Merge pull request 'chore(release): prepare for v0.4.0' (#244) from next-release into main

Reviewed-on: #244

.gitea/workflows/ci.yaml

@@ -0,0 +1,30 @@
+name: authz_client
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: 'stable'
+      - name: Run tests
+        run: go test -race -coverprofile=coverage.txt ./...
+
+  vulnerabilities:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: 'stable'
+      - name: Check vulnerabilities
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...

.gitea/workflows/pre-commit.yaml

@@ -0,0 +1,25 @@
+name: pre-commit
+permissions: read-all
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    env:
+      SKIP: no-commit-to-branch
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+      - name: Install goimports
+        run: go install golang.org/x/tools/cmd/goimports@latest
+      - uses: pre-commit/action@v3.0.1

.gitea/workflows/release.yaml

@@ -0,0 +1,9 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  release:
+    uses: unboundsoftware/shared-workflows/.gitea/workflows/Release.yml@main

.gitignore

@@ -1,2 +1,4 @@
 .idea
+.claude
 /release
+coverage.txt

.gitlab-ci.yml

@@ -7,7 +7,7 @@ include:
 - project: unboundsoftware/ci-templates
   file: Pre-Commit-Go.gitlab-ci.yml
 
-image: amd64/golang:1.25.3@sha256:69d10098be2e990bb1d987daec0e36d18ad287e139450dc7d98a0ded3498888d
+image: amd64/golang:1.25.5@sha256:ad03ba93327b8a6143b49373790b5d92c28067bdb814418509466122ee9c9e63
 
 stages:
 - deps
@@ -32,7 +32,7 @@ test:
 
 vulnerabilities:
   stage: test
-  image: amd64/golang:1.25.3@sha256:69d10098be2e990bb1d987daec0e36d18ad287e139450dc7d98a0ded3498888d
+  image: amd64/golang:1.25.5@sha256:ad03ba93327b8a6143b49373790b5d92c28067bdb814418509466122ee9c9e63
   script:
   - go install golang.org/x/vuln/cmd/govulncheck@latest
   - govulncheck ./...

.pre-commit-config.yaml

@@ -10,13 +10,6 @@ repos:
     args:
     - --allow-multiple-documents
   - id: check-added-large-files
-- repo: https://gitlab.com/devopshq/gitlab-ci-linter
-  rev: v1.0.6
-  hooks:
-  - id: gitlab-ci-linter
-    args:
-    - --project
-    - unboundsoftware/shiny/authz_client
 - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
   rev: v9.23.0
   hooks:
@@ -30,17 +23,17 @@ repos:
   - id: go-imports
     args:
     - -local
-    - gitlab.com/unboundsoftware/shiny/authz_client
+    - git.unbound.se/shiny/authz_client
 - repo: https://github.com/lietu/go-pre-commit
   rev: v1.0.0
   hooks:
   - id: go-test
   - id: gofumpt
 - repo: https://github.com/golangci/golangci-lint
-  rev: v2.6.0
+  rev: v2.8.0
   hooks:
   - id: golangci-lint-full
 - repo: https://github.com/gitleaks/gitleaks
-  rev: v8.28.0
+  rev: v8.30.0
   hooks:
   - id: gitleaks

.version

@@ -1 +1,3 @@
-{"version":"v0.3.1"}
+{
+  "version": "v0.4.0"
+}

CHANGELOG.md

@@ -2,6 +2,47 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.4.0] - 2026-01-09
+
+### 🚀 Features
+
+- Migrate from GitLab CI to Gitea Actions
+
+### 🚜 Refactor
+
+- Update module path to new repository location
+
+### 📚 Documentation
+
+- Add CLAUDE.md for Claude Code integration
+
+### 🧪 Testing
+
+- Add concurrent fetch and read tests for privileges
+
+### ⚙️ Miscellaneous Tasks
+
+- *(deps)* Update golang:1.25.3 docker digest to 9ac0edc
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.6.1
+- *(deps)* Update pre-commit hook gitleaks/gitleaks to v8.29.0
+- *(deps)* Update dependency go to v1.25.4
+- *(deps)* Update golang docker tag to v1.25.4
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.6.2
+- *(deps)* Update golang:1.25.4 docker digest to efe81fa
+- *(deps)* Update pre-commit hook gitleaks/gitleaks to v8.29.1
+- *(deps)* Update pre-commit hook gitleaks/gitleaks to v8.30.0
+- *(deps)* Update dependency go to v1.25.5
+- *(deps)* Update golang docker tag to v1.25.5
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.7.0
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.7.1
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.7.2
+- *(deps)* Update golang:1.25.5 docker digest to 0c27bcf
+- *(deps)* Update golang:1.25.5 docker digest to ad03ba9
+- *(deps)* Update actions/setup-go action to v6
+- *(deps)* Update actions/checkout action to v6
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.8.0
+- Add pre-commit and release workflows
+
 ## [0.3.1] - 2025-11-02
 
