fd5f8ae36f
internal/keycloak/ — Adapter interface with two implementations:
HTTPAdapter pgxpool-style real Admin API client with cached client-
credentials token (auto-refresh, 401 retry).
Mock in-process map for unit tests + dev convenience when
KEYCLOAK_ADMIN_URL is empty. Used by the eachStore harness.
Adapter contract (adapter.go):
CreateOrgAndInvite(ctx, InviteInput) (*InviteResult, error)
Creates a KC organization, an IT_ADMIN user, adds the user as a
member, triggers VERIFY_EMAIL + UPDATE_PASSWORD execute-actions
email. Atomic from the caller's PoV; partial failures surface as
typed errors (ErrOrgConflict, ErrUserConflict, ErrUnauthorized,
ErrUnavailable).
SyncClaims(ctx, userID, Claims) error
Pushes tenant_id / tenant_slug / org_roles / products / plan /
tenant_status into the user's KC attributes — the same shape the
realm's protocol mappers project into JWTs.
Health(ctx) error
Pings /admin/serverinfo; wired into readyz.
Wiring:
POST /v1/tenants now accepts admin_email + admin_name. When set, the
adapter creates the org and invites the user. Response wraps the
tenant with the new TenantCreated{tenant, invite_url} shape so dev
testers can use the action-token URL without waiting for the email.
KC failures DO NOT roll the tenant back — they emit a
keycloak.provision_failed audit event so the operator can resend.
Successful invites emit keycloak.invite_sent.
POST /v1/internal/keycloak/claims resolves a tenant's current claim
bundle. Lookup chain: body.tenant_id → body.tenant_slug →
body.user_attrs.tenant_id → body.user_attrs.tenant_slug. The realm's
protocol mapper calls this at token issuance, or operators on demand.
Config: KEYCLOAK_ADMIN_URL / REALM / CLIENT_ID / CLIENT_SECRET; empty
URL falls back to Mock for dev.
OpenAPI: TenantCreated + Claims schemas added; /v1/internal/keycloak/claims
documented. Contract test extended to cover the new endpoint.
Tests:
internal/keycloak/mock_test.go Mock semantics: conflict surfacing,
FailNext hook, SyncClaims persistence.
internal/server/keycloak_test.go KC provisioning end-to-end via
eachStore: invite_url returned,
mock records, invite_sent audit;
failure path emits provision_failed
but tenant still lands; claims
endpoint resolves via tenant_id /
tenant_slug / user_attrs / 404 / 400.
The real-KC integration test (against a testcontainers-spun KC 26)
lands in a follow-up — gating it behind KEYCLOAK_INTEGRATION=1 + a
slower nightly CI is cleaner than baking 30s+ of KC boot into every PR.
Refs: M4.3
187 lines
4.6 KiB
Go
187 lines
4.6 KiB
Go
package server_test
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"database/sql"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang-migrate/migrate/v4"
|
|
migpg "github.com/golang-migrate/migrate/v4/database/postgres"
|
|
"github.com/golang-migrate/migrate/v4/source/iofs"
|
|
_ "github.com/jackc/pgx/v5/stdlib"
|
|
tcpostgres "github.com/testcontainers/testcontainers-go/modules/postgres"
|
|
|
|
"gitea.meghsakha.com/platform/tenant-registry/internal/config"
|
|
"gitea.meghsakha.com/platform/tenant-registry/internal/keycloak"
|
|
"gitea.meghsakha.com/platform/tenant-registry/internal/server"
|
|
"gitea.meghsakha.com/platform/tenant-registry/internal/store"
|
|
"gitea.meghsakha.com/platform/tenant-registry/migrations"
|
|
)
|
|
|
|
// ─── harness ──────────────────────────────────────────────────────────────
|
|
|
|
type testHarness struct {
|
|
t *testing.T
|
|
srv *httptest.Server
|
|
store store.Store
|
|
tenant *store.Tenant // pre-created acme tenant
|
|
kcMock *keycloak.Mock
|
|
}
|
|
|
|
func (h *testHarness) Close() {
|
|
h.srv.Close()
|
|
h.store.Close()
|
|
}
|
|
|
|
// every test runs against both stores so we know they're equivalent.
