refactor

internal/auth/oidc.go

@@ -22,7 +22,7 @@ import (
 )
 
 // OIDCProvider implements Resolver against any OpenID Connect provider,
-// including the auth-dev.urpi.be realm used for local development.
+// including the auth.lcl-urpi.be realm used for local development.
 //
 // Everything provider-specific comes from the issuer's discovery document, so
 // the same code works against Keycloak, Authentik, Zitadel or Google without a

internal/config/config.go

@@ -71,7 +71,7 @@ type Config struct {
 
 	// AuthMode is oidc, dev, or none.
 	AuthMode string
-	// OIDCIssuer is the issuer URL, e.g. https://auth-dev.urpi.be/realms/urpi.
+	// OIDCIssuer is the issuer URL, e.g. https://auth.lcl-urpi.be/realms/urpi.
 	OIDCIssuer string
 	// OIDCClientID is the client identifier registered with the provider.
 	OIDCClientID string

internal/httpapi/router_test.go

@@ -70,7 +70,7 @@ func newUnauthenticatedRouter(t *testing.T) http.Handler {
 	t.Helper()
 	cfg := testConfig(t)
 	cfg.AuthMode = config.AuthModeOIDC
-	cfg.OIDCIssuer = "https://auth-dev.urpi.be/realms/urpi"
+	cfg.OIDCIssuer = "https://auth.lcl-urpi.be/realms/urpi"
 	cfg.OIDCClientID = "go-bananas"
 	cfg.OIDCClientSecret = "test-client-secret"
 	cfg.SessionSecure = false
@@ -278,7 +278,7 @@ func TestRuntimeIsReadableCrossOrigin(t *testing.T) {
 			// not testing the policy — it is testing the same-origin path under a
 			// misleading name.
 			req := httptest.NewRequestWithContext(context.Background(), http.MethodGet, path, nil)
-			req.Header.Set("Origin", "https://tell-dev.urpi.be")
+			req.Header.Set("Origin", "https://tell.lcl-urpi.be")
 			rec := httptest.NewRecorder()
 			router.ServeHTTP(rec, req)
 
@@ -313,7 +313,7 @@ func TestAdminAPIIsNotOpenedByTheRuntimePolicy(t *testing.T) {
 	for _, path := range []string{"/api/v1/session", "/api/v1/themes"} {
 		t.Run(path, func(t *testing.T) {
 			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, path, nil)
-			req.Header.Set("Origin", "https://tell-dev.urpi.be")
+			req.Header.Set("Origin", "https://tell.lcl-urpi.be")
 			rec := httptest.NewRecorder()
 			router.ServeHTTP(rec, req)
 
@@ -357,7 +357,7 @@ func TestAdminAPIAllowsAConfiguredOrigin(t *testing.T) {
 func TestRuntimeAnswersPreflight(t *testing.T) {
 	req := httptest.NewRequestWithContext(
 		context.Background(), http.MethodOptions, "/rt/v1/contract.json", nil)
-	req.Header.Set("Origin", "https://tell-dev.urpi.be")
+	req.Header.Set("Origin", "https://tell.lcl-urpi.be")
 	// A real preflight names the method it wants to use. Without this header the
 	// request is not a preflight, and asserting 204 on it would be asserting on a
 	// case no browser ever sends — which is how this test passed against a 405.

internal/store/repositories.go

@@ -207,8 +207,8 @@ func (s *Store) ListAudit(ctx context.Context, filter AuditFilter) ([]domain.Aud
 		args  []any
 	)
 	if filter.Actor != "" {
-		where = append(where, `actor = ?`)
-		args = append(args, filter.Actor)
+		where = append(where, `actor_email LIKE ?`)
+		args = append(args, "%"+filter.Actor+"%")
 	}
 	if filter.Action != "" {
 		where = append(where, `action = ?`)