REORG

src/test/Yavsc.Org.Tests/Mandatory/Remoting.cs

@@ -0,0 +1,223 @@
+using System.Security.Cryptography.X509Certificates;
+using System.Net.Security;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using IdentityModel.Client;
+using Xunit;
+using Yavsc.Server.Helpers;
+
+namespace Yavsc.Org.Tests
+{
+    [Collection("Yavsc Server")]
+    [Trait("regression", "oui")]
+    public class Remoting : BaseTestContext, IClassFixture<WebServerFixture>
+    {
+        private readonly ITestOutputHelper _output;
+
+        public Remoting(WebServerFixture serverFixture, ITestOutputHelper output)
+        : base(output, serverFixture)
+        {
+            _output = output;
+        }
+
+
+        [Fact]
+        public async Task ObtainServiceToken()
+        {
+            var serverUrl = GetServerUrl();
+            var cancellationToken = TestContext.Current.CancellationToken;
+
+            HttpClient client = NewHttpClient();
+            var tokenEndpoint = await ResolveTokenEndpointAsync(client, serverUrl, cancellationToken);
+
+            var response = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
+            {
+                Address = tokenEndpoint,
+                ClientId = RequireNonEmpty(_serverFixture.TestClientId, nameof(_serverFixture.TestClientId)),
+                ClientSecret = RequireNonEmpty(_serverFixture.TestClientSecret, nameof(_serverFixture.TestClientSecret)),
+                Scope = "test",
+                GrantType = "client_credentials"
+            }, cancellationToken);
+            if (response.IsError) throw new Exception(response.Error);
+        }
+
+        private static HttpClient NewHttpClient()
+        {
+            return new HttpClient(new BypassSslValidationHandler());
+        }
+
+        [Fact]
+        public async Task ObtainResourceOwnerPasswordToken()
+        {
+            var serverUrl = GetServerUrl();
+            var cancellationToken = TestContext.Current.CancellationToken;
+
+            var client = NewHttpClient();
+            var tokenEndpoint = await ResolveTokenEndpointAsync(client, serverUrl, cancellationToken);
+
+            var response = await client.RequestPasswordTokenAsync(new PasswordTokenRequest
+            {
+                Address = tokenEndpoint,
+                ClientId = RequireNonEmpty(_serverFixture.TestClientId, nameof(_serverFixture.TestClientId)),
+                ClientSecret = RequireNonEmpty(_serverFixture.TestClientSecret, nameof(_serverFixture.TestClientSecret)),
+                UserName = RequireNonEmpty(_serverFixture.TestingUserName, nameof(_serverFixture.TestingUserName)),
+                Password = RequireNonEmpty(_serverFixture.TestingUserPassword, nameof(_serverFixture.TestingUserPassword)),
+                Scope = "test",
+                Parameters =
+                {
+                    { "acr_values", "tenant:custom_account_store1 foo bar quux" }
+                }
+            }, cancellationToken);
+
+            if (response.IsError) throw new Exception(response.Error);
+
+        }
+
+        /// <summary>
+        /// Regression for the MyFiles upload 500 / null
+        /// <c>User.Identity.Name</c>: the access token minted by the
+        /// real IdentityServer (resource-owner password grant) must
+        /// carry a <c>name</c> claim whose value is the user's login
+        /// (<c>UserName</c>), and <see cref="UserHelpers.GetUserName"/>
+        /// — which reads <c>FindFirstValue("name")</c> — must resolve
+        /// to it on a principal built the way
+        /// <c>AddYavscJwtBearer</c> builds one
+        /// (<c>MapInboundClaims=false</c>, <c>NameClaimType="name"</c>).
+        ///
+        /// <para>Prerequisites wired by <see cref="WebServerFixture"/>:
+        /// the test client's <c>AllowedScopes</c> include
+        /// <c>openid</c>+<c>profile</c>, and the standard identity
+        /// resources are seeded by the production pipeline. Requesting
+        /// <c>openid profile</c> makes <c>ProfileService</c> emit
+        /// <c>name</c> = <c>user.UserName</c>.</para>
+        /// </summary>
+        [Fact]
+        public async Task PasswordToken_carries_name_claim_equal_to_login()
+        {
+            var serverUrl = GetServerUrl();
+            var cancellationToken = TestContext.Current.CancellationToken;
+
+            var client = NewHttpClient();
+            var tokenEndpoint = await ResolveTokenEndpointAsync(client, serverUrl, cancellationToken);
+
+            var response = await client.RequestPasswordTokenAsync(new PasswordTokenRequest
+            {
+                Address = tokenEndpoint,
+                ClientId = RequireNonEmpty(_serverFixture.TestClientId, nameof(_serverFixture.TestClientId)),
+                ClientSecret = RequireNonEmpty(_serverFixture.TestClientSecret, nameof(_serverFixture.TestClientSecret)),
+                UserName = RequireNonEmpty(_serverFixture.TestingUserName, nameof(_serverFixture.TestingUserName)),
+                Password = RequireNonEmpty(_serverFixture.TestingUserPassword, nameof(_serverFixture.TestingUserPassword)),
+                // "openid profile" triggers ProfileService to emit the
+                // "name" claim (user.UserName). Without profile, the
+                // token carries only sub + scopes and GetUserName()
+                // resolves to null — the exact regression behind the
+                // MyFiles upload 500. "test" is the API scope, so a real
+                // JWT access token (not just an id_token) is issued.
