REORG
This commit is contained in:
parent
f0792a844f
commit
8c8ab70d38
GPG key ID:
AD4B9B545FBD7D12
82 changed files with 113 additions and 94 deletions
|
|
@ -0,0 +1,309 @@
|
|||
using System.Net;
|
||||
using IdentityServer8.EntityFramework.Entities;
|
||||
using Microsoft.AspNetCore.Mvc.Testing;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Yavsc.Models;
|
||||
using Yavsc.Tests.Shared;
|
||||
using Xunit;
|
||||
|
||||
namespace Yavsc.Org.Tests.Controllers;
|
||||
|
||||
/// <summary>
|
||||
/// Integration tests for the per-collection edit pages of the OAuth2
|
||||
/// client editor. Hits the real ASP.NET pipeline against
|
||||
/// <see cref="WebServerFixture"/>: the WebApplication is built once per
|
||||
/// collection and shared, so these tests must be defensive about row
|
||||
/// IDs (they pick their own dedicated client to mutate).
|
||||
///
|
||||
/// Admin auth is satisfied by sending an <c>X-Test-Role: Administrator</c>
|
||||
/// header. The <see cref="TestAuthPolicyProvider"/> short-circuits the
|
||||
/// production policy to honour that header, sidestepping the login flow
|
||||
/// (which is itself not exercised by these tests).
|
||||
/// </summary>
|
||||
[Collection("Yavsc Server")]
|
||||
public class ClientControllerCollectionTests : IClassFixture<TestWebApplicationFactory>
|
||||
{
|
||||
private const string TargetClientId = "collection-tests-target";
|
||||
|
||||
private readonly TestWebApplicationFactory _factory;
|
||||
|
||||
public ClientControllerCollectionTests(TestWebApplicationFactory factory)
|
||||
{
|
||||
_factory = factory;
|
||||
EnsureTargetClient();
|
||||
}
|
||||
|
||||
private void EnsureTargetClient()
|
||||
{
|
||||
using var scope = _factory.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
if (db.Clients.Any(c => c.ClientId == TargetClientId)) return;
|
||||
|
||||
db.Clients.Add(new Client
|
||||
{
|
||||
ClientId = TargetClientId,
|
||||
ClientName = "Collection-edit tests target",
|
||||
Enabled = true,
|
||||
RequireClientSecret = false,
|
||||
RequirePkce = true,
|
||||
ProtocolType = "oidc",
|
||||
AllowedGrantTypes = new List<ClientGrantType>
|
||||
{
|
||||
new() { GrantType = "authorization_code" },
|
||||
},
|
||||
AllowedScopes = new List<ClientScope>
|
||||
{
|
||||
new() { Scope = "openid" },
|
||||
},
|
||||
RedirectUris = new List<ClientRedirectUri>
|
||||
{
|
||||
new() { RedirectUri = "https://app.example.com/cb" },
|
||||
},
|
||||
});
|
||||
db.SaveChanges();
|
||||
}
|
||||
|
||||
private int TargetClientDbId()
|
||||
{
|
||||
using var scope = _factory.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
return db.Clients.Single(c => c.ClientId == TargetClientId).Id;
|
||||
}
|
||||
|
||||
private HttpClient CreateAdminClient()
|
||||
{
|
||||
// WebApplicationFactory.CreateClient() returns an HttpClient wired
|
||||
// directly to the in-memory test server — no Kestrel socket, no
|
||||
// self-signed cert, no IServerAddressesFeature lookup. Keep
|
||||
// cookies enabled so the antiforgery cookie set on the GET that
|
||||
// fetches the form is replayed on the POST that submits it.
|
||||
var http = _factory.CreateClient(new WebApplicationFactoryClientOptions
|
||||
{
|
||||
HandleCookies = true,
|
||||
});
|
||||
http.DefaultRequestHeaders.Add(TestAuthPolicyProvider.HeaderName, TestAuthPolicyProvider.AdminRole);
|
||||
return http;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Edit_GET_returns_200_for_admin()
|
||||
{
|
||||
var http = CreateAdminClient();
|
||||
var id = TargetClientDbId();
|
||||
var resp = await http.GetAsync($"/Client/Edit/{id}", TestContext.Current.CancellationToken);
|
||||
Assert.Equal(HttpStatusCode.OK, resp.StatusCode);
|
||||
var body = await resp.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
|
||||
Assert.Contains(TargetClientId, body);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task EditRedirectUris_GET_returns_200_and_lists_seeded_uri()
|
||||
{
|
||||
var http = CreateAdminClient();
|
||||
var id = TargetClientDbId();
|
||||
var resp = await http.GetAsync($"/Client/EditRedirectUris/{id}", TestContext.Current.CancellationToken);
|
||||
Assert.Equal(HttpStatusCode.OK, resp.StatusCode);
|
||||
var body = await resp.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
|
||||
Assert.Contains("https://app.example.com/cb", body);
|
||||
}
|
||||
|
||||
// Repro: GET /Client/EditRedirectUris/{id} après qu'une seconde
|
||||
// RedirectUri a été ajoutée via POST. LoadClientAsync(id) réhydrate
|
||||
// le Client avec 9 Includes (RedirectUris, AllowedScopes, ClientSecrets,
|
||||
// etc.) via l'InMemory provider. Sur l'Id=2 seedé, la matérialisation
|
||||
// des nav properties sur les entités IdentityServer8 lève
|
||||
// IndexOutOfRangeException — l'action renvoie un 500 et la page
|
||||
// d'erreur masque le diagnostic.
