fix(dashboard): attach Keycloak token on agent API calls (#90)

compliance-agent/tests/common/mod.rs

@@ -7,7 +7,7 @@ use std::sync::Arc;
 
 use compliance_agent::agent::ComplianceAgent;
 use compliance_agent::api;
-use compliance_agent::database::Database;
+use compliance_agent::database::DatabasePool;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
@@ -28,10 +28,9 @@ impl TestServer {
         // Unique database name per test run to avoid collisions
         let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
 
-        let db = Database::connect(&mongodb_uri, &db_name)
+        let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
             .await
-            .expect("Failed to connect to MongoDB — is it running?");
-        db.ensure_indexes().await.expect("Failed to create indexes");
+            .expect("Failed to build DatabasePool");
 
         let config = AgentConfig {
             mongodb_uri: mongodb_uri.clone(),
@@ -69,11 +68,15 @@ impl TestServer {
             pentest_imap_password: None,
         };
 
-        let agent = ComplianceAgent::new(config, db);
+        let agent = ComplianceAgent::new(config, db_pool);
 
-        // Build the router with the agent extension
+        // Build the router with the agent extension. After M7.2-B every
+        // handler takes a TenantCtx extractor; without KC in the test
+        // harness, the dev-tenant injector mounts a synthetic context so
+        // tests run end-to-end against `<db_name>_dev`.
         let app = api::routes::build_router()
             .layer(axum::extract::Extension(Arc::new(agent)))
+            .layer(axum::middleware::from_fn(api::server::inject_dev_tenant))
             .layer(tower_http::cors::CorsLayer::permissive());
 
         // Bind to port 0 to get a random available port
@@ -156,10 +159,19 @@ impl TestServer {
         &self.db_name
     }
 
-    /// Drop the test database on cleanup
+    /// Drop every per-tenant database belonging to this test run.
+    /// Post-M7.2-D the agent never opens a `db_name` directly —
+    /// data lives only in `<db_name>_<tenant>` per-tenant databases.
     pub async fn cleanup(&self) {
         if let Ok(client) = mongodb::Client::with_uri_str(&self.mongodb_uri).await {
-            client.database(&self.db_name).drop().await.ok();
+            if let Ok(names) = client.list_database_names().await {
+                let prefix = format!("{}_", self.db_name);
+                for name in names {
+                    if name.starts_with(&prefix) {
+                        client.database(&name).drop().await.ok();
+                    }
+                }
+            }
         }
     }
 }