notazof/yavsc
1
0
Fork 0
Code Issues Pull requests Projects 1 Releases 3 Packages Wiki Activity Actions
yavsc/Directory.Packages.props

30 lines
2 KiB
Text
Raw Normal View History

testing
2025-07-14 18:58:04 +01:00
<Project>
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
</PropertyGroup>
<ItemGroup>
fices the UI
2026-06-15 02:55:22 +01:00
<PackageVersion Include="coverlet.collector" Version="10.0.1" />
Identity reloaded
2026-07-05 23:56:10 +01:00
<PackageVersion Include="GitVersion.MsBuild" Version="6.8.1" />
<PackageVersion Include="HigginsSoft.IdentityServer8" Version="8.1.0-alpha.171" />
<PackageVersion Include="HigginsSoft.IdentityServer8.EntityFramework" Version="8.1.0-alpha.171" />
fices the UI
2026-06-15 02:55:22 +01:00
<PackageVersion Include="IdentityModel.OidcClient" Version="6.0.0" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
test(blogs): real JwtBearer in fixture, drop X-Test-Role bypass Wire the Blogs integration test host with a real AddJwtBearer (HS256, IssuerSigningKey shared with the new TestTokenIssuer) and the production BlogScope policy verbatim, instead of the TestAuthPolicyProvider / AllowAllAuthorizationService / NoopAuthHandler stack that short-circuited every authorization check. Why: BlogSpotService.Modify calls IAuthorizationService.AuthorizeAsync(user, blog, EditPermission); the previous AllowAllAuthorizationService stub made that a no-op, so the tests could not exercise the real ownership chain and any change in PermissionHandler would silently slip through. The new test host registers the real PermissionHandler, so a PUT that succeeds (204) is now proof that PermissionHandler.IsOwner accepted the request — i.e. the JWT's sub matched the post's AuthorId, end-to-end. Notes for future-me: - JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear() is called once on the first Issue() to keep the 'sub' claim literal; without it UserHelpers.GetUserId (which reads 'sub') gets ClaimTypes.NameIdentifier instead, returns null, and the owner check fails for every PUT. The companion options.MapInboundClaims = false on the validation pipeline keeps both sides in sync. - Production still uses AddYavscJwtBearer against the OIDC authority; the test-only HS256 path is local to the test process and never crosses a network boundary. Coverage: - GetBlog_returns_401_when_no_token_is_provided — anonymous request, real policy fails closed. - PutBlog_with_valid_token_and_owner_returns_204_and_Get_ reflects_update — POST then PUT then GET, all behind a real JWT, asserting 204 + list contains the updated title. Packages added to Directory.Packages.props at 8.2.1 to match what Microsoft.AspNetCore.Authentication.JwtBearer 10.0.9 already transitively pulls in (no version drift).
2026-07-06 23:29:51 +01:00
<PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.2.1" />
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.2.1" />
refactor: extract WebHostFixture + TestAuthPolicyProvider to shared lib Yavsc.Blogs.Tests will need a fixture too. Lifting the cross-cutting plumbing (Kestrel + self-signed cert + address discovery + lazy init) into a new Yavsc.Tests.Shared project lets the next fixture inherit from it without copying 200+ lines of setup boilerplate, and keeps the Org.Tests fixture focused on its IdentityServer + SMTP seed. * New project src/Yavsc.Tests.Shared with WebHostFixture (abstract) and TestAuthPolicyProvider (test auth bypass via X-Test-Role). * WebServerFixture in Org.Tests now inherits from WebHostFixture; BuildApp + ConfigurePipelineAsync hold only Org-specific work. * Two shared package versions promoted to the root Directory.Packages.props. * Tests still 30/30 green.
2026-07-06 21:33:57 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Hosting" Version="2.3.11" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.9" />
<PackageVersion Include="Microsoft.AspNetCore.Identity.UI" Version="10.0.9" />
refactor: extract WebHostFixture + TestAuthPolicyProvider to shared lib Yavsc.Blogs.Tests will need a fixture too. Lifting the cross-cutting plumbing (Kestrel + self-signed cert + address discovery + lazy init) into a new Yavsc.Tests.Shared project lets the next fixture inherit from it without copying 200+ lines of setup boilerplate, and keeps the Org.Tests fixture focused on its IdentityServer + SMTP seed. * New project src/Yavsc.Tests.Shared with WebHostFixture (abstract) and TestAuthPolicyProvider (test auth bypass via X-Test-Role). * WebServerFixture in Org.Tests now inherits from WebHostFixture; BuildApp + ConfigurePipelineAsync hold only Org-specific work. * Two shared package versions promoted to the root Directory.Packages.props. * Tests still 30/30 green.
2026-07-06 21:33:57 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
fices the UI
2026-06-15 02:55:22 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Razor" Version="2.3.0" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.9" />
Identity reloaded
2026-07-05 23:56:10 +01:00
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="10.0.2" />
Modernization
2026-04-19 17:23:18 +01:00
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
PostIt testing setup
2026-06-19 16:55:42 +01:00
<PackageVersion Include="xunit.v3" Version="3.2.2" />
feat(tests): scaffold Yavsc.Blogs.Tests with BlogsWebServerFixture Adds the test project that the next commit will use to assert the blog API endpoints. The fixture inherits from the shared WebHostFixture (commit "refactor: extract WebHostFixture…") and wires up only the bits the blog API needs: * In-memory ApplicationDbContext — BlogSpotService is used as-is, no mock. The first tests will exercise the real service against an empty table. * Trivial IFileSystemAuthManager stub (the GET index path never reads the file system). * TestAuthPolicyProvider swapped in, so X-Test-Role satisfies [Authorize("BlogScope")]. Two smoke tests verify the fixture boots and the controller pipeline is reachable. The first behavioural test (GET /api/v1/blog → 200) lands in the next commit. Also promotes two xunit.v3.* package versions to the root Directory.Packages.props so future test projects can share them.
2026-07-06 21:49:53 +01:00
<PackageVersion Include="xunit.v3.common" Version="3.2.2" />
<PackageVersion Include="xunit.v3.extensibility.core" Version="3.2.2" />
Front matters
2026-06-27 13:30:28 +01:00
<PackageVersion Include="YamlDotNet" Version="18.1.0" />
testing
2025-07-14 18:58:04 +01:00
</ItemGroup>
code cleanup
2026-07-06 03:31:05 +01:00
</Project>
Reference in a new issue Copy permalink