|
||||
//
|
||||
// Ce test reproduit le chemin qui plante : GET initial (lit l'AF
|
||||
// token) → POST AddRedirectUri → GET final qui exerce LoadClientAsync
|
||||
// avec une collection RedirectUris non triviale (2 entrées).
|
||||
// Il doit ÉCHOUER tant que le bug n'est pas traité.
|
||||
[Fact]
|
||||
public async Task EditRedirectUris_GET_after_add_lists_both_uris()
|
||||
{
|
||||
var http = CreateAdminClient();
|
||||
var id = TargetClientDbId();
|
||||
const string newUri = "https://app.example.com/cb-repro";
|
||||
|
||||
// Premier GET pour récupérer l'antiforgery token du form Add.
|
||||
var pageResp = await http.GetAsync(
|
||||
$"/Client/EditRedirectUris/{id}", TestContext.Current.CancellationToken);
|
||||
pageResp.EnsureSuccessStatusCode();
|
||||
var token = ExtractAntiforgeryToken(
|
||||
await pageResp.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
|
||||
Assert.False(string.IsNullOrEmpty(token));
|
||||
|
||||
// Ajout d'une seconde RedirectUri — c'est l'état non-trivial
|
||||
// qui déclenche la matérialisation problématique côté
|
||||
// InMemory provider.
|
||||
var form = new MultipartFormDataContent
|
||||
{
|
||||
{ new StringContent(newUri), "redirectUri" },
|
||||
{ new StringContent(token!), "__RequestVerificationToken" },
|
||||
};
|
||||
var addResp = await http.PostAsync(
|
||||
$"/Client/AddRedirectUri/{id}", form, TestContext.Current.CancellationToken);
|
||||
Assert.Equal(HttpStatusCode.OK, addResp.StatusCode);
|
||||
|
||||
try
|
||||
{
|
||||
// GET final : exerce LoadClientAsync(id) sur le client
|
||||
// avec 2 RedirectUris, 1 AllowedScope, 1 GrantType, etc.
|
||||
// Si la matérialisation échoue (IndexOutOfRange), ce GET
|
||||
// renvoie 500 et EnsureSuccessStatusCode fait échouer le test.
|
||||
var finalResp = await http.GetAsync(
|
||||
$"/Client/EditRedirectUris/{id}", TestContext.Current.CancellationToken);
|
||||
finalResp.EnsureSuccessStatusCode();
|
||||
var finalBody = await finalResp.Content.ReadAsStringAsync(
|
||||
TestContext.Current.CancellationToken);
|
||||
|
||||
// La page doit lister les DEUX URIs.
|
||||
Assert.Contains("https://app.example.com/cb", finalBody);
|
||||
Assert.Contains(newUri, finalBody);
|
||||
}
|
||||
finally
|
||||
{
|
||||
// Cleanup idempotent : on retire l'URI ajoutée pour ne
|
||||
// pas polluer les autres tests de la collection.
|
||||
using var scope = _factory.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
var row = db.ClientRedirectUris
|
||||
.FirstOrDefault(r => r.RedirectUri == newUri);
|
||||
if (row is not null)
|
||||
{
|
||||
db.ClientRedirectUris.Remove(row);
|
||||
db.SaveChanges();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task AddRedirectUri_POST_appends_to_database()
|
||||
{
|
||||
var http = CreateAdminClient();
|
||||
var id = TargetClientDbId();
|
||||
const string newUri = "https://app.example.com/cb2";
|
||||
|
||||
// Read the GET page first to grab the antiforgery token attached
|
||||
// to the Add form on EditRedirectUris.
|
||||
var pageResp = await http.GetAsync($"/Client/EditRedirectUris/{id}", TestContext.Current.CancellationToken);
|
||||
pageResp.EnsureSuccessStatusCode();
|
||||
var pageHtml = await pageResp.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
|
||||
var token = ExtractAntiforgeryToken(pageHtml);
|
||||
Assert.False(string.IsNullOrEmpty(token));
|
||||
|
||||
var form = new MultipartFormDataContent
|
||||
{
|
||||
{ new StringContent(newUri), "redirectUri" },
|
||||
{ new StringContent(token!), "__RequestVerificationToken" },
|
||||
};
|
||||
var postResp = await http.PostAsync($"/Client/AddRedirectUri/{id}", form, TestContext.Current.CancellationToken);
|
||||
var postBody = await postResp.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
|
||||
Assert.True(postResp.StatusCode == HttpStatusCode.OK,
|
||||
$"Expected 200, got {(int)postResp.StatusCode}. Body[0..500]: {postBody.Substring(0, Math.Min(500, postBody.Length))}");
|
||||
Assert.Equal(HttpStatusCode.OK, postResp.StatusCode);
|
||||
|
||||
// Verify in DB.
