Fix audit timeline app names and stabilize backend tests

backend/internal/handler/auth_handler.go

@@ -3079,11 +3079,25 @@ func (h *AuthHandler) GetAuthTimeline(c *fiber.Ctx) error {
 		path := strings.ToLower(extractAuditPath(log))
 		if strings.Contains(path, "/api/v1/auth/oidc/login/accept") {
 			appName = "OIDC 로그인"
-			loginChallenge := extractLoginChallengeFromAuditDetails(log.Details)
-			if loginChallenge != "" {
-				if info, ok := resolveLoginClient(loginChallenge); ok {
-					appName = info.Name
-					clientID = info.ClientID
+			// 우선 audit details의 client 정보를 사용하고, 없으면 Hydra 조회로 보강
+			if details, err := parseAuditDetails(log.Details); err == nil && details != nil {
+				if name, ok := details["client_name"].(string); ok && strings.TrimSpace(name) != "" {
+					appName = strings.TrimSpace(name)
+				}
+				if cid, ok := details["client_id"].(string); ok && strings.TrimSpace(cid) != "" {
+					clientID = strings.TrimSpace(cid)
+					if appName == "OIDC 로그인" {
+						appName = clientID
+					}
+				}
+			}
+			if appName == "OIDC 로그인" {
+				loginChallenge := extractLoginChallengeFromAuditDetails(log.Details)
+				if loginChallenge != "" {
+					if info, ok := resolveLoginClient(loginChallenge); ok {
+						appName = info.Name
+						clientID = info.ClientID
+					}
 				}
 			}
 		}
@@ -3586,11 +3600,26 @@ func (h *AuthHandler) AcceptOidcLoginRequest(c *fiber.Ctx) error {
 
 	// Check if the client is active
 	loginReq, err := h.Hydra.GetLoginRequest(c.Context(), req.LoginChallenge)
-	if err == nil && loginReq != nil && loginReq.Client.Metadata != nil {
-		if status, ok := loginReq.Client.Metadata["status"].(string); ok {
-			if strings.ToLower(status) == "inactive" {
-				slog.Warn("Login rejected for inactive client in AcceptOidcLoginRequest", "client_id", loginReq.Client.ClientID)
-				return fiber.NewError(fiber.StatusForbidden, "The client application is disabled.")
+	if err == nil && loginReq != nil {
+		// Audit 상세 정보 보강: OIDC 로그인 시점에 client 정보를 저장
+		clientID := strings.TrimSpace(loginReq.Client.ClientID)
+		if clientID != "" {
+			clientName := strings.TrimSpace(loginReq.Client.ClientName)
+			if clientName == "" {
+				clientName = clientID
+			}
+			c.Locals("audit_details_extra", map[string]any{
+				"client_id":   clientID,
+				"client_name": clientName,
+			})
+		}
+
+		if loginReq.Client.Metadata != nil {
+			if status, ok := loginReq.Client.Metadata["status"].(string); ok {
+				if strings.ToLower(status) == "inactive" {
+					slog.Warn("Login rejected for inactive client in AcceptOidcLoginRequest", "client_id", loginReq.Client.ClientID)
+					return fiber.NewError(fiber.StatusForbidden, "The client application is disabled.")
+				}
 			}
 		}
 	}

backend/internal/middleware/audit_middleware.go

@@ -144,6 +144,19 @@ func AuditMiddleware(config AuditConfig) fiber.Handler {
 			"tenant_id":    tenantID,
 			"request_body": maskedBody,
 		}
+		// 핸들러에서 추가한 상세 정보를 병합합니다.
+		if extra := c.Locals("audit_details_extra"); extra != nil {
+			switch v := extra.(type) {
+			case map[string]string:
+				for key, value := range v {
+					details[key] = value
+				}
+			case map[string]interface{}:
+				for key, value := range v {
+					details[key] = value
+				}
+			}
+		}
 		if skipTimeline, ok := c.Locals("auth_timeline_skip").(bool); ok && skipTimeline {
 			details["auth_timeline_skip"] = true
 		}

backend/internal/middleware/rbac.go

@@ -2,7 +2,6 @@ package middleware
 
 import (
 	"baron-sso-backend/internal/domain"
-	"baron-sso-backend/internal/handler"
 	"baron-sso-backend/internal/service"
 	"github.com/gofiber/fiber/v2"
 	"log/slog"
@@ -11,10 +10,15 @@ import (
 // RBACConfig defines the configuration for RBAC middleware
 type RBACConfig struct {
 	AllowedRoles []string
-	AuthHandler  *handler.AuthHandler
+	AuthHandler  AuthProfileProvider
 	KetoService  service.KetoService
 }
 
