test: dek orphan-report/orphan-confirm af en valideer item-type en realm

- client-tests voor get_orphan_report en confirm_orphans
- CLI-tests voor orphan-report/orphan-confirm (dry-run, ontbrekend item,
  ongeldig formaat, onbekend type, keycloak_client zonder realm)
- valideer item-type client-side en eis een realm voor keycloak_client

Author: anneschuth

src/zad_cli/commands/admin.py

@@ -13,6 +13,10 @@
     no_args_is_help=True,
 )
 
+# Valid orphan item types. keycloak_client additionally requires a realm.
+ORPHAN_TYPES = ("postgresql_database", "postgresql_user", "minio_bucket", "keycloak_client")
+ORPHAN_TYPES_REQUIRING_REALM = ("keycloak_client",)
+
 
 @app.command("list")
 @handle_api_errors
@@ -117,9 +121,16 @@ def orphan_confirm(
         if len(parts) < 2:
             formatter.render_error(f"Invalid item format '{raw}'. Expected TYPE:NAME or TYPE:NAME:REALM.")
             raise typer.Exit(1)
-        entry: dict = {"type": parts[0], "name": parts[1]}
+        item_type, name = parts[0], parts[1]
+        if item_type not in ORPHAN_TYPES:
+            formatter.render_error(f"Invalid item type '{item_type}'. Valid types: {', '.join(ORPHAN_TYPES)}.")
+            raise typer.Exit(1)
+        entry: dict = {"type": item_type, "name": name}
         if len(parts) == 3:
             entry["realm"] = parts[2]
+        if item_type in ORPHAN_TYPES_REQUIRING_REALM and "realm" not in entry:
+            formatter.render_error(f"Item type '{item_type}' requires a realm. Use TYPE:NAME:REALM.")
+            raise typer.Exit(1)
         parsed.append(entry)
 
     payload = {"items": parsed}

tests/test_cli.py

@@ -354,6 +354,96 @@ def test_admin_delete_dry_run_shows_endpoint():
     assert '"method": "DELETE"' in out
 
 
+def test_admin_help_shows_orphan_commands():
+    result = _run_help("admin")
+    out = _strip_ansi(result.stdout)
+    assert result.returncode == 0
+    assert "orphan-report" in out
+    assert "orphan-confirm" in out
+
+
+def test_admin_orphan_report_dry_run_not_applicable_help():
+    """orphan-report is read-only: no --yes / --dry-run flags."""
+    result = _run_help("admin", "orphan-report")
+    out = _strip_ansi(result.stdout)
+    assert result.returncode == 0
+    assert "--dry-run" not in out
+    assert "--yes" not in out
+
+
+def test_admin_orphan_confirm_dry_run_shows_endpoint():
+    """--dry-run must short-circuit before any confirmation or API call."""
+    result = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "zad_cli",
+            "admin",
+            "orphan-confirm",
+            "--item",
+            "postgresql_database:regel_k4c_pr104",
+            "--dry-run",
+            "--output",
+            "json",
+        ],
+        capture_output=True,
+        text=True,
+        env={**_MINIMAL_ENV, "ZAD_API_KEY": "k", "ZAD_PROJECT_ID": "p"},
+    )
+    out = _strip_ansi(result.stdout)
+    assert result.returncode == 0
+    assert "/v2/admin/orphans/confirm" in out
+    assert '"method": "POST"' in out
+    assert "regel_k4c_pr104" in out
+
+
+def test_admin_orphan_confirm_requires_item():
+    """No --item is a user error: exit 1, no API call."""
+    result = subprocess.run(
+        [sys.executable, "-m", "zad_cli", "admin", "orphan-confirm"],
+        capture_output=True,
+        text=True,
+        env={**_MINIMAL_ENV, "ZAD_API_KEY": "k", "ZAD_PROJECT_ID": "p"},
+    )
+    assert result.returncode == 1
+    assert "item is required" in _strip_ansi(result.stderr).lower()
+
+
+def test_admin_orphan_confirm_rejects_bad_format():
+    """An item missing the TYPE:NAME separator is rejected client-side."""
+    result = subprocess.run(
+        [sys.executable, "-m", "zad_cli", "admin", "orphan-confirm", "--item", "justaname"],
+        capture_output=True,
+        text=True,
+        env={**_MINIMAL_ENV, "ZAD_API_KEY": "k", "ZAD_PROJECT_ID": "p"},
+    )
+    assert result.returncode == 1
+    assert "invalid item format" in _strip_ansi(result.stderr).lower()
+
+
+def test_admin_orphan_confirm_rejects_unknown_type():
+    result = subprocess.run(
+        [sys.executable, "-m", "zad_cli", "admin", "orphan-confirm", "--item", "bogus_type:name"],
+        capture_output=True,
+        text=True,
+        env={**_MINIMAL_ENV, "ZAD_API_KEY": "k", "ZAD_PROJECT_ID": "p"},
+    )
+    assert result.returncode == 1
+    assert "invalid item type" in _strip_ansi(result.stderr).lower()
+
+
+def test_admin_orphan_confirm_keycloak_requires_realm():
+    """keycloak_client without a realm is rejected before any API call."""
+    result = subprocess.run(
+        [sys.executable, "-m", "zad_cli", "admin", "orphan-confirm", "--item", "keycloak_client:my-client"],
+        capture_output=True,
+        text=True,
+        env={**_MINIMAL_ENV, "ZAD_API_KEY": "k", "ZAD_PROJECT_ID": "p"},
+    )
+    assert result.returncode == 1
+    assert "requires a realm" in _strip_ansi(result.stderr).lower()
+
+
 def test_restore_help_shows_deployment_and_pvc_snapshots():
     result = _run_help("restore")
     out = _strip_ansi(result.stdout)

tests/test_client.py

@@ -352,6 +352,33 @@ def test_delete_admin_mark_handles_empty_body(client):
     assert client.delete_admin_mark("mark-1") == {}
 
 
+@respx.mock
+def test_get_orphan_report_returns_json(client):
+    """orphan-report is a read-only v1 GET that returns the sweep report as-is."""
+    report = {"orphan_candidates": [{"type": "postgresql_database", "name": "regel_k4c_pr104"}]}
+    route = respx.get("https://api.example.com/v2/admin/orphans/report").mock(
+        return_value=httpx.Response(200, json=report)
+    )
+
+    result = client.get_orphan_report()
+
+    assert result == report
+    assert route.call_count == 1
+
+
+@respx.mock
+def test_confirm_orphans_sends_items_payload(client):
+    route = respx.post("https://api.example.com/v2/admin/orphans/confirm").mock(
+        return_value=httpx.Response(200, json={"marked": 1})
+    )
+    payload = {"items": [{"type": "postgresql_database", "name": "regel_k4c_pr104"}]}
+
+    result = client.confirm_orphans(payload)
+
+    assert result == {"marked": 1}
+    assert json.loads(route.calls.last.request.content) == payload
+
+
 @respx.mock
 def test_restore_deployment_resource_sends_payload(client):
     route = respx.post("https://api.example.com/v1/restore/project/my-project/deployment/staging").mock(