fix: recognize 500 unique-constraint conflicts on import replay

[NathaelB]

Bug

is_conflict only recognized a 409, or a 400 whose body contains "exist". Some already-deployed servers surface a duplicate-key unique-constraint violation as a raw 500 instead (e.g. realms_name_key on a duplicate realm name), so replaying an import stopped at its first line instead of converging.

Fix

• Widen is_conflict to also treat a 500 whose body names a unique-constraint violation as a skip, not a hard failure.
• Add ImportReport.already_present, incremented at all 7 skip sites (realm, realm role, client, redirect, client role, user, role assignment), and render it in realm import's output — so a converging replay is now distinguishable from a run that did nothing, per the issue's ask.

Issue

Refs #27 — not fully closing it. See verification below: this server's realm-name conflict is already fixed server-side (returns 409 cleanly), but I found a different, still-live instance of the same class of bug — duplicate role creation returns a 500 with a body containing zero diagnostic information ({"message":"Internal Server Error: Internal server error"}). There is nothing in that body to safely distinguish "role already exists" from a genuine server error, so I did not attempt to pattern-match it — doing so would risk silently swallowing real failures during import. That case can only be fixed server-side (returning 409, which is exactly point 2 of this issue); leaving it here rather than guessing.

Verification

Ran a real import against a local FerrisKey server, replayed it, and inspected each conflict path directly:

• realm create <existing> → clean 409 (already fixed server-side here).
• realm import replay of a realm with one role → 500 on the role-recreation step, generic body (see above) — confirms the shape of the underlying class of bug is still present, even though this specific occurrence isn't fixable from the CLI.
• is_conflict's new branch is covered by unit tests using the exact unique constraint wording from the issue's cited Postgres violation, since I couldn't reproduce that literal case live (already patched here).

Test plan

• cargo build --workspace
• cargo test --workspace (73 passed, +5 new: is_conflict cases)
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• Manual import + replay against a running FerrisKey server (see above)

Summary by CodeRabbit

• New Features

  • Import reports now show how many resources were already present and skipped.
  • Realm import summaries include the already-present resource count.

• Bug Fixes

  • Import conflict detection now recognizes additional duplicate-resource responses.
  • Duplicate realms, roles, redirects, clients, users, and assignments are consistently counted in import reports.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 09f97f55-ef41-4420-8d08-2c01a958e032

📥 Commits

Reviewing files that changed from the base of the PR and between 399ff7c and c777a7d.

📒 Files selected for processing (3)

• libs/ferriskey-cli-core/src/import/apply.rs
• libs/ferriskey-cli-core/src/import/mod.rs
• libs/ferriskey-cli-core/src/realm.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Import replay now counts entities that already exist, recognizes legacy 500 unique-constraint responses as conflicts, validates conflict detection, and displays the count in realm import output.

Changes

Import replay accounting

Layer / File(s)	Summary
Conflict detection and replay counting libs/ferriskey-cli-core/src/import/mod.rs, libs/ferriskey-cli-core/src/import/apply.rs	ImportReport now tracks already-present entities. All supported conflict branches increment the counter. is_conflict recognizes 500 responses containing unique constraint. Tests cover supported and rejected responses.
Import report output libs/ferriskey-cli-core/src/realm.rs	Realm import tables now display the already-present count.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to c777a

The import now skips a broader class of server errors across roles, redirects, users, and assignments. If a matching 500 does not actually prove that the intended resource or relationship exists, the import could report success while leaving identity or authorization configuration incomplete; this requires explicit owner acceptance or tighter validation before merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: recognizing HTTP 500 unique-constraint conflicts during import replay.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/import-conflict-detection

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}