|
||||
using var scope = _factory.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
var client = db.Clients
|
||||
.Include(c => c.RedirectUris)
|
||||
.Single(c => c.ClientId == TargetClientId);
|
||||
Assert.Contains(client.RedirectUris, r => r.RedirectUri == newUri);
|
||||
|
||||
// Cleanup so the test is idempotent across runs.
|
||||
var toRemove = client.RedirectUris.First(r => r.RedirectUri == newUri);
|
||||
db.ClientRedirectUris.Remove(toRemove);
|
||||
db.SaveChanges();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RemoveRedirectUri_POST_with_foreign_rowId_returns_NotFound()
|
||||
{
|
||||
// SECURITY: a Remove call for a row that belongs to a different
|
||||
// client must be rejected. The test creates a second client,
|
||||
// gets a real rowId from it, then calls Remove on the target
|
||||
// client with that foreign rowId. Expected: 404, target
|
||||
// client unchanged.
|
||||
using (var scope = _factory.Services.CreateScope())
|
||||
{
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
if (!db.Clients.Any(c => c.ClientId == "collection-tests-other"))
|
||||
{
|
||||
db.Clients.Add(new Client
|
||||
{
|
||||
ClientId = "collection-tests-other",
|
||||
ClientName = "Other target",
|
||||
Enabled = true,
|
||||
ProtocolType = "oidc",
|
||||
RequireClientSecret = false,
|
||||
RequirePkce = true,
|
||||
});
|
||||
db.SaveChanges();
|
||||
}
|
||||
}
|
||||
|
||||
int otherRowId;
|
||||
using (var scope = _factory.Services.CreateScope())
|
||||
{
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
var other = db.Clients.Include(c => c.RedirectUris)
|
||||
.Single(c => c.ClientId == "collection-tests-other");
|
||||
if (!other.RedirectUris.Any())
|
||||
{
|
||||
other.RedirectUris.Add(new ClientRedirectUri { RedirectUri = "https://other.example/cb" });
|
||||
db.SaveChanges();
|
||||
}
|
||||
otherRowId = other.RedirectUris.First().Id;
|
||||
}
|
||||
|
||||
var http = CreateAdminClient();
|
||||
var targetId = TargetClientDbId();
|
||||
var pageResp = await http.GetAsync($"/Client/EditRedirectUris/{targetId}", TestContext.Current.CancellationToken);
|
||||
var token = ExtractAntiforgeryToken(await pageResp.Content.ReadAsStringAsync(TestContext.Current.CancellationToken));
|
||||
|
||||
var form = new MultipartFormDataContent
|
||||
{
|
||||
{ new StringContent(targetId.ToString()), "id" },
|
||||
{ new StringContent(otherRowId.ToString()), "rowId" },
|
||||
{ new StringContent(token!), "__RequestVerificationToken" },
|
||||
};
|
||||
var resp = await http.PostAsync($"/Client/RemoveRedirectUri", form,
|
||||
TestContext.Current.CancellationToken);
|
||||
Assert.Equal(HttpStatusCode.NotFound, resp.StatusCode);
|
||||
}
|
||||
|
||||
// ---------- Bisection de l'Include qui plante ----------
|
||||
//
|
||||
// LoadClientAsync charge le Client avec 9 Includes :
|
||||
// RedirectUris, PostLogoutRedirectUris, AllowedScopes,
|
||||
// AllowedGrantTypes, AllowedCorsOrigins,
|
||||
// IdentityProviderRestrictions, Claims, Properties, ClientSecrets.
|
||||
//
|
||||
// Le test EditRedirectUris_GET_after_add_lists_both_uris échoue
|
||||
// avec IndexOutOfRangeException au shaper de l'InMemory provider,
|
||||
// sans préciser lequel des Includes pose problème. La stack
|
||||
// indique IncludeCollection (donc un Include de collection, pas
|
||||
// de référence).
|
||||
//
|
||||
// 2026-07-11 fix/issue-3-splitquery: tests retirés car leur hypothèse
|
||||
// ("bug de provider InMemory sur ces 3 entités") n'est pas la cause
|
||||
// racine — c'est une redondance de mapping HasOne dans
|
||||
// ApplicationDbContext.OnModelCreating. Le test gardien
|
||||
// EditRedirectUris_GET_after_add_lists_both_uris reste en place
|
||||
// comme sentinelle de régression sur le fix.
|
||||
|
||||
private static string? ExtractAntiforgeryToken(string html)
|
||||
{
|
||||
const string marker = "name=\"__RequestVerificationToken\"";
|
||||
var idx = html.IndexOf(marker, StringComparison.Ordinal);
|
||||
if (idx < 0) return null;
|
||||
var valueStart = html.IndexOf("value=\"", idx, StringComparison.Ordinal);
|
||||
if (valueStart < 0) return null;
|
||||
valueStart += "value=\"".Length;
|
||||
var valueEnd = html.IndexOf('"', valueStart);
|
||||
return valueEnd < 0 ? null : html[valueStart..valueEnd];
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue