auth: add Keycloak OIDC verifier, role check, and test mock

backend/internal/auth/oidc_test.go

@@ -0,0 +1,31 @@
+package auth
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestIDTokenClaims_HasRole(t *testing.T) {
+	cases := []struct {
+		name string
+		json string
+		role string
+		want bool
+	}{
+		{"role present among others", `{"realm_access":{"roles":["geniusrun-user","other"]}}`, "geniusrun-user", true},
+		{"role absent", `{"realm_access":{"roles":["other"]}}`, "geniusrun-user", false},
+		{"realm_access missing entirely", `{}`, "geniusrun-user", false},
+		{"roles array empty", `{"realm_access":{"roles":[]}}`, "geniusrun-user", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var c idTokenClaims
+			if err := json.Unmarshal([]byte(tc.json), &c); err != nil {
+				t.Fatalf("unmarshal: %v", err)
+			}
+			if got := c.hasRole(tc.role); got != tc.want {
+				t.Errorf("hasRole(%q) = %v, want %v", tc.role, got, tc.want)
+			}
+		})
+	}
+}