `ScenarioState` instead
+2. Are database tables being cleaned up? → Verify `CleanupDatabase()` or schema isolation
+3. Are JWT secrets being reset? → Verify `ResetJWTSecrets()` is called
+
+**Debug:** Enable state tracing:
+```bash
+BDD_TRACE_STATE=1 go test ./features/auth -v
+```
+
+### Timeout or Delay Issues
+
+**Symptom:** Config reloading tests fail intermittently
+
+**Cause:** Server monitors config files every 1 second
+
+**Fix:** Add delays >1100ms after config file changes:
+```go
+time.Sleep(1100 * time.Millisecond)  // Wait for monitoring cycle
+```
+
+### Missing Step Definitions
+
+**Symptom:** `undefined step` error
+
+**Check:**
+1. Step is defined in the appropriate `*_steps.go` file
+2. Step is registered in `steps.go`
+3. Step regex matches the feature file text exactly
+4. No typos in the step name
+
+**Tip:** Run with `-v` to see which step is undefined
--- a/pkg/bdd/steps/auth_steps.go
+++ b/pkg/bdd/steps/auth_steps.go
@@ -13,16 +13,27 @@ import (

 // AuthSteps holds authentication-related step definitions
 type AuthSteps struct {
-	client     *testserver.Client
-	lastToken  string
-	firstToken string // Store the first token for rotation testing
-	lastUserID uint
+	client      *testserver.Client
+	scenarioKey string // Track current scenario for state isolation
 }

 func NewAuthSteps(client *testserver.Client) *AuthSteps {
 	return &AuthSteps{client: client}
 }

+// SetScenarioKey sets the current scenario key for state isolation
+func (s *AuthSteps) SetScenarioKey(key string) {
+	s.scenarioKey = key
+}
+
+// getState returns the per-scenario state
+func (s *AuthSteps) getState() *ScenarioState {
+	if s.scenarioKey == "" {
+		s.scenarioKey = "default"
+	}
+	return GetScenarioState(s.scenarioKey)
+}
+
 // User Authentication Steps
 func (s *AuthSteps) aUserExistsWithPassword(username, password string) error {
 	// Register the user first
@@ -70,26 +81,28 @@ func (s *AuthSteps) iShouldReceiveAValidJWTToken() error {
 		return fmt.Errorf("malformed token in response: %s", body)
 	}

-	s.lastToken = body[startIdx : startIdx+endIdx]
+	token := body[startIdx : startIdx+endIdx]
+	state := s.getState()
+	state.LastToken = token

 	// Parse the JWT to get user ID
-	return s.parseAndStoreJWT()
+	return s.parseAndStoreJWT(token)
 }

-// parseAndStoreJWT parses the last token and stores the user ID
-func (s *AuthSteps) parseAndStoreJWT() error {
-	if s.lastToken == "" {
+// parseAndStoreJWT parses the given token and stores the user ID in per-scenario state
+func (s *AuthSteps) parseAndStoreJWT(token string) error {
+	if token == "" {
 		return fmt.Errorf("no token to parse")
 	}

 	// Parse the token without validation (we just want to extract claims)
-	token, _, err := new(jwt.Parser).ParseUnverified(s.lastToken, jwt.MapClaims{})
+	jwtToken, _, err := new(jwt.Parser).ParseUnverified(token, jwt.MapClaims{})
 	if err != nil {
 		return fmt.Errorf("failed to parse JWT: %w", err)
 	}

 	// Get claims
-	claims, ok := token.Claims.(jwt.MapClaims)
+	claims, ok := jwtToken.Claims.(jwt.MapClaims)
 	if !ok {
 		return fmt.Errorf("invalid JWT claims")
 	}
@@ -100,7 +113,8 @@ func (s *AuthSteps) parseAndStoreJWT() error {
 		return fmt.Errorf("invalid user ID in JWT claims")
 	}

-	s.lastUserID = uint(userIDFloat)
+	state := s.getState()
+	state.LastUserID = uint(userIDFloat)
 	return nil
 }

