test(security): add integration tests for OIDC providers and session lifecycle

oidc.rs: CREATE/DROP/ALTER OIDC PROVIDER DDL round-trips through the
catalog, SHOW OIDC PROVIDERS, privilege enforcement, and
apply_claim_mapping unit coverage for wildcard and ordered rules.

session_lifecycle.rs: ALTER DATABASE SET IDLE_TIMEOUT cache update and
catalog persistence; KILL SESSION authority matrix (superuser, cluster
admin, database owner, unprivileged); idle-sweep deadline arithmetic
exported via the public re-export path.

security.rs: updated to pass KillReason::AdminKill to
kill_sessions_for_user and assert the watch receiver is not Alive.

catalog_integrity_verify.rs: PutOidcProvider / DeleteOidcProvider
marked Exempt (cluster-level identity config; no per-object owner row).

Mirror and kind_labels tests: propagate idle_session_timeout_secs = 0
into DatabaseDescriptor literals to satisfy the new required field.

Author: farhan-syah

nodedb/src/control/catalog_entry/tests/kind_labels.rs

@@ -4,6 +4,7 @@
 
 use crate::control::catalog_entry::entry::CatalogEntry;
 use crate::control::security::catalog::StoredCollection;
+use crate::control::security::catalog::oidc_providers::StoredOidcProvider;
 use crate::control::security::catalog::sequence_types::StoredSequence;
 
 #[test]
@@ -32,4 +33,23 @@ fn kind_label_is_stable() {
         .kind(),
         "delete_sequence"
     );
+    let provider = StoredOidcProvider {
+        provider_name: "test".into(),
+        issuer: "https://example.com".into(),
+        jwks_uri: "https://example.com/.well-known/jwks.json".into(),
+        audience: None,
+        claim_mapping: vec![],
+        created_at_lsn: 0,
+    };
+    assert_eq!(
+        CatalogEntry::PutOidcProvider(Box::new(provider)).kind(),
+        "put_oidc_provider"
+    );
+    assert_eq!(
+        CatalogEntry::DeleteOidcProvider {
+            name: "test".into()
+        }
+        .kind(),
+        "delete_oidc_provider"
+    );
 }

nodedb/tests/catalog_integrity_verify.rs

@@ -175,5 +175,10 @@ fn classify(entry: &CatalogEntry) -> VariantClass {
         CatalogEntry::CloneDatabase { .. } => VariantClass::Exempt,
         // Move tenant cutover re-keys collections; no ownership object is created.
         CatalogEntry::MoveTenantCutover { .. } => VariantClass::Exempt,
+
+        // OIDC providers are cluster-level identity-provider config; no
+        // per-object owner row required.
+        CatalogEntry::PutOidcProvider(_) => VariantClass::Exempt,
+        CatalogEntry::DeleteOidcProvider { .. } => VariantClass::Exempt,
     }
 }

nodedb/tests/mirror/helpers.rs

@@ -67,6 +67,7 @@ pub fn make_mirror_descriptor(
             status,
         }),
         audit_dml: nodedb_types::AuditDmlMode::None,
+        idle_session_timeout_secs: 0,
     }
 }
 

nodedb/tests/mirror/test_clone_from_mirror_rejected.rs

@@ -54,6 +54,7 @@ fn clone_from_following_mirror_rejected() {
             status: MirrorStatus::Following,
         }),
         audit_dml: nodedb_types::AuditDmlMode::None,
+        idle_session_timeout_secs: 0,
     };
     catalog.put_database(&descriptor).expect("inject mirror");
 
@@ -84,6 +85,7 @@ fn clone_from_degraded_mirror_rejected() {
             status: MirrorStatus::Degraded { lag_ms: 9_000 },
         }),
         audit_dml: nodedb_types::AuditDmlMode::None,
+        idle_session_timeout_secs: 0,
     };
     catalog.put_database(&descriptor).expect("inject mirror");
 
@@ -115,6 +117,7 @@ fn clone_from_promoted_mirror_allowed() {
             status: MirrorStatus::Promoted,
         }),
         audit_dml: nodedb_types::AuditDmlMode::None,
+        idle_session_timeout_secs: 0,
     };
     catalog.put_database(&descriptor).expect("inject promoted");
 
@@ -139,6 +142,7 @@ fn clone_from_normal_database_allowed() {
         parent_clone: None,
         mirror_origin: None,
         audit_dml: nodedb_types::AuditDmlMode::None,
+        idle_session_timeout_secs: 0,
     };
     catalog.put_database(&descriptor).expect("inject normal db");
 

nodedb/tests/mirror/test_full_lifecycle.rs

@@ -52,6 +52,7 @@ fn mirror_full_lifecycle() {
             },
         }),
         audit_dml: nodedb_types::AuditDmlMode::None,
+        idle_session_timeout_secs: 0,
     };
     catalog
         .put_database(&descriptor)

nodedb/tests/mirror/test_promotion_durability.rs

@@ -149,6 +149,7 @@ fn mirror_restart_does_not_reconnect_promoted() {
                 status: MirrorStatus::Promoted,
             }),
             audit_dml: nodedb_types::AuditDmlMode::None,
+            idle_session_timeout_secs: 0,
         };
         catalog.put_database(&descriptor).expect("inject promoted");
     }

nodedb/tests/mirror/test_restart_resume.rs

@@ -158,6 +158,7 @@ fn mirror_restart_does_not_reconnect_promoted() {
                 status: MirrorStatus::Promoted,
             }),
             audit_dml: nodedb_types::AuditDmlMode::None,
+            idle_session_timeout_secs: 0,
         };
         catalog.put_database(&descriptor).expect("inject promoted");
     }

