auth: add Keycloak OIDC verifier, role check, and test mock

backend/internal/auth/mock/mock.go

@@ -0,0 +1,41 @@
+// Package mock provides a fake auth.Verifier for tests that need to exercise
+// internal/api's session endpoints and RequireSession gating without a real
+// Keycloak instance.
+package mock
+
+import (
+	"context"
+	"net/url"
+
+	"geniusrun/backend/internal/auth"
+)
+
+// Verifier is a fake auth.Verifier returning canned results supplied by the
+// test/caller.
+type Verifier struct {
+	AuthURL          string
+	Txn              auth.TxnState
+	CallbackResult   auth.LoginResult
+	CallbackErr      error
+	EndSessionResult string // if empty, EndSessionURL returns postLogoutRedirectURL unchanged
+}
+
+var _ auth.Verifier = (*Verifier)(nil)
+
+func (v *Verifier) BeginLogin() (string, auth.TxnState, error) {
+	return v.AuthURL, v.Txn, nil
+}
+
+func (v *Verifier) HandleCallback(ctx context.Context, txn auth.TxnState, query url.Values) (auth.LoginResult, error) {
+	if v.CallbackErr != nil {
+		return auth.LoginResult{}, v.CallbackErr
+	}
+	return v.CallbackResult, nil
+}
+
+func (v *Verifier) EndSessionURL(postLogoutRedirectURL string) string {
+	if v.EndSessionResult != "" {
+		return v.EndSessionResult
+	}
+	return postLogoutRedirectURL
+}