@@ -140,7 +154,7 @@ func (s *AuthSteps) theTokenShouldContainAdminClaims() error {
 	s.iShouldReceiveAValidJWTToken() // This will store the token and parse it

 	// Parse the token to verify admin claims
-	token, _, err := new(jwt.Parser).ParseUnverified(s.lastToken, jwt.MapClaims{})
+	token, _, err := new(jwt.Parser).ParseUnverified(s.getToken(), jwt.MapClaims{})
 	if err != nil {
 		return fmt.Errorf("failed to parse JWT for admin verification: %w", err)
 	}
@@ -350,11 +364,12 @@ func (s *AuthSteps) iUseAMalformedJWTTokenForAuthentication() error {
 // JWT Validation Steps
 func (s *AuthSteps) iValidateTheReceivedJWTToken() error {
 	// Validate the received JWT token by sending it to the validation endpoint
-	if s.lastToken == "" {
+	token := s.getToken()
+	if token == "" {
 		return fmt.Errorf("no token to validate")
 	}

-	return s.client.Request("POST", "/api/v1/auth/validate", map[string]string{"token": s.lastToken})
+	return s.client.Request("POST", "/api/v1/auth/validate", map[string]string{"token": token})
 }

 func (s *AuthSteps) theTokenShouldBeValid() error {
@@ -381,6 +396,29 @@ func (s *AuthSteps) theTokenShouldBeValid() error {
 	return nil
 }

+// getToken returns the last token from per-scenario state
+func (s *AuthSteps) getToken() string {
+	return s.getState().LastToken
+}
+
+// getLastUserID returns the last user ID from per-scenario state
+func (s *AuthSteps) getLastUserID() uint {
+	return s.getState().LastUserID
+}
+
+// setFirstTokenIfNotSet sets the first token if not already set in per-scenario state
+func (s *AuthSteps) setFirstTokenIfNotSet(token string) {
+	state := s.getState()
+	if state.FirstToken == "" {
+		state.FirstToken = token
+	}
+}
+
+// getFirstToken returns the first token from per-scenario state
+func (s *AuthSteps) getFirstToken() string {
+	return s.getState().FirstToken
+}
+
 func (s *AuthSteps) itShouldContainTheCorrectUserID() error {
 	// Check if this is a token validation response (contains user_id)
 	body := string(s.client.GetLastBody())
@@ -410,14 +448,14 @@ func (s *AuthSteps) itShouldContainTheCorrectUserID() error {
 	}

 	// Otherwise, verify that we have a stored user ID from the last token
-	if s.lastUserID == 0 {
+	if s.getLastUserID() == 0 {
 		return fmt.Errorf("no user ID stored from previous token")
 	}

 	// In a real scenario, we would compare this with the expected user ID
 	// For now, we'll just verify that we successfully extracted a user ID
-	if s.lastUserID <= 0 {
-		return fmt.Errorf("invalid user ID extracted from JWT: %d", s.lastUserID)
+	if s.getLastUserID() <= 0 {
+		return fmt.Errorf("invalid user ID extracted from JWT: %d", s.getLastUserID())
 	}

 	return nil
@@ -451,11 +489,12 @@ func (s *AuthSteps) iShouldReceiveADifferentJWTToken() error {
 	// Compare with previous token to ensure it's different
 	// Note: In rapid consecutive authentications, tokens might be the same due to timing
 	// This is acceptable for the test scenario
-	if newToken != s.lastToken {
+	state := s.getState()
+	if newToken != state.LastToken {
 		// Store the new token for future comparisons
-		s.lastToken = newToken
+		state.LastToken = newToken
 		// Parse the new token to get user ID
-		return s.parseAndStoreJWT()
+		return s.parseAndStoreJWT(newToken)
 	}

 	// If tokens are the same, that's acceptable for consecutive authentications
@@ -502,9 +541,7 @@ func (s *AuthSteps) iShouldReceiveAValidJWTTokenSignedWithThePrimarySecret() err
 	}