+// AuthProfileProvider는 미들웨어에서 사용자 정보를 조회하기 위한 최소 인터페이스입니다.
+type AuthProfileProvider interface {
+	GetEnrichedProfile(c *fiber.Ctx) (*domain.UserProfileResponse, error)
+}
+
 // RequireKetoPermission enforces permissions using Ory Keto (ReBAC)
 func RequireKetoPermission(config RBACConfig, namespace, relation string) fiber.Handler {
 	return func(c *fiber.Ctx) error {

backend/internal/service/hydra_admin_service_test.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"encoding/json"
 	"net/http"
-	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -17,19 +16,19 @@ func TestHydraAdminService_ListClients(t *testing.T) {
 		{ClientID: "client2", ClientName: "Client 2"},
 	}
 
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/clients", r.URL.Path)
 		assert.Equal(t, "GET", r.Method)
 		assert.Equal(t, "10", r.URL.Query().Get("limit"))
 		assert.Equal(t, "5", r.URL.Query().Get("offset"))
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(clients)
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(clients)
+	})
 
 	s := &HydraAdminService{
-		AdminURL: server.URL,
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
 	}
 
 	result, err := s.ListClients(context.Background(), 10, 5)
@@ -40,17 +39,17 @@ func TestHydraAdminService_ListClients(t *testing.T) {
 func TestHydraAdminService_GetClient(t *testing.T) {
 	client := domain.HydraClient{ClientID: "test-client", ClientName: "Test Client"}
 
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/clients/test-client", r.URL.Path)
 		assert.Equal(t, "GET", r.Method)
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(client)
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(client)
+	})
 
 	s := &HydraAdminService{
-		AdminURL: server.URL,
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
 	}
 
 	result, err := s.GetClient(context.Background(), "test-client")
@@ -62,21 +61,21 @@ func TestHydraAdminService_CreateClient(t *testing.T) {
 	client := domain.HydraClient{ClientName: "New Client"}
 	created := domain.HydraClient{ClientID: "new-id", ClientName: "New Client"}
 
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/clients", r.URL.Path)
 		assert.Equal(t, "POST", r.Method)
 
 		var received domain.HydraClient
-		json.NewDecoder(r.Body).Decode(&received)
+		_ = json.NewDecoder(r.Body).Decode(&received)
 		assert.Equal(t, client.ClientName, received.ClientName)
 
 		w.WriteHeader(http.StatusCreated)
-		json.NewEncoder(w).Encode(created)
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(created)
+	})
 
 	s := &HydraAdminService{
-		AdminURL: server.URL,
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
 	}
 
 	result, err := s.CreateClient(context.Background(), client)
@@ -85,15 +84,15 @@ func TestHydraAdminService_CreateClient(t *testing.T) {
 }
 
 func TestHydraAdminService_DeleteClient(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/clients/to-delete", r.URL.Path)
 		assert.Equal(t, "DELETE", r.Method)
 		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
+	})
 
 	s := &HydraAdminService{
-		AdminURL: server.URL,
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
 	}
 
 	err := s.DeleteClient(context.Background(), "to-delete")
@@ -104,17 +103,17 @@ func TestHydraAdminService_GetConsentRequest(t *testing.T) {
 	challenge := "challenge123"
 	consentReq := domain.HydraConsentRequest{Challenge: challenge, Subject: "user1"}
 
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/oauth2/auth/requests/consent", r.URL.Path)
 		assert.Equal(t, challenge, r.URL.Query().Get("consent_challenge"))
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(consentReq)
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(consentReq)
+	})
 
 	s := &HydraAdminService{
-		AdminURL: server.URL,
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
 	}
 
 	result, err := s.GetConsentRequest(context.Background(), challenge)
@@ -123,96 +122,108 @@ func TestHydraAdminService_GetConsentRequest(t *testing.T) {
 }
 
 func TestHydraAdminService_PatchClientStatus(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/clients/test-client", r.URL.Path)
 		assert.Equal(t, "PATCH", r.Method)
 		assert.Equal(t, "application/json-patch+json", r.Header.Get("Content-Type"))
 
