feat(auth): include authentication in workspace and tht diagnostics

frontend/src/shell/WorkspaceManager.test.tsx

@@ -26,6 +26,12 @@ const requirement = {
   configured: false,
 };
 
+const readyAuthentication = {
+  ready: true,
+  mode: "none",
+  checks: [{ level: "info", code: "auth_ready", message: "Authentication is ready." }],
+};
+
 function runtimeConfiguration(configured = false) {
   return {
     workspaceId: "psd-clinical",
@@ -187,10 +193,13 @@ test("workspace-specific commands remain isolated until a workspace is selected"
 test("keeps validation and connection results inside their respective action cards", async () => {
   const user = userEvent.setup();
   server.use(
-    http.post("/api/workspaces/validate", () => HttpResponse.json({ workspace, contract: {} })),
+    http.post("/api/workspaces/validate", () => HttpResponse.json({
+      workspace, contract: {}, activatable: true, diagnostics: [], authentication: readyAuthentication,
+    })),
     http.post("/api/workspaces/psd-clinical/test", () => HttpResponse.json({
       activatable: false,
       diagnostics: [{ level: "error", code: "connector_unavailable", message: "Connector diagnostic failed." }],
+      authentication: readyAuthentication,
     })),
   );
   renderManager();
@@ -200,9 +209,9 @@ test("keeps validation and connection results inside their respective action car
   const connectionCard = screen.getByTestId("workspace-connection-card");
   await user.click(within(validationCard).getByRole("button", { name: "Validate workspace source" }));
   const validationStatus = await within(validationCard).findByRole("status");
-  expect(validationStatus).toHaveTextContent("Workspace source is valid.");
+  expect(validationStatus).toHaveTextContent("Workspace source and authentication are valid.");
   expect(validationStatus).toHaveClass("text-emerald-700");
-  expect(within(connectionCard).queryByText("Workspace source is valid.")).not.toBeInTheDocument();
+  expect(within(connectionCard).queryByText("Workspace source and authentication are valid.")).not.toBeInTheDocument();
 
   await user.click(within(connectionCard).getByRole("button", { name: "Test workspace connections" }));
   expect(await within(connectionCard).findByRole("alert")).toHaveTextContent(
@@ -211,12 +220,43 @@ test("keeps validation and connection results inside their respective action car
   expect(within(validationCard).queryByText("connector_unavailable: Connector diagnostic failed.")).not.toBeInTheDocument();
 });
 
+test("renders one authentication section with configured-group errors and no unmapped-group list", async () => {
+  const user = userEvent.setup();
+  server.use(http.post("/api/workspaces/validate", () => HttpResponse.json({
+    workspace,
+    contract: {},
+    activatable: false,
+    diagnostics: [],
+    authentication: {
+      ready: false,
+      mode: "oidc",
+      checks: [{
+        level: "error",
+        code: "oidc_mapped_group_missing",
+        field: "Thoth Administrators",
+        message: "A configured authorization group does not exist.",
+      }],
+    },
+  })));
+  renderManager();
+  await user.click(await screen.findByRole("button", { name: "PSD Clinical" }));
+
+  await user.click(screen.getByRole("button", { name: "Validate workspace source" }));
+
+  const section = await screen.findByTestId("workspace-authentication");
+  expect(within(section).getByRole("heading", { name: "Authentication" })).toBeVisible();
+  expect(within(section).getByText("Failed")).toBeVisible();
+  expect(within(section).getByText("oidc_mapped_group_missing: Thoth Administrators — A configured authorization group does not exist.")).toBeVisible();
+  expect(within(section).queryByText(/unmapped/i)).not.toBeInTheDocument();
+});
+
 test("renders binding_ok as a green connection success", async () => {
   const user = userEvent.setup();
   server.use(
     http.post("/api/workspaces/psd-clinical/test", () => HttpResponse.json({
       activatable: true,
       diagnostics: [{ level: "info", code: "binding_ok", message: "Installation bindings and diagnostics succeeded." }],
+      authentication: readyAuthentication,
     })),
   );
   renderManager();