Private/PKCE 앱 유형 및 관리자 권한 정책 적용

backend/internal/handler/dev_handler_test.go

@@ -1,8 +1,10 @@
 package handler
 
 import (
+	"baron-sso-backend/internal/domain"
 	"baron-sso-backend/internal/service"
 	"bytes"
+	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -10,8 +12,32 @@ import (
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 )
 
+type MockKetoService struct {
+	mock.Mock
+}
+
+func (m *MockKetoService) CheckPermission(ctx context.Context, subject, namespace, object, relation string) (bool, error) {
+	args := m.Called(ctx, subject, namespace, object, relation)
+	return args.Bool(0), args.Error(1)
+}
+func (m *MockKetoService) CreateRelation(ctx context.Context, namespace, object, relation, subject string) error {
+	return m.Called(ctx, namespace, object, relation, subject).Error(0)
+}
+func (m *MockKetoService) DeleteRelation(ctx context.Context, namespace, object, relation, subject string) error {
+	return m.Called(ctx, namespace, object, relation, subject).Error(0)
+}
+func (m *MockKetoService) ListRelations(ctx context.Context, namespace, object, relation, subject string) ([]service.RelationTuple, error) {
+	args := m.Called(ctx, namespace, object, relation, subject)
+	return args.Get(0).([]service.RelationTuple), args.Error(1)
+}
+func (m *MockKetoService) ListObjects(ctx context.Context, namespace, relation, subject string) ([]string, error) {
+	args := m.Called(ctx, namespace, relation, subject)
+	return args.Get(0).([]string), args.Error(1)
+}
+
 func TestListClients_Success(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.URL.Path == "/clients" {
@@ -23,13 +49,22 @@ func TestListClients_Success(t *testing.T) {
 		return httpJSONAny(r, http.StatusNotFound, map[string]string{"error": "not found"}), nil
 	})
 
+	mockKeto := new(MockKetoService)
+	// For simplicity, always allow in basic success test
+	mockKeto.On("CheckPermission", mock.Anything, mock.Anything, "System", "AppManager", "member").Return(true, nil)
+
 	h := &DevHandler{
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			HTTPClient: &http.Client{Transport: transport},
 		},
+		Keto: mockKeto,
 	}
 	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "test-user", Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
 	app.Get("/api/v1/dev/clients", h.ListClients)
 
 	req := httptest.NewRequest(http.MethodGet, "/api/v1/dev/clients", nil)
@@ -58,14 +93,21 @@ func TestGetClient_Success(t *testing.T) {
 		return httpJSONAny(r, http.StatusNotFound, map[string]string{"error": "not found"}), nil
 	})
 
+	mockKeto := new(MockKetoService)
+
 	h := &DevHandler{
 		Hydra: &service.HydraAdminService{
 			AdminURL:   "http://hydra.test",
 			PublicURL:  "http://hydra-public.test", // PublicURL 추가
 			HTTPClient: &http.Client{Transport: transport},
 		},
+		Keto: mockKeto,
 	}
 	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "test-user", Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
 	app.Get("/api/v1/dev/clients/:id", h.GetClient)
 
 	req := httptest.NewRequest(http.MethodGet, "/api/v1/dev/clients/client-123", nil)
@@ -80,26 +122,6 @@ func TestGetClient_Success(t *testing.T) {
 	assert.Equal(t, "http://hydra-public.test/oauth2/auth", res.Endpoints.Authorization)
 }
 
-func TestGetClient_NotFound(t *testing.T) {
-	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		return httpJSONAny(r, http.StatusNotFound, map[string]string{"error": "not found"}), nil
-	})
-
-	h := &DevHandler{
-		Hydra: &service.HydraAdminService{
-			AdminURL:   "http://hydra.test",
-			HTTPClient: &http.Client{Transport: transport},
-		},
-	}
-	app := fiber.New()
-	app.Get("/api/v1/dev/clients/:id", h.GetClient)
-
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/dev/clients/non-existent", nil)
-	resp, _ := app.Test(req, -1)
-
-	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
-}
-
 func TestCreateClient_Success(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.Method == http.MethodPost && r.URL.Path == "/clients" {
@@ -112,6 +134,7 @@ func TestCreateClient_Success(t *testing.T) {
 		return httpJSONAny(r, http.StatusInternalServerError, map[string]string{"error": "hydra error"}), nil
 	})
 
+	mockKeto := new(MockKetoService)
 	secretRepo := &mockSecretRepo{secrets: make(map[string]string)}
 	redisRepo := &mockRedisRepo{data: make(map[string]string)}
 
@@ -122,13 +145,18 @@ func TestCreateClient_Success(t *testing.T) {
 		},
 		SecretRepo: secretRepo,
 		Redis:      redisRepo,
+		Keto:       mockKeto,
 	}
 	app := fiber.New()
+	app.Use(func(c *fiber.Ctx) error {
+		c.Locals("user_profile", &domain.UserProfileResponse{ID: "test-user", Role: domain.RoleSuperAdmin})
+		return c.Next()
+	})
 	app.Post("/api/v1/dev/clients", h.CreateClient)
 
 	body, _ := json.Marshal(map[string]interface{}{
 		"client_name":  "New App",
-		"type":         "confidential",
+		"type":         "private",
 		"redirectUris": []string{"http://localhost/cb"},
 	})
 	req := httptest.NewRequest(http.MethodPost, "/api/v1/dev/clients", bytes.NewReader(body))