코드 테스트 실패 수정

2026-06-11 08:55:41 +09:00
parent 4d77060b5d
commit 0bb3ccb850
13 changed files with 517 additions and 382 deletions
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -837,6 +837,7 @@ func main() {
 	dev.Get("/users", devHandler.SearchUsers)
 	dev.Get("/clients", devHandler.ListClients)
 	dev.Post("/clients", devHandler.CreateClient)
+	dev.Put("/clients/:id/users/me/metadata", devHandler.SelfUpdateRPUserMetadata)
 	dev.Get("/clients/:id/users/:userId/metadata", devHandler.GetRPUserMetadata)
 	dev.Put("/clients/:id/users/:userId/metadata", devHandler.UpsertRPUserMetadata)
 	dev.Get("/clients/:id", devHandler.GetClient)
--- a/backend/internal/handler/dev_handler.go
+++ b/backend/internal/handler/dev_handler.go
@@ -573,6 +573,30 @@ func (h *DevHandler) canManageClientRelations(c *fiber.Ctx, profile *domain.User
 	return canAccessClientByLegacyScope(profile, summary)
 }

+func (h *DevHandler) canManageRPUserMetadata(c *fiber.Ctx, profile *domain.UserProfileResponse, summary clientSummary) bool {
+	if profile == nil {
+		return false
+	}
+	if normalizeUserRole(profile.Role) == domain.RoleSuperAdmin {
+		return true
+	}
+	return h.canOperateClientByPermit(c, profile, summary, "manage")
+}
+
+func (h *DevHandler) canSelfUpdateRPUserMetadata(c *fiber.Ctx, profile *domain.UserProfileResponse, summary clientSummary) bool {
+	if profile == nil {
+		return false
+	}
+	if normalizeUserRole(profile.Role) == domain.RoleSuperAdmin {
+		return true
+	}
+	if h.Keto == nil {
+		return true
+	}
+	allowed, err := h.checkProfileKetoPermission(c, profile, "RelyingParty", summary.ID, "access")
+	return err == nil && allowed
+}
+
 func (h *DevHandler) auditClientIDsByPermit(c *fiber.Ctx, profile *domain.UserProfileResponse, clientFilter string) map[string]struct{} {
 	ids := make(map[string]struct{})
 	if profile == nil || h.Hydra == nil {
@@ -1612,7 +1636,7 @@ func (h *DevHandler) UpsertRPUserMetadata(c *fiber.Ctx) error {
 	if err != nil {
 		return errorJSON(c, fiber.StatusNotFound, "client not found")
 	}
-	if !h.canManageClientRelations(c, profile, summary) {
+	if !h.canManageRPUserMetadata(c, profile, summary) {
 		return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permission to update client metadata")
 	}

@@ -1645,6 +1669,73 @@ func (h *DevHandler) UpsertRPUserMetadata(c *fiber.Ctx) error {
 	return c.JSON(row)
 }

