Add OIDC sign-in, group-derived roles and declarative instance configuration

Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>

tests/support/mod.rs

@@ -1,7 +1,11 @@
+#![allow(dead_code)]
 use chrono::{Duration, Utc};
-use cot::db::Model;
+use cot::db::query;
 use meguri::{
+    access::{AuthConfig, Config, WorkspaceConfig},
+    admin::{self, NewUser},
     domain::*,
+    identity,
     models::UserRow,
     service,
     store::{Store, WorkspaceRecord},
@@ -14,54 +18,83 @@ pub struct Fixture {
     pub team: WorkspaceRecord,
     pub schedule: Uuid,
     pub start: chrono::DateTime<Utc>,
+    pub config: Config,
 }
+
+pub fn config_with(workspaces: Vec<WorkspaceConfig>) -> Config {
+    Config {
+        auth: AuthConfig {
+            password_login: true,
+            bootstrap_admin: None,
+        },
+        oidc: None,
+        instance_admin_groups: vec![],
+        workspaces,
+    }
+}
+
+pub fn unique_workspace(name: &str) -> WorkspaceConfig {
+    let key = format!("t-{}", &Uuid::new_v4().simple().to_string()[..12]);
+    WorkspaceConfig {
+        admin_groups: vec![format!("{key}-leads")],
+        member_groups: vec![format!("{key}-staff")],
+        name: name.into(),
+        key,
+    }
+}
+
+pub async fn connect() -> Store {
+    let url = std::env::var("MEGURI_TEST_DATABASE_URL")
+        .expect("Set MEGURI_TEST_DATABASE_URL to a disposable PostgreSQL database");
+    Store::connect(&url).await.unwrap()
+}
+
+/// A password account whose groups are applied through the real access path.
+pub async fn account(db: &Store, config: &Config, name: &str, groups: &[String]) -> User {
+    let created = admin::create_password_user(
+        db,
+        config,
+        None,
+        NewUser {
+            username: format!("test-{}", Uuid::new_v4().simple()),
+            display_name: name.into(),
+            password: "test-only-password".into(),
+            email: None,
+            groups: groups.to_vec(),
+        },
+    )
+    .await
+    .unwrap();
+    serde_json::from_value(created["user"].clone()).unwrap()
+}
+
 impl Fixture {
     pub async fn new() -> Self {
-        let url = std::env::var("MEGURI_TEST_DATABASE_URL")
-            .expect("Set MEGURI_TEST_DATABASE_URL to a disposable PostgreSQL database");
-        let db = Store::connect(&url).await.unwrap();
+        let db = connect().await;
+        let workspace = unique_workspace("Test team");
+        let config = config_with(vec![workspace.clone()]);
+        let ensured = identity::ensure_workspace(&db, &workspace).await.unwrap();
         let mut people = vec![];
-        for name in ["Alice", "Bob", "Carol"] {
-            let user = User {
-                language: None,
-                id: Uuid::new_v4(),
-                username: format!("test-{}", Uuid::new_v4().simple()),
-                display_name: name.into(),
-                country: "CY".into(),
-                timezone: None,
+        for (index, name) in ["Alice", "Bob", "Carol"].into_iter().enumerate() {
+            let groups = if index == 0 {
+                &workspace.admin_groups
+            } else {
+                &workspace.member_groups
             };
-            UserRow {
-                language: None,
-                demo_deleted_at: None,
-                id: user.id.to_string(),
-                username: user.username.clone(),
-                display_name: user.display_name.clone(),
-                country: user.country.clone(),
-                timezone: None,
-                password_hash: "test-only-unusable-password".into(),
-                created_at: Utc::now(),
-            }
-            .insert(&db.db)
-            .await
-            .unwrap();
-            people.push(user);
+            people.push(account(&db, &config, name, groups).await);
         }
         let people: [User; 3] = people.try_into().unwrap();
-        let mut team = service::create_workspace(&db, people[0].id, "Test team".into())
