notazof/yavsc
1
0
Fork 0
Code Issues Pull requests Projects 1 Releases 3 Packages Wiki Activity Actions
yavsc/Directory.Packages.props

31 lines
2 KiB
Text
Raw Normal View History

testing
2025-07-14 18:58:04 +01:00
<Project>
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
</PropertyGroup>
<ItemGroup>
fices the UI
2026-06-15 02:55:22 +01:00
<PackageVersion Include="coverlet.collector" Version="10.0.1" />
Identity reloaded
2026-07-05 23:56:10 +01:00
<PackageVersion Include="GitVersion.MsBuild" Version="6.8.1" />
<PackageVersion Include="HigginsSoft.IdentityServer8" Version="8.1.0-alpha.171" />
<PackageVersion Include="HigginsSoft.IdentityServer8.EntityFramework" Version="8.1.0-alpha.171" />
fices the UI
2026-06-15 02:55:22 +01:00
<PackageVersion Include="IdentityModel.OidcClient" Version="6.0.0" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
test(blogs): real JwtBearer in fixture, drop X-Test-Role bypass Wire the Blogs integration test host with a real AddJwtBearer (HS256, IssuerSigningKey shared with the new TestTokenIssuer) and the production BlogScope policy verbatim, instead of the TestAuthPolicyProvider / AllowAllAuthorizationService / NoopAuthHandler stack that short-circuited every authorization check. Why: BlogSpotService.Modify calls IAuthorizationService.AuthorizeAsync(user, blog, EditPermission); the previous AllowAllAuthorizationService stub made that a no-op, so the tests could not exercise the real ownership chain and any change in PermissionHandler would silently slip through. The new test host registers the real PermissionHandler, so a PUT that succeeds (204) is now proof that PermissionHandler.IsOwner accepted the request — i.e. the JWT's sub matched the post's AuthorId, end-to-end. Notes for future-me: - JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear() is called once on the first Issue() to keep the 'sub' claim literal; without it UserHelpers.GetUserId (which reads 'sub') gets ClaimTypes.NameIdentifier instead, returns null, and the owner check fails for every PUT. The companion options.MapInboundClaims = false on the validation pipeline keeps both sides in sync. - Production still uses AddYavscJwtBearer against the OIDC authority; the test-only HS256 path is local to the test process and never crosses a network boundary. Coverage: - GetBlog_returns_401_when_no_token_is_provided — anonymous request, real policy fails closed. - PutBlog_with_valid_token_and_owner_returns_204_and_Get_ reflects_update — POST then PUT then GET, all behind a real JWT, asserting 204 + list contains the updated title. Packages added to Directory.Packages.props at 8.2.1 to match what Microsoft.AspNetCore.Authentication.JwtBearer 10.0.9 already transitively pulls in (no version drift).
2026-07-06 23:29:51 +01:00
<PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.2.1" />
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.2.1" />
refactor: extract WebHostFixture + TestAuthPolicyProvider to shared lib Yavsc.Blogs.Tests will need a fixture too. Lifting the cross-cutting plumbing (Kestrel + self-signed cert + address discovery + lazy init) into a new Yavsc.Tests.Shared project lets the next fixture inherit from it without copying 200+ lines of setup boilerplate, and keeps the Org.Tests fixture focused on its IdentityServer + SMTP seed. * New project src/Yavsc.Tests.Shared with WebHostFixture (abstract) and TestAuthPolicyProvider (test auth bypass via X-Test-Role). * WebServerFixture in Org.Tests now inherits from WebHostFixture; BuildApp + ConfigurePipelineAsync hold only Org-specific work. * Two shared package versions promoted to the root Directory.Packages.props. * Tests still 30/30 green.
2026-07-06 21:33:57 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Hosting" Version="2.3.11" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.9" />
<PackageVersion Include="Microsoft.AspNetCore.Identity.UI" Version="10.0.9" />
refactor: extract WebHostFixture + TestAuthPolicyProvider to shared lib Yavsc.Blogs.Tests will need a fixture too. Lifting the cross-cutting plumbing (Kestrel + self-signed cert + address discovery + lazy init) into a new Yavsc.Tests.Shared project lets the next fixture inherit from it without copying 200+ lines of setup boilerplate, and keeps the Org.Tests fixture focused on its IdentityServer + SMTP seed. * New project src/Yavsc.Tests.Shared with WebHostFixture (abstract) and TestAuthPolicyProvider (test auth bypass via X-Test-Role). * WebServerFixture in Org.Tests now inherits from WebHostFixture; BuildApp + ConfigurePipelineAsync hold only Org-specific work. * Two shared package versions promoted to the root Directory.Packages.props. * Tests still 30/30 green.
