fix(bff): pin test JWT schemes to a static config so no OIDC metadata fetch (refs #13)

The medewerker scheme intermittently hung ~2s fetching OIDC metadata from its
(unreachable) test authority and then 401'd — clearing Authority alone left
JwtBearer's PostConfigure free to build a ConfigurationManager under CI timing. Give
both test schemes a StaticConfigurationManager so metadata is never fetched, making
token validation deterministic. Also harden AddRealmRoles to never throw (a throw in
OnTokenValidated surfaces as a 401) — a malformed realm_access yields no roles (403).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/Bff.Tests/BffFactory.cs

@@ -5,6 +5,7 @@ using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.AspNetCore.TestHost;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Microsoft.IdentityModel.Tokens;
 
@@ -23,9 +24,34 @@ internal sealed class BffFactory : WebApplicationFactory<Program>
     public FakeDomainClient Domain { get; } = new();
     public FakeProjectionClient Projection { get; } = new();
 
+    private static void ValidateWithTestKey(IServiceCollection services, string scheme) =>
+        services.Configure<JwtBearerOptions>(scheme, options =>
+        {
+            // Validate locally against the test key and NEVER reach out for OIDC metadata. A static
+            // configuration manager guarantees this regardless of Configure/PostConfigure ordering —
+            // clearing Authority alone left the medewerker scheme fetching metadata under CI timing
+            // (2s hang → 401), because JwtBearer's PostConfigure could still build a ConfigurationManager.
+            options.Authority = null;
+            options.MetadataAddress = null!;
+            options.RequireHttpsMetadata = false;
+            options.Configuration = new OpenIdConnectConfiguration();
+            options.ConfigurationManager =
+                new StaticConfigurationManager<OpenIdConnectConfiguration>(new OpenIdConnectConfiguration());
+            options.TokenValidationParameters = new TokenValidationParameters
+            {
+                ValidateIssuer = false,
+                ValidateAudience = false,
+                ValidateLifetime = true,
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKey = TestSigningKey,
+                ClockSkew = TimeSpan.Zero,
+            };
+        });
+
     protected override void ConfigureWebHost(IWebHostBuilder builder)
     {
         builder.UseSetting("Keycloak:Authority", "https://keycloak.invalid/realms/digid");
+        builder.UseSetting("Keycloak:MedewerkerAuthority", "https://keycloak.invalid/realms/medewerker");
         builder.UseSetting("Downstream:Domain:BaseUrl", "http://domain.invalid/");
         builder.UseSetting("Downstream:Projection:BaseUrl", "http://projection.invalid/");
 
@@ -34,23 +60,11 @@ internal sealed class BffFactory : WebApplicationFactory<Program>
             services.AddSingleton<IDomainClient>(Domain);
             services.AddSingleton<IProjectionClient>(Projection);
 
-            services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
-            {
-                // Validate locally against the test key; never reach out for OIDC metadata.
-                options.Authority = null;
-                options.MetadataAddress = null!;
-                options.RequireHttpsMetadata = false;
-                options.Configuration = new OpenIdConnectConfiguration();
-                options.TokenValidationParameters = new TokenValidationParameters
-                {
-                    ValidateIssuer = false,
-                    ValidateAudience = false,
-                    ValidateLifetime = true,
-                    ValidateIssuerSigningKey = true,
-                    IssuerSigningKey = TestSigningKey,
-                    ClockSkew = TimeSpan.Zero,
-                };
-            });
+            // Both realms validate locally against the test key (no live Keycloak). The medewerker
+            // scheme keeps its OnTokenValidated role-lifting from Program.cs — only the validation
+            // parameters are swapped here.
+            ValidateWithTestKey(services, JwtBearerDefaults.AuthenticationScheme);
+            ValidateWithTestKey(services, "medewerker");
         });
     }
 }