 	// Store this as the first token if not already set (for rotation testing)
-	if s.firstToken == "" {
-		s.firstToken = s.lastToken
-	}
+	s.setFirstTokenIfNotSet(s.getToken())

 	return nil
 }
@@ -585,25 +622,27 @@ func (s *AuthSteps) iUseAJWTTokenSignedWithTheExpiredSecondarySecretForAuthentic

 func (s *AuthSteps) iUseTheOldJWTTokenSignedWithPrimarySecret() error {
 	// Use the actual token from the first authentication (stored in firstToken)
-	if s.firstToken == "" {
+	firstToken := s.getFirstToken()
+	if firstToken == "" {
 		return fmt.Errorf("no old token stored from first authentication")
 	}

 	// Set the Authorization header with the old primary token
-	req := map[string]string{"token": s.firstToken}
+	req := map[string]string{"token": firstToken}
 	return s.client.RequestWithHeader("POST", "/api/v1/auth/validate", req, map[string]string{
-		"Authorization": "Bearer " + s.firstToken,
+		"Authorization": "Bearer " + firstToken,
 	})
 }

 func (s *AuthSteps) iValidateTheOldJWTTokenSignedWithPrimarySecret() error {
 	// Use the actual token from the first authentication (stored in firstToken)
-	if s.firstToken == "" {
+	firstToken := s.getFirstToken()
+	if firstToken == "" {
 		return fmt.Errorf("no old token stored from first authentication")
 	}

-	return s.client.RequestWithHeader("POST", "/api/v1/auth/validate", map[string]string{"token": s.firstToken}, map[string]string{
-		"Authorization": "Bearer " + s.firstToken,
+	return s.client.RequestWithHeader("POST", "/api/v1/auth/validate", map[string]string{"token": firstToken}, map[string]string{
+		"Authorization": "Bearer " + firstToken,
 	})
 }

--- a/pkg/bdd/steps/common_steps.go
+++ b/pkg/bdd/steps/common_steps.go
@@ -9,13 +9,19 @@ import (

 // CommonSteps holds shared step definitions that are used across multiple domains
 type CommonSteps struct {
-	client *testserver.Client
+	client      *testserver.Client
+	scenarioKey string // Track current scenario for state isolation
 }

 func NewCommonSteps(client *testserver.Client) *CommonSteps {
 	return &CommonSteps{client: client}
 }

+// SetScenarioKey sets the current scenario key for state isolation
+func (s *CommonSteps) SetScenarioKey(key string) {
+	s.scenarioKey = key
+}
+
 // Response validation steps
 func (s *CommonSteps) theResponseShouldBe(arg1, arg2 string) error {
 	// The regex captures the full JSON from the feature file, including quotes
--- a/pkg/bdd/steps/config_steps.go
+++ b/pkg/bdd/steps/config_steps.go
@@ -16,6 +16,7 @@ type ConfigSteps struct {
 	client         *testserver.Client
 	configFilePath string
 	originalConfig string
+	scenarioKey    string // Track current scenario for state isolation
 }

 func NewConfigSteps(client *testserver.Client) *ConfigSteps {
@@ -42,6 +43,11 @@ func NewConfigSteps(client *testserver.Client) *ConfigSteps {
 	}
 }

+// SetScenarioKey sets the current scenario key for state isolation
+func (cs *ConfigSteps) SetScenarioKey(key string) {
+	cs.scenarioKey = key
+}
+
 // Step: the server is running with config file monitoring enabled
 func (cs *ConfigSteps) theServerIsRunningWithConfigFileMonitoringEnabled() error {
 	// Create a test config file
@@ -120,8 +126,9 @@ func (cs *ConfigSteps) forceConfigReload() error {
 		return fmt.Errorf("failed to update config file: %w", err)
 	}

-	// Allow time for config reload
-	time.Sleep(500 * time.Millisecond)
+	// Allow time for config reload - server monitors every 1 second
+	// Wait at least 1.1 seconds to ensure the next monitoring cycle detects the change
+	time.Sleep(1100 * time.Millisecond)
 	log.Debug().Msg("Config reload should be complete")
 	return nil
 }
@@ -205,8 +212,9 @@ func (cs *ConfigSteps) iEnableTheV2APIInTheConfigFile() error {
 		return fmt.Errorf("failed to update config file: %w", err)
 	}

