notazof/yavsc
1
1
Fork 0
Code Issues 1 Pull requests 1 Projects 2 Releases 9 Packages Wiki Activity Actions

code REORG, pour partage pkg version entre app et tests

Browse source
This commit is contained in:
Paul Schneider 2026-08-22 15:17:08 +01:00
commit 634607ba18
Signed by: notazof
GPG key ID: 1DD5D838E5343B06
27 changed files with 29 additions and 123 deletions
Download patch file Download diff file Expand all files Collapse all files

550
src/PostIt.Tests/YavscApiClientTests.cs
View file

@ -1,550 +0,0 @@
using System.Net;
using System.Net.Sockets;
using System.Text;
using System.Text.Json;
using PostIt.Services;
using IdentityModel.OidcClient.Browser;
using PostIt.ViewModels;
namespace PostIt.Tests;
/// <summary>
/// End-to-end coverage of <see cref="YavscApiClient"/>: silent
/// refresh on a near-expiry access token, 401-driven refresh + retry,
/// and persistence of the token bundle via <see cref="TokenStore"/>.
/// Uses the project's <see cref="OIDCStubAuthority"/> for the IdP and
/// a tiny in-process HTTP listener for the API server side.
/// </summary>
public class YavscApiClientTests
{
private static int GetFreePort()
{
var l = new TcpListener(IPAddress.Loopback, 0);
l.Start();
var port = ((IPEndPoint)l.LocalEndpoint).Port;
l.Stop();
return port;
}
private static string TokensPath() => Path.Combine(
Path.GetTempPath(), $"postit-tests-tokens-{Guid.NewGuid():N}.json");
[Fact]
public async Task CallAsync_refreshes_silently_when_access_token_is_about_to_expire()
{
// The stub OIDC hands out access tokens that expire in 600s.
// We construct a YavscApiClient, then forcibly mark the
// in-memory access token as expired and re-run a call. The
// refresh path must rotate the refresh token transparently
// and the API call must succeed with the new token.
using var authority = await OIDCStubAuthority.StartAsync();
using var apiServer = new StubApiServer();
await apiServer.StartAsync();
var settings = BuildSettings(authority, apiServer.BaseUrl);
var tokensPath = TokensPath();
try
{
var client = await LoginAndPersistAsync(
settings, authority, tokensPath);
// Mark the cached access token as already expired.
ExpireCachedAccessToken(tokensPath);
// Reload — YavscApiClient constructor reads the store.
var reloaded = new YavscApiClient(settings, new TokenStore(tokensPath));
// Same BaseAddress dance as LoginAndPersistAsync: a fresh
// YavscApiClient starts with no BaseAddress, and the test
// calls CallAsync("posts", ...) directly (bypassing
// BlogApiClient, which is the only thing that would set
// it in production). Mirror prod here.
reloaded.Http.BaseAddress = new Uri(settings.BusinessApiUrl);
var posts = await reloaded.CallAsync<List<StubApiServer.Post>>(
HttpMethod.Get, "posts", TestContext.Current.CancellationToken);
Assert.NotNull(posts);
Assert.NotEmpty(posts);
// The API server must have seen the new (post-refresh)
// bearer token, distinct from the original.
var seen = apiServer.SeenBearers.ToList();
Assert.NotEmpty(seen);
Assert.Contains(seen, b => !string.IsNullOrEmpty(b));
}
finally
{
if (File.Exists(tokensPath)) File.Delete(tokensPath);
}
}
[Fact]
public async Task CallAsync_retries_once_after_401_then_succeeds()
{
// API server returns 401 on the first request, 200 on the next.