 ### 🐛 Bug Fixes

CLAUDE.md

@@ -0,0 +1,46 @@
+# authz_client
+
+Shared Go library for authorization service client integration.
+
+## Shared Documentation
+
+@../docs/claude/architecture.md
+@../docs/claude/go-services.md
+@../docs/claude/conventions.md
+
+## Library Information
+
+### Purpose
+
+Provides a client for the authz-service, handling privilege management for users across companies. Used by all microservices that need to check user permissions.
+
+### Usage
+
+```go
+import client "git.unbound.se/shiny/authz_client"
+
+// Create handler with options
+handler := client.New(client.WithBaseURL("http://authz-service"))
+
+// Check user privileges
+privileges := handler.Get(email, companyID)
+if privileges.Invoicing {
+    // User has invoicing privileges
+}
+```
+
+### Privileges
+
+The `CompanyPrivileges` struct contains permission flags:
+- `Admin` - Administrative access
+- `Company` - Company management
+- `Consumer` - Consumer/customer access
+- `Time` - Time tracking
+- `Invoicing` - Invoice management
+- `Accounting` - Accounting access
+- `Supplier` - Supplier management
+- `Salary` - Salary/payroll access
+
+### Event Handling
+
+Implements `goamqp` message handlers to receive privilege update events from the authz-service, keeping the local privilege cache up-to-date.

README.md

@@ -1,4 +1 @@
 # Shiny authz-client
-
-[![Build Status](https://gitlab.com/unboundsoftware/shiny/authz_client/badges/main/pipeline.svg)](https://gitlab.com/unboundsoftware/shiny/authz_client/commits/main)
-[![codecov](https://codecov.io/gl/unboundsoftware:shiny/authz_client/branch/main/graph/badge.svg?token=AQS7QVLCEQ)](https://codecov.io/gl/unboundsoftware:shiny/authz_client)

client_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"sort"
+	"sync"
 	"testing"
 
