chore(ers): add BDD scenarios for condition operators equals, contains, regex

[khvirtru]

Summary

Adds BDD test coverage for the three untested condition operators in multi-strategy ERS strategy matching:

• @ers-condition-equals — 3 scenarios: exact match (alice PERMIT), negative match (bob DENY), case-insensitive matching (values: ["ALICE"] matches userName alice)
• @ers-condition-contains — 3 scenarios: substring match ("ali" in "alice" PERMIT), negative match (bob DENY), AND logic (two contains conditions — only "diana" matches both)
• @ers-condition-regex — 3 scenarios: pattern match (^[a-d].* matches alice PERMIT), negative match (henry DENY), AND logic (regex + exists conditions)

All 9 scenarios use LDAP strategies with user_name entities, avoiding the claims provider bug (#3790). Each feature file is @stateless and runs independently.

Coverage before/after

Operator	Unit tests	BDD tests (before)	BDD tests (after)
exists	Many	Many	Many
equals	1 (negative only)	0	3
contains	0	0	3
regex	0	0	3
AND logic (multiple conditions)	0	0	2

Related

• fix(ers): ResolveEntities does not populate JWTClaimsContextKey for claims provider #3790 — claims provider context bug (why these tests use LDAP, not claims)
• chore(ers): expand multi-strategy ERS BDD coverage #3791 — fail-fast, fallback, and claims-only BDD tests
• DSPX-4100 — multi-strategy ERS BDD coverage

Test plan

• CI: all 9 scenarios should pass (equals, contains, regex)
• Run locally with --godog.tags=@ers-condition-equals / @ers-condition-contains / @ers-condition-regex

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Added BDD coverage for ERS condition operators: contains, equals (including case-insensitive and multi-value), regex, and mixed-operator AND logic.
  • Validated substring and pattern matching semantics, non-matching behavior, and scenario routing outcomes.
  • Added end-to-end decision requests asserting expected PERMIT and DENY results across the new scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 60428150-5ad5-4410-9731-b8b9f0f66dca

📥 Commits

Reviewing files that changed from the base of the PR and between 843f8f6 and 8d038ce.

📒 Files selected for processing (7)

• tests-bdd/features/ers-condition-and-logic.feature
• tests-bdd/features/ers-condition-and-mixed.feature
• tests-bdd/features/ers-condition-contains.feature
• tests-bdd/features/ers-condition-equals-ci.feature
• tests-bdd/features/ers-condition-equals-multi.feature
• tests-bdd/features/ers-condition-equals.feature
• tests-bdd/features/ers-condition-regex.feature

---

📝 Walkthrough

Walkthrough

Adds BDD feature coverage for ERS contains, equals, and regex JWT claim conditions, including case-insensitive matching, multi-value matching, non-matching denial, and combined-condition behavior using LDAP-backed configurations.

Changes

ERS condition operators

Layer / File(s)	Summary
Single-condition operator scenarios tests-bdd/features/ers-condition-contains.feature, tests-bdd/features/ers-condition-equals*.feature, tests-bdd/features/ers-condition-regex.feature	Adds LDAP-backed scenarios for case-insensitive contains and equals matching, regex matching, and denial when conditions do not match.
Equals multi-value scenarios tests-bdd/features/ers-condition-equals-multi.feature	Verifies PERMIT when the claim matches either configured value and DENY when it matches neither.
Combined condition logic tests-bdd/features/ers-condition-and-logic.feature, tests-bdd/features/ers-condition-and-mixed.feature	Verifies AND semantics for multiple contains conditions and for mixed regex plus contains conditions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: jrschumacher

Poem

A rabbit hops through claims so bright,
Tests match by day and deny by night.
Equals, contains, regex in flight,
LDAP guides each decision right.
“PERMIT!” we cheer in moonbeam light.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: new BDD scenarios covering equals, contains, and regex ERS condition operators.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[elizabethhealy]

looks good, some comments about some cases to add to get fuller coverage + 1 about discrepancy in the description vs what its actually testing. but you could tackle them as a follow on if you want

Comment was edited