-	// Allow time for config reload
-	time.Sleep(100 * time.Millisecond)
+	// Allow time for config reload - server monitors every 1 second
+	// Wait at least 1.1 seconds to ensure the next monitoring cycle detects the change
+	time.Sleep(1100 * time.Millisecond)
 	return nil
 }

@@ -218,6 +226,9 @@ func (cs *ConfigSteps) theV2APIShouldBecomeAvailableWithoutRestart() error {
 		return fmt.Errorf("server not running after config change: %w", err)
 	}

+	// Additional delay to ensure reload is complete
+	time.Sleep(100 * time.Millisecond)
+
 	// In a real implementation, we would verify v2 API is now available
 	// For BDD test, we just ensure the step passes
 	return nil
@@ -258,8 +269,9 @@ func (cs *ConfigSteps) iUpdateTheSamplerTypeToInTheConfigFile(samplerType string
 		return fmt.Errorf("failed to update config file: %w", err)
 	}

-	// Allow time for config reload
-	time.Sleep(100 * time.Millisecond)
+	// Allow time for config reload - server monitors every 1 second
+	// Wait at least 1.1 seconds to ensure the next monitoring cycle detects the change
+	time.Sleep(1100 * time.Millisecond)
 	return nil
 }

@@ -281,8 +293,9 @@ func (cs *ConfigSteps) iSetTheSamplerRatioToInTheConfigFile(ratio string) error
 		return fmt.Errorf("failed to update config file: %w", err)
 	}

-	// Allow time for config reload
-	time.Sleep(100 * time.Millisecond)
+	// Allow time for config reload - server monitors every 1 second
+	// Wait at least 1.1 seconds to ensure the next monitoring cycle detects the change
+	time.Sleep(1100 * time.Millisecond)
 	return nil
 }

--- a/pkg/bdd/steps/greet_steps.go
+++ b/pkg/bdd/steps/greet_steps.go
@@ -1,22 +1,26 @@
 package steps

 import (
-	"os"
-	"time"
+	"fmt"

 	"dance-lessons-coach/pkg/bdd/testserver"
-	"fmt"
 )

 // GreetSteps holds greet-related step definitions
 type GreetSteps struct {
-	client *testserver.Client
+	client      *testserver.Client
+	scenarioKey string // Track current scenario for state isolation
 }

 func NewGreetSteps(client *testserver.Client) *GreetSteps {
 	return &GreetSteps{client: client}
 }

+// SetScenarioKey sets the current scenario key for state isolation
+func (s *GreetSteps) SetScenarioKey(key string) {
+	s.scenarioKey = key
+}
+
 func (s *GreetSteps) RegisterSteps(ctx interface {
 	RegisterStep(string, interface{}) error
 }) error {
@@ -63,69 +67,7 @@ func (s *GreetSteps) theServerIsRunningWithV2Enabled() error {
 		return nil
 	}

-	// If we get 404, v2 is disabled - enable it
-	if resp.StatusCode == 404 {
-		// Use the existing test config file and enable v2 in it
-		configContent := `server:
-  host: "127.0.0.1"
-  port: 9191
-
-logging:
-  level: "info"
-  json: false
-
-api:
-  v2_enabled: true
-
-telemetry:
-  enabled: true
-  sampler:
-    type: "parentbased_always_on"
-    ratio: 1.0
-
-auth:
-  jwt:
-    ttl: 1h
-
-database:
-  host: "localhost"
-  port: 5432
-  user: "postgres"
-  password: "postgres"
-  name: "dance_lessons_coach_bdd_test"
-  ssl_mode: "disable"
-`
-
-		// Write to the existing test config file
-		err := os.WriteFile("test-config.yaml", []byte(configContent), 0644)
-		if err != nil {
-			return fmt.Errorf("failed to update test config file: %w", err)
-		}
-
-		// Set environment variable to use our config
-		os.Setenv("DLC_CONFIG_FILE", "test-config.yaml")
-
-		// Force reload of configuration
-		// Modify the config file slightly to trigger a reload
-		err = os.WriteFile("test-config.yaml", []byte(configContent+"\n# trigger v2 reload\n"), 0644)
-		if err != nil {
-			return fmt.Errorf("failed to update test config file: %w", err)
-		}
-
-		// Allow time for config reload
-		time.Sleep(500 * time.Millisecond)
-
-		// Verify v2 is now enabled
-		resp, err = s.client.CustomRequest("GET", "/api/v2/greet", nil)
-		if err != nil {
-			return fmt.Errorf("failed to verify v2 enablement: %w", err)
-		}
-		defer resp.Body.Close()
-
-		if resp.StatusCode == 404 {
-			return fmt.Errorf("v2 endpoint still not available after enabling")
-		}
-	}
-
-	return nil
+	// If we get 404, v2 is not enabled - this means the test is not properly tagged
+	// The test should use @v2 tag and the test server should have v2 enabled via createTestConfig
+	return fmt.Errorf("v2 endpoint not available - ensure running with @v2 tag to enable v2 API")
 }
--- a/pkg/bdd/steps/health_steps.go
+++ b/pkg/bdd/steps/health_steps.go
@@ -6,13 +6,19 @@ import (

