From a17654819c6d279c069d5cb799fd1c0dd5f2f028 Mon Sep 17 00:00:00 2001
From: codex <codex@bstein.dev>
Date: Tue, 21 Apr 2026 02:53:23 -0300
Subject: [PATCH] test(ariadne): cover keycloak profile sync edges

---
 .../services/test_keycloak_profile_edges.py   | 81 +++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 tests/unit/services/test_keycloak_profile_edges.py

diff --git a/tests/unit/services/test_keycloak_profile_edges.py b/tests/unit/services/test_keycloak_profile_edges.py
new file mode 100644
index 0000000..e969b5d
--- /dev/null
+++ b/tests/unit/services/test_keycloak_profile_edges.py
@@ -0,0 +1,81 @@
+from __future__ import annotations
+
+from ariadne.services import keycloak_profile
+
+
+class _Admin:
+    def __init__(self, users=None, *, ready: bool = True, fail_update: bool = False) -> None:
+        self.users = users or []
+        self._ready = ready
+        self.fail_update = fail_update
+        self.calls = []
+
+    def ready(self) -> bool:
+        return self._ready
+
+    def iter_users(self, page_size=200, brief=False):
+        return self.users
+
+    def update_user_safe(self, user_id, payload) -> None:
+        if self.fail_update:
+            raise RuntimeError("update failed")
+        self.calls.append((user_id, payload))
+
+
+def test_profile_sync_ready_and_skip_edges(monkeypatch) -> None:
+    assert not keycloak_profile._profile_complete({"email": "", "lastName": "User", "emailVerified": True})
+    assert not keycloak_profile._profile_complete({"email": "a@b.test", "lastName": "", "emailVerified": True})
+    assert not keycloak_profile._profile_complete({"email": "a@b.test", "lastName": "User", "emailVerified": False})
+
+    monkeypatch.setattr(keycloak_profile, "keycloak_admin", _Admin(ready=False))
+    summary = keycloak_profile.run_profile_sync()
+    assert summary.failures == 1
+    assert summary.detail == "keycloak admin not configured"
+
+    users = [
+        {},
+        {"username": "disabled", "enabled": False},
+        {"username": "service-account-demo", "requiredActions": ["UPDATE_PROFILE"]},
+        {"username": "svc", "serviceAccountClientId": "client", "requiredActions": ["UPDATE_PROFILE"]},
+        {"username": "no-actions", "email": "no-actions@bstein.dev", "lastName": "User", "emailVerified": True},
+        {"username": "incomplete", "requiredActions": ["UPDATE_PROFILE"]},
+        {
+            "username": "other-action",
+            "id": "2",
+            "email": "other@bstein.dev",
+            "lastName": "User",
+            "emailVerified": True,
+            "requiredActions": ["CONFIGURE_TOTP"],
+        },
+        {
+            "username": "missing-id",
+            "email": "missing@bstein.dev",
+            "lastName": "User",
+            "emailVerified": True,
+            "requiredActions": ["UPDATE_PROFILE"],
+        },
+    ]
+    monkeypatch.setattr(keycloak_profile, "keycloak_admin", _Admin(users))
+    summary = keycloak_profile.run_profile_sync()
+    assert summary.skipped == 7
+    assert summary.failures == 1
+
+
+def test_profile_sync_update_failure(monkeypatch) -> None:
+    users = [
+        {
+            "id": "1",
+            "username": "alice",
+            "email": "alice@bstein.dev",
+            "lastName": "User",
+            "emailVerified": True,
+            "requiredActions": ["UPDATE_PROFILE", "CONFIGURE_TOTP"],
+        }
+    ]
+    monkeypatch.setattr(keycloak_profile, "keycloak_admin", _Admin(users, fail_update=True))
+
+    summary = keycloak_profile.run_profile_sync()
+    assert summary.processed == 1
+    assert summary.updated == 0
+    assert summary.failures == 1
+