feat(project): init

tests/iam_client_cache.rs

@@ -0,0 +1,128 @@
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, AtomicUsize, Ordering},
+};
+use std::time::Duration;
+
+use axum::{Json, Router, routing::post};
+use axum::response::IntoResponse;
+use cms_service::infrastructure::iam_client::{IamClient, IamClientConfig};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Deserialize)]
+struct AuthorizationCheckRequest {
+    permission: String,
+}
+
+#[derive(Debug, Serialize)]
+struct AuthorizationCheckResponse {
+    allowed: bool,
+}
+
+#[derive(Debug, Serialize)]
+struct ApiSuccessResponse<T> {
+    code: u32,
+    message: String,
+    data: T,
+    trace_id: Option<String>,
+}
+
+async fn start_mock_iam(
+    call_count: Arc<AtomicUsize>,
+    fail: Arc<AtomicBool>,
+) -> (String, tokio::task::JoinHandle<()>) {
+    let app = Router::new().route(
+        "/authorize/check",
+        post(move |Json(body): Json<AuthorizationCheckRequest>| {
+            let call_count = call_count.clone();
+            let fail = fail.clone();
+            async move {
+                call_count.fetch_add(1, Ordering::SeqCst);
+                if fail.load(Ordering::SeqCst) {
+                    return (axum::http::StatusCode::INTERNAL_SERVER_ERROR, "fail").into_response();
+                }
+
+                let allowed = body.permission == "cms:article:read";
+                let resp = ApiSuccessResponse {
+                    code: 0,
+                    message: "ok".to_string(),
+                    data: AuthorizationCheckResponse { allowed },
+                    trace_id: None,
+                };
+                (axum::http::StatusCode::OK, Json(resp)).into_response()
+            }
+        }),
+    );
+
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    let base_url = format!("http://{}", addr);
+    let handle = tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+    (base_url, handle)
+}
+
+#[tokio::test]
+async fn iam_client_caches_decisions() {
+    let call_count = Arc::new(AtomicUsize::new(0));
+    let fail = Arc::new(AtomicBool::new(false));
+    let (base_url, handle) = start_mock_iam(call_count.clone(), fail.clone()).await;
+
+    let client = IamClient::new(IamClientConfig {
+        base_url,
+        timeout: Duration::from_millis(500),
+        cache_ttl: Duration::from_secs(5),
+        cache_stale_if_error: Duration::from_secs(30),
+        cache_max_entries: 1000,
+    });
+
+    let tenant_id = uuid::Uuid::new_v4();
+    let user_id = uuid::Uuid::new_v4();
+
+    client
+        .require_permission(tenant_id, user_id, "cms:article:read", "token")
+        .await
+        .unwrap();
+    client
+        .require_permission(tenant_id, user_id, "cms:article:read", "token")
+        .await
+        .unwrap();
+
+    assert_eq!(call_count.load(Ordering::SeqCst), 1);
+    handle.abort();
+}
+
+#[tokio::test]
+async fn iam_client_uses_stale_cache_on_error() {
+    let call_count = Arc::new(AtomicUsize::new(0));
+    let fail = Arc::new(AtomicBool::new(false));
+    let (base_url, handle) = start_mock_iam(call_count.clone(), fail.clone()).await;
+
+    let client = IamClient::new(IamClientConfig {
+        base_url,
+        timeout: Duration::from_millis(500),
+        cache_ttl: Duration::from_millis(50),
+        cache_stale_if_error: Duration::from_secs(30),
+        cache_max_entries: 1000,
+    });
+
+    let tenant_id = uuid::Uuid::new_v4();
+    let user_id = uuid::Uuid::new_v4();
+
+    client
+        .require_permission(tenant_id, user_id, "cms:article:read", "token")
+        .await
+        .unwrap();
+
+    tokio::time::sleep(Duration::from_millis(70)).await;
+    fail.store(true, Ordering::SeqCst);
+
+    client
+        .require_permission(tenant_id, user_id, "cms:article:read", "token")
+        .await
+        .unwrap();
+
+    assert!(call_count.load(Ordering::SeqCst) >= 1);
+    handle.abort();
+}