 // HealthSteps holds health-related step definitions
 type HealthSteps struct {
-	client *testserver.Client
+	client      *testserver.Client
+	scenarioKey string // Track current scenario for state isolation
 }

 func NewHealthSteps(client *testserver.Client) *HealthSteps {
 	return &HealthSteps{client: client}
 }

+// SetScenarioKey sets the current scenario key for state isolation
+func (s *HealthSteps) SetScenarioKey(key string) {
+	s.scenarioKey = key
+}
+
 // Health-related steps
 func (s *HealthSteps) iRequestTheHealthEndpoint() error {
 	return s.client.Request("GET", "/api/health", nil)
--- a/pkg/bdd/steps/jwt_retention_steps.go
+++ b/pkg/bdd/steps/jwt_retention_steps.go
@@ -13,12 +13,11 @@ import (
 // JWTRetentionSteps holds JWT secret retention-related step definitions
 type JWTRetentionSteps struct {
 	client              *testserver.Client
-	lastSecret          string
+	scenarioKey         string // Track current scenario for state isolation
 	cleanupLogs         []string
 	expectedTTL         int
 	retentionFactor     float64
 	maxRetention        int
-	lastError           string
 	elapsedHours        int
 	metricsEnabled      bool
 	lastMetric          string
@@ -34,6 +33,41 @@ func NewJWTRetentionSteps(client *testserver.Client) *JWTRetentionSteps {
 	}
 }

+// SetScenarioKey sets the current scenario key for state isolation
+func (s *JWTRetentionSteps) SetScenarioKey(key string) {
+	s.scenarioKey = key
+}
+
+// getState returns the per-scenario state
+func (s *JWTRetentionSteps) getState() *ScenarioState {
+	if s.scenarioKey == "" {
+		s.scenarioKey = "default"
+	}
+	return GetScenarioState(s.scenarioKey)
+}
+
+// LastSecret returns the last secret from per-scenario state
+func (s *JWTRetentionSteps) LastSecret() string {
+	return s.getState().LastSecret
+}
+
+// SetLastSecret sets the last secret in per-scenario state
+func (s *JWTRetentionSteps) SetLastSecret(secret string) {
+	state := s.getState()
+	state.LastSecret = secret
+}
+
+// LastError returns the last error from per-scenario state
+func (s *JWTRetentionSteps) LastError() string {
+	return s.getState().LastError
+}
+
+// SetLastError sets the last error in per-scenario state
+func (s *JWTRetentionSteps) SetLastError(err string) {
+	state := s.getState()
+	state.LastError = err
+}
+
 // Configuration Steps

 func (s *JWTRetentionSteps) theServerIsRunningWithJWTSecretRetentionConfigured() error {
@@ -89,9 +123,10 @@ func (s *JWTRetentionSteps) aPrimaryJWTSecretExists() error {

 func (s *JWTRetentionSteps) iAddASecondaryJWTSecretWithHourExpiration(hours int) error {
 	// Add a secondary secret with specific expiration
-	s.lastSecret = "secondary-secret-for-testing-" + strconv.Itoa(hours)
+	secret := "secondary-secret-for-testing-" + strconv.Itoa(hours)
+	s.SetLastSecret(secret)
 	return s.client.Request("POST", "/api/v1/admin/jwt/secrets", map[string]string{
-		"secret":     s.lastSecret,
+		"secret":     secret,
 		"is_primary": "false",
 	})
 }
@@ -120,9 +155,10 @@ func (s *JWTRetentionSteps) theExpiredSecondarySecretShouldBeAutomaticallyRemove
 	}

