@ngocsangairvds/vsaf 4.0.5 → 4.0.7

package/skills/vds-skill/vds-scripts/confluence_orchestrator/tests/test_tree_copier_remap.py

@@ -0,0 +1,289 @@
+"""Unit tests for TreeCopier link-remapping phase (FR-01.5 / TSK-D.5).
+
+Tests cover all four pattern classes:
+  Pattern 1 — ri:content-id attribute (only for IDs present in page_map)
+  Pattern 2 — ri:space-key attribute (unconditional space substitution)
+  Pattern 3 — relative /display/<source-space>/ URL paths
+  Pattern 4 — absolute <source-base-url>/display/<source-space>/ URLs
+
+Edge cases:
+  - ID not in page_map → unchanged
+  - Body with no matching links → update_page not called
+  - Mixed patterns in single body → all replaced in one pass
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from confluence_orchestrator.tree_copier import (
+    CopyOptions,
+    CopyResult,
+    TreeCopier,
+)
+
+SOURCE_SPACE = "IIST"
+TARGET_SPACE = "TTPMCOREPM"
+SOURCE_BASE = "http://10.254.136.35:8090"
+TARGET_BASE = "http://confluence.digital.vn"
+
+
+# ---------------------------------------------------------------------------
+# Mock infrastructure (minimal — remap only needs get_page + update_page)
+# ---------------------------------------------------------------------------
+
+
+class RemapHttp:
+    """Minimal HTTP stub for remap tests — only needs base_url."""
+
+    def __init__(self, base_url: str) -> None:
+        self.base_url = base_url
+
+
+class RemapClient:
+    """ContentClient stub scoped to remap test needs."""
+
+    def __init__(self, base_url: str) -> None:
+        self._http = RemapHttp(base_url)
+        self.base_url = base_url
+        # Configurable: page_id → body string
+        self._bodies: dict[str, str] = {}
+        self.updated: list[dict[str, Any]] = []
+        self.get_page_calls: list[str] = []
+
+    def get_page(self, page_id: str, *, expand: list[str] | None = None) -> dict[str, Any]:
+        self.get_page_calls.append(page_id)
+        body = self._bodies.get(page_id, "")
+        return {"id": page_id, "body": {"storage": {"value": body}}}
+
+    def update_page(self, page_id: str, **kwargs: Any) -> dict[str, Any]:
+        self.updated.append({"page_id": page_id, **kwargs})
+        return {"id": page_id}
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def make_remap_copier(
+    source_client: RemapClient,
+    target_client: RemapClient,
+    *,
+    source_space: str = SOURCE_SPACE,
+    target_space: str = TARGET_SPACE,
+) -> TreeCopier:
+    return TreeCopier(
+        source_client,  # type: ignore[arg-type]
+        target_client,  # type: ignore[arg-type]
+        target_space,
+        source_space,
+        CopyOptions(skip_attachments=True, skip_labels=True),
+    )
+
+
+def remap_single(body: str, page_map: dict[str, str]) -> str:
+    """Run _remap_links on a single page body and return the remapped body."""
+    src = RemapClient(SOURCE_BASE)
+    tgt = RemapClient(TARGET_BASE)
+    tgt._bodies["T1"] = body
+    copier = make_remap_copier(src, tgt)
+    result = CopyResult(page_map=dict(page_map))
+    copier._remap_links(result, {})
+    if tgt.updated:
+        return tgt.updated[0]["body"]
+    return body  # unchanged — no update_page call made
+
+
+# ---------------------------------------------------------------------------
+# Pattern 1: ri:content-id
+# ---------------------------------------------------------------------------
+
+
+class TestPattern1ContentId:
+    def test_remaps_id_present_in_page_map(self) -> None:
+        body = '<ac:structured-macro><ri:content-id="111"/></ac:structured-macro>'
+        result = remap_single(body, {"SRC-A": "T1", "111": "999"})
+        assert 'ri:content-id="999"' in result
+        assert 'ri:content-id="111"' not in result
+
+    def test_leaves_numeric_id_unchanged_when_not_in_page_map(self) -> None:
+        """A matching numeric ID that isn't in page_map must not be remapped."""
