Add versioned HTTP gateway routing by business domain

tests/test_gateway.py

@@ -0,0 +1,61 @@
+import pytest
+from fastapi.testclient import TestClient
+
+from adcloud_server.main import create_app
+
+
+@pytest.fixture
+def client():
+    with TestClient(create_app()) as test_client:
+        yield test_client
+
+
+@pytest.mark.parametrize("module", ["events", "users", "ads", "identity"])
+def test_versioned_module_routing(client, module):
+    response = client.get(f"/v1/{module}/health?probe=1")
+    assert response.status_code == 200
+    assert response.json() == {"status": "ok", "module": module}
+
+
+@pytest.mark.parametrize(
+    "path",
+    ["/events/health", "/v2/events/health", "/v1/unknown/health", "/v1/events/unknown"],
+)
+def test_unknown_routes_return_404(client, path):
+    assert client.get(path).status_code == 404
+
+
+def test_unsupported_method(client):
+    assert client.post("/v1/events/health").status_code == 405
+
+
+def test_write_request_preflight(client):
+    response = client.options(
+        "/v1/events/health",
+        headers={
+            "Origin": "http://localhost:5174",
+            "Access-Control-Request-Method": "POST",
+            "Access-Control-Request-Headers": "authorization,content-type,x-request-id",
+        },
+    )
+    assert response.status_code == 200
+    assert response.headers["access-control-allow-origin"] == "http://localhost:5174"
+    assert "POST" in response.headers["access-control-allow-methods"]
+
+
+def test_openapi_groups(client):
+    schema = client.get("/openapi.json").json()
+    for module in ["events", "users", "ads", "identity"]:
+        operation = schema["paths"][f"/v1/{module}/health"]["get"]
+        assert operation["tags"] == [module]
+
+
+def test_cors_configuration(monkeypatch):
+    monkeypatch.setenv(
+        "CORS_ORIGINS", " https://console.example, ,https://dev.example "
+    )
+    with TestClient(create_app()) as client:
+        accepted = client.get("/health", headers={"Origin": "https://dev.example"})
+        denied = client.get("/health", headers={"Origin": "http://localhost:5173"})
+    assert accepted.headers["access-control-allow-origin"] == "https://dev.example"
+    assert "access-control-allow-origin" not in denied.headers