feat: add user entity, registration, and RBAC model

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/test/java/net/siegeln/cameleer/saas/auth/AuthServiceTest.java

@@ -0,0 +1,98 @@
+package net.siegeln.cameleer.saas.auth;
+
+import net.siegeln.cameleer.saas.audit.AuditAction;
+import net.siegeln.cameleer.saas.audit.AuditService;
+import net.siegeln.cameleer.saas.auth.dto.RegisterRequest;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+import java.util.Optional;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class AuthServiceTest {
+
+    @Mock
+    private UserRepository userRepository;
+    @Mock
+    private RoleRepository roleRepository;
+    @Mock
+    private PasswordEncoder passwordEncoder;
+    @Mock
+    private JwtService jwtService;
+    @Mock
+    private AuditService auditService;
+
+    private AuthService authService;
+
+    @BeforeEach
+    void setUp() {
+        authService = new AuthService(userRepository, roleRepository,
+                passwordEncoder, jwtService, auditService);
+    }
+
+    @Test
+    void register_createsUserAndReturnsToken() {
+        var request = new RegisterRequest("user@example.com", "Test User", "password123");
+        var ownerRole = new RoleEntity();
+        ownerRole.setName("OWNER");
+
+        when(userRepository.existsByEmail("user@example.com")).thenReturn(false);
+        when(passwordEncoder.encode("password123")).thenReturn("encoded-password");
+        when(roleRepository.findByName("OWNER")).thenReturn(Optional.of(ownerRole));
+        when(userRepository.save(any(UserEntity.class))).thenAnswer(invocation -> {
+            UserEntity user = invocation.getArgument(0);
+            // simulate ID assignment by persistence
+            try {
+                var idField = UserEntity.class.getDeclaredField("id");
+                idField.setAccessible(true);
+                idField.set(user, java.util.UUID.randomUUID());
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+            return user;
+        });
+        when(jwtService.generateToken(any(UserEntity.class))).thenReturn("test-jwt-token");
+
+        var response = authService.register(request, "127.0.0.1");
+
+        assertNotNull(response);
+        assertEquals("test-jwt-token", response.token());
+        assertEquals("user@example.com", response.email());
+        assertEquals("Test User", response.name());
+
+        // Verify audit was logged
+        verify(auditService).log(
+                any(), eq("user@example.com"), eq(null),
+                eq(AuditAction.AUTH_REGISTER), eq(null),
+                eq(null), eq("127.0.0.1"),
+                eq("SUCCESS"), eq(null)
+        );
+    }
+
+    @Test
+    void register_rejectsDuplicateEmail() {
+        var request = new RegisterRequest("existing@example.com", "Test User", "password123");
+        when(userRepository.existsByEmail("existing@example.com")).thenReturn(true);
+
+        var exception = assertThrows(IllegalArgumentException.class,
+                () -> authService.register(request, "127.0.0.1"));
+
+        assertEquals("Email already registered", exception.getMessage());
+        verify(userRepository, never()).save(any());
+        verify(auditService, never()).log(any(), any(), any(), any(), any(), any(), any(), any(), any());
+    }
+}