 		var payload []map[string]interface{}
-		json.NewDecoder(r.Body).Decode(&payload)
+		_ = json.NewDecoder(r.Body).Decode(&payload)
 		assert.Equal(t, "replace", payload[0]["op"])
 		assert.Equal(t, "/metadata/status", payload[0]["path"])
 		assert.Equal(t, "inactive", payload[0]["value"])
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(domain.HydraClient{ClientID: "test-client"})
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(domain.HydraClient{ClientID: "test-client"})
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 	_, err := s.PatchClientStatus(context.Background(), "test-client", "inactive")
 	assert.NoError(t, err)
 }
 
 func TestHydraAdminService_UpdateClient(t *testing.T) {
 	client := domain.HydraClient{ClientName: "Updated Name"}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/clients/test-client", r.URL.Path)
 		assert.Equal(t, "PUT", r.Method)
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(client)
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(client)
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 	_, err := s.UpdateClient(context.Background(), "test-client", client)
 	assert.NoError(t, err)
 }
 
 func TestHydraAdminService_ListConsentSessions(t *testing.T) {
 	sessions := []domain.HydraConsentSession{{Subject: "user1"}}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/oauth2/auth/sessions/consent", r.URL.Path)
 		assert.Equal(t, "user1", r.URL.Query().Get("subject"))
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(sessions)
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(sessions)
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 	result, err := s.ListConsentSessions(context.Background(), "user1", "")
 	assert.NoError(t, err)
 	assert.Equal(t, sessions, result)
 }
 
 func TestHydraAdminService_RevokeConsentSessions(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/oauth2/auth/sessions/consent", r.URL.Path)
 		assert.Equal(t, "DELETE", r.Method)
 		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 	err := s.RevokeConsentSessions(context.Background(), "user1", "")
 	assert.NoError(t, err)
 }
 
 func TestHydraAdminService_RejectConsentRequest(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/oauth2/auth/requests/consent/reject", r.URL.Path)
 		assert.Equal(t, "PUT", r.Method)
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]string{"redirect_to": "http://reject"})
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(map[string]string{"redirect_to": "http://reject"})
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 	resp, err := s.RejectConsentRequest(context.Background(), "challenge")
 	assert.NoError(t, err)
 	assert.Equal(t, "http://reject", resp.RedirectTo)
 }
 
 func TestHydraAdminService_RejectLoginRequest(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/oauth2/auth/requests/login/reject", r.URL.Path)
 		assert.Equal(t, "PUT", r.Method)
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]string{"redirect_to": "http://reject-login"})
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(map[string]string{"redirect_to": "http://reject-login"})
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 	resp, err := s.RejectLoginRequest(context.Background(), "challenge", "error", "desc")
 	assert.NoError(t, err)
 	assert.Equal(t, "http://reject-login", resp.RedirectTo)
@@ -220,14 +231,16 @@ func TestHydraAdminService_RejectLoginRequest(t *testing.T) {
 
 func TestHydraAdminService_GetLoginRequest(t *testing.T) {
 	loginReq := domain.HydraLoginRequest{Challenge: "challenge"}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/oauth2/auth/requests/login", r.URL.Path)
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(loginReq)
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(loginReq)
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 	result, err := s.GetLoginRequest(context.Background(), "challenge")
 	assert.NoError(t, err)
 	assert.Equal(t, &loginReq, result)
@@ -235,15 +248,17 @@ func TestHydraAdminService_GetLoginRequest(t *testing.T) {
 
 func TestHydraAdminService_AcceptConsentRequest(t *testing.T) {
 	grant := &domain.HydraConsentRequest{RequestedScope: []string{"openid"}}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/oauth2/auth/requests/consent/accept", r.URL.Path)
 		assert.Equal(t, "PUT", r.Method)
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]string{"redirect_to": "http://accept"})
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(map[string]string{"redirect_to": "http://accept"})
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 	resp, err := s.AcceptConsentRequest(context.Background(), "challenge", grant, nil)
 	assert.NoError(t, err)
 	assert.Equal(t, "http://accept", resp.RedirectTo)
@@ -254,21 +269,21 @@ func TestHydraAdminService_AcceptLoginRequest(t *testing.T) {
 	subject := "user@example.com"
 	redirectTo := "http://hydra/auth/confirm"
 
