Migrate account REST service tests to tests/base - #51678

tests/base/src/test/java/org/keycloak/tests/account/ResourcesRestServiceTest.java:439

• The attacker and Alice mutations persist in the class-scoped realm; in particular, a later testUserLookupReturnsMinimalData will receive alice@test.com instead of its expected alice@localhost. Register both changes through ManagedRealm cleanup helpers.

        // Create an attacker user whose username matches the email of a legitimate user.
        UserRepresentation attacker = createUser("alice@test.com", "password", "Attacker", "X", "attacker@test.com");
        managedRealm.admin().users().create(attacker);

        alice.setEmail("alice@test.com");

tests/base/src/test/java/org/keycloak/tests/account/AccountRestServiceCorsTest.java:188

• LegacyRealmConfig starts from an empty realm, so this configuration creates neither test-user@localhost nor the direct-grant client used by getToken(); every CORS test will fail before issuing its XHR. Extend the account REST realm configuration and apply only the username override here.
  tests/base/src/test/java/org/keycloak/tests/account/AccountRestServiceCorsTest.java:54
• The new test framework serves Keycloak on port 8080 and its injected test HTTP server on 8500; nothing in tests/base listens on the legacy 8180 port. Browser navigation to these origins will therefore fail before the CORS request runs; use a reachable origin and whitelist that same origin on direct-grant.
  tests/base/src/test/java/org/keycloak/tests/account/LinkedAccountsRestServiceTest.java:104
• After switching to managedRealm.getBaseUrl(), generated broker links use /realms/test/..., but testBuildLinkedAccountUri still asserts the legacy /auth/realms/test/... path. Update that assertion to the test-framework URL layout or derive it from the managed realm URL.
  tests/base/src/test/java/org/keycloak/tests/account/SessionRestServiceTest.java:438
• Unlike the migrated TokenUtil, this helper performs a fresh password grant on every call. In testLogout, the calls at lines 301 and 304 create two test-user sessions, so the final assertEquals(1, sessions.size()) fails; cache one access token per test instance.
  tests/base/src/test/java/org/keycloak/tests/account/ResourcesRestServiceTest.java:894
• This uncached helper is invoked inside the 30-iteration setup loop, replacing one cached TokenUtil login with at least 30 password-grant requests and user sessions per test. Cache the access token for the test instance to avoid thousands of unnecessary logins across this class.
  tests/base/src/test/java/org/keycloak/tests/account/ResourcesRestServiceTest.java:748
• The setup already creates granted tickets on every resource, and the migrated test removed the code that deleted tickets for this selected resource. If its existing requester is alice, this lookup succeeds because of the granted permission rather than the new pending request, so restore ticket cleanup or select a resource/requester pair without an existing grant.
  tests/base/src/test/java/org/keycloak/tests/account/LinkedAccountsRestServiceTest.java:363
• This legacy configuration starts with an empty realm, so test-user@localhost and direct-grant are absent and addFederatedIdentities silently finds no user. Build on AccountRestRealmConfig before adding the identity providers.

tests/base/src/test/java/org/keycloak/tests/account/AccountRestServiceCorsTest.java:188

• LegacyRealmConfig starts from an empty RealmBuilder, so this realm contains neither test-user@localhost nor the direct-grant client used by getToken(). All tests will fail to obtain a token; build this configuration on AccountRestRealmConfig (or explicitly add the required user/client) before disabling username edits.
  tests/base/src/test/java/org/keycloak/tests/account/AccountRestServiceCorsTest.java:66
• The migrated framework exposes Keycloak on port 8080 and its test HTTP server on port 8500; nothing in this test starts a server on the legacy port 8180. Navigating there will fail before the XHR runs, so use a reachable test origin and whitelist that same origin on the token client.
  tests/base/src/test/java/org/keycloak/tests/account/LinkedAccountsRestServiceTest.java:363
• This configuration starts from an empty realm, but the tests authenticate test-user@localhost through direct-grant; it also means addFederatedIdentities finds no test user and adds no links. Base this realm on AccountRestRealmConfig (without re-adding its existing users), then add the identity providers and federated identities.
  tests/base/src/test/java/org/keycloak/tests/account/LinkedAccountsRestServiceTest.java:150
• The test framework serves realms directly under /realms, without the legacy /auth context path, so the generated broker URI cannot satisfy this assertion. Match the path produced from managedRealm.getBaseUrl() instead.
  tests/base/src/test/java/org/keycloak/tests/account/ResourcesRestServiceTest.java:923
• The protection ticket endpoint returns 200 OK (PermissionTicketService#create uses Response.ok(...)), not 201 or 204. Consequently the first ticket created in before() fails this assertion; assert Response.Status.OK here.
  tests/base/src/test/java/org/keycloak/tests/account/ResourcesRestServiceTest.java:747
• before() already creates a granted ticket for the first resource, requester alice, and Scope A; the protection endpoint rejects this duplicate with 400 Permission already exists. The legacy test deleted that resource's existing tickets first, so equivalent cleanup must be restored before creating this ungranted request.
  tests/base/src/test/java/org/keycloak/tests/account/SessionRestServiceTest.java:304
• Each getToken() performs a new password grant and creates another test-user session. Calling it once for DELETE and again for GET leaves two sessions, so the final assertEquals(1, ...) fails; obtain one token and reuse it for both requests.