+        body = '<ri:content-id="9999"/>'
+        result = remap_single(body, {"SRC-A": "T1"})  # "9999" not in map
+        assert 'ri:content-id="9999"' in result
+
+    def test_only_remaps_ids_in_page_map_not_all_ids(self) -> None:
+        body = '<p><ri:content-id="10"/> and <ri:content-id="20"/></p>'
+        result = remap_single(body, {"SRC-A": "T1", "10": "100"})
+        # "10" is in map → remapped; "20" is not → unchanged
+        assert 'ri:content-id="100"' in result
+        assert 'ri:content-id="20"' in result
+        assert 'ri:content-id="10"' not in result
+
+    def test_multiple_occurrences_all_remapped(self) -> None:
+        body = '<ri:content-id="55"/> <ri:content-id="55"/>'
+        result = remap_single(body, {"SRC": "T1", "55": "77"})
+        assert result.count('ri:content-id="77"') == 2
+
+    def test_remap_increments_links_remapped_counter(self) -> None:
+        src = RemapClient(SOURCE_BASE)
+        tgt = RemapClient(TARGET_BASE)
+        tgt._bodies["T1"] = '<ri:content-id="10"/> <ri:content-id="10"/>'
+        copier = make_remap_copier(src, tgt)
+        result = CopyResult(page_map={"SRC": "T1", "10": "20"})
+        copier._remap_links(result, {})
+        assert result.links_remapped == 2
+
+
+# ---------------------------------------------------------------------------
+# Pattern 2: ri:space-key
+# ---------------------------------------------------------------------------
+
+
+class TestPattern2SpaceKey:
+    def test_replaces_source_space_key_attribute(self) -> None:
+        body = f'<ri:space ri:space-key="{SOURCE_SPACE}"/>'
+        result = remap_single(body, {"SRC": "T1"})
+        assert f'ri:space-key="{TARGET_SPACE}"' in result
+        assert f'ri:space-key="{SOURCE_SPACE}"' not in result
+
+    def test_multiple_space_key_occurrences_all_replaced(self) -> None:
+        body = f'<ri:space-key="{SOURCE_SPACE}"/> <ri:space-key="{SOURCE_SPACE}"/> <ri:space-key="OTHER"/>'
+        result = remap_single(body, {"SRC": "T1"})
+        assert result.count(f'ri:space-key="{TARGET_SPACE}"') == 2
+        assert 'ri:space-key="OTHER"' in result  # different space not touched
+
+    def test_applies_unconditionally_even_to_external_pages(self) -> None:
+        """Patterns 2-4 apply to ALL occurrences of source space, not just page_map IDs."""
+        body = f'<ri:space-key="{SOURCE_SPACE}"/> no page-id link here'
+        result = remap_single(body, {"SRC": "T1"})  # page_map has no content-id
+        assert f'ri:space-key="{TARGET_SPACE}"' in result
+
+
+# ---------------------------------------------------------------------------
+# Pattern 3: relative /display/ URL
+# ---------------------------------------------------------------------------
+
+
+class TestPattern3RelativeDisplayUrl:
+    def test_replaces_relative_display_path(self) -> None:
+        body = f'<a href="/display/{SOURCE_SPACE}/PageTitle">link</a>'
+        result = remap_single(body, {"SRC": "T1"})
+        assert f"/display/{TARGET_SPACE}/" in result
+        assert f"/display/{SOURCE_SPACE}/" not in result
+
+    def test_leaves_other_spaces_relative_paths_unchanged(self) -> None:
+        body = '<a href="/display/OTHERSPACE/Page">other</a>'
+        result = remap_single(body, {"SRC": "T1"})
+        assert "/display/OTHERSPACE/" in result
+
+    def test_multiple_relative_links_all_replaced(self) -> None:
+        body = f'<a href="/display/{SOURCE_SPACE}/P1">p1</a><a href="/display/{SOURCE_SPACE}/P2">p2</a>'
+        result = remap_single(body, {"SRC": "T1"})
+        assert result.count(f"/display/{TARGET_SPACE}/") == 2
+
+
+# ---------------------------------------------------------------------------
+# Pattern 4: absolute source base URL
+# ---------------------------------------------------------------------------
+
+
+class TestPattern4AbsoluteUrl:
+    def test_replaces_absolute_source_url(self) -> None:
+        body = f'<a href="{SOURCE_BASE}/display/{SOURCE_SPACE}/Page">link</a>'
+        result = remap_single(body, {"SRC": "T1"})
+        assert f"{TARGET_BASE}/display/{TARGET_SPACE}/" in result
+        assert SOURCE_BASE not in result
+
+    def test_partial_url_not_affected(self) -> None:
+        """Only the combination of base + space is replaced, not base URL alone."""
