개발자 권한 앱 생성 오류 수정

backend/internal/handler/dev_handler_test.go

@@ -1102,6 +1102,103 @@ func TestCreateClient_ApprovedDeveloperCanCreatePrivateClient(t *testing.T) {
 	mockOutbox.AssertExpectations(t)
 }
 
+func TestEnsureDeveloperGrantRelation_CreatesRequiredTenantRelations(t *testing.T) {
+	mockKeto := new(devMockKetoService)
+	for _, relation := range []string{"developer_console_grant_manager", "view_dev_console", "grant_dev_permissions"} {
+		mockKeto.On("ListRelations", mock.Anything, "Tenant", "tenant-a", relation, "User:user-1").Return([]service.RelationTuple{}, nil).Once()
+		mockKeto.On("CreateRelation", mock.Anything, "Tenant", "tenant-a", relation, "User:user-1").Return(nil).Once()
+	}
+
+	mockOutbox := new(devMockKetoOutboxRepository)
+	for _, relation := range []string{"developer_console_grant_manager", "view_dev_console", "grant_dev_permissions"} {
+		expectedRelation := relation
+		mockOutbox.On("Create", mock.Anything, mock.MatchedBy(func(entry *domain.KetoOutbox) bool {
+			return entry.Namespace == "Tenant" &&
+				entry.Object == "tenant-a" &&
+				entry.Relation == expectedRelation &&
+				entry.Subject == "User:user-1" &&
+				entry.Action == domain.KetoOutboxActionCreate
+		})).Return(nil).Once()
+	}
+
+	h := &DevHandler{
+		Keto:       mockKeto,
+		KetoOutbox: mockOutbox,
+	}
+
+	app := fiber.New()
+	app.Get("/test", func(c *fiber.Ctx) error {
+		h.ensureDeveloperGrantRelation(c, "user-1", "tenant-a")
+		return c.SendStatus(fiber.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/test", nil)
+	resp, _ := app.Test(req, -1)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	mockKeto.AssertExpectations(t)
+	mockOutbox.AssertExpectations(t)
+}
+
+func TestEnsureDeveloperGrantRelation_SkipsExistingTenantRelations(t *testing.T) {
+	mockKeto := new(devMockKetoService)
+	for _, relation := range []string{"developer_console_grant_manager", "view_dev_console", "grant_dev_permissions"} {
+		mockKeto.On("ListRelations", mock.Anything, "Tenant", "tenant-a", relation, "User:user-1").
+			Return([]service.RelationTuple{{Namespace: "Tenant", Object: "tenant-a", Relation: relation, SubjectID: "User:user-1"}}, nil).Once()
+	}
+
+	h := &DevHandler{
+		Keto:       mockKeto,
+		KetoOutbox: new(devMockKetoOutboxRepository),
+	}
+
+	app := fiber.New()
+	app.Get("/test", func(c *fiber.Ctx) error {
+		h.ensureDeveloperGrantRelation(c, "user-1", "tenant-a")
+		return c.SendStatus(fiber.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/test", nil)
+	resp, _ := app.Test(req, -1)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	mockKeto.AssertExpectations(t)
+}
+
+func TestRevokeDeveloperGrantRelation_DeletesRequiredTenantRelations(t *testing.T) {
+	mockKeto := new(devMockKetoService)
+	for _, relation := range []string{"developer_console_grant_manager", "view_dev_console", "grant_dev_permissions"} {
+		mockKeto.On("DeleteRelation", mock.Anything, "Tenant", "tenant-a", relation, "User:user-1").Return(nil).Once()
+	}
+
+	mockOutbox := new(devMockKetoOutboxRepository)
+	for _, relation := range []string{"developer_console_grant_manager", "view_dev_console", "grant_dev_permissions"} {
+		expectedRelation := relation
+		mockOutbox.On("Create", mock.Anything, mock.MatchedBy(func(entry *domain.KetoOutbox) bool {
+			return entry.Namespace == "Tenant" &&
+				entry.Object == "tenant-a" &&
+				entry.Relation == expectedRelation &&
+				entry.Subject == "User:user-1" &&
+				entry.Action == domain.KetoOutboxActionDelete
+		})).Return(nil).Once()
+	}
+
+	h := &DevHandler{
+		Keto:       mockKeto,
+		KetoOutbox: mockOutbox,
+	}
+
+	app := fiber.New()
+	app.Get("/test", func(c *fiber.Ctx) error {
+		h.revokeDeveloperGrantRelation(c, "user-1", "tenant-a")
+		return c.SendStatus(fiber.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/test", nil)
+	resp, _ := app.Test(req, -1)
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	mockKeto.AssertExpectations(t)
+	mockOutbox.AssertExpectations(t)
+}
+
 func TestGetStats_Success(t *testing.T) {
 	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
 		if r.URL.Path == "/clients" {