-            .await
-            .unwrap();
-        for person in &people[1..] {
-            team = service::set_member(
-                &db,
-                people[0].id,
-                team.id,
-                team.revision,
-                person.username.clone(),
-                Permission::member(),
-            )
-            .await
-            .unwrap();
-        }
+        let mut team = db.workspace(ensured.id).await.unwrap();
+        // Employees keep the narrow pre-existing grant set that the scheduling regressions assume.
+        team = service::set_member_permissions(
+            &db,
+            people[0].id,
+            team.id,
+            team.revision,
+            Permission::member(),
+        )
+        .await
+        .unwrap();
         let schedule = Uuid::new_v4();
         let day = Utc::now().date_naive() + Duration::days(2);
         let mut doc = team.document.clone();
@@ -86,8 +119,28 @@ impl Fixture {
             team,
             schedule,
             start,
+            config,
         }
     }
+    /// A second workspace whose administrator group is granted to `admin` only.
+    pub async fn extra_workspace(&self, name: &str, admin: &User) -> WorkspaceRecord {
+        let extra = unique_workspace(name);
+        let mut config = self.config.clone();
+        config.workspaces.push(extra.clone());
+        let ensured = identity::ensure_workspace(&self.db, &extra).await.unwrap();
+        let id = admin.id.to_string();
+        let row = query!(UserRow,$id==id)
+            .get(&self.db.db)
+            .await
+            .unwrap()
+            .unwrap();
+        let mut groups = identity::stored_groups(&row).unwrap();
+        groups.extend(extra.admin_groups);
+        identity::apply_access(&self.db, &config, admin.id, Some(groups))
+            .await
+            .unwrap();
+        self.db.workspace(ensured.id).await.unwrap()
+    }
     pub fn leg(&self) -> ReplacementLeg {
         ReplacementLeg {
             schedule_id: self.schedule,
@@ -133,3 +186,47 @@ impl Fixture {
             .unwrap();
     }
 }
+
+/// Demonstration seeding reads the run's generated password from the process-wide notice.
+pub fn install_demo_notice() {
+    meguri::demo_runtime::install(meguri::demo_runtime::Notice {
+        isolated: false,
+        retention: meguri::demo_runtime::Retention::default(),
+        password: meguri::access::random_password(),
+        accounts: meguri::demo::accounts(),
+    });
+}
+
+/// A uniquely named database for tests whose subject is whole-instance state (configuration
+/// sync disables every workspace that is not configured, so shared databases cannot be used).
+pub struct IsolatedDatabase {
+    pub store: Store,
+    admin: cot::db::Database,
+    name: String,
+}
+impl IsolatedDatabase {
+    pub async fn new() -> Self {
+        let base = std::env::var("MEGURI_TEST_DATABASE_URL")
+            .expect("Set MEGURI_TEST_DATABASE_URL to a disposable PostgreSQL database");
+        let admin = cot::db::Database::new(&base).await.unwrap();
+        let name = format!("meguri_access_test_{}", Uuid::new_v4().simple());
+        admin.raw(&format!("CREATE DATABASE {name}")).await.unwrap();
+        let mut url = reqwest::Url::parse(&base).unwrap();
+        url.set_path(&format!("/{name}"));
+        let store = Store::connect(url.as_str()).await.unwrap();
+        Self { store, admin, name }
+    }
+    pub async fn url(&self) -> String {
+        let base = std::env::var("MEGURI_TEST_DATABASE_URL").unwrap();
+        let mut url = reqwest::Url::parse(&base).unwrap();
+        url.set_path(&format!("/{}", self.name));
+        url.to_string()
+    }
+    pub async fn drop(self) {
+        drop(self.store);
+        self.admin
+            .raw(&format!("DROP DATABASE {} WITH (FORCE)", self.name))
+            .await
+            .unwrap();
+    }
+}