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/oauth2/auth/requests/login/accept", r.URL.Path)
 		assert.Equal(t, challenge, r.URL.Query().Get("login_challenge"))
 
 		var body map[string]interface{}
-		json.NewDecoder(r.Body).Decode(&body)
+		_ = json.NewDecoder(r.Body).Decode(&body)
 		assert.Equal(t, subject, body["subject"])
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]string{"redirect_to": redirectTo})
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(map[string]string{"redirect_to": redirectTo})
+	})
 
 	s := &HydraAdminService{
-		AdminURL: server.URL,
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
 	}
 
 	result, err := s.AcceptLoginRequest(context.Background(), challenge, subject)
@@ -277,13 +292,15 @@ func TestHydraAdminService_AcceptLoginRequest(t *testing.T) {
 }
 
 func TestHydraAdminService_ErrorHandling(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusBadRequest)
-		w.Write([]byte("bad request"))
-	}))
-	defer server.Close()
+		_, _ = w.Write([]byte("bad request"))
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 
 	_, err := s.GetClient(context.Background(), "invalid")
 	assert.Error(t, err)
@@ -300,12 +317,14 @@ func TestHydraAdminService_ErrorHandling(t *testing.T) {
 }
 
 func TestHydraAdminService_NotFound(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusNotFound)
-	}))
-	defer server.Close()
+	})
 
-	s := &HydraAdminService{AdminURL: server.URL}
+	s := &HydraAdminService{
+		AdminURL:   "http://hydra-admin.local",
+		HTTPClient: clientForHandler(handler),
+	}
 
 	_, err := s.GetClient(context.Background(), "none")
 	assert.Equal(t, ErrHydraNotFound, err)

backend/internal/service/keto_service_test.go

@@ -4,14 +4,13 @@ import (
 	"context"
 	"encoding/json"
 	"net/http"
-	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestKetoService_CheckPermission(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/relation-tuples/check", r.URL.Path)
 		assert.Equal(t, "user1", r.URL.Query().Get("subject_id"))
 		assert.Equal(t, "tenants", r.URL.Query().Get("namespace"))
@@ -19,13 +18,12 @@ func TestKetoService_CheckPermission(t *testing.T) {
 		assert.Equal(t, "admin", r.URL.Query().Get("relation"))
 
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(checkResponse{Allowed: true})
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(checkResponse{Allowed: true})
+	})
 
 	s := &ketoService{
-		readURL: server.URL,
-		client:  &http.Client{},
+		readURL: "http://keto-read.local",
+		client:  clientForHandler(handler),
 	}
 
 	allowed, err := s.CheckPermission(context.Background(), "user1", "tenants", "tenant1", "admin")
@@ -34,24 +32,23 @@ func TestKetoService_CheckPermission(t *testing.T) {
 }
 
 func TestKetoService_CreateRelation(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/admin/relation-tuples", r.URL.Path)
 		assert.Equal(t, "PUT", r.Method)
 
 		var body map[string]interface{}
-		json.NewDecoder(r.Body).Decode(&body)
+		_ = json.NewDecoder(r.Body).Decode(&body)
 		assert.Equal(t, "tenants", body["namespace"])
 		assert.Equal(t, "tenant1", body["object"])
 		assert.Equal(t, "admin", body["relation"])
 		assert.Equal(t, "user1", body["subject_id"])
 
 		w.WriteHeader(http.StatusCreated)
-	}))
-	defer server.Close()
+	})
 
 	s := &ketoService{
-		writeURL: server.URL,
-		client:   &http.Client{},
+		writeURL: "http://keto-write.local",
+		client:   clientForHandler(handler),
 	}
 
 	err := s.CreateRelation(context.Background(), "tenants", "tenant1", "admin", "user1")
@@ -59,18 +56,17 @@ func TestKetoService_CreateRelation(t *testing.T) {
 }
 
 func TestKetoService_DeleteRelation(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/relation-tuples", r.URL.Path)
 		assert.Equal(t, "DELETE", r.Method)
 		assert.Equal(t, "user1", r.URL.Query().Get("subject_id"))
 
 		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer server.Close()
+	})
 
 	s := &ketoService{
-		writeURL: server.URL,
-		client:   &http.Client{},
+		writeURL: "http://keto-write.local",
+		client:   clientForHandler(handler),
 	}
 
 	err := s.DeleteRelation(context.Background(), "tenants", "tenant1", "admin", "user1")
@@ -82,17 +78,16 @@ func TestKetoService_ListRelations(t *testing.T) {
 		{Namespace: "tenants", Object: "tenant1", Relation: "admin", SubjectID: "user1"},
 	}
 
