feat(federation): relay the partner registry on /platform/v1/federation/partners

Sergio Gimenezrequested to merge
feat/partner-registry-relay into feat/federation-identity

Stacked on !37 (merged) (identity relay); GitLab retargets it to develop once !37 (merged) merges.

The portal's Federation page (portal!6 (merged)) registers a partner before it federates with it, and it calls /platform/v1/federation/partners. OEG had no such route, so every call came back 404 even though FM already serves the registry on /internal/partners. This adds the four relays.

sequenceDiagram
    participant P as Portal
    participant OEG as OEG
    participant FM as FM
    P->>OEG: GET/POST /platform/v1/federation/partners (role operator)
    P->>OEG: GET/PATCH /platform/v1/federation/partners/{partnerOpId}
    OEG->>FM: same method + body on /internal/partners[/{id}]
    FM-->>OEG: 200/201 Partner, or ProblemDetails
    OEG-->>P: relayed unchanged, or 502 if outside FM's contract
Operation FM statuses relayed Meaning
list_partners 200, 500
register_partner 201, 400, 409, 422, 500 400 bad field (invalidParams), 409 mcc_mnc or oauth2_client_id taken, 422 only some outbound credential fields set
get_partner 200, 404, 500 OEG rejects a non-UUID partnerOpId itself, so FM never sees one
update_partner 200, 400, 404, 409, 422, 500
  • OEG doesn't validate the bodies. FM is the only place the registration rules live, so OEG checks only that the body is JSON. FM's success bodies are checked against Partner/PartnerList, the same way the other federation routes are gated.
  • FM only returns ProblemDetails on these routes after federation-manager!29 (merged) merges. Before it, a bad body came back as FastAPI's plain 422 and OEG turned it into a 502.
  • Role operator for all four, in OPERATION_REQUIREMENTS.

Tested: 9 new unit tests in test_federation_manager_endpoints.py (106 pass). End to end on the two-operator docker harness, through OEG-A to FM-A: list, register 201, get, patch, duplicate 409, bad mcc_mnc 400 naming the field, partial credentials 422, unknown 404, non-UUID 400, non-JSON 400. Auth was in log-only mode there, because the harness Keycloak has no realm-oop operator user, so the role check is covered by unit tests only.

Merge request reports