sharang
d4e8042b94
internal/keycloak/ — Adapter interface with two implementations:
HTTPAdapter cached client-credentials token; CreateOrgAndInvite +
SyncClaims + Health against the real KC Admin API.
Mock in-process map for unit tests + dev convenience when
KEYCLOAK_ADMIN_URL is empty. Used by the eachStore harness.
POST /v1/tenants now accepts admin_email + admin_name. When set, the
adapter creates a KC organization, invites the user as IT_ADMIN, and
triggers VERIFY_EMAIL + UPDATE_PASSWORD. Response wraps the tenant
with TenantCreated{tenant, invite_url}. KC failures DO NOT roll the
tenant back — they emit a keycloak.provision_failed audit event.
Successful invites emit keycloak.invite_sent.
POST /v1/internal/keycloak/claims resolves a tenant's current claim
bundle (tenant_id, slug, products, plan, status). Lookup chain:
body.tenant_id → body.tenant_slug → user_attrs.tenant_id →
user_attrs.tenant_slug.
Config: KEYCLOAK_ADMIN_URL / REALM / CLIENT_ID / CLIENT_SECRET;
empty URL falls back to Mock.
Tests:
internal/keycloak/mock_test.go conflict surfacing, FailNext hook,
SyncClaims persistence.
internal/keycloak/client_test.go HTTPAdapter against an in-process
stub KC: health, full create-org-
and-invite, conflict, token-cache,
401 retry, ErrUnavailable.
internal/server/keycloak_test.go eachStore integration: provisions
via mock; failure path emits
provision_failed audit; claims
endpoint via every lookup variant
+ 404 + 400.
OpenAPI extended with TenantCreated + Claims schemas and the new
claims endpoint. Contract test asserts the new path.
CI: include internal/keycloak/... in the test package list so
HTTPAdapter coverage counts. Total project line coverage: 71.6%.
Refs: M4.3
117 lines
3.4 KiB
Go
117 lines
3.4 KiB
Go
package server_test
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"gitea.meghsakha.com/platform/tenant-registry/internal/store"
|
|
)
|
|
|
|
func TestAppendAndListAudit(t *testing.T) {
|
|
eachStore(t, func(t *testing.T, h *testHarness) {
|
|
// Take a snapshot of the audit count beforehand (the seed acme tenant
|
|
// + any /v1/tenants POST in earlier subtests already emit events).
|
|
resp, body := h.do("GET", "/v1/audit?limit=500", nil)
|
|
if resp.StatusCode != 200 {
|
|
t.Fatalf("baseline list status = %d", resp.StatusCode)
|
|
}
|
|
baseline := decode[struct {
|
|
Items []store.AuditEvent `json:"items"`
|
|
}](t, body)
|
|
before := len(baseline.Items)
|
|
|
|
// Append three events.
|
|
for i := 0; i < 3; i++ {
|
|
resp, body := h.do("POST", "/v1/audit", map[string]any{
|
|
"tenant_id": h.tenant.ID, "action": "test.event",
|
|
"actor_id": "u1", "actor_name": "Test User",
|
|
"metadata": map[string]any{"i": i},
|
|
})
|
|
if resp.StatusCode != http.StatusCreated {
|
|
t.Fatalf("append %d status = %d, body=%s", i, resp.StatusCode, body)
|
|
}
|
|
}
|
|
|
|
// List again, expect baseline + 3
|
|
resp, body = h.do("GET", "/v1/audit?limit=500", nil)
|
|
if resp.StatusCode != 200 {
|
|
t.Fatalf("list status = %d", resp.StatusCode)
|
|
}
|
|
after := decode[struct {
|
|
Items []store.AuditEvent `json:"items"`
|
|
}](t, body)
|
|
if len(after.Items) != before+3 {
|
|
t.Errorf("expected before+3=%d events, got %d", before+3, len(after.Items))
|
|
}
|
|
|
|
// Filter by action: only our test.event rows.
|
|
resp, body = h.do("GET", "/v1/audit?action=test.event", nil)
|
|
if resp.StatusCode != 200 {
|
|
t.Fatalf("filter status = %d", resp.StatusCode)
|
|
}
|
|
filtered := decode[struct {
|
|
Items []store.AuditEvent `json:"items"`
|
|
}](t, body)
|
|
if len(filtered.Items) != 3 {
|
|
t.Errorf("expected 3 filtered events, got %d", len(filtered.Items))
|
|
}
|
|
for _, ev := range filtered.Items {
|
|
if ev.Action != "test.event" {
|
|
t.Errorf("filter leaked %q", ev.Action)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestAppendAudit_actionRequired(t *testing.T) {
|
|
eachStore(t, func(t *testing.T, h *testHarness) {
|
|
resp, _ := h.do("POST", "/v1/audit", map[string]any{
|
|
"tenant_id": h.tenant.ID,
|
|
})
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("status = %d", resp.StatusCode)
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestListAudit_invalidParams(t *testing.T) {
|
|
eachStore(t, func(t *testing.T, h *testHarness) {
|
|
cases := []string{
|
|
"/v1/audit?since=notatime",
|
|
"/v1/audit?until=notatime",
|
|
"/v1/audit?limit=0",
|
|
"/v1/audit?limit=10000",
|
|
"/v1/audit?cursor=abc",
|
|
}
|
|
for _, p := range cases {
|
|
resp, _ := h.do("GET", p, nil)
|
|
if resp.StatusCode != http.StatusBadRequest {
|
|
t.Errorf("%s: status = %d, want 400", p, resp.StatusCode)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestAuditAutoEmittedOnTenantCreate(t *testing.T) {
|
|
eachStore(t, func(t *testing.T, h *testHarness) {
|
|
_, body := h.do("POST", "/v1/tenants", map[string]any{
|
|
"slug": "audit-target", "name": "Audit Target",
|
|
})
|
|
freshWrap := decode[struct {
|
|
Tenant *store.Tenant `json:"tenant"`
|
|
}](t, body)
|
|
fresh := freshWrap.Tenant
|
|
|
|
resp, body := h.do("GET", "/v1/audit?action=tenant.created&tenant_id="+fresh.ID, nil)
|
|
if resp.StatusCode != 200 {
|
|
t.Fatalf("status = %d", resp.StatusCode)
|
|
}
|
|
events := decode[struct {
|
|
Items []store.AuditEvent `json:"items"`
|
|
}](t, body)
|
|
if len(events.Items) != 1 || events.Items[0].TargetID != fresh.ID {
|
|
t.Errorf("expected exactly one tenant.created event for %s, got %d items", fresh.ID, len(events.Items))
|
|
}
|
|
})
|
|
}
|