 	"github.com/sparetimecoders/goamqp"
@@ -332,3 +333,285 @@ func TestPrivilegeHandler_Fetch_Valid(t *testing.T) {
 	}
 	assert.Equal(t, expectedPrivileges, handler.privileges)
 }
+
+func TestPrivilegeHandler_Fetch_Concurrent_Fetches(t *testing.T) {
+	privileges := `
+{
+  "jim@example.org": {
+    "00010203-0405-4607-8809-0a0b0c0d0e0f": {
+      "admin": false,
+      "company": true,
+      "consumer": false,
+      "time": true,
+      "invoicing": true,
+      "accounting": false,
+      "supplier": false,
+      "salary": true
+    }
+  }
+}`
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(privileges))
+	}))
+	defer server.Close()
+
+	baseURL := server.Listener.Addr().String()
+	handler := New(WithBaseURL(fmt.Sprintf("http://%s", baseURL)))
+
+	// Run multiple Fetch calls concurrently to test thread-safety
+	var wg sync.WaitGroup
+	errors := make(chan error, 10)
+
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if err := handler.Fetch(); err != nil {
+				errors <- err
+			}
+		}()
+	}
+
+	wg.Wait()
+	close(errors)
+
+	// Check no errors occurred
+	for err := range errors {
+		assert.NoError(t, err)
+	}
+
+	// Verify privileges were set correctly
+	expectedPrivileges := map[string]map[string]*CompanyPrivileges{
+		"jim@example.org": {
+			"00010203-0405-4607-8809-0a0b0c0d0e0f": {
+				Admin:      false,
+				Company:    true,
+				Consumer:   false,
+				Time:       true,
+				Invoicing:  true,
+				Accounting: false,
+				Supplier:   false,
+				Salary:     true,
+			},
+		},
+	}
+	assert.Equal(t, expectedPrivileges, handler.privileges)
+}
+
+func TestPrivilegeHandler_Concurrent_Fetch_And_Read(t *testing.T) {
+	privileges := `
+{
+  "jim@example.org": {
+    "abc-123": {
+      "admin": true,
+      "company": true,
+      "consumer": false,
+      "time": false,
+      "invoicing": false,
+      "accounting": false,
+      "supplier": false,
+      "salary": false
+    }
+  }
+}`
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(privileges))
+	}))
+	defer server.Close()
+
+	baseURL := server.Listener.Addr().String()
+	handler := New(WithBaseURL(fmt.Sprintf("http://%s", baseURL)))
+
+	var wg sync.WaitGroup
+	errors := make(chan error, 100)
+
+	// Start multiple Fetch operations
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if err := handler.Fetch(); err != nil {
+				errors <- err
+			}
+		}()
+	}
+
+	// Concurrently read privileges while Fetch is running
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+				return privileges.Admin
+			})
+		}()
+	}
+
+	// Concurrently check privileges while Fetch is running
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
+				return privileges.Admin
+			})
+		}()
+	}
+
+	wg.Wait()
+	close(errors)
+
+	// Check no errors occurred
+	for err := range errors {
+		assert.NoError(t, err)
+	}
+
+	// Verify privileges are correct after all concurrent operations
+	companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return privileges.Admin
+	})
+	assert.Equal(t, []string{"abc-123"}, companies)
+
+	isAllowed := handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
+		return privileges.Admin && privileges.Company
+	})
+	assert.True(t, isAllowed)
+}
+
+func TestPrivilegeHandler_Concurrent_Process_And_Read(t *testing.T) {
+	handler := New(WithBaseURL("base"))
+
+	var wg sync.WaitGroup
+
+	// Concurrently add privileges via Process
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		companyID := fmt.Sprintf("company-%d", i%10)
+		go func(id string) {
+			defer wg.Done()
+			_, _ = handler.Process(&PrivilegeAdded{
+				Email:     "jim@example.org",
+				CompanyID: id,
+				Privilege: PrivilegeAdmin,
+			}, goamqp.Headers{})
+		}(companyID)
+	}
+
+	// Concurrently read privileges while Process is running
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+				return privileges.Admin
+			})
+		}()
+	}
+
+	wg.Wait()
+
+	// Verify all companies were added
+	companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return privileges.Admin
+	})
+	sort.Strings(companies)
+
+	expected := make([]string, 10)
+	for i := 0; i < 10; i++ {
+		expected[i] = fmt.Sprintf("company-%d", i)
+	}
+	sort.Strings(expected)
+
+	assert.Equal(t, expected, companies)
+}
+
+func TestPrivilegeHandler_Concurrent_Multiple_Operations(t *testing.T) {
+	privileges := `
+{
+  "jim@example.org": {
+    "initial-company": {
+      "admin": true,
+      "company": true,
+      "consumer": false,
+      "time": false,
+      "invoicing": false,
+      "accounting": false,
+      "supplier": false,
+      "salary": false
+    }
+  }
+}`
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(privileges))
+	}))
+	defer server.Close()
+
+	baseURL := server.Listener.Addr().String()
+	handler := New(WithBaseURL(fmt.Sprintf("http://%s", baseURL)))
+
+	var wg sync.WaitGroup
+
+	// Fetch
+	for i := 0; i < 5; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = handler.Fetch()
+		}()
+	}
+
+	// Process PrivilegeAdded
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			_, _ = handler.Process(&PrivilegeAdded{
+				Email:     "jane@example.org",
+				CompanyID: fmt.Sprintf("company-%d", idx%5),
+				Privilege: PrivilegeCompany,
+			}, goamqp.Headers{})
+		}(i)
+	}
+
+	// CompaniesByUser reads
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		email := "jim@example.org"
+		if i%2 == 0 {
+			email = "jane@example.org"
+		}
+		go func(e string) {
+			defer wg.Done()
+			_ = handler.CompaniesByUser(e, func(privileges CompanyPrivileges) bool {
+				return privileges.Admin || privileges.Company
+			})
+		}(email)
+	}
+
+	// IsAllowed reads
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = handler.IsAllowed("jim@example.org", "initial-company", func(privileges CompanyPrivileges) bool {
+				return privileges.Admin
+			})
+		}()
+	}
+
+	wg.Wait()
+
+	// Verify final state is consistent
+	jimCompanies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return privileges.Admin
+	})
+	assert.Contains(t, jimCompanies, "initial-company")
+
+	janeCompanies := handler.CompaniesByUser("jane@example.org", func(privileges CompanyPrivileges) bool {
+		return privileges.Company
+	})
+	sort.Strings(janeCompanies)
+
+	expectedJane := []string{"company-0", "company-1", "company-2", "company-3", "company-4"}
+	assert.Equal(t, expectedJane, janeCompanies)
+}

go.mod

@@ -1,8 +1,8 @@
-module gitlab.com/unboundsoftware/shiny/authz_client
+module git.unbound.se/shiny/authz_client
 
 go 1.22.12
 
-toolchain go1.25.3
+toolchain go1.25.5
 
 require (
 	github.com/sparetimecoders/goamqp v0.3.3