启动自检 issuer 不一致拒绝启动;路由覆盖 fail-closed;Keycloak 配置解析测试(ADR-012)

上一个任务把统一鉴权中心接上了,但缺配置照常起、issuer 配错也照常起 —— 每个请求都 401 还查不出原因。boot() 开头补两道保险:缺 KEYCLOAK_URL/REALM/CLIENT_ID 直接拒绝启动;配了就拉一次 .well-known/openid-configuration 核对 issuer,不一致同样拒绝启动 (话里带期望/实际/KC_HOSTNAME,照后端接入手册第 5 步)。另加路由覆盖 it 测试:Hono 里每条注册路由都必须能在 appRouteRegistry() 里查到归属,查不到就是一个没人管的权限口子。真库跑通,96 条路由全部有归属、0 条查不到——把上一个任务里人工核对的结论固化成测试。
2026-08-25 18:04:21 +08:00
parent 8dc71db9d8
commit 61622f94d5
5 changed files with 185 additions and 0 deletions
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest';
+import type { KeycloakConfig } from '../config.ts';
+import { checkKeycloakConnection } from '../keycloak-check.ts';
+
+const kc: KeycloakConfig = {
+  url: 'https://kc.test',
+  realm: 'corp',
+  clientId: 'api-gateway',
+  issuer: 'https://kc.test/realms/corp',
+  jwksUrl: 'https://kc.test/realms/corp/protocol/openid-connect/certs',
+};
+const reply = (status: number, body: unknown): typeof fetch => async () =>
+  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+
+describe('启动自检(手册第 5 步)', () => {
+  it('issuer 一致 → 回 issuer 与 clientId', async () => {
+    await expect(checkKeycloakConnection(kc, reply(200, { issuer: kc.issuer }))).resolves.toEqual({
+      issuer: kc.issuer,
+      clientId: 'api-gateway',
+    });
+  });
+  it('issuer 不一致 → 抛,话里带期望 / 实际 / KC_HOSTNAME', async () => {
+    await expect(checkKeycloakConnection(kc, reply(200, { issuer: 'http://localhost:8080/realms/corp' }))).rejects.toThrow(
+      /KC_HOSTNAME/,
+    );
+  });
+  it('发现文档拉不到 → 抛带状态码', async () => {
+    await expect(checkKeycloakConnection(kc, reply(503, {}))).rejects.toThrow(/503/);
+  });
+});