test(BA-4985): add component tests for auth security management

[jopemachine]

Resolves #9843 (BA-4985)

Summary

Merge auth component tests into a single tests/component/auth/test_auth.py, covering verify-auth, role/scope control, authorize, full-name update, password management (including expiry), SSH keypair operations, signup, and cross-domain access enforcement.

Previously split across test_auth.py (basic) and test_auth_security.py (extended), now consolidated with duplicate tests removed and additional coverage added.

Target test file: tests/component/auth/test_auth.py

Test Class	Count	Test Scenarios
TestVerifyAuth	3	Admin verify-auth with echo round-trip, regular user verify-auth with echo round-trip, domain-admin verify-auth
TestRoleAndScopeAccess	5	Superadmin gets superadmin role, regular user gets user role, domain-admin gets admin role, get role with valid group, get role with nonexistent group raises NotFoundError
TestAuthorize	2	Authorize returns keypair credentials (access_key, secret_key, role), authorize with wrong password raises AuthenticationError
TestUpdateFullName	1	Admin updates full name
TestPasswordChange	5	Self-initiated password change succeeds, wrong old password raises AuthenticationError, confirmation mismatch raises InvalidRequestError, login with new password after change, old password rejected after change
TestPasswordExpiry	4	Expired password login rejected (max_password_age=90d), no-auth renewal with expired password, no-auth rejected when max_password_age not configured, same-password renewal rejected
TestSSHKeypair	7	Initial empty state, generate keypair, get after generate matches, upload custom RSA keypair, upload overwrites existing, regenerate replaces previous, per-user keypair independence
TestSignup	1	Signup creates user with keypair (access_key/secret_key returned)
TestCrossDomainAccess	3	Superadmin authorizes cross-domain user, domain-admin role scoped to own domain, domain-admin cannot query other-domain group role

Total: 31 tests

Key improvements over original PR

• Merged test_auth.py and test_auth_security.py into a single file (eliminated duplicate tests)
• Replaced pytest.raises(Exception) with specific exception types (NotFoundError)
• Replaced manual try/finally config restoration with monkeypatch.setattr in TestPasswordExpiry
• Extracted RSA keypair generation into rsa_keypair fixture
• Consolidated all helper types at the top of the file for readability
• Prefixed internal dataclasses with _ (e.g., _ExpiredPasswordUserData, _CrossDomainFixtureData)
• Added detailed English docstrings to all test classes and methods

Test plan

• pants lint passes
• pants check passes
• pants test passes

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR consolidates previously split auth component tests into a single tests/component/auth/test_auth.py, expanding coverage for auth verification, role/scope access control, password management (including expiry), SSH keypair operations, signup, and cross-domain access rules.

Changes:

• Merged and reorganized auth component tests into one file with shared helper dataclasses/fixtures.
• Added new fixtures to create expired-password users and a second (“cross”) domain for access-control scenarios.
• Expanded test coverage across authorize, password-change/expiry flows, SSH keypair CRUD-like behavior, signup, and cross-domain restrictions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
tests/component/auth/test_auth.py	Consolidates and expands auth component tests; adds fixtures for expired-password and cross-domain scenarios.
changes/9873.test.md	Adds a changelog entry for the new/updated component tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.