Keycloak telemetry: add keycloakCallerClientId to PostHog events.

Expose Keycloak top-level clientId (introspection caller) separately from
attributed clientId so Stalwart vs send-backend flows remain distinguishable
when both resolve to the same token client.

Tests cover stalwart vs thunderbird-send-backend introspection.

Author: Sancus

src/thunderbird_accounts/telemetry/tasks.py

@@ -199,13 +199,16 @@ def poll_keycloak_events(self):
             # correct client at the top level and have no `token_issued_for`
             # in details, so the fallback path returns the unchanged value.
             details = event.get('details') or {}
-            client_id = details.get('token_issued_for') or event.get('clientId')
+            caller_client_id = event.get('clientId')
+            # Attributed client (e.g. desktop): prefer token_issued_for on introspection.
+            client_id = details.get('token_issued_for') or caller_client_id
 
             capture(
                 event=event_name,
                 keycloak_user_id=user_id,
                 properties={
                     'clientId': client_id,
+                    'keycloakCallerClientId': caller_client_id,
                     'keycloak_event_type': kc_type,
                     'keycloak_event_id': event_id,
                     'is_error': kc_type.endswith('_ERROR'),

src/thunderbird_accounts/telemetry/tests_keycloak.py

@@ -126,23 +126,32 @@ def test_seen_ids_are_persisted_to_cache(self):
         self.assertIn('new-event-123', cached)
 
     def test_is_error_flag_for_all_event_types(self):
-        """Exercise every mapped event type through the task and verify is_error matches the _ERROR suffix."""
-        self._set_keycloak_events([_make_keycloak_event(kc_type) for kc_type in settings.KEYCLOAK_EVENT_MAP])
+        """Every mapped event type is submitted with the correct is_error flag."""
+        # Hardcoded so the test catches regressions in the _ERROR suffix rule
+        # (instead of re-deriving it the same way the production code does).
+        expected_is_error = {
+            'LOGIN': False,
+            'LOGIN_ERROR': True,
+            'REGISTER': False,
+            'REGISTER_ERROR': True,
+            'LOGOUT': False,
+            'CODE_TO_TOKEN': False,
+            'CODE_TO_TOKEN_ERROR': True,
+            'INTROSPECT_TOKEN': False,
+            'REFRESH_TOKEN': False,
+        }
+        # If a new type is added to KEYCLOAK_EVENT_MAP, extend the table above.
+        self.assertEqual(set(expected_is_error), set(settings.KEYCLOAK_EVENT_MAP))
+
+        self._set_keycloak_events([_make_keycloak_event(kc_type) for kc_type in expected_is_error])
 
         poll_keycloak_events()
 
-        submitted_types = {
+        submitted = {
             call.kwargs['properties']['keycloak_event_type']: call.kwargs['properties']['is_error']
             for call in self.mock_ph.capture.call_args_list
         }
-        for kc_type in settings.KEYCLOAK_EVENT_MAP:
-            self.assertIn(kc_type, submitted_types, f'{kc_type} was not submitted')
-            expected_error = kc_type.endswith('_ERROR')
-            self.assertEqual(
-                submitted_types[kc_type],
-                expected_error,
-                f'{kc_type}: expected is_error={expected_error}, got {submitted_types[kc_type]}',
-            )
+        self.assertEqual(submitted, expected_is_error)
 
     @override_settings(KEYCLOAK_EVENTS_PAGE_SIZE=3)
     def test_pagination_fetches_all_events(self):
@@ -154,10 +163,10 @@ def test_pagination_fetches_all_events(self):
         self.assertEqual(mock_kc_client.request.call_count, 3)  # pages: 3+3+1
 
     def test_client_id_resolution(self):
-        """clientId is taken from details.token_issued_for when present, else from the top-level clientId."""
+        """clientId is attributed (token_issued_for or top-level); keycloakCallerClientId is raw Keycloak clientId."""
         cases = [
             (
-                'INTROSPECT_TOKEN uses details.token_issued_for',
+                'INTROSPECT_TOKEN: attributed to token_issued_for, caller stays stalwart',
                 _make_keycloak_event(
                     'INTROSPECT_TOKEN',
                     client_id='stalwart',
@@ -169,38 +178,30 @@ def test_client_id_resolution(self):
                     },
                 ),
                 'desktop',
+                'stalwart',
             ),
             (
-                'LOGIN has no details; top-level clientId wins',
+                'LOGIN has no details; top-level clientId wins for both fields',
                 _make_keycloak_event('LOGIN', client_id='desktop'),
                 'desktop',
-            ),
-            (
-                'REFRESH_TOKEN details without token_issued_for; top-level clientId wins',
-                _make_keycloak_event(
-                    'REFRESH_TOKEN',
-                    client_id='desktop',
-                    details={
-                        'token_id': 'ofrtrt:fake',
-                        'grant_type': 'refresh_token',
-                        'refresh_token_type': 'Offline',
-                    },
-                ),
                 'desktop',
             ),
             (
                 'no top-level clientId and no token_issued_for',
                 _make_keycloak_event('LOGIN', include_client_id=False),
                 None,
+                None,
             ),
         ]
 
-        for label, event, expected_client_id in cases:
+        for label, event, expected_client_id, expected_caller in cases:
             with self.subTest(case=label):
                 self.mock_ph.reset_mock()
                 cache.delete(settings.KEYCLOAK_SEEN_EVENTS_CACHE_KEY)
                 self._set_keycloak_events([event])
 
                 poll_keycloak_events()
 
-                self.assertEqual(self._last_capture_properties()['clientId'], expected_client_id)
+                props = self._last_capture_properties()
+                self.assertEqual(props['clientId'], expected_client_id)
+                self.assertEqual(props['keycloakCallerClientId'], expected_caller)