+func (h *DevHandler) SelfUpdateRPUserMetadata(c *fiber.Ctx) error {
+	clientID := strings.TrimSpace(c.Params("id"))
+	if clientID == "" {
+		return errorJSON(c, fiber.StatusBadRequest, "client id is required")
+	}
+	if h.RPUserMetadataRepo == nil {
+		return errorJSON(c, fiber.StatusServiceUnavailable, "rp user metadata repository unavailable")
+	}
+
+	profile := h.getCurrentProfile(c)
+	if profile == nil || strings.TrimSpace(profile.ID) == "" {
+		return errorJSON(c, fiber.StatusUnauthorized, "unauthorized: authentication required")
+	}
+
+	summary, err := h.loadClientSummary(c.Context(), clientID)
+	if err != nil {
+		return errorJSON(c, fiber.StatusNotFound, "client not found")
+	}
+	if !h.canSelfUpdateRPUserMetadata(c, profile, summary) {
+		return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permission to update own client metadata")
+	}
+
+	var req struct {
+		Metadata map[string]any `json:"metadata"`
+	}
+	if err := c.BodyParser(&req); err != nil {
+		return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
+	}
+	if req.Metadata == nil {
+		req.Metadata = map[string]any{}
+	}
+
+	filteredMetadata, err := filterSelfWritableRPUserMetadata(req.Metadata, summary.Metadata)
+	if err != nil {
+		return errorJSON(c, fiber.StatusForbidden, err.Error())
+	}
+	normalizedMetadata, err := normalizeRPUserMetadataForClient(filteredMetadata, summary.Metadata)
+	if err != nil {
+		return errorJSON(c, fiber.StatusBadRequest, err.Error())
+	}
+
+	userID := strings.TrimSpace(profile.ID)
+	mergedMetadata := domain.JSONMap{}
+	if existing, err := h.RPUserMetadataRepo.Get(c.Context(), clientID, userID); err == nil && existing != nil {
+		for key, value := range existing.Metadata {
+			mergedMetadata[key] = value
+		}
+	}
+	for key, value := range normalizedMetadata {
+		mergedMetadata[key] = value
+	}
+
+	row := &domain.RPUserMetadata{
+		ClientID: clientID,
+		UserID:   userID,
+		Metadata: mergedMetadata,
+	}
+	if err := h.RPUserMetadataRepo.Upsert(c.Context(), row); err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+	}
+	if err := h.syncRPUserMetadataToKratos(c.Context(), userID, clientID, mergedMetadata); err != nil {
+		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
+	}
+
+	return c.JSON(row)
+}
+
 func (h *DevHandler) syncRPUserMetadataToKratos(ctx context.Context, userID string, clientID string, metadata domain.JSONMap) error {
 	if h == nil || h.KratosAdmin == nil {
 		return nil
@@ -1769,6 +1860,33 @@ func normalizeRPUserMetadataForClient(metadata map[string]any, clientMetadata ma
 	return normalized, nil
 }

+func filterSelfWritableRPUserMetadata(metadata map[string]any, clientMetadata map[string]any) (map[string]any, error) {
+	schemas, err := rpUserMetadataClaimSchemas(clientMetadata)
+	if err != nil {
+		return nil, err
+	}
+
+	filtered := map[string]any{}
+	for rawKey, rawValue := range metadata {
+		key := strings.TrimSpace(rawKey)
+		if key == "" || isEmptyRPUserMetadataValue(rawValue) {
+			continue
+		}
+		if strings.HasSuffix(key, "_permissions") {
+			return nil, fmt.Errorf("rp user metadata permission cannot be updated by user: %s", key)
+		}
+		schema, ok := schemas[key]
+		if !ok {
+			return nil, fmt.Errorf("rp user metadata claim is not configured: %s", key)
+		}
+		if normalizeCustomClaimPermission(schema.WritePermission) != "user_and_admin" {
+			return nil, fmt.Errorf("rp user metadata claim is admin only: %s", key)
+		}
+		filtered[key] = rawValue
+	}
+	return filtered, nil
+}
+
 func rpUserMetadataClaimSchemas(clientMetadata map[string]any) (map[string]rpUserMetadataClaimSchema, error) {
 	rawClaims, ok := clientMetadata[domain.MetadataIDTokenClaims]
 	if !ok || rawClaims == nil {
--- a/backend/internal/handler/dev_handler_rp_metadata_test.go
+++ b/backend/internal/handler/dev_handler_rp_metadata_test.go
@@ -125,6 +125,100 @@ func TestDevHandler_RPUserMetadataRoundTrip(t *testing.T) {
 	repo.AssertExpectations(t)
 }