nodedb/tests/oidc.rs

@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: BUSL-1.1
+
+//! Integration tests for OIDC provider DDL + claim mapping.
+
+mod common;
+
+use common::pgwire_auth_helpers::{
+    ddl_err, ddl_ok, make_state_with_catalog, readonly_user, superuser,
+};
+use nodedb::control::security::oidc::claim_mapping::apply_claim_mapping;
+
+// ── CREATE OIDC PROVIDER ────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn create_oidc_provider_persists_in_catalog() {
+    let state = make_state_with_catalog();
+    let su = superuser();
+    ddl_ok(
+        &state,
+        &su,
+        "CREATE OIDC PROVIDER okta \
+         ISSUER 'https://acme.okta.com' \
+         JWKS_URI 'https://acme.okta.com/.well-known/jwks.json' \
+         AUDIENCE 'nodedb'",
+    )
+    .await;
+
+    let cat = state.credentials.catalog();
+    let cat = cat.as_ref().expect("catalog must be present");
+    let stored = cat
+        .get_oidc_provider("okta")
+        .expect("catalog read must succeed")
+        .expect("provider must exist after CREATE");
+    assert_eq!(stored.issuer, "https://acme.okta.com");
+    assert_eq!(stored.audience.as_deref(), Some("nodedb"));
+}
+
+#[tokio::test]
+async fn create_oidc_provider_requires_superuser() {
+    let state = make_state_with_catalog();
+    let viewer = readonly_user();
+    let err = ddl_err(
+        &state,
+        &viewer,
+        "CREATE OIDC PROVIDER bad \
+         ISSUER 'https://x.example/' \
+         JWKS_URI 'https://x.example/jwks'",
+    )
+    .await;
+    assert!(
+        err.contains("42501") || err.contains("permission denied"),
+        "expected permission denied, got: {err}"
+    );
+}
+
+// ── DROP OIDC PROVIDER ──────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn drop_oidc_provider_removes_record() {
+    let state = make_state_with_catalog();
+    let su = superuser();
+    ddl_ok(
+        &state,
+        &su,
+        "CREATE OIDC PROVIDER auth0 \
+         ISSUER 'https://x.auth0.com' \
+         JWKS_URI 'https://x.auth0.com/.well-known/jwks.json'",
+    )
+    .await;
+    ddl_ok(&state, &su, "DROP OIDC PROVIDER auth0").await;
+
+    let cat = state.credentials.catalog();
+    let cat = cat.as_ref().expect("catalog must be present");
+    let stored = cat
+        .get_oidc_provider("auth0")
+        .expect("catalog read must succeed");
+    assert!(stored.is_none(), "provider must be absent after DROP");
+}
+
+#[tokio::test]
+async fn drop_oidc_provider_unknown_returns_not_found() {
+    let state = make_state_with_catalog();
+    let su = superuser();
+    let err = ddl_err(&state, &su, "DROP OIDC PROVIDER does_not_exist").await;
+    assert!(
+        err.contains("42704") || err.contains("does not exist"),
+        "expected not-found error, got: {err}"
+    );
+}
+
+#[tokio::test]
+async fn drop_oidc_provider_if_exists_unknown_succeeds() {
+    let state = make_state_with_catalog();
+    let su = superuser();
+    ddl_ok(&state, &su, "DROP OIDC PROVIDER IF EXISTS does_not_exist").await;
+}
+
+// ── SHOW OIDC PROVIDERS ─────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn show_oidc_providers_lists_registered() {
+    let state = make_state_with_catalog();
+    let su = superuser();
+    ddl_ok(
+        &state,
+        &su,
+        "CREATE OIDC PROVIDER p1 \
+         ISSUER 'https://p1.example/' \
+         JWKS_URI 'https://p1.example/jwks'",
+    )
+    .await;
+    ddl_ok(
+        &state,
+        &su,
+        "CREATE OIDC PROVIDER p2 \
+         ISSUER 'https://p2.example/' \
+         JWKS_URI 'https://p2.example/jwks'",
+    )
+    .await;
+    ddl_ok(&state, &su, "SHOW OIDC PROVIDERS").await;
+}
+
+// ── Claim-mapping public surface smoke check ────────────────────────────────
+
+#[test]
+fn claim_mapping_apply_function_is_public() {
+    // Verifies that `apply_claim_mapping` is accessible from integration tests.
+    let _ = apply_claim_mapping;
+}

nodedb/tests/security.rs

@@ -15,7 +15,7 @@ use std::sync::Arc;
 
 use nodedb::bridge::dispatch::Dispatcher;
 use nodedb::control::security::identity::{AuthMethod, Role};
-use nodedb::control::security::sessions::{SessionParams, SessionRegistry};
+use nodedb::control::security::sessions::{KillReason, SessionParams, SessionRegistry};
 use nodedb::control::state::SharedState;
 use nodedb::types::TenantId;
 use nodedb::wal::WalManager;
@@ -38,6 +38,8 @@ fn sample_params(user_id: u64, username: &str) -> SessionParams {
         auth_method: "password".to_string(),
         tenant_id: 1,
         credential_version: 0,
+        current_database: None,
+        token_expiry_ms: None,
     }
 }
 
@@ -71,10 +73,10 @@ fn session_hard_revoke_close() {
     let reg = SessionRegistry::new();
     let mut rx = reg.register("s1", &sample_params(99, "bob")).unwrap();
     assert!(!rx.has_changed().unwrap_or(false));
-    let killed = reg.kill_sessions_for_user(99);
+    let killed = reg.kill_sessions_for_user(99, KillReason::AdminKill);
     assert_eq!(killed, 1);
     assert!(rx.has_changed().unwrap_or(false));
-    assert!(*rx.borrow_and_update());
+    assert_ne!(*rx.borrow_and_update(), KillReason::Alive);
 }
 
 #[test]