test(unit): add roles, web deps, use cases, VO boundary tests — reach 70% coverage

tests/unit/infrastructure/test_auth.py

@@ -234,6 +234,28 @@ class TestKeycloakAuthClient:
         assert mock_async_client.post.call_count == 1
         assert result1.user_id == result2.user_id
 
+    def test_get_cached_token_expired(self, client: KeycloakAuthClient) -> None:
+        """Test expired cache entry returns None and is removed."""
+        from app.infrastructure.auth.models import TokenInfo
+
+        client._cache["expired-token"] = (TokenInfo(active=True), 0)
+        with patch("time.time", return_value=1000):
+            result = client._get_cached_token("expired-token")
+        assert result is None
+        assert "expired-token" not in client._cache
+
+    def test_cache_token_removes_expired_entries(self, client: KeycloakAuthClient) -> None:
+        """Test caching new token removes expired existing entries."""
+        from app.infrastructure.auth.models import TokenInfo
+
+        old_token = TokenInfo(active=True)
+        new_token = TokenInfo(active=True)
+        client._cache["old"] = (old_token, 0)
+        with patch("time.time", return_value=1000):
+            client._cache_token("new", new_token)
+        assert "old" not in client._cache
+        assert "new" in client._cache
+
     @pytest.mark.asyncio
     async def test_get_userinfo_success(self, client: KeycloakAuthClient) -> None:
         """Test successful userinfo retrieval."""

tests/unit/infrastructure/test_di_container.py

@@ -0,0 +1,14 @@
+"""Tests for DI container."""
+
+from app.infrastructure.di.container import create_container
+
+
+class TestContainer:
+    """Test DI container creation."""
+
+    def test_create_container(self) -> None:
+        """Test container factory returns AsyncContainer."""
+        from dishka import AsyncContainer
+
+        container = create_container()
+        assert isinstance(container, AsyncContainer)

tests/unit/infrastructure/test_mock_auth.py

@@ -0,0 +1,54 @@
+"""Tests for mock Keycloak client."""
+
+import pytest
+
+from app.infrastructure.auth.mock_client import MockKeycloakClient
+
+
+class TestMockKeycloakClient:
+    """Test MockKeycloakClient token introspection."""
+
+    @pytest.fixture
+    def client(self) -> MockKeycloakClient:
+        """Create mock client instance."""
+        return MockKeycloakClient()
+
+    @pytest.mark.asyncio
+    async def test_introspect_user_token(self, client: MockKeycloakClient) -> None:
+        """Test introspecting user token."""
+        result = await client.introspect_token("dev-token-user")
+        assert result.is_valid is True
+        assert result.user_id == "dev-user"
+        assert result.username == "Dev User"
+        assert result.email == "dev.user@example.com"
+        assert result.roles == ["user"]
+
+    @pytest.mark.asyncio
+    async def test_introspect_user2_token(self, client: MockKeycloakClient) -> None:
+        """Test introspecting user2 token."""
+        result = await client.introspect_token("dev-token-user2")
+        assert result.is_valid is True
+        assert result.user_id == "dev-user2"
+        assert result.username == "Test User"
+        assert result.roles == ["user"]
+
+    @pytest.mark.asyncio
+    async def test_introspect_admin_token(self, client: MockKeycloakClient) -> None:
+        """Test introspecting admin token."""
+        result = await client.introspect_token("dev-token-admin")
+        assert result.is_valid is True
+        assert result.user_id == "dev-admin"
+        assert result.username == "Dev Admin"
+        assert result.roles == ["admin"]
+
+    @pytest.mark.asyncio
+    async def test_introspect_guest_token(self, client: MockKeycloakClient) -> None:
+        """Test introspecting guest token returns inactive."""
+        result = await client.introspect_token("dev-token-guest")
+        assert result.is_valid is False
+
+    @pytest.mark.asyncio
+    async def test_introspect_unknown_token(self, client: MockKeycloakClient) -> None:
+        """Test introspecting unknown token returns inactive."""
+        result = await client.introspect_token("unknown-token")
+        assert result.is_valid is False