module

KemalIdentity::Testing

Fixtures and pre-wired harnesses for specs.

Part of require "kemal_identity/testing", which is published for consumers rather than kept in this repository's spec/ tree -- an adapter author needs the same doubles this shard's own suite uses, and reaching into a shard's private spec directory to get them is what blueprints/0025-maturity-validation-results.md recorded as DEV-02's failure.

Constants

FIXED_NOW = Time.utc(2026, 8, 24, 12, 0, 0)

A fixed instant every spec can anchor on, so no spec depends on the wall clock.

Class methods

account(id : String = "a1", login : String = "ada@example.com", tenant_id : String | Nil = nil, auth_version : Int32 = 1, disabled_at : Time | Nil = nil, password_digest : String | Nil = "digest", now : Time = FIXED_NOW) : KemalIdentity::Accounts::Account
Source
account_harness(accounts : Array(KemalIdentity::Accounts::Account) | Nil = nil, rate_limiter : KemalIdentity::RateLimiter = KemalIdentity::NullRateLimiter.new, reset_ttl : Time::Span = 1.hour, now : Time = FIXED_NOW, seed : Int32 = 1) : AccountHarness
Source
harness(config : KemalIdentity::Sessions::Config = KemalIdentity::Sessions::Config.new, accounts : Array(KemalIdentity::Accounts::Account) = [] of KemalIdentity::Accounts::Account, now : Time = FIXED_NOW, seed : Int32 = 1) : Harness
Source
principal(subject : String = "account-1", assurance : KemalIdentity::AssuranceLevel = KemalIdentity::AssuranceLevel::Password, authenticated_at : Time = FIXED_NOW, session_id : String | Nil = "session-1", credential : KemalIdentity::CredentialRef | Nil = nil, mfa_verified_at : Time | Nil = nil, tenant_id : String | Nil = nil, password_verified_at : Time | Nil = nil) : KemalIdentity::Principal

session_id stays as a convenience here — the overwhelming majority of specs want a session-backed principal and should not have to build a CredentialRef to say so. Pass credential: explicitly for a bearer-backed one; it wins over session_id.

Source
should_authenticate(outcome : KemalIdentity::Outcome, file : String = __FILE__, line : Int32 = __LINE__) : KemalIdentity::Principal
Source
should_fail_with(outcome : KemalIdentity::Outcome, reason : KemalIdentity::FailureReason, file : String = __FILE__, line : Int32 = __LINE__) : KemalIdentity::Failed
Source
should_fail_with(result : KemalIdentity::MFA::VerificationResult, reason : KemalIdentity::FailureReason, file : String = __FILE__, line : Int32 = __LINE__) : KemalIdentity::Failed

The same, for a second-factor check.

MFA::VerificationResult is Verified | Failed rather than an Outcome, so the overload above does not accept it and a consumer's spec falls back to the cast this module exists to replace. Found writing MFA-01 in blueprints/0025: a packaged assertion that covers three of the four result unions is a packaged assertion somebody stops using.

Source
should_verify(result : KemalIdentity::MFA::VerificationResult, file : String = __FILE__, line : Int32 = __LINE__) : KemalIdentity::MFA::Verified
Source

Nested types