iamtest

Documentation

Overview

Package iamtest provides testing helpers for applications built on the IAM SDK: an httptest-backed mock IAM server, a MockResolver, and a context helper to inject roles/permissions into unit tests.

Index

• func NewContext(ctx context.Context, opts ...Option) context.Context
• type AccountOrganizationDTO
• type MockResolver
  • func NewMockResolver() *MockResolver
  • func (m *MockResolver) Given(role string, perms ...string) *MockResolver
  • func (m *MockResolver) Resolve(_ context.Context, _ string, roles []string) ([]string, error)
• type MockServer
  • func NewMockServer() (*MockServer, error)
  • func (m *MockServer) Given(role string, perms ...string) *MockServer
  • func (m *MockServer) GivenUserProfile(subject string, profile UserProfileDTO) *MockServer
  • func (m *MockServer) Issuer() string
  • func (m *MockServer) MeCalls() int
  • func (m *MockServer) TokenCalls(scope string) int
  • func (m *MockServer) TokenFor(subject string, roles []string) (string, error)
  • func (m *MockServer) TokenForWith(subject string, roles []string, extra map[string]any) (string, error)
  • func (m *MockServer) WithAudience(aud string) *MockServer
• type Option
  • func WithACR(acr string) Option
  • func WithAppID(id string) Option
  • func WithEmail(email string) Option
  • func WithImpersonator(actor string) Option
  • func WithOrg(orgID, orgRole string) Option
  • func WithPermissions(perms ...string) Option
  • func WithRoles(roles ...string) Option
  • func WithSubject(sub string) Option
• type PermissionDefinitionDTO
• type UserProfileDTO

Functions

func NewContext

func NewContext(ctx context.Context, opts ...Option) context.Context

NewContext returns a context carrying an authz.User built from opts.

Types

type AccountOrganizationDTO

type AccountOrganizationDTO struct {
	OrganizationID string `json:"organizationId"`
	Name           string `json:"name"`
	Slug           string `json:"slug,omitempty"`
	Role           string `json:"role"`
	JoinedAt       string `json:"joinedAt,omitempty"`
	Current        bool   `json:"current"`
}

AccountOrganizationDTO mirrors current-user organization membership responses.

type MockResolver

type MockResolver struct {
	// contains filtered or unexported fields
}

MockResolver is a deterministic authz.Resolver for unit tests.

func NewMockResolver

func NewMockResolver() *MockResolver

NewMockResolver returns a fresh MockResolver with no mappings.

func (*MockResolver) Given

func (m *MockResolver) Given(role string, perms ...string) *MockResolver

Given maps role → perms. Chainable.

func (*MockResolver) Resolve

func (m *MockResolver) Resolve(_ context.Context, _ string, roles []string) ([]string, error)

Resolve implements authz.Resolver. Returns the union of permissions for the requested roles, deduplicated + sorted for reproducibility.

type MockServer

type MockServer struct {
	*httptest.Server
	// contains filtered or unexported fields
}

MockServer is an httptest.Server that exposes the subset of IAM endpoints the SDK needs: OIDC discovery, JWKS, resolve, and permission snapshots.

func NewMockServer

func NewMockServer() (*MockServer, error)

NewMockServer spins up a server. Call s.Close() when done.

func (*MockServer) Given

func (m *MockServer) Given(role string, perms ...string) *MockServer

Given maps a role → perms for the resolve endpoint.

func (*MockServer) GivenUserProfile

func (m *MockServer) GivenUserProfile(subject string, profile UserProfileDTO) *MockServer

GivenUserProfile configures the response returned by /api/v1/auth/me for a subject.

func (*MockServer) Issuer

func (m *MockServer) Issuer() string

Issuer returns the URL of the server (used as the JWT issuer).

func (*MockServer) MeCalls

func (m *MockServer) MeCalls() int

MeCalls returns how many times /api/v1/auth/me was invoked.

func (*MockServer) TokenCalls

func (m *MockServer) TokenCalls(scope string) int

TokenCalls returns how many /oauth2/token requests used the given scope.

func (*MockServer) TokenFor

func (m *MockServer) TokenFor(subject string, roles []string) (string, error)

TokenFor signs a JWT for the given subject + roles, with default validity of 5 minutes.

func (*MockServer) TokenForWith

func (m *MockServer) TokenForWith(subject string, roles []string, extra map[string]any) (string, error)

TokenForWith signs a JWT with extra claims merged in (typically app_id, org_id, acr, etc.).

func (*MockServer) WithAudience

func (m *MockServer) WithAudience(aud string) *MockServer

WithAudience sets the aud claim stamped by TokenFor.

type Option

type Option func(*authz.User)

Option mutates a test *authz.User.

func WithACR

func WithACR(acr string) Option

WithACR sets the ACR.

func WithAppID

func WithAppID(id string) Option

WithAppID sets the app_id claim.

func WithEmail

func WithEmail(email string) Option

WithEmail sets the email.

func WithImpersonator

func WithImpersonator(actor string) Option

WithImpersonator marks the user as impersonated by actor.

func WithOrg

func WithOrg(orgID, orgRole string) Option

WithOrg sets the org context.

func WithPermissions

func WithPermissions(perms ...string) Option

WithPermissions sets the permissions.

func WithRoles

func WithRoles(roles ...string) Option

WithRoles sets the roles.

func WithSubject

func WithSubject(sub string) Option

WithSubject sets the user subject.

type PermissionDefinitionDTO

type PermissionDefinitionDTO struct {
	Resource    string `json:"resource"`
	Action      string `json:"action"`
	Description string `json:"description,omitempty"`
}

PermissionDefinitionDTO mirrors the SDK's wire format (duplicated to avoid a dependency on the top-level iam package).

type UserProfileDTO

type UserProfileDTO struct {
	UserID              string                  `json:"userId"`
	ApplicationID       string                  `json:"applicationId,omitempty"`
	GlobalIdentityID    string                  `json:"globalIdentityId,omitempty"`
	Email               string                  `json:"email"`
	EmailVerified       bool                    `json:"emailVerified"`
	Username            string                  `json:"username"`
	DisplayName         string                  `json:"displayName,omitempty"`
	AvatarURL           string                  `json:"avatarUrl,omitempty"`
	Status              string                  `json:"status"`
	CreatedAt           string                  `json:"createdAt,omitempty"`
	UpdatedAt           string                  `json:"updatedAt,omitempty"`
	CurrentOrganization *AccountOrganizationDTO `json:"currentOrganization,omitempty"`
	Roles               []string                `json:"roles,omitempty"`
	Metadata            map[string]any          `json:"metadata,omitempty"`
}

UserProfileDTO mirrors GET /api/v1/auth/me/profile.

Metadata is profile metadata for test profile responses, not App User authorization attributes.