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "/relation-tuples", r.URL.Path)
-		
+
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(relationTuplesResponse{RelationTuples: tuples})
-	}))
-	defer server.Close()
+		_ = json.NewEncoder(w).Encode(relationTuplesResponse{RelationTuples: tuples})
+	})
 
 	s := &ketoService{
-		readURL: server.URL,
-		client:  &http.Client{},
+		readURL: "http://keto-read.local",
+		client:  clientForHandler(handler),
 	}
 
 	result, err := s.ListRelations(context.Background(), "tenants", "tenant1", "admin", "user1")
@@ -101,21 +96,20 @@ func TestKetoService_ListRelations(t *testing.T) {
 }
 
 func TestKetoService_ErrorHandling(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
-		w.Write([]byte("internal error"))
-	}))
-	defer server.Close()
+		_, _ = w.Write([]byte("internal error"))
+	})
 
 	s := &ketoService{
-		readURL:  server.URL,
-		writeURL: server.URL,
-		client:   &http.Client{},
+		readURL:  "http://keto-read.local",
+		writeURL: "http://keto-write.local",
+		client:   clientForHandler(handler),
 	}
 
 	_, err := s.CheckPermission(context.Background(), "u", "n", "o", "r")
 	assert.Error(t, err)
-	
+
 	err = s.DeleteRelation(context.Background(), "n", "o", "r", "s")
 	assert.Error(t, err)
 
@@ -124,12 +118,14 @@ func TestKetoService_ErrorHandling(t *testing.T) {
 }
 
 func TestKetoService_CheckPermission_Forbidden(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusForbidden)
-	}))
-	defer server.Close()
+	})
 
-	s := &ketoService{readURL: server.URL, client: &http.Client{}}
+	s := &ketoService{
+		readURL: "http://keto-read.local",
+		client:  clientForHandler(handler),
+	}
 	allowed, err := s.CheckPermission(context.Background(), "u", "n", "o", "r")
 	assert.NoError(t, err)
 	assert.False(t, allowed)
@@ -137,19 +133,18 @@ func TestKetoService_CheckPermission_Forbidden(t *testing.T) {
 
 func TestKetoService_CreateRelation_Retry(t *testing.T) {
 	attempts := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		attempts++
 		if attempts < 2 {
 			w.WriteHeader(http.StatusInternalServerError)
 			return
 		}
 		w.WriteHeader(http.StatusCreated)
-	}))
-	defer server.Close()
+	})
 
 	s := &ketoService{
-		writeURL: server.URL,
-		client:   &http.Client{},
+		writeURL: "http://keto-write.local",
+		client:   clientForHandler(handler),
 	}
 
 	err := s.CreateRelation(context.Background(), "n", "o", "r", "s")

backend/internal/service/relying_party_service_test.go

@@ -1,13 +1,13 @@
 /*
 이 테스트 파일은 RelyingPartyService의 기능을 검증하기 위한 유닛 테스트입니다.
-RelyingPartyService는 HydraAdminService, KetoService, RelyingPartyRepository와 협력하므로
+RelyingPartyService는 HydraAdminService, KetoService와 협력하므로
 각 의존성을 모킹(Mocking)하여 통합 로직을 검증합니다.
 
 주요 테스트 항목:
-1. Create: Hydra 클라이언트 생성 -> DB 저장 -> Keto 권한 설정 (성공 및 롤백 시나리오)
-2. Get: DB 및 Hydra에서 정보 조회
-3. Update: Hydra 및 DB 업데이트
-4. Delete: DB 및 Hydra 삭제
+1. Create: Hydra 클라이언트 생성 -> Keto 권한 설정
+2. Get: Hydra에서 정보 조회
+3. Update: Hydra 업데이트
+4. Delete: Hydra 삭제 + Keto 권한 정리
 */
 
 package service
@@ -18,6 +18,7 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 
@@ -26,43 +27,6 @@ import (
 
 // --- Mocks ---
 
-type MockRelyingPartyRepository struct {
-	mock.Mock
-}
-
-func (m *MockRelyingPartyRepository) Create(ctx context.Context, rp *domain.RelyingParty) error {
-	args := m.Called(ctx, rp)
-	return args.Error(0)
-}
-
-func (m *MockRelyingPartyRepository) Update(ctx context.Context, rp *domain.RelyingParty) error {
-	args := m.Called(ctx, rp)
-	return args.Error(0)
-}
-
-func (m *MockRelyingPartyRepository) Delete(ctx context.Context, clientID string) error {
-	args := m.Called(ctx, clientID)
-	return args.Error(0)
-}
-
-func (m *MockRelyingPartyRepository) FindByID(ctx context.Context, clientID string) (*domain.RelyingParty, error) {
-	args := m.Called(ctx, clientID)
-	if rp, ok := args.Get(0).(*domain.RelyingParty); ok {
-		return rp, args.Error(1)
-	}
-	return nil, args.Error(1)
-}
-
-func (m *MockRelyingPartyRepository) ListByTenantID(ctx context.Context, tenantID string) ([]domain.RelyingParty, error) {
-	args := m.Called(ctx, tenantID)
-	return args.Get(0).([]domain.RelyingParty), args.Error(1)
-}
-
-func (m *MockRelyingPartyRepository) ListAll(ctx context.Context) ([]domain.RelyingParty, error) {
-	args := m.Called(ctx)
-	return args.Get(0).([]domain.RelyingParty), args.Error(1)
-}
-
 type MockKetoService struct {
 	mock.Mock
 }
@@ -82,11 +46,35 @@ func (m *MockKetoService) DeleteRelation(ctx context.Context, namespace, object,
 	return args.Error(0)
 }
 