+func TestDevHandler_RPUserMetadataAdminUpsertRequiresRPManage(t *testing.T) {
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.URL.Path == "/clients/client-1" {
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":   "client-1",
+				"client_name": "Client One",
+				"metadata": map[string]any{
+					"tenant_id": "tenant-1",
+					"id_token_claims": []map[string]any{
+						{
+							"namespace":       "rp_claims",
+							"key":             "approvalLevel",
+							"valueType":       "text",
+							"value":           "A",
+							"readPermission":  "user_and_admin",
+							"writePermission": "user_and_admin",
+						},
+					},
+				},
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	t.Run("tenant grant does not allow rp user metadata admin upsert", func(t *testing.T) {
+		repo := new(devMockRPUserMetadataRepo)
+		repo.On("Upsert", mock.Anything, mock.AnythingOfType("*domain.RPUserMetadata")).Return(nil).Maybe()
+		keto := new(devMockKetoService)
+		keto.On("CheckPermission", mock.Anything, "User:operator-1", "RelyingParty", "client-1", "manage").Return(false, nil)
+		keto.On("CheckPermission", mock.Anything, "User:operator-1", "Tenant", "tenant-1", "grant_dev_permissions").Return(true, nil).Maybe()
+		h := &DevHandler{
+			Hydra: &service.HydraAdminService{
+				AdminURL:   "http://hydra.test",
+				HTTPClient: &http.Client{Transport: transport},
+			},
+			Keto:               keto,
+			RPUserMetadataRepo: repo,
+		}
+		app := fiber.New()
+		app.Use(func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{ID: "operator-1", Role: domain.RoleUser})
+			return c.Next()
+		})
+		app.Put("/api/v1/dev/clients/:id/users/:userId/metadata", h.UpsertRPUserMetadata)
+
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{"approvalLevel": "B"},
+		})
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-1/users/user-1/metadata", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		resp, _ := app.Test(req, -1)
+
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+		repo.AssertNotCalled(t, "Upsert", mock.Anything, mock.Anything)
+		keto.AssertExpectations(t)
+	})
+
+	t.Run("rp manage allows rp user metadata admin upsert", func(t *testing.T) {
+		repo := new(devMockRPUserMetadataRepo)
+		repo.On("Upsert", mock.Anything, mock.MatchedBy(func(row *domain.RPUserMetadata) bool {
+			return row.ClientID == "client-1" &&
+				row.UserID == "user-1" &&
+				row.Metadata["approvalLevel"] == "B"
+		})).Return(nil).Once()
+		keto := new(devMockKetoService)
+		keto.On("CheckPermission", mock.Anything, "User:operator-1", "RelyingParty", "client-1", "manage").Return(true, nil)
+		h := &DevHandler{
+			Hydra: &service.HydraAdminService{
+				AdminURL:   "http://hydra.test",
+				HTTPClient: &http.Client{Transport: transport},
+			},
+			Keto:               keto,
+			RPUserMetadataRepo: repo,
+		}
+		app := fiber.New()
+		app.Use(func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{ID: "operator-1", Role: domain.RoleUser})
+			return c.Next()
+		})
+		app.Put("/api/v1/dev/clients/:id/users/:userId/metadata", h.UpsertRPUserMetadata)
+
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{"approvalLevel": "B"},
+		})
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-1/users/user-1/metadata", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		resp, _ := app.Test(req, -1)
+
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		repo.AssertExpectations(t)
+		keto.AssertExpectations(t)
+	})
+}
+
 func TestDevHandler_RPUserMetadataMirrorsToKratosTraits(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.URL.Path == "/clients/client-1" {
@@ -201,6 +295,130 @@ func TestDevHandler_RPUserMetadataMirrorsToKratosTraits(t *testing.T) {
 	kratos.AssertExpectations(t)
 }

