feat(auth): migrate to Keycloak metadata auth

cli/tests/unit/test_tjwater_cli.py

@@ -32,7 +32,6 @@ def test_load_auth_context_supports_aliases(monkeypatch):
     monkeypatch.setenv("TJWATER_SERVER", "http://server")
     monkeypatch.setenv("TJWATER_ACCESS_TOKEN", "abc")
     monkeypatch.setenv("TJWATER_PROJECT_ID", "p1")
-    monkeypatch.setenv("TJWATER_USER_ID", "u1")
     monkeypatch.setenv("TJWATER_USERNAME", "tester")
     monkeypatch.setenv("TJWATER_NETWORK", "net1")
 
@@ -41,7 +40,6 @@ def test_load_auth_context_supports_aliases(monkeypatch):
     assert auth.server == "http://server"
     assert auth.access_token == "abc"
     assert auth.project_id == "p1"
-    assert auth.user_id == "u1"
     assert auth.username == "tester"
     assert auth.network == "net1"
 
@@ -50,7 +48,6 @@ def test_build_runtime_context_uses_default_server(monkeypatch):
     monkeypatch.delenv("TJWATER_SERVER", raising=False)
     monkeypatch.delenv("TJWATER_ACCESS_TOKEN", raising=False)
     monkeypatch.delenv("TJWATER_PROJECT_ID", raising=False)
-    monkeypatch.delenv("TJWATER_USER_ID", raising=False)
     monkeypatch.delenv("TJWATER_USERNAME", raising=False)
     monkeypatch.delenv("TJWATER_NETWORK", raising=False)
     monkeypatch.delenv("TJWATER_EXTRA_HEADERS", raising=False)

cli/tjwater_cli/core.py

@@ -46,7 +46,6 @@ class AuthContext:
     server: str | None = None
     access_token: str | None = None
     project_id: str | None = None
-    user_id: str | None = None
     username: str | None = None
     network: str | None = None
     headers: dict[str, str] = field(default_factory=dict)
@@ -98,7 +97,6 @@ def load_auth_context(auth_stdin: bool = False) -> AuthContext:
             "server": os.getenv("TJWATER_SERVER"),
             "access_token": os.getenv("TJWATER_ACCESS_TOKEN"),
             "project_id": os.getenv("TJWATER_PROJECT_ID"),
-            "user_id": os.getenv("TJWATER_USER_ID"),
             "username": os.getenv("TJWATER_USERNAME"),
             "network": os.getenv("TJWATER_NETWORK"),
             "headers": json.loads(extra_headers) if extra_headers else {},
@@ -117,7 +115,6 @@ def load_auth_context(auth_stdin: bool = False) -> AuthContext:
         server=_pick(raw, "server", "base_url"),
         access_token=_pick(raw, "access_token", "token", "accessToken"),
         project_id=_pick(raw, "project_id", "projectId", "x_project_id"),
-        user_id=_pick(raw, "user_id", "userId", "x_user_id"),
         username=_pick(raw, "username", "preferred_username"),
         network=_pick(raw, "network", "project_code", "projectCode", "project"),
         headers={str(key): str(value) for key, value in headers.items()},
@@ -350,8 +347,6 @@ def build_headers(
         headers["X-Project-Id"] = require_project_id(ctx)
     elif ctx.auth.project_id:
         headers["X-Project-Id"] = ctx.auth.project_id
-    if ctx.auth.user_id:
-        headers["X-User-Id"] = ctx.auth.user_id
     return headers
 
 

cli/tjwater_cli_endpoint_scope.md

@@ -306,10 +306,9 @@ app/api/v1/endpoints/snapshots.py
 app/api/v1/endpoints/cache.py
 app/api/v1/endpoints/audit.py
 app/api/v1/endpoints/users.py
-app/api/v1/endpoints/user_management.py
 ```
 
-这些接口不纳入首批 Agent CLI。原因是它们更偏运维、审计、用户管理或状态回滚，不属于 Agent 面向水务业务分析的核心调用范围。
+这些接口不纳入首批 Agent CLI。原因是它们更偏运维、审计或状态回滚，不属于 Agent 面向水务业务分析的核心调用范围。
 
 暂不暴露：
 
@@ -339,10 +338,6 @@ GET  /audit/logs/count
 GET  /getuserschema/
 GET  /getuser/
 GET  /getallusers/
-PUT    /users/{user_id}
-DELETE /users/{user_id}
-POST   /users/{user_id}/activate
-POST   /users/{user_id}/deactivate
 ```
 
 ## Help