|
|
func eachStore(t *testing.T, run func(*testing.T, *testHarness)) {
|
|
t.Run("memory", func(t *testing.T) {
|
|
h := newMemoryHarness(t)
|
|
defer h.Close()
|
|
run(t, h)
|
|
})
|
|
t.Run("postgres", func(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("skipping postgres harness under -short")
|
|
}
|
|
h := newPostgresHarness(t)
|
|
defer h.Close()
|
|
run(t, h)
|
|
})
|
|
}
|
|
|
|
func newMemoryHarness(t *testing.T) *testHarness {
|
|
t.Helper()
|
|
mem := store.NewMemory()
|
|
tenant, _ := mem.GetTenantBySlug(context.Background(), "acme")
|
|
return wireHarness(t, mem, tenant)
|
|
}
|
|
|
|
func newPostgresHarness(t *testing.T) *testHarness {
|
|
t.Helper()
|
|
ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
|
|
defer cancel()
|
|
|
|
pgc, err := tcpostgres.Run(ctx,
|
|
"postgres:16-alpine",
|
|
tcpostgres.WithDatabase("tenant_registry_test"),
|
|
tcpostgres.WithUsername("test"),
|
|
tcpostgres.WithPassword("test"),
|
|
tcpostgres.BasicWaitStrategies(),
|
|
)
|
|
if err != nil {
|
|
t.Skipf("skipping postgres harness: docker unreachable (%v)", err)
|
|
}
|
|
dsn, err := pgc.ConnectionString(ctx, "sslmode=disable")
|
|
if err != nil {
|
|
_ = pgc.Terminate(context.Background())
|
|
t.Fatalf("dsn: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
c, cancel := context.WithTimeout(context.Background(), 30*time.Second)
|
|
defer cancel()
|
|
_ = pgc.Terminate(c)
|
|
})
|
|
|
|
// run migrations
|
|
src, err := iofs.New(migrations.FS, ".")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
db, err := sql.Open("pgx", dsn)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
driver, err := migpg.WithInstance(db, &migpg.Config{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
m, err := migrate.NewWithInstance("iofs", src, "postgres", driver)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := m.Up(); err != nil && err.Error() != "no change" {
|
|
t.Fatalf("migrate: %v", err)
|
|
}
|
|
_, _ = m.Close()
|
|
_ = db.Close()
|
|
|
|
pg, err := store.NewPostgres(ctx, dsn)
|
|
if err != nil {
|
|
t.Fatalf("new postgres: %v", err)
|
|
}
|
|
|
|
// seed an acme tenant so the per-endpoint tests can reuse the slug.
|
|
tenant, err := pg.CreateTenant(ctx, store.TenantCreate{
|
|
Slug: "acme", Name: "Acme Inc.", Plan: "professional",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("seed acme: %v", err)
|
|
}
|
|
return wireHarness(t, pg, tenant)
|
|
}
|
|
|
|
func wireHarness(t *testing.T, s store.Store, seed *store.Tenant) *testHarness {
|
|
t.Helper()
|
|
logger := slog.New(slog.NewTextHandler(io.Discard, nil))
|
|
mock := keycloak.NewMock()
|
|
handler := server.NewRouter(&server.Server{
|
|
Cfg: &config.Config{Env: "dev"},
|
|
Log: logger,
|
|
Store: s,
|
|
Keycloak: mock,
|
|
})
|
|
return &testHarness{
|
|
t: t,
|
|
srv: httptest.NewServer(handler),
|
|
store: s,
|
|
tenant: seed,
|
|
kcMock: mock,
|
|
}
|
|
}
|
|
|
|
func (h *testHarness) do(method, path string, body any) (*http.Response, []byte) {
|
|
h.t.Helper()
|
|
var reader io.Reader
|
|
if body != nil {
|
|
buf, _ := json.Marshal(body)
|
|
reader = bytes.NewReader(buf)
|
|
}
|
|
req, err := http.NewRequest(method, h.srv.URL+path, reader)
|
|
if err != nil {
|
|
h.t.Fatal(err)
|
|
}
|
|
if body != nil {
|
|
req.Header.Set("Content-Type", "application/json")
|
|
}
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
h.t.Fatal(err)
|
|
}
|
|
defer func() { _ = resp.Body.Close() }()
|
|
raw, _ := io.ReadAll(resp.Body)
|
|
return resp, raw
|
|
}
|
|
|
|
func decode[T any](t *testing.T, raw []byte) T {
|
|
t.Helper()
|
|
var v T
|
|
if err := json.Unmarshal(raw, &v); err != nil {
|
|
t.Fatalf("decode: %v; raw=%s", err, raw)
|
|
}
|
|
return v
|
|
}
|
|
|
|
// silence unused-import linter warnings if a test is removed temporarily.
|
|
var _ = fmt.Sprintf
|
|
var _ = os.Stderr
|