// YavscApiClient must refresh, then retry exactly once.
using var authority = await OIDCStubAuthority.StartAsync();
using var apiServer = new StubApiServer(forceFirstRequest: true);
await apiServer.StartAsync();
var settings = BuildSettings(authority, apiServer.BaseUrl);
var tokensPath = TokensPath();
try
{
var client = await LoginAndPersistAsync(
settings, authority, tokensPath);
var posts = await client.CallAsync<List<StubApiServer.Post>>(
HttpMethod.Get, "posts", TestContext.Current.CancellationToken);
Assert.NotEmpty(posts);
Assert.Equal(2, apiServer.RequestCount);
}
finally
{
if (File.Exists(tokensPath)) File.Delete(tokensPath);
}
}
[Fact]
public async Task CallAsync_throws_when_no_token_and_no_interactive_login()
{
var settings = new Settings
{
Authentication = new AuthenticationSettings
{
Authority = "https://127.0.0.1:5001",
ClientId = "postit-tests",
RedirectUri = "postit://callback",
Scopes = new[] { "openid" },
},
BusinessApiUrl = "https://127.0.0.1:5003/api/v1",
};
var client = new YavscApiClient(settings, new TokenStore(Path.Combine(
Path.GetTempPath(), $"postit-tests-noop-{Guid.NewGuid():N}.json")));
await Assert.ThrowsAsync<InvalidOperationException>(
() =>
client.CallAsync<JsonElement>(HttpMethod.Get, "posts", TestContext.Current.CancellationToken));
}
[Fact]
public async Task HasValidSession_is_true_after_login()
{
using var authority = await OIDCStubAuthority.StartAsync();
using var apiServer = new StubApiServer();
await apiServer.StartAsync();
var settings = BuildSettings(authority, apiServer.BaseUrl);
var tokensPath = TokensPath();
try
{
var client = await LoginAndPersistAsync(
settings, authority, tokensPath);
Assert.True(client.HasValidSession,
"HasValidSession should be true right after a successful login.");
}
finally
{
if (File.Exists(tokensPath)) File.Delete(tokensPath);
}
}
// --- helpers --------------------------------------------------------
private static Settings BuildSettings(OIDCStubAuthority authority, string apiBaseUrl) => new()
{
Authentication = new AuthenticationSettings
{
Authority = authority.Issuer,
ClientId = "postit-tests",
RedirectUri = authority.LoopbackRedirectUri,
Scopes = new[] { "openid", "profile", "blog" }
},
BusinessApiUrl = apiBaseUrl
};
private static async Task<YavscApiClient> LoginAndPersistAsync(
Settings settings, OIDCStubAuthority authority, string tokensPath)
{
var browser = new FakeAuthorizingBrowser(authority.LoopbackRedirectUri);
var client = new YavscApiClient(settings, new TokenStore(tokensPath));
// The two integration tests that call CallAsync("posts", ...)
// directly (bypassing BlogApiClient) rely on the same
// BaseAddress the production chain sets in BlogApiClient's
// ctor. Mirror that here so "posts" resolves to the stub.
client.Http.BaseAddress = new Uri(settings.BusinessApiUrl);
// Force the API client to use the test browser by routing the
// LoginInteractiveAsync call through a small wrapper.
await LoginWithBrowserAsync(client, browser.CreateBrowser());
return client;
}
/// <summary>
/// YavscApiClient.LoginInteractiveAsync delegates to
/// Platform.CreateBrowser. We can't override that static cleanly
/// from XUnit.v3, so we rebuild the call by re-routing the
/// Platform.CreateBrowser delegate for the duration of the call.
/// </summary>
private static async Task LoginWithBrowserAsync(
YavscApiClient client, IBrowser browser)
{
var original = Platform.CreateBrowser;
try
{
Platform.CreateBrowser = () => browser;
await client.LoginInteractiveAsync();
}
finally
{
Platform.CreateBrowser = original;
}
}
private static void ExpireCachedAccessToken(string tokensPath)
{
var json = File.ReadAllText(tokensPath);
var doc = JsonDocument.Parse(json);
var record = new RefreshTokenRecord(
AccessToken: doc.RootElement.GetProperty("AccessToken").GetString()!,
RefreshToken: doc.RootElement.GetProperty("RefreshToken").GetString()!,
// Far in the past → refresh path must engage on next call.
