Initial import with GitLab CI/CD and registry deploy flow

tests/test_security_track1.py

@@ -0,0 +1,66 @@
+from fastapi import Depends, FastAPI
+from fastapi.testclient import TestClient
+
+from services.shared.core import Role
+from services.shared.security import get_actor, issue_app_token, require_roles
+
+
+def build_app() -> FastAPI:
+    app = FastAPI()
+
+    @app.get('/actor')
+    def actor_view(actor: dict = Depends(get_actor)) -> dict:
+        return actor
+
+    @app.get('/admin')
+    def admin_view(_: dict = Depends(require_roles(Role.ADMIN))) -> dict:
+        return {'ok': True}
+
+    return app
+
+
+def test_valid_bearer_token_resolves_actor(monkeypatch):
+    monkeypatch.setenv('APP_TOKEN_SECRET', 'track1-secret')
+    client = TestClient(build_app())
+    token = issue_app_token(
+        subject='usr_1',
+        username='alice',
+        role='admin',
+        auth_source='oidc',
+        provider='keycloak',
+    )
+
+    response = client.get('/actor', headers={'Authorization': f'Bearer {token}'})
+
+    assert response.status_code == 200
+    body = response.json()
+    assert body['user'] == 'alice'
+    assert body['role'] == 'admin'
+    assert body['auth_source'] == 'oidc'
+
+
+def test_invalid_bearer_token_returns_401(monkeypatch):
+    monkeypatch.setenv('APP_TOKEN_SECRET', 'track1-secret')
+    client = TestClient(build_app())
+
+    response = client.get('/actor', headers={'Authorization': 'Bearer broken.token.value'})
+
+    assert response.status_code == 401
+
+
+def test_legacy_header_auth_can_be_disabled(monkeypatch):
+    monkeypatch.setenv('ALLOW_LEGACY_HEADER_AUTH', '0')
+    client = TestClient(build_app())
+
+    response = client.get('/admin', headers={'X-User': 'admin', 'X-Role': 'admin'})
+
+    assert response.status_code == 403
+
+
+def test_legacy_header_auth_still_works_when_enabled(monkeypatch):
+    monkeypatch.setenv('ALLOW_LEGACY_HEADER_AUTH', '1')
+    client = TestClient(build_app())
+
+    response = client.get('/admin', headers={'X-User': 'admin', 'X-Role': 'admin'})
+
+    assert response.status_code == 200