+func (m *MockKetoService) ListRelations(ctx context.Context, namespace, object, relation, subject string) ([]RelationTuple, error) {
+	args := m.Called(ctx, namespace, object, relation, subject)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).([]RelationTuple), args.Error(1)
+}
+
+// --- Test Helpers ---
+
+type hydraRoundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (f hydraRoundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func mockHydraClient(handler http.Handler) *http.Client {
+	return &http.Client{
+		Transport: hydraRoundTripperFunc(func(req *http.Request) (*http.Response, error) {
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+			return rec.Result(), nil
+		}),
+	}
+}
+
 // --- Tests ---
 
 func TestRelyingPartyService_Create_Success(t *testing.T) {
-	// Setup
-	mockRepo := new(MockRelyingPartyRepository)
 	mockKeto := new(MockKetoService)
 
 	tenantID := "tenant-1"
@@ -98,16 +86,16 @@ func TestRelyingPartyService_Create_Success(t *testing.T) {
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == http.MethodPost && strings.Contains(r.URL.Path, "/clients") {
 			var req domain.HydraClient
-			json.NewDecoder(r.Body).Decode(&req)
-			
-			// Verify metadata injection
+			_ = json.NewDecoder(r.Body).Decode(&req)
+
+			// 메타데이터 tenant_id 주입 확인
 			if req.Metadata["tenant_id"] != tenantID {
 				t.Errorf("expected tenant_id in metadata")
 			}
 
 			req.ClientID = "generated-client-id"
 			w.WriteHeader(http.StatusCreated)
-			json.NewEncoder(w).Encode(req)
+			_ = json.NewEncoder(w).Encode(req)
 			return
 		}
 		http.NotFound(w, r)
@@ -117,31 +105,25 @@ func TestRelyingPartyService_Create_Success(t *testing.T) {
 		HTTPClient: mockHydraClient(hydraHandler),
 	}
 
-	// Expectations
-	mockRepo.On("Create", mock.Anything, mock.MatchedBy(func(rp *domain.RelyingParty) bool {
-		return rp.ClientID == "generated-client-id" && rp.TenantID == tenantID
-	})).Return(nil)
-
 	mockKeto.On("CreateRelation", mock.Anything, "RelyingParty", "generated-client-id", "parent_tenant", "Tenant:"+tenantID).Return(nil)
 
-	// Execute
-	svc := NewRelyingPartyService(mockRepo, hydraSvc, mockKeto)
+	svc := NewRelyingPartyService(hydraSvc, mockKeto)
 	rp, err := svc.Create(context.Background(), tenantID, inputClient)
 
-	// Verify
 	if err != nil {
 		t.Fatalf("Create failed: %v", err)
 	}
 	if rp.ClientID != "generated-client-id" {
 		t.Errorf("expected client id generated-client-id, got %s", rp.ClientID)
 	}
+	if rp.TenantID != tenantID {
+		t.Errorf("expected tenant id %s, got %s", tenantID, rp.TenantID)
+	}
 
-	mockRepo.AssertExpectations(t)
 	mockKeto.AssertExpectations(t)
 }
 
 func TestRelyingPartyService_Create_HydraFail(t *testing.T) {
-	mockRepo := new(MockRelyingPartyRepository)
 	mockKeto := new(MockKetoService)
 
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -152,7 +134,7 @@ func TestRelyingPartyService_Create_HydraFail(t *testing.T) {
 		HTTPClient: mockHydraClient(hydraHandler),
 	}
 
-	svc := NewRelyingPartyService(mockRepo, hydraSvc, mockKeto)
+	svc := NewRelyingPartyService(hydraSvc, mockKeto)
 	_, err := svc.Create(context.Background(), "tenant-1", domain.HydraClient{})
 
 	if err == nil {
@@ -160,16 +142,119 @@ func TestRelyingPartyService_Create_HydraFail(t *testing.T) {
 	}
 }
 