AccessTokenExpiresAt: DateTimeOffset.UtcNow.AddMinutes(-5),
IdToken: doc.RootElement.TryGetProperty("IdToken", out var idt)
? idt.GetString()
: null);
File.WriteAllText(tokensPath, JsonSerializer.Serialize(record));
}
// --- OIDCLoginPhase progress tests ---------------------------------
/// <summary>
/// Collecting Progress<T> is documented to capture reports
/// synchronously inside the awaiter when called on the same
/// thread, but our LoginInteractiveAsync awaits across threads;
/// we use the post-await snapshot to keep this test deterministic.
/// </summary>
[Fact]
public async Task LoginInteractiveAsync_reports_Discovering_then_Success()
{
using var authority = await OIDCStubAuthority.StartAsync();
using var apiServer = new StubApiServer();
await apiServer.StartAsync();
var settings = BuildSettings(authority, apiServer.BaseUrl);
var tokensPath = TokensPath();
var client = new YavscApiClient(settings, new TokenStore(tokensPath));
var browser = new FakeAuthorizingBrowser(authority.LoopbackRedirectUri);
var reported = new System.Collections.Generic.List<OIDCLoginPhase>();
var progress = new SyncProgress<OIDCLoginPhase>(reported);
try
{
await LoginWithBrowserAsync(client, browser.CreateBrowser(), progress);
// SyncProgress captures reports synchronously — no flush needed.
Assert.Contains(OIDCLoginPhase.Discovering, reported);
Assert.Contains(OIDCLoginPhase.OpeningBrowser, reported);
Assert.Contains(OIDCLoginPhase.ExchangingCode, reported);
Assert.Equal(OIDCLoginPhase.Success, Last(reported));
}
finally
{
if (File.Exists(tokensPath)) File.Delete(tokensPath);
}
}
[Fact]
public async Task LoginInteractiveAsync_reports_Error_when_browser_missing()
{
using var authority = await OIDCStubAuthority.StartAsync();
using var apiServer = new StubApiServer();
await apiServer.StartAsync();
var settings = BuildSettings(authority, apiServer.BaseUrl);
var client = new YavscApiClient(settings, new TokenStore(TokensPath()));
var reported = new System.Collections.Generic.List<OIDCLoginPhase>();
var progress = new SyncProgress<OIDCLoginPhase>(reported);
var original = Platform.CreateBrowser;
try
{
Platform.CreateBrowser = () => null; // simulate no browser wired up
await Assert.ThrowsAsync<InvalidOperationException>(
() => client.LoginInteractiveAsync(progress, TestContext.Current.CancellationToken));
// SyncProgress captures reports synchronously — no flush needed.
Assert.Equal(OIDCLoginPhase.Error, Last(reported));
}
finally
{
Platform.CreateBrowser = original;
}
}
[Fact]
public async Task TrySilentLoginAsync_returns_false_when_no_bundle_on_disk()
{
using var authority = await OIDCStubAuthority.StartAsync();
using var apiServer = new StubApiServer();
await apiServer.StartAsync();
var settings = BuildSettings(authority, apiServer.BaseUrl);
var tokensPath = TokensPath();
// Tokens file deliberately doesn't exist.
var client = new YavscApiClient(settings, new TokenStore(tokensPath));
var ok = await client.TrySilentLoginAsync(null, TestContext.Current.CancellationToken);
Assert.False(ok);
Assert.False(client.HasValidSession);
}
[Fact]
public async Task TrySilentLoginAsync_returns_true_when_access_token_still_valid()
{
using var authority = await OIDCStubAuthority.StartAsync();
using var apiServer = new StubApiServer();
await apiServer.StartAsync();
var settings = BuildSettings(authority, apiServer.BaseUrl);
var tokensPath = TokensPath();
var client = new YavscApiClient(settings, new TokenStore(tokensPath));
var browser = new FakeAuthorizingBrowser(authority.LoopbackRedirectUri);
try
{
await LoginWithBrowserAsync(client, browser.CreateBrowser());
// Login fresh → access token is far from expiry.