2026-07-06 21:33:57 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
fices the UI
2026-06-15 02:55:22 +01:00
<PackageVersion Include="Microsoft.AspNetCore.Razor" Version="2.3.0" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
feat(postit): circles+ACL UI, blog fixture→SQLite, seed default user Bundled end-of-branch commit on feat/postit-acl-members. PostIt UI for circles + per-post ACL - Reorganise PostIt.Tests into Auth/ and Blogs/ subfolders (Bearer/OIDC scope tests vs. blog API fakes live where they belong) and introduces PostItHeadlessCollection so the Avalonia.Headless tests share a single xUnit collection instead of contending with the EF-Core test host. - Adds BlogAclApiTests (a brand-new behavioural layer over POST /api/v1/blogacl) and the fakes it relies on (BlogApiTestFakes, BlogPostAuthorDtoTests, AddCircleMember DialogTests); pulls UserId-through-OIDC-sub path into BearerScopeTests / FakeAuthorizingBrowser / OidcStubAuthority. - App.axaml.cs gets a small PushPageAsync touch-up the new tests rely on. - Drops UnitTest1.cs (xUnit scaffold, never used). Yavsc.Blogs.Tests — SQLite instead of InMemory - Bumps Yavsc.Blogs.Tests.csproj on Microsoft.EntityFrameworkCore.Sqlite and rewrites BlogsWebServerFixture to hold a single shared SqliteConnection (Cache=Shared) for the fixture lifetime, with a sync Dispose close to dodge async teardown hangs. Reason: the EF Core InMemory provider silently ignores FKs, which masked the kind of bug we are about to pin in the ACL tests. SQLite enforces them, so any future INSERT that forgets to seed its parent rows fails loudly here instead of passing the test and breaking prod. - PublishEndpointTests and BlogApiSmokeTests get a one-line tweak to follow the new connection lifecycle. Foreign-key fallout: seed the default user in the fixture - Adds BlogsWebServerFixture.SeedUser(userName). Now that SQLite enforces BlogPost.AuthorId → AspNetUsers.Id, every test that POST/PUT/DELETE a BlogPost and sends AuthorId= 'tester' in the payload needs an AspNetUsers row to satisfy the FK or it returns 500 with SQLite Error 19. - BlogApiTests wraps the existing ResetDatabase with a ResetAndSeedDefaultUser helper for the six mutating tests; the four GET-only and ModelState-only tests keep the bare ResetDatabase. - Side benefit: every test in Yavsc.Blogs.Tests now finishes cleanly instead of hanging at teardown — previously a stuck test held the shared SqliteConnection open and the next tests waited indefinitely. Verified: dotnet test src/Yavsc.Blogs.Tests passes 25/25 green from a clean run, no fixture teardown hang.
2026-08-20 23:59:21 +01:00
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.9" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.9" />
Identity reloaded
2026-07-05 23:56:10 +01:00
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
Login settings
2026-06-10 16:59:23 +01:00
<PackageVersion Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="10.0.2" />
Modernization
2026-04-19 17:23:18 +01:00
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
PostIt testing setup
2026-06-19 16:55:42 +01:00
<PackageVersion Include="xunit.v3" Version="3.2.2" />
feat(tests): scaffold Yavsc.Blogs.Tests with BlogsWebServerFixture Adds the test project that the next commit will use to assert the blog API endpoints. The fixture inherits from the shared WebHostFixture (commit "refactor: extract WebHostFixture…") and wires up only the bits the blog API needs: * In-memory ApplicationDbContext — BlogSpotService is used as-is, no mock. The first tests will exercise the real service against an empty table. * Trivial IFileSystemAuthManager stub (the GET index path never reads the file system). * TestAuthPolicyProvider swapped in, so X-Test-Role satisfies [Authorize("BlogScope")]. Two smoke tests verify the fixture boots and the controller pipeline is reachable. The first behavioural test (GET /api/v1/blog → 200) lands in the next commit. Also promotes two xunit.v3.* package versions to the root Directory.Packages.props so future test projects can share them.
2026-07-06 21:49:53 +01:00
<PackageVersion Include="xunit.v3.common" Version="3.2.2" />
<PackageVersion Include="xunit.v3.extensibility.core" Version="3.2.2" />
Front matters
2026-06-27 13:30:28 +01:00
<PackageVersion Include="YamlDotNet" Version="18.1.0" />
testing
2025-07-14 18:58:04 +01:00
</ItemGroup>
code cleanup
2026-07-06 03:31:05 +01:00
</Project>
Reference in a new issue Copy permalink