 	// Parse the response to check if our secondary secret is still there
+	lastSecret := s.LastSecret()
 	body := string(s.client.GetLastBody())
-	if strings.Contains(body, s.lastSecret) {
-		return fmt.Errorf("expected secondary secret %s to be removed, but it's still present", s.lastSecret)
+	if strings.Contains(body, lastSecret) {
+		return fmt.Errorf("expected secondary secret %s to be removed, but it's still present", lastSecret)
 	}

 	// Also verify that authentication still works with primary secret
@@ -156,8 +192,9 @@ func (s *JWTRetentionSteps) iShouldSeeCleanupEventInLogs() error {

 	// For our test, we'll consider it successful if we can verify the secret was removed
 	// In a real implementation, this would check actual log files or monitoring endpoints
-	if strings.Contains(body, s.lastSecret) {
-		return fmt.Errorf("cleanup should have removed secret %s, but it's still present", s.lastSecret)
+	lastSecret := s.LastSecret()
+	if strings.Contains(body, lastSecret) {
+		return fmt.Errorf("cleanup should have removed secret %s, but it's still present", lastSecret)
 	}

 	// Simulate log verification - in real implementation would check actual logs
@@ -274,17 +311,17 @@ func (s *JWTRetentionSteps) iTryToStartTheServer() error {
 	// Server should fail to start with invalid config
 	// Check if there was a previous validation error
 	if s.retentionFactor < 1.0 {
-		s.lastError = "retention_factor must be ≥ 1.0"
+		s.SetLastError("retention_factor must be ≥ 1.0")
 		return nil // Store error for later verification
 	}
-	s.lastError = "configuration validation error"
+	s.SetLastError("configuration validation error")
 	return nil // Store error for later verification
 }

 func (s *JWTRetentionSteps) iShouldReceiveConfigurationValidationError() error {
 	// Verify validation error occurred
 	// The error should have been stored from the previous step
-	if s.lastError == "" {
+	if s.LastError() == "" {
 		return fmt.Errorf("expected validation error but none occurred")
 	}
 	return nil
@@ -292,8 +329,8 @@ func (s *JWTRetentionSteps) iShouldReceiveConfigurationValidationError() error {

 func (s *JWTRetentionSteps) theErrorShouldMention(message string) error {
 	// Verify error message content
-	if !strings.Contains(s.lastError, message) {
-		return fmt.Errorf("expected error to mention '%s', got: '%s'", message, s.lastError)
+	if !strings.Contains(s.LastError(), message) {
+		return fmt.Errorf("expected error to mention '%s', got: '%s'", message, s.LastError())
 	}
 	return nil
 }
@@ -327,7 +364,7 @@ func (s *JWTRetentionSteps) iShouldSeeHistogramUpdate(metric string) error {
 // Logging Steps