+        # This URL has the base but not the /display/SPACE/ path — pattern 4 won't match
+        body = f'<img src="{SOURCE_BASE}/download/attachments/123/img.png"/>'
+        result = remap_single(body, {"SRC": "T1"})
+        # The attachment download URL shouldn't be modified by pattern 4
+        assert f"{SOURCE_BASE}/download/" in result
+
+    def test_multiple_absolute_links_all_replaced(self) -> None:
+        body = (
+            f'<a href="{SOURCE_BASE}/display/{SOURCE_SPACE}/A">a</a>'
+            f'<a href="{SOURCE_BASE}/display/{SOURCE_SPACE}/B">b</a>'
+        )
+        result = remap_single(body, {"SRC": "T1"})
+        assert result.count(f"{TARGET_BASE}/display/{TARGET_SPACE}/") == 2
+
+
+# ---------------------------------------------------------------------------
+# Edge cases
+# ---------------------------------------------------------------------------
+
+
+class TestRemapEdgeCases:
+    def test_body_with_no_links_no_update_page_called(self) -> None:
+        src = RemapClient(SOURCE_BASE)
+        tgt = RemapClient(TARGET_BASE)
+        tgt._bodies["T1"] = "<p>plain text, no links at all</p>"
+        copier = make_remap_copier(src, tgt)
+        result = CopyResult(page_map={"SRC": "T1"})
+        copier._remap_links(result, {})
+        assert tgt.updated == []
+        assert result.links_remapped == 0
+
+    def test_empty_body_no_update_page_called(self) -> None:
+        src = RemapClient(SOURCE_BASE)
+        tgt = RemapClient(TARGET_BASE)
+        tgt._bodies["T1"] = ""
+        copier = make_remap_copier(src, tgt)
+        result = CopyResult(page_map={"SRC": "T1"})
+        copier._remap_links(result, {})
+        assert tgt.updated == []
+
+    def test_mixed_patterns_all_replaced_in_single_pass(self) -> None:
+        """A realistic body with all 4 patterns should be fully remapped."""
+        body = (
+            f'<ri:content-id="10"/> '
+            f'<ri:space-key="{SOURCE_SPACE}"/> '
+            f'<a href="/display/{SOURCE_SPACE}/Page">rel</a> '
+            f'<a href="{SOURCE_BASE}/display/{SOURCE_SPACE}/Page">abs</a>'
+        )
+        result = remap_single(body, {"SRC": "T1", "10": "20"})
+        assert 'ri:content-id="20"' in result
+        assert f'ri:space-key="{TARGET_SPACE}"' in result
+        assert f"/display/{TARGET_SPACE}/" in result
+        assert f"{TARGET_BASE}/display/{TARGET_SPACE}/" in result
+        # Source artifacts gone
+        assert 'ri:content-id="10"' not in result
+        assert f'ri:space-key="{SOURCE_SPACE}"' not in result
+        assert f"/display/{SOURCE_SPACE}/" not in result
+        assert f"{SOURCE_BASE}/display/" not in result
+
+    def test_dry_run_placeholders_skipped(self) -> None:
+        """Dry-run entries have empty target_id — _remap_links must skip them."""
+        src = RemapClient(SOURCE_BASE)
+        tgt = RemapClient(TARGET_BASE)
+        copier = make_remap_copier(src, tgt)
+        result = CopyResult(page_map={"SRC-A": "", "SRC-B": ""})  # dry-run placeholders
+        copier._remap_links(result, {})
+        assert tgt.get_page_calls == []
+        assert tgt.updated == []
+
+    def test_links_remapped_total_count_across_all_pages(self) -> None:
+        src = RemapClient(SOURCE_BASE)
+        tgt = RemapClient(TARGET_BASE)
+        tgt._bodies["T1"] = f'<ri:space-key="{SOURCE_SPACE}"/>'
+        tgt._bodies["T2"] = f'<ri:space-key="{SOURCE_SPACE}"/> <ri:space-key="{SOURCE_SPACE}"/>'
+        copier = make_remap_copier(src, tgt)
+        result = CopyResult(page_map={"S1": "T1", "S2": "T2"})
+        copier._remap_links(result, {})
+        assert result.links_remapped == 3  # 1 in T1 + 2 in T2
+
+    def test_update_page_called_with_body_kwarg(self) -> None:
+        src = RemapClient(SOURCE_BASE)
+        tgt = RemapClient(TARGET_BASE)
+        tgt._bodies["T1"] = f'<ri:space-key="{SOURCE_SPACE}"/>'
+        copier = make_remap_copier(src, tgt)
+        result = CopyResult(page_map={"S1": "T1"})
+        copier._remap_links(result, {})
+        assert tgt.updated[0]["page_id"] == "T1"
+        assert "body" in tgt.updated[0]
+        assert f'ri:space-key="{TARGET_SPACE}"' in tgt.updated[0]["body"]

package/skills/vds-skill/vds-scripts/confluence_orchestrator/tests/test_user_group_management.py

@@ -0,0 +1,387 @@
+from __future__ import annotations
+
+from typing import Any
+from unittest.mock import Mock
+
+import pytest
+from confluence_orchestrator.cli import app
+from confluence_orchestrator.config import ConfluenceSettings
+from confluence_orchestrator.http import ConfluenceClient
+from typer.testing import CliRunner
+
+runner = CliRunner()
+
+
+@pytest.fixture(autouse=True)
+def mock_settings(monkeypatch: pytest.MonkeyPatch) -> None:
+    def fake_load_settings(strict: bool = False) -> ConfluenceSettings:
+        return ConfluenceSettings.model_validate(
+            {
+                "VDS_USERNAME": "user",
+                "VDS_PASSWORD": "pass",
+                "INTERNAL_CONFLUENCE_TOKEN": "token-int",
+                "EXTERNAL_CONFLUENCE_TOKEN": "token-ext",
+            }
+        )
+
+    monkeypatch.setattr("confluence_orchestrator.cli.load_settings", fake_load_settings)
+
+
+def _build_fake_client() -> tuple[ConfluenceClient, Mock]:
+    inner = Mock()
+    client = ConfluenceClient.__new__(ConfluenceClient)  # type: ignore[call-arg]
+    client._client = inner  # type: ignore[attr-defined]
+    client._log = Mock()
+    client._with_retry = lambda operation, _: operation()  # type: ignore[assignment]
+    return client, inner
+
+
+# ---------------------------------------------------------------------------
+# Client method coverage
+# ---------------------------------------------------------------------------
+
+
+def test_client_get_all_groups_invokes_sdk() -> None:
+    client, inner = _build_fake_client()
+    inner.get_all_groups.return_value = [{"name": "group1"}, {"name": "group2"}]
+
+    result = client.get_all_groups(start=0, limit=100)
+
+    assert len(result) == 2
+    assert result[0]["name"] == "group1"
+    inner.get_all_groups.assert_called_once_with(start=0, limit=100)
+
+
+def test_client_get_all_groups_with_pagination() -> None:
+    client, inner = _build_fake_client()
+    inner.get_all_groups.return_value = [{"name": "group3"}]
+
+    result = client.get_all_groups(start=10, limit=20)
+
+    assert len(result) == 1
+    inner.get_all_groups.assert_called_once_with(start=10, limit=20)
+
+
+def test_client_get_group_members_invokes_sdk() -> None:
+    client, inner = _build_fake_client()
+    inner.get_group_members.return_value = [{"username": "user1"}, {"username": "user2"}]
+
+    result = client.get_group_members("admins", start=0, limit=100)
+
+    assert len(result) == 2
+    assert result[0]["username"] == "user1"
+    inner.get_group_members.assert_called_once_with("admins", start=0, limit=100)
+
+
+def test_client_get_user_details_by_username_invokes_sdk() -> None:
+    client, inner = _build_fake_client()
+    inner.get_user_details_by_username.return_value = {"username": "testuser", "displayName": "Test User"}
+
+    result = client.get_user_details_by_username("testuser", expand="status")
+
+    assert result["username"] == "testuser"
+    inner.get_user_details_by_username.assert_called_once_with("testuser", expand="status")
+
+
+def test_client_get_user_details_by_userkey_invokes_sdk() -> None:
+    client, inner = _build_fake_client()
+    inner.get_user_details_by_userkey.return_value = {"userKey": "key123", "displayName": "Test User"}
+
