ilpanich / axiam / 29830888120

83%

push

github

fix(bench): make Keycloak and Zitadel seed users loginable

Two seed-provisioning bugs left the benchmark bench users in a
non-loginable state, failing the post-seed smoke checks.

Keycloak (keycloak-ropc-login HTTP 400 "Account is not fully set up"):
KC 24+ ships the declarative user profile enabled with firstName and
lastName required. The bench user was created without them, so KC
attached a VERIFY_PROFILE required action on first login that the
non-interactive ROPC grant cannot satisfy. Add firstName/lastName and
requiredActions:[] to the create payload, PUT the corrected state
unconditionally (kc_post treats 409 as OK without updating, so a stale
user would keep its broken state across re-seeds), and verify no
required actions remain.

Zitadel (session-create HTTP 400 "User has not set a password"):
the human user was created with a top-level "password" field, which is
an unknown key to the management-v1 AddHumanUserRequest schema and is
silently dropped by the gRPC gateway, leaving the user in
USER_STATE_INITIAL with no password. Use the correct field name,
initialPassword, which creates the user already ACTIVE.

Both fixes verified end-to-end against live keycloak:26.7.0 and zitadel
containers: all seed smoke checks (incl. real password session-create)
pass, and a Keycloak re-seed exercises the idempotent PUT path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D2Q2PPBgvLEwrbNzXUqetL

1682 of 1859 branches covered (90.48%)

Branch coverage included in aggregate %.

28697 of 34898 relevant lines covered (82.23%)

69.85 hits per line