+func TestDevHandler_SelfUpdateRPUserMetadataHonorsWritePermission(t *testing.T) {
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if r.URL.Path == "/clients/client-1" {
+			return httpJSONAny(r, http.StatusOK, map[string]any{
+				"client_id":   "client-1",
+				"client_name": "Client One",
+				"metadata": map[string]any{
+					"tenant_id": "tenant-1",
+					"id_token_claims": []map[string]any{
+						{
+							"namespace":       "rp_claims",
+							"key":             "approvalLevel",
+							"valueType":       "text",
+							"value":           "A",
+							"readPermission":  "user_and_admin",
+							"writePermission": "user_and_admin",
+						},
+						{
+							"namespace":       "rp_claims",
+							"key":             "internalRank",
+							"valueType":       "text",
+							"value":           "S",
+							"readPermission":  "admin_only",
+							"writePermission": "admin_only",
+						},
+					},
+				},
+			}), nil
+		}
+		return httpJSONAny(r, http.StatusNotFound, nil), nil
+	})
+
+	t.Run("rejects admin_only claim", func(t *testing.T) {
+		repo := new(devMockRPUserMetadataRepo)
+		repo.On("Upsert", mock.Anything, mock.AnythingOfType("*domain.RPUserMetadata")).Return(nil).Maybe()
+		h := &DevHandler{
+			Hydra: &service.HydraAdminService{
+				AdminURL:   "http://hydra.test",
+				HTTPClient: &http.Client{Transport: transport},
+			},
+			RPUserMetadataRepo: repo,
+		}
+		app := fiber.New()
+		app.Use(func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{ID: "user-1", Role: domain.RoleUser})
+			return c.Next()
+		})
+		app.Put("/api/v1/dev/clients/:id/users/me/metadata", h.SelfUpdateRPUserMetadata)
+
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{"internalRank": "A"},
+		})
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-1/users/me/metadata", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		resp, _ := app.Test(req, -1)
+
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+		repo.AssertNotCalled(t, "Upsert", mock.Anything, mock.Anything)
+	})
+
+	t.Run("allows user_and_admin claim for self", func(t *testing.T) {
+		repo := new(devMockRPUserMetadataRepo)
+		repo.On("Get", mock.Anything, "client-1", "user-1").Return(&domain.RPUserMetadata{
+			ClientID: "client-1",
+			UserID:   "user-1",
+			Metadata: domain.JSONMap{
+				"internalRank": "S",
+				"internalRank_permissions": map[string]any{
+					"readPermission":  "admin_only",
+					"writePermission": "admin_only",
+				},
+			},
+		}, nil).Once()
+		repo.On("Upsert", mock.Anything, mock.MatchedBy(func(row *domain.RPUserMetadata) bool {
+			return row.ClientID == "client-1" &&
+				row.UserID == "user-1" &&
+				row.Metadata["approvalLevel"] == "B" &&
+				row.Metadata["internalRank"] == "S"
+		})).Return(nil).Once()
+		kratos := new(MockKratosAdmin)
+		kratos.On("GetIdentity", mock.Anything, "user-1").Return(&service.KratosIdentity{
+			ID:    "user-1",
+			State: "active",
+			Traits: map[string]any{
+				"email": "user@example.com",
+			},
+		}, nil).Once()
+		var capturedTraits map[string]any
+		kratos.On("UpdateIdentity", mock.Anything, "user-1", mock.Anything, "active").Run(func(args mock.Arguments) {
+			capturedTraits = args.Get(2).(map[string]any)
+		}).Return(&service.KratosIdentity{ID: "user-1", State: "active", Traits: map[string]any{}}, nil).Once()
+		h := &DevHandler{
+			Hydra: &service.HydraAdminService{
+				AdminURL:   "http://hydra.test",
+				HTTPClient: &http.Client{Transport: transport},
+			},
+			KratosAdmin:        kratos,
+			IdentityWriter:     service.NewIdentityWriteService(kratos, nil),
+			RPUserMetadataRepo: repo,
+		}
+		app := fiber.New()
+		app.Use(func(c *fiber.Ctx) error {
+			c.Locals("user_profile", &domain.UserProfileResponse{ID: "user-1", Role: domain.RoleUser})
+			return c.Next()
+		})
+		app.Put("/api/v1/dev/clients/:id/users/me/metadata", h.SelfUpdateRPUserMetadata)
+
+		body, _ := json.Marshal(map[string]any{
+			"metadata": map[string]any{"approvalLevel": "B"},
+		})
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/dev/clients/client-1/users/me/metadata", bytes.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		resp, _ := app.Test(req, -1)
+
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		rpClaims := capturedTraits["rp_custom_claims"].(map[string]any)
+		clientClaims := rpClaims["client-1"].(domain.JSONMap)
+		require.Equal(t, "B", clientClaims["approvalLevel"])
+		require.Equal(t, "S", clientClaims["internalRank"])
+		repo.AssertExpectations(t)
+		kratos.AssertExpectations(t)
+	})
+}
+
 func TestDevHandler_RPUserMetadataRejectsUndefinedClaimKey(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.URL.Path == "/clients/client-1" {