+    result = client.get_user_details_by_userkey("key123")
+
+    assert result["userKey"] == "key123"
+    inner.get_user_details_by_userkey.assert_called_once_with("key123", expand=None)
+
+
+def test_client_change_user_password_invokes_sdk() -> None:
+    client, inner = _build_fake_client()
+    inner.change_user_password.return_value = None
+
+    result = client.change_user_password("testuser", "newpass123")
+
+    assert result is None
+    inner.change_user_password.assert_called_once_with("testuser", "newpass123")
+
+
+def test_client_add_user_to_group_invokes_sdk() -> None:
+    client, inner = _build_fake_client()
+    inner.add_user_to_group.return_value = None
+
+    result = client.add_user_to_group("testuser", "admins")
+
+    assert result is None
+    inner.add_user_to_group.assert_called_once_with("testuser", "admins")
+
+
+def test_client_remove_user_from_group_invokes_sdk() -> None:
+    client, inner = _build_fake_client()
+    inner.remove_user_from_group.return_value = None
+
+    result = client.remove_user_from_group("testuser", "admins")
+
+    assert result is None
+    inner.remove_user_from_group.assert_called_once_with("testuser", "admins")
+
+
+# ---------------------------------------------------------------------------
+# CLI command coverage
+# ---------------------------------------------------------------------------
+
+
+class DummyGroupClient:
+    def __init__(self) -> None:
+        self.calls: list[tuple[str, tuple[Any, ...], dict[str, Any]]] = []
+
+    def get_all_groups(self, start: int = 0, limit: int = 1000) -> list[dict[str, Any]]:
+        self.calls.append(("get_all_groups", (start, limit), {}))
+        return [{"name": "group1"}, {"name": "group2"}]
+
+    def get_group_members(self, group_name: str, start: int = 0, limit: int = 1000) -> list[dict[str, Any]]:
+        self.calls.append(("get_group_members", (group_name, start, limit), {}))
+        return [{"username": "user1"}]
+
+
+class DummyUserClient:
+    def __init__(self) -> None:
+        self.calls: list[tuple[str, tuple[Any, ...], dict[str, Any]]] = []
+
+    def get_user_details_by_username(self, username: str, expand: str | None = None) -> dict[str, Any]:
+        self.calls.append(("get_user_details_by_username", (username,), {"expand": expand}))
+        return {"username": username, "displayName": "Test User"}
+
+    def get_user_details_by_userkey(self, userkey: str, expand: str | None = None) -> dict[str, Any]:
+        self.calls.append(("get_user_details_by_userkey", (userkey,), {"expand": expand}))
+        return {"userKey": userkey, "displayName": "Test User"}
+
+    def change_user_password(self, username: str, password: str) -> None:
+        self.calls.append(("change_user_password", (username, password), {}))
+
+    def add_user_to_group(self, username: str, group_name: str) -> None:
+        self.calls.append(("add_user_to_group", (username, group_name), {}))
+
+    def remove_user_from_group(self, username: str, group_name: str) -> None:
+        self.calls.append(("remove_user_from_group", (username, group_name), {}))
+
+
+def test_cli_group_list_success(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyGroupClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["group", "list", "--start", "0", "--limit", "100"])
+
+    assert result.exit_code == 0
+    assert "group1" in result.stdout
+    assert len(client.calls) == 1
+    assert client.calls[0][0] == "get_all_groups"
+
+
+def test_cli_group_list_with_pagination(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyGroupClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["group", "list", "--start", "10", "--limit", "50"])
+
+    assert result.exit_code == 0
+    assert client.calls[0][1] == (10, 50)
+
+
+def test_cli_group_members_success(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyGroupClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["group", "members", "--group", "admins"])
+
+    assert result.exit_code == 0
+    assert "user1" in result.stdout
+    assert len(client.calls) == 1
+    assert client.calls[0][0] == "get_group_members"
+
+
+def test_cli_group_members_requires_group(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyGroupClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["group", "members"])
+
+    assert result.exit_code != 0
+    assert "--group required" in result.stdout or "--group required" in result.stderr
+
+
+def test_cli_group_invalid_action(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyGroupClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["group", "invalid"])
+
+    assert result.exit_code != 0
+    assert "Unknown action" in result.stdout or "Unknown action" in result.stderr
+
+