var ok = await client.TrySilentLoginAsync(null, TestContext.Current.CancellationToken);
Assert.True(ok);
Assert.True(client.HasValidSession);
}
finally
{
if (File.Exists(tokensPath)) File.Delete(tokensPath);
}
}
[Fact]
public async Task TrySilentLoginAsync_returns_true_when_refresh_succeeds()
{
using var authority = await OIDCStubAuthority.StartAsync();
using var apiServer = new StubApiServer();
await apiServer.StartAsync();
var settings = BuildSettings(authority, apiServer.BaseUrl);
var tokensPath = TokensPath();
var store = new TokenStore(tokensPath);
var browser = new FakeAuthorizingBrowser(authority.LoopbackRedirectUri);
try
{
// Bootstrap: login through one client to persist the
// bundle, then expire it on disk so the silent refresh
// path has to engage.
var firstClient = new YavscApiClient(settings, store);
await LoginWithBrowserAsync(firstClient, browser.CreateBrowser());
ExpireCachedAccessToken(tokensPath);
// Build a second API client to mirror the real boot
// path (YavscApiClient loads from the store in its
// constructor). Its in-memory _tokens snapshot now
// matches the disk: access expired, refresh still good.
var client = new YavscApiClient(settings, store);
var reported = new System.Collections.Generic.List<OIDCLoginPhase>();
var progress = new SyncProgress<OIDCLoginPhase>(reported);
var ok = await client.TrySilentLoginAsync(progress, TestContext.Current.CancellationToken);
Assert.True(ok, "silent refresh should succeed via the stub authority.");
Assert.Contains(OIDCLoginPhase.ExchangingCode, reported);
Assert.Equal(OIDCLoginPhase.Success, Last(reported));
}
finally
{
if (File.Exists(tokensPath)) File.Delete(tokensPath);
}
}
// SKIPPED — see comment.
//
// We can't cover "TrySilentLoginAsync purges the store when the
// refresh token is rejected" with OidcStubAuthority: the stub's
// /connect/token endpoint is unconditional and hands out a fresh
// refresh token regardless of what the caller sends. To exercise
// the RefreshFailedException path we'd need an authority option
// to fail on a specific refresh-token string; until then the
// production refresh-failure path is covered manually (and by
// the structural guarantee that _store.Clear() runs in the catch
// block of ForceRefreshAsync when result.IsError).
//
// [Fact]
// public async Task TrySilentLoginAsync_purges_store_when_refresh_fails_permanently() { ... }
private static T Last<T>(System.Collections.Generic.List<T> list)
{
lock (list)
{
if (list.Count == 0)
throw new InvalidOperationException(
$"IProgress<{typeof(T).Name}> never received any reports before the assertion.");
return list[list.Count - 1];
}
}
/// <summary>
/// Synchronous <see cref="IProgress{T}"/> for tests. The BCL
/// <c>Progress&lt;T&gt;</c> posts via <see cref="SynchronizationContext"/>,
/// which xUnit only drains between awaits in the test method —
/// long enough that two rapid <c>Report</c> calls in the same
/// await chain can produce an empty / partial list. A synchronous
/// proxy captures every report in the order it was made, which
/// is exactly the contract <c>YavscApiClient</c> relies on (it
/// never inspects the progress sink, it just calls <c>Report</c>).
