feat: 接入 SSF 实时会话撤销

apps/api/internal/securityevents/metrics_test.go

@@ -0,0 +1,50 @@
+package securityevents
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+type metricsSnapshot struct {
+	mode string
+	last time.Time
+}
+
+func (m metricsSnapshot) SecurityEventMetrics(context.Context, string, string) (string, *time.Time, error) {
+	return m.mode, &m.last, nil
+}
+
+func TestMetricsExposeBoundedOutcomesAndState(t *testing.T) {
+	metrics := &Metrics{}
+	metrics.ObserveReceipt("accepted", 20*time.Millisecond, 2)
+	metrics.ObserveReceipt("duplicate", 10*time.Millisecond, 0)
+	metrics.ObserveWatermarkRejection()
+	metrics.ObserveHeartbeat("accepted")
+	metrics.ObserveIntrospection("failed")
+	metrics.ObserveJWKSRefreshFailure("ssf")
+
+	recorder := httptest.NewRecorder()
+	metrics.Handler(metricsSnapshot{mode: "push_healthy", last: time.Now().Add(-time.Minute)}, "issuer", "audience", true).
+		ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/metrics", nil))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("metrics status=%d", recorder.Code)
+	}
+	for _, expected := range []string{
+		`easyai_gateway_ssf_receipts_total{outcome="accepted"} 1`,
+		`easyai_gateway_ssf_receipts_total{outcome="duplicate"} 1`,
+		`easyai_gateway_ssf_sessions_deleted_total 2`,
+		`easyai_gateway_ssf_watermark_rejections_total 1`,
+		`easyai_gateway_ssf_processing_duration_seconds_bucket{le="0.05"} 2`,
+		`easyai_gateway_ssf_mode{mode="push_healthy"} 1`,
+		`easyai_gateway_oidc_introspection_total{outcome="failed"} 1`,
+		`easyai_gateway_jwks_refresh_failures_total{outcome="ssf"} 1`,
+	} {
+		if !strings.Contains(recorder.Body.String(), expected) {
+			t.Fatalf("missing metric %q in:\n%s", expected, recorder.Body.String())
+		}
+	}
+}