+def test_cli_user_get_by_username_success(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "get", "--username", "testuser"])
+
+    assert result.exit_code == 0
+    assert "testuser" in result.stdout
+    assert len(client.calls) == 1
+    assert client.calls[0][0] == "get_user_details_by_username"
+
+
+def test_cli_user_get_by_userkey_success(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "get", "--userkey", "key123"])
+
+    assert result.exit_code == 0
+    assert "key123" in result.stdout
+    assert len(client.calls) == 1
+    assert client.calls[0][0] == "get_user_details_by_userkey"
+
+
+def test_cli_user_get_with_expand(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "get", "--username", "testuser", "--expand", "status,details"])
+
+    assert result.exit_code == 0
+    assert client.calls[0][2]["expand"] == "status,details"
+
+
+def test_cli_user_get_requires_username_or_userkey(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "get"])
+
+    assert result.exit_code != 0
+    assert "--username" in result.stdout or "--username" in result.stderr or "--userkey" in result.stdout
+
+
+def test_cli_user_get_rejects_both_username_and_userkey(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "get", "--username", "testuser", "--userkey", "key123"])
+
+    assert result.exit_code != 0
+    assert "not both" in result.stdout or "not both" in result.stderr
+
+
+def test_cli_user_password_success(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "password", "--username", "testuser", "--new-password", "newpass123", "--yes"])
+
+    assert result.exit_code == 0
+    assert "password_changed" in result.stdout
+    assert len(client.calls) == 1
+    assert client.calls[0][0] == "change_user_password"
+
+
+def test_cli_user_password_requires_yes(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "password", "--username", "testuser", "--new-password", "newpass123"])
+
+    assert result.exit_code != 0
+    assert "--yes required" in result.stdout or "--yes required" in result.stderr
+
+
+def test_cli_user_password_requires_username(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "password", "--new-password", "newpass123", "--yes"])
+
+    assert result.exit_code != 0
+    assert "--username required" in result.stdout or "--username required" in result.stderr
+
+
+def test_cli_user_password_requires_new_password(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "password", "--username", "testuser", "--yes"])
+
+    assert result.exit_code != 0
+    assert "--new-password required" in result.stdout or "--new-password required" in result.stderr
+
+
+def test_cli_user_group_add_success(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "group-add", "--username", "testuser", "--group", "admins", "--yes"])
+
+    assert result.exit_code == 0
+    assert "added" in result.stdout
+    assert len(client.calls) == 1
+    assert client.calls[0][0] == "add_user_to_group"
+
+
+def test_cli_user_group_add_requires_yes(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "group-add", "--username", "testuser", "--group", "admins"])
+
+    assert result.exit_code != 0
+    assert "--yes required" in result.stdout or "--yes required" in result.stderr
+
+
+def test_cli_user_group_add_requires_username(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "group-add", "--group", "admins", "--yes"])
+
+    assert result.exit_code != 0
+    assert "--username required" in result.stdout or "--username required" in result.stderr
+
+
+def test_cli_user_group_add_requires_group(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "group-add", "--username", "testuser", "--yes"])
+
+    assert result.exit_code != 0
+    assert "--group required" in result.stdout or "--group required" in result.stderr
+
+
+def test_cli_user_group_remove_success(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "group-remove", "--username", "testuser", "--group", "admins", "--yes"])
+
+    assert result.exit_code == 0
+    assert "removed" in result.stdout
+    assert len(client.calls) == 1
+    assert client.calls[0][0] == "remove_user_from_group"
+
+
+def test_cli_user_group_remove_requires_yes(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "group-remove", "--username", "testuser", "--group", "admins"])
+
+    assert result.exit_code != 0
+    assert "--yes required" in result.stdout or "--yes required" in result.stderr
+
+
+def test_cli_user_invalid_action(monkeypatch: pytest.MonkeyPatch) -> None:
+    client = DummyUserClient()
+    monkeypatch.setattr("confluence_orchestrator.cli._build_http_client", lambda *args: client)
+
+    result = runner.invoke(app, ["user", "invalid"])
+
+    assert result.exit_code != 0
+    assert "Unknown action" in result.stdout or "Unknown action" in result.stderr