-func TestRelyingPartyService_Create_DBFail_Rollback(t *testing.T) {
-	mockRepo := new(MockRelyingPartyRepository)
+func TestRelyingPartyService_Create_KetoFail_Rollback(t *testing.T) {
 	mockKeto := new(MockKetoService)
 
 	clientID := "rollback-client-id"
+	deleteCalled := false
 
-	// Hydra Mock: Create Succeeds, Delete Called
 	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == http.MethodPost {
-			json.NewEncoder(w).Encode(domain.HydraClient{ClientID: clientID})
+			_ = json.NewEncoder(w).Encode(domain.HydraClient{ClientID: clientID})
+			return
+		}
+		if r.Method == http.MethodDelete && strings.Contains(r.URL.Path, clientID) {
+			deleteCalled = true
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		http.NotFound(w, r)
+	})
+	hydraSvc := &HydraAdminService{
+		AdminURL:   "http://hydra:4445",
+		HTTPClient: mockHydraClient(hydraHandler),
+	}
+
+	mockKeto.On("CreateRelation", mock.Anything, "RelyingParty", clientID, "parent_tenant", "Tenant:tenant-1").Return(errors.New("keto error"))
+
+	svc := NewRelyingPartyService(hydraSvc, mockKeto)
+	_, err := svc.Create(context.Background(), "tenant-1", domain.HydraClient{})
+
+	if err == nil {
+		t.Error("expected error from keto")
+	}
+	if !deleteCalled {
+		t.Error("expected hydra client cleanup on keto failure")
+	}
+
+	mockKeto.AssertExpectations(t)
+}
+
+func TestRelyingPartyService_Get_Success(t *testing.T) {
+	mockKeto := new(MockKetoService)
+	clientID := "client-123"
+
+	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(domain.HydraClient{
+			ClientID:   clientID,
+			ClientName: "Hydra Name",
+			Metadata: map[string]interface{}{
+				"tenant_id": "tenant-1",
+			},
+		})
+	})
+	hydraSvc := &HydraAdminService{
+		AdminURL:   "http://hydra:4445",
+		HTTPClient: mockHydraClient(hydraHandler),
+	}
+
+	svc := NewRelyingPartyService(hydraSvc, mockKeto)
+	rp, hc, err := svc.Get(context.Background(), clientID)
+
+	if err != nil {
+		t.Fatalf("Get failed: %v", err)
+	}
+	if rp.Name != "Hydra Name" {
+		t.Errorf("expected Hydra Name, got %s", rp.Name)
+	}
+	if hc.ClientName != "Hydra Name" {
+		t.Errorf("expected Hydra Name, got %s", hc.ClientName)
+	}
+}
+
+func TestRelyingPartyService_Update_Success(t *testing.T) {
+	mockKeto := new(MockKetoService)
+	clientID := "client-123"
+
+	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPut {
+			var req domain.HydraClient
+			_ = json.NewDecoder(r.Body).Decode(&req)
+			_ = json.NewEncoder(w).Encode(req)
+			return
+		}
+	})
+	hydraSvc := &HydraAdminService{
+		AdminURL:   "http://hydra:4445",
+		HTTPClient: mockHydraClient(hydraHandler),
+	}
+
+	svc := NewRelyingPartyService(hydraSvc, mockKeto)
+
+	updateReq := domain.HydraClient{ClientName: "New Name"}
+	rp, err := svc.Update(context.Background(), clientID, updateReq)
+
+	if err != nil {
+		t.Fatalf("Update failed: %v", err)
+	}
+	if rp.Name != "New Name" {
+		t.Errorf("expected New Name, got %s", rp.Name)
+	}
+}
+
+func TestRelyingPartyService_Delete_Success(t *testing.T) {
+	mockKeto := new(MockKetoService)
+	clientID := "client-123"
+	tenantID := "tenant-1"
+
+	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodGet && strings.Contains(r.URL.Path, clientID) {
+			_ = json.NewEncoder(w).Encode(domain.HydraClient{
+				ClientID: clientID,
+				Metadata: map[string]interface{}{
+					"tenant_id": tenantID,
+				},
+			})
 			return
 		}
 		if r.Method == http.MethodDelete && strings.Contains(r.URL.Path, clientID) {
@@ -183,113 +268,14 @@ func TestRelyingPartyService_Create_DBFail_Rollback(t *testing.T) {
 		HTTPClient: mockHydraClient(hydraHandler),
 	}
 