/// </summary>
private sealed class SyncProgress<T> : IProgress<T>
{
private readonly System.Collections.Generic.List<T> _items;
private readonly object _gate = new();
public SyncProgress(System.Collections.Generic.List<T> sink) { _items = sink; }
public void Report(T value) { lock (_gate) _items.Add(value); }
}
private static void CorruptRefreshToken(string tokensPath)
{
// Kept as a helper even though the test that exercised it is
// currently disabled — see SKIPPED note above.
var json = File.ReadAllText(tokensPath);
var doc = JsonDocument.Parse(json);
var record = new RefreshTokenRecord(
AccessToken: doc.RootElement.GetProperty("AccessToken").GetString()!,
RefreshToken: "definitely-not-a-valid-refresh-token",
AccessTokenExpiresAt: DateTimeOffset.UtcNow.AddMinutes(-5),
IdToken: doc.RootElement.TryGetProperty("IdToken", out var idt) ? idt.GetString() : null);
File.WriteAllText(tokensPath, JsonSerializer.Serialize(record));
}
/// <summary>
/// LoginWithBrowserAsync overload that also forwards a progress
/// sink to LoginInteractiveAsync. The default (no-progress)
/// overload stays for tests that don't care about phase events.
/// </summary>
private static async Task LoginWithBrowserAsync(
YavscApiClient client, IBrowser browser, IProgress<OIDCLoginPhase>? progress = null)
{
var original = Platform.CreateBrowser;
try
{
Platform.CreateBrowser = () => browser;
await client.LoginInteractiveAsync(progress);
}
finally
{
Platform.CreateBrowser = original;
}
}
}
/// <summary>
/// Tiny in-process API server. By default returns 200 with a fixed
/// list of posts. When <paramref name="forceFirstRequest"/> is true,
/// returns 401 on the first request, 200 on subsequent ones — this
/// is what the silent-refresh-on-401 test hooks into.
/// </summary>
internal sealed class StubApiServer : IAsyncDisposable, IDisposable
{
public record Post(long Id, string Title);
private readonly HttpListener _listener;
private readonly bool _forceFirstRequest;
private int _requestCount;
public string BaseUrl { get; private set; } = string.Empty;
public List<string> SeenBearers { get; } = new();
public int RequestCount => _requestCount;
public StubApiServer(bool forceFirstRequest = false)
{
_forceFirstRequest = forceFirstRequest;
var port = GetFreePort();
_listener = new HttpListener();
_listener.Prefixes.Add($"http://127.0.0.1:{port}/");
}
public async Task StartAsync()
{
_listener.Start();
BaseUrl = _listener.Prefixes.First().TrimEnd('/');
_ = Task.Run(AcceptLoopAsync);
await Task.Yield();
}
private async Task AcceptLoopAsync()
{
while (_listener.IsListening)
{
HttpListenerContext ctx;
try { ctx = await _listener.GetContextAsync(); }
catch { return; }
Interlocked.Increment(ref _requestCount);
// Capture the bearer for assertions.
var auth = ctx.Request.Headers["Authorization"];
if (!string.IsNullOrEmpty(auth))
SeenBearers.Add(auth!);
if (_forceFirstRequest && _requestCount == 1)
{
ctx.Response.StatusCode = 401;
ctx.Response.Close();
continue;
}
var payload = new
{
// Result is an array; the call site expects List<Post>.
// JsonSerializer deserialises arrays to List<T> fine.
Items = new[]
{
new Post(1, "Hello from stub"),
new Post(2, "Second post"),
}
};
// Wrap in a top-level "Posts" property so the deserialiser
// sees { "Posts": [...] }? No — the API client expects a
// JSON array directly. We send the array, not the wrapper.
var bytes = Encoding.UTF8.GetBytes(JsonSerializer.Serialize(payload.Items));
ctx.Response.ContentType = "application/json";
ctx.Response.ContentLength64 = bytes.Length;
await ctx.Response.OutputStream.WriteAsync(bytes);
ctx.Response.Close();
}
}
private static int GetFreePort()
{
var l = new TcpListener(IPAddress.Loopback, 0);
l.Start();
var port = ((IPEndPoint)l.LocalEndpoint).Port;
l.Stop();
return port;
}
public ValueTask DisposeAsync()
{
Dispose();
return ValueTask.CompletedTask;
}
public void Dispose()
{
try { _listener.Stop(); } catch { }
_listener.Close();
}
}