WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/application/service/user_jwt_test.go

@@ -0,0 +1,95 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+func TestIsRefreshTokenClaims(t *testing.T) {
+	cases := []struct {
+		name   string
+		claims jwt.MapClaims
+		want   bool
+	}{
+		{name: "refresh", claims: jwt.MapClaims{"type": "refresh"}, want: true},
+		{name: "access", claims: jwt.MapClaims{"type": "access"}, want: false},
+		{name: "missing type", claims: jwt.MapClaims{"user_id": "u1"}, want: false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isRefreshTokenClaims(tc.claims); got != tc.want {
+				t.Fatalf("isRefreshTokenClaims(%v) = %v, want %v", tc.claims, got, tc.want)
+			}
+		})
+	}
+}
+
+// tenantIDFromClaims is the JWT->tenant-id projection used by
+// userService.ValidateToken. It must:
+//   - prefer the claim when present (so /auth/switch-tenant takes effect)
+//   - fall back to the caller-supplied default when the claim is absent
+//     (backward compatibility with tokens minted before tenant-level RBAC)
+//   - reject zero / negative claim values rather than scoping the session
+//     to "tenant 0"
+//
+// These tests are pure-function so they don't need any DB/repo plumbing.
+func TestTenantIDFromClaims(t *testing.T) {
+	cases := []struct {
+		name     string
+		claims   jwt.MapClaims
+		fallback uint64
+		want     uint64
+	}{
+		{
+			name:     "json number wins over fallback",
+			claims:   jwt.MapClaims{"tenant_id": float64(99)},
+			fallback: 1,
+			want:     99,
+		},
+		{
+			name:     "missing claim falls back to home tenant",
+			claims:   jwt.MapClaims{"user_id": "u1"},
+			fallback: 7,
+			want:     7,
+		},
+		{
+			name:     "zero claim treated as missing",
+			claims:   jwt.MapClaims{"tenant_id": float64(0)},
+			fallback: 5,
+			want:     5,
+		},
+		{
+			name:     "negative claim treated as missing",
+			claims:   jwt.MapClaims{"tenant_id": float64(-3)},
+			fallback: 5,
+			want:     5,
+		},
+		{
+			name:     "string claim treated as missing",
+			claims:   jwt.MapClaims{"tenant_id": "12"},
+			fallback: 8,
+			want:     8,
+		},
+		{
+			name:     "int64 claim accepted (test-built tokens)",
+			claims:   jwt.MapClaims{"tenant_id": int64(42)},
+			fallback: 1,
+			want:     42,
+		},
+		{
+			name:     "uint64 claim accepted",
+			claims:   jwt.MapClaims{"tenant_id": uint64(123)},
+			fallback: 1,
+			want:     123,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tenantIDFromClaims(tc.claims, tc.fallback); got != tc.want {
+				t.Fatalf("tenantIDFromClaims(%v, %d) = %d, want %d",
+					tc.claims, tc.fallback, got, tc.want)
+			}
+		})
+	}
+}