+                Scope = "openid profile test"
+            }, cancellationToken);
+
+            Assert.False(response.IsError,
+                $"Token request failed: {response.Error} ({response.ErrorDescription})");
+
+            // Decode the access token straight from the payload so short
+            // claim names ("name", "sub") stay as-emitted — mirrors
+            // AddYavscJwtBearer with MapInboundClaims=false.
+            var jwt = new JwtSecurityToken(response.AccessToken);
+            var nameClaim = jwt.Claims.FirstOrDefault(c => c.Type == "name");
+            Assert.True(nameClaim is not null,
+                "access_token has no 'name' claim; ProfileService did not emit it " +
+                "(is the 'profile' scope in the client's AllowedScopes and requested?).");
+            Assert.Equal(_serverFixture.TestingUserName, nameClaim!.Value);
+
+            // Rebuild the principal the way a bearer consumer host does
+            // and exercise the real GetUserName() helper used by the
+            // file-system / avatar paths.
+            var identity = new ClaimsIdentity(
+                jwt.Claims, authenticationType: "Bearer",
+                nameType: "name", roleType: null);
+            var principal = new ClaimsPrincipal(identity);
+            Assert.Equal(_serverFixture.TestingUserName, principal.GetUserName());
+        }
+
+ [Fact]
+    public async Task GetSignin_returns_a_page()
+    {
+        using var client = new HttpClient(new BypassSslValidationHandler())
+        {
+            BaseAddress = new Uri(this._serverFixture.HttpsAuthority ?? throw new InvalidOperationException("Missing HttpsAuthority"))
+        };
+        await AssertResponds(client, "/signin");
+    }
+
+
+
+    [Fact]
+    public async Task GetOpenIdConfiguration_returns_ok()
+    {
+        using var client = CreateHttpClient();
+        var response = await GetRaw(client, "/.well-known/openid-configuration");
+        var payload = await response.Content.ReadAsStringAsync(
+            TestContext.Current.CancellationToken
+        );
+
+        Assert.True(
+            response.IsSuccessStatusCode,
+            $"GET /.well-known/openid-configuration returned {(int)response.StatusCode} {response.StatusCode}. Body: {payload}");
+    }
+        public static IEnumerable<object[]> GetLoginIntentData()
+        {
+            return new object[][] { new object[] { "testuser", "test" } };
+        }
+
+        private async Task<string> ResolveTokenEndpointAsync(HttpClient client, string serverUrl, CancellationToken cancellationToken)
+        {
+            var disco = await client.GetDiscoveryDocumentAsync(serverUrl, cancellationToken);
+            if (!disco.IsError && !string.IsNullOrWhiteSpace(disco.TokenEndpoint))
+            {
+                return disco.TokenEndpoint;
+            }
+
+            // Some full-suite runs intermittently return 500 on the OIDC
+            // discovery document while /connect/token remains available.
+            var fallback = new Uri(new Uri(serverUrl), "/connect/token").ToString();
+            _output.WriteLine($"WARNING: OIDC discovery failed ({disco.Error}). Fallback token endpoint: {fallback}");
+            return fallback;
+        }
+
+        private string GetServerUrl()
+        {
+            return RequireNonEmpty(_serverFixture.SiteSettings?.Authority, "SiteSettings.Authority");
+        }
+
+        private static string RequireNonEmpty(string? value, string name)
+        {
+            if (string.IsNullOrWhiteSpace(value))
+            {
+                throw new InvalidOperationException($"Missing required test setting: {name}");
+            }
+
+            return value;
+        }
+
+    }
+
+    internal class BypassSslValidationHandler : HttpClientHandler
+    {
+        public BypassSslValidationHandler()
+        {
+            // Override validation for this handler only
+            ServerCertificateCustomValidationCallback = ValidateCertificate;
+        }
+
+        private bool ValidateCertificate(
+            HttpRequestMessage request,
+            X509Certificate2? certificate,
+            X509Chain? chain,
+            SslPolicyErrors errors)
+        {
+            // Accept all certificates (bypass validation)
+            return true;
+        }
+    }
+
+}