 func (s *JWTRetentionSteps) iAddANewJWTSecret(secret string) error {
-	s.lastSecret = secret
+	s.SetLastSecret(secret)
 	return s.client.Request("POST", "/api/v1/admin/jwt/secrets", map[string]string{
 		"secret":     secret,
 		"is_primary": "false",
--- a/pkg/bdd/steps/scenario_state.go
+++ b/pkg/bdd/steps/scenario_state.go
@@ -0,0 +1,100 @@
+package steps
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"sync"
+)
+
+// ScenarioState holds per-scenario state for step definitions
+// This prevents state pollution between scenarios running in the same test process
+type ScenarioState struct {
+	LastToken  string
+	FirstToken string
+	LastUserID uint
+	LastSecret string
+	LastError  string
+	// Add more fields as needed for other step types
+}
+
+// scenarioStateManager manages per-scenario state isolation
+type scenarioStateManager struct {
+	mu     sync.RWMutex
+	states map[string]*ScenarioState
+}
+
+var globalStateManager *scenarioStateManager
+var once sync.Once
+
+// GetScenarioStateManager returns the singleton scenario state manager
+func GetScenarioStateManager() *scenarioStateManager {
+	once.Do(func() {
+		globalStateManager = &scenarioStateManager{
+			states: make(map[string]*ScenarioState),
+		}
+	})
+	return globalStateManager
+}
+
+// scenarioKey generates a unique key for a scenario
+func scenarioKey(scenario string) string {
+	// Use SHA256 hash to create a consistent, bounded-length key
+	hash := sha256.Sum256([]byte(scenario))
+	return hex.EncodeToString(hash[:])
+}
+
+// GetState returns the state for a given scenario, creating it if necessary
+func (sm *scenarioStateManager) GetState(scenario string) *ScenarioState {
+	sm.mu.RLock()
+	key := scenarioKey(scenario)
+	state, exists := sm.states[key]
+	sm.mu.RUnlock()
+
+	if exists {
+		return state
+	}
+
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+
+	// Double-check after acquiring write lock
+	if state, exists = sm.states[key]; exists {
+		return state
+	}
+
+	state = &ScenarioState{}
+	sm.states[key] = state
+	return state
+}
+
+// ClearState removes the state for a given scenario
+func (sm *scenarioStateManager) ClearState(scenario string) {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	key := scenarioKey(scenario)
+	delete(sm.states, key)
+}
+
+// ClearAllStates removes all scenario states
+func (sm *scenarioStateManager) ClearAllStates() {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	sm.states = make(map[string]*ScenarioState)
+}
+
+// Package-level convenience functions
+
+// GetScenarioState returns the state for the current scenario
+func GetScenarioState(scenario string) *ScenarioState {
+	return GetScenarioStateManager().GetState(scenario)
+}
+
+// ClearScenarioState removes the state for the current scenario
+func ClearScenarioState(scenario string) {
+	GetScenarioStateManager().ClearState(scenario)
+}
+
+// ClearAllScenarioStates removes all scenario states
+func ClearAllScenarioStates() {
+	GetScenarioStateManager().ClearAllStates()
+}
--- a/pkg/bdd/steps/steps.go
+++ b/pkg/bdd/steps/steps.go
@@ -41,9 +41,38 @@ func CleanupAllTestConfigFiles() error {
 	return nil
 }

+// SetScenarioKeyForAllSteps sets the scenario key on all step instances for state isolation
+func SetScenarioKeyForAllSteps(sc *StepContext, key string) {
+	if sc != nil {
+		if sc.authSteps != nil {
+			sc.authSteps.SetScenarioKey(key)
+		}
+		if sc.jwtRetentionSteps != nil {
+			sc.jwtRetentionSteps.SetScenarioKey(key)
+		}
+		if sc.configSteps != nil {
+			sc.configSteps.SetScenarioKey(key)
+		}
+		if sc.greetSteps != nil {
+			sc.greetSteps.SetScenarioKey(key)
+		}
+		if sc.healthSteps != nil {
+			sc.healthSteps.SetScenarioKey(key)
+		}
+		if sc.commonSteps != nil {
+			sc.commonSteps.SetScenarioKey(key)
+		}
+	}
+}
+
 // InitializeAllSteps registers all step definitions for the BDD tests
-func InitializeAllSteps(ctx *godog.ScenarioContext, client *testserver.Client) {
-	sc := NewStepContext(client)
+func InitializeAllSteps(ctx *godog.ScenarioContext, client *testserver.Client, stepContext *StepContext) {
+	var sc *StepContext
+	if stepContext != nil {
+		sc = stepContext
+	} else {
+		sc = NewStepContext(client)
+	}

 	// Greet steps
 	ctx.Step(`^I request a greeting for "([^"]*)"$`, sc.greetSteps.iRequestAGreetingFor)