kafka: decouple topic manager tests from Sarama

[3AceShowHand]

What problem does this PR solve?

Issue Number: close #5885

Kafka topic manager tests depend on Sarama-specific authorization errors. This couples the behavior tests to the current Kafka client implementation and makes them harder to reuse during the franz-go migration tracked by #5881.

What is changed and how it works?

• Add the client-independent ErrKafkaAdminAuthorizationFailed error.
• Translate Sarama topic and cluster authorization errors at the admin adapter boundary.
• Update topic manager tests to use the AdminClient mock and TiCDC-owned errors instead of Sarama types.
• Expand Kafka admin adapter tests for config lookup, topic metadata, topic creation, authorization errors, general errors, and cleanup behavior.

Check List

Tests

• Unit test
• Integration test
• Manual test
• No code

Questions

Will it cause performance regression or break compatibility?

No. The change only normalizes Kafka admin authorization errors at the adapter boundary and preserves the existing topic manager fallback behavior.

Do you need to update user documentation, design documentation or monitoring documentation?

No.

Release note

None

Summary by CodeRabbit

• Bug Fixes

  • Improved Kafka authorization error handling across broker, topic, configuration, and partition operations.
  • Authorization failures are now consistently classified as non-fatal, while other administrative errors retain their context.
  • Improved topic creation and metadata handling, including clearer outcomes for existing topics and delayed visibility.

• Tests

  • Expanded coverage for Kafka administration, topic creation, authorization failures, and configuration scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9f73b1bd-f46a-4e07-9214-ea6b00491224

📥 Commits

Reviewing files that changed from the base of the PR and between 0b7df28 and 2b3c99e.

📒 Files selected for processing (6)

• downstreamadapter/sink/topicmanager/kafka_topic_manager.go
• downstreamadapter/sink/topicmanager/kafka_topic_manager_test.go
• pkg/errors/error.go
• pkg/errors/error_test.go
• pkg/sink/kafka/admin.go
• pkg/sink/kafka/admin_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• downstreamadapter/sink/topicmanager/kafka_topic_manager_test.go
• pkg/sink/kafka/admin_test.go

---

📝 Walkthrough

Walkthrough

Kafka admin operations now normalize authorization failures as ErrKafkaAuthorizationFailed. Topic-manager authorization checks use the renamed helper. Tests cover admin error classification and isolated topic-manager scenarios.

Changes

Kafka authorization handling

Layer / File(s)	Summary
Authorization contract and admin mapping pkg/errors/error.go, pkg/errors/error_test.go, pkg/sink/kafka/admin.go	Adds ErrKafkaAuthorizationFailed and classifies authorization failures across Kafka admin operations.
Kafka admin behavior coverage pkg/sink/kafka/admin_test.go	Adds coverage for configuration lookup, topic metadata, authorization classification, and topic creation outcomes.
Topic-manager fallback coverage downstreamadapter/sink/topicmanager/kafka_topic_manager.go, downstreamadapter/sink/topicmanager/kafka_topic_manager_test.go	Uses IsAuthorizationFailed and refactors tests into isolated subtests for creation, visibility, validation, and authorization fallback behavior.

Estimated code review effort: 4 (Complex) | ~45 minutes

Mergeability Score: ⚪ Minimal · up to 2b3c9

This change is limited to decoupling Kafka topic-manager tests and normalizing authorization errors at the adapter boundary; no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant TopicManager
  participant KafkaAdmin
  participant Sarama
  TopicManager->>KafkaAdmin: Retrieve topic metadata or create topic
  KafkaAdmin->>Sarama: Execute Kafka admin request
  Sarama-->>KafkaAdmin: Return authorization or general error
  KafkaAdmin-->>TopicManager: Return normalized Kafka error
  TopicManager->>TopicManager: Apply partition fallback for authorization failure

Loading

Possibly related PRs

• pingcap/ticdc#5368: Refactors Kafka topic-manager tests with gomock expectations.
• pingcap/ticdc#5715: Modifies Kafka topic metadata handling and tests.
• pingcap/ticdc#5786: Extends Kafka admin error classification.

Suggested labels: lgtm, approved

Suggested reviewers: wk989898, lidezhu

Poem

A rabbit checks each Kafka call,
Standard errors mark them all.
Topics wait, then become clear,
Parallel mocks guard every gear.
Hop by hop, tests stand tall.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR covers authorization normalization, Sarama decoupling, and test coverage, but the summary does not show the required ClusterAdminClient-to-AdminClient rename.	Add or verify the ClusterAdminClient-to-AdminClient rename and update all affected common test interfaces and mocks.
Docstring Coverage	⚠️ Warning	Docstring coverage is 11.76% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary Sarama-decoupling change in the topic manager tests.
Description check	✅ Passed	The description includes the issue link, change summary, unit-test selection, compatibility answers, documentation decision, and release note.
Out of Scope Changes check	✅ Passed	All reported changes support the linked issue through admin error normalization, Sarama-independent tests, and expanded coverage.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[3AceShowHand]

/test all

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lidezhu, wk989898

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [lidezhu,wk989898]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-08-13 07:45:44.688957011 +0000 UTC m=+3291730.725052097: ☑️ agreed by lidezhu.
• 2026-08-13 07:49:51.285204512 +0000 UTC m=+3291977.321299558: ☑️ agreed by wk989898.

[3AceShowHand]

/test pull-cdc-kafka-integration-light-next-gen-legacy-safepoint