fix: restore native user portal login and track tenant integration

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

sso-mfa/k8s/keycape/test_portal_client_rollout.py

@@ -0,0 +1,54 @@
+import base64
+import importlib.util
+import json
+from pathlib import Path
+import unittest
+
+import yaml
+
+spec = importlib.util.spec_from_file_location('portal_rollout', Path(__file__).with_name('portal-client-rollout.py'))
+rollout = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(rollout)
+
+
+class PortalClientTests(unittest.TestCase):
+    def fixture(self, clients=None):
+        # Synthetic marker values only; no live Secret is loaded by this suite.
+        raw = ('# preserve this comment\nauthelia:\n  issuer: https://auth.example.invalid\n'
+               '  clientSecret: synthetic-marker\nclients:\n' +
+               yaml.safe_dump(json.loads(json.dumps(clients or [{'clientId': 'existing', 'clientType': 'public'}])), sort_keys=False) +
+               'tokenLifetime: 15m\n')
+        return {'data': {'config.yaml': base64.b64encode(raw.encode()).decode(), 'key.pem': 'synthetic-key'}}, raw
+
+    def test_add_preserves_other_values_and_original_bytes(self):
+        secret, raw = self.fixture()
+        encoded, changed = rollout.replacement(secret)
+        updated = base64.b64decode(encoded).decode()
+        self.assertTrue(changed)
+        self.assertTrue(updated.startswith(raw[:raw.index('tokenLifetime:')]))
+        self.assertTrue(updated.endswith('tokenLifetime: 15m\n'))
+        expected = yaml.safe_load(raw)
+        expected['clients'].append(rollout.portal.CLIENT)
+        self.assertEqual(yaml.safe_load(updated), expected)
+        self.assertEqual(secret['data']['key.pem'], 'synthetic-key')
+
+    def test_exact_existing_registration_is_noop(self):
+        secret, _ = self.fixture([rollout.portal.CLIENT])
+        self.assertEqual(rollout.replacement(secret), (secret['data']['config.yaml'], False))
+
+    def test_differing_or_duplicate_registration_refused(self):
+        for clients in [[dict(rollout.portal.CLIENT, redirectUris=['https://other.invalid/callback'])],
+                        [rollout.portal.CLIENT, rollout.portal.CLIENT]]:
+            with self.subTest(clients=len(clients)), self.assertRaises(rollout.Refused):
+                rollout.replacement(self.fixture(clients)[0])
+
+    def test_bootstrap_retains_same_public_registration(self):
+        source = Path(__file__).with_name('create-secrets.sh').read_text()
+        raw = source.split('CONFIG_YAML=$(cat <<EOF\n', 1)[1].split('\nEOF', 1)[0]
+        clients = yaml.safe_load(raw)['clients']
+        self.assertEqual([c for c in clients if c['clientId'] == rollout.portal.CLIENT_ID],
+                         [rollout.portal.CLIENT])
+
+
+if __name__ == '__main__':
+    unittest.main()