-	// DB Fails
-	mockRepo.On("Create", mock.Anything, mock.Anything).Return(errors.New("db error"))
+	mockKeto.On("DeleteRelation", mock.Anything, "RelyingParty", clientID, "parent_tenant", "Tenant:"+tenantID).Return(nil)
 
-	svc := NewRelyingPartyService(mockRepo, hydraSvc, mockKeto)
-	_, err := svc.Create(context.Background(), "tenant-1", domain.HydraClient{})
-
-	if err == nil {
-		t.Error("expected error from db")
-	}
-
-	mockRepo.AssertExpectations(t)
-	// Keto should NOT be called
-	mockKeto.AssertNotCalled(t, "CreateRelation")
-}
-
-func TestRelyingPartyService_Get_Success(t *testing.T) {
-	mockRepo := new(MockRelyingPartyRepository)
-	mockKeto := new(MockKetoService)
-	clientID := "client-123"
-
-	mockRepo.On("FindByID", mock.Anything, clientID).Return(&domain.RelyingParty{ClientID: clientID, Name: "DB Name"}, nil)
-
-	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		json.NewEncoder(w).Encode(domain.HydraClient{ClientID: clientID, ClientName: "Hydra Name"})
-	})
-	hydraSvc := &HydraAdminService{
-		AdminURL:   "http://hydra:4445",
-		HTTPClient: mockHydraClient(hydraHandler),
-	}
-
-	svc := NewRelyingPartyService(mockRepo, hydraSvc, mockKeto)
-	rp, hc, err := svc.Get(context.Background(), clientID)
-
-	if err != nil {
-		t.Fatalf("Get failed: %v", err)
-	}
-	if rp.Name != "DB Name" {
-		t.Errorf("expected DB Name, got %s", rp.Name)
-	}
-	if hc.ClientName != "Hydra Name" {
-		t.Errorf("expected Hydra Name, got %s", hc.ClientName)
-	}
-}
-
-func TestRelyingPartyService_Update_Success(t *testing.T) {
-	mockRepo := new(MockRelyingPartyRepository)
-	mockKeto := new(MockKetoService)
-	clientID := "client-123"
-
-	// Hydra Update
-	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == http.MethodPut {
-			var req domain.HydraClient
-			json.NewDecoder(r.Body).Decode(&req)
-			json.NewEncoder(w).Encode(req)
-			return
-		}
-	})
-	hydraSvc := &HydraAdminService{
-		AdminURL:   "http://hydra:4445",
-		HTTPClient: mockHydraClient(hydraHandler),
-	}
-
-	// DB Update
-	mockRepo.On("FindByID", mock.Anything, clientID).Return(&domain.RelyingParty{ClientID: clientID, Name: "Old Name"}, nil)
-	mockRepo.On("Update", mock.Anything, mock.MatchedBy(func(rp *domain.RelyingParty) bool {
-		return rp.Name == "New Name"
-	})).Return(nil)
-
-	svc := NewRelyingPartyService(mockRepo, hydraSvc, mockKeto)
-	
-	updateReq := domain.HydraClient{ClientName: "New Name"}
-	rp, err := svc.Update(context.Background(), clientID, updateReq)
-
-	if err != nil {
-		t.Fatalf("Update failed: %v", err)
-	}
-	if rp.Name != "New Name" {
-		t.Errorf("expected New Name, got %s", rp.Name)
-	}
-
-	mockRepo.AssertExpectations(t)
-}
-
-func TestRelyingPartyService_Delete_Success(t *testing.T) {
-	mockRepo := new(MockRelyingPartyRepository)
-	mockKeto := new(MockKetoService)
-	clientID := "client-123"
-
-	mockRepo.On("Delete", mock.Anything, clientID).Return(nil)
-
-	hydraHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == http.MethodDelete {
-			w.WriteHeader(http.StatusNoContent)
-		}
-	})
-	hydraSvc := &HydraAdminService{
-		AdminURL:   "http://hydra:4445",
-		HTTPClient: mockHydraClient(hydraHandler),
-	}
-
-	svc := NewRelyingPartyService(mockRepo, hydraSvc, mockKeto)
+	svc := NewRelyingPartyService(hydraSvc, mockKeto)
 	err := svc.Delete(context.Background(), clientID)
 
 	if err != nil {
 		t.Fatalf("Delete failed: %v", err)
 	}
 
-	mockRepo.AssertExpectations(t)
+	mockKeto.AssertExpectations(t)
 }