notazof/yavsc
1
0
Fork 0
Code Issues Pull requests Projects 1 Releases 3 Packages Wiki Activity Actions

feat(postit): circles+ACL UI, blog fixture→SQLite, seed default user

Browse source 
Bundled end-of-branch commit on feat/postit-acl-members.

PostIt UI for circles + per-post ACL
- Reorganise PostIt.Tests into Auth/ and Blogs/ subfolders
  (Bearer/OIDC scope tests vs. blog API fakes live where they
  belong) and introduces PostItHeadlessCollection so the
  Avalonia.Headless tests share a single xUnit collection
  instead of contending with the EF-Core test host.
- Adds BlogAclApiTests (a brand-new behavioural layer over
  POST /api/v1/blogacl) and the fakes it relies on
  (BlogApiTestFakes, BlogPostAuthorDtoTests, AddCircleMember
  DialogTests); pulls UserId-through-OIDC-sub path into
  BearerScopeTests / FakeAuthorizingBrowser /
  OidcStubAuthority.
- App.axaml.cs gets a small PushPageAsync touch-up the new
  tests rely on.
- Drops UnitTest1.cs (xUnit scaffold, never used).

Yavsc.Blogs.Tests — SQLite instead of InMemory
- Bumps Yavsc.Blogs.Tests.csproj on
  Microsoft.EntityFrameworkCore.Sqlite and rewrites
  BlogsWebServerFixture to hold a single shared
  SqliteConnection (Cache=Shared) for the fixture lifetime,
  with a sync Dispose close to dodge async teardown hangs.
  Reason: the EF Core InMemory provider silently ignores FKs,
  which masked the kind of bug we are about to pin in the
  ACL tests. SQLite enforces them, so any future INSERT that
  forgets to seed its parent rows fails loudly here instead
  of passing the test and breaking prod.
- PublishEndpointTests and BlogApiSmokeTests get a one-line
  tweak to follow the new connection lifecycle.

Foreign-key fallout: seed the default user in the fixture
- Adds BlogsWebServerFixture.SeedUser(userName). Now that
  SQLite enforces BlogPost.AuthorId → AspNetUsers.Id, every
  test that POST/PUT/DELETE a BlogPost and sends AuthorId=
  'tester' in the payload needs an AspNetUsers row to satisfy
  the FK or it returns 500 with SQLite Error 19.
- BlogApiTests wraps the existing ResetDatabase with a
  ResetAndSeedDefaultUser helper for the six mutating tests;
  the four GET-only and ModelState-only tests keep the bare
  ResetDatabase.
- Side benefit: every test in Yavsc.Blogs.Tests now finishes
  cleanly instead of hanging at teardown — previously a stuck
  test held the shared SqliteConnection open and the next
  tests waited indefinitely.

Verified: dotnet test src/Yavsc.Blogs.Tests passes 25/25
green from a clean run, no fixture teardown hang.
This commit is contained in:
Paul Schneider 2026-08-20 23:59:21 +01:00
commit a44c04ad77
Signed by: notazof
GPG key ID: 1DD5D838E5343B06
22 changed files with 806 additions and 460 deletions
Download patch file Download diff file Expand all files Collapse all files

97
src/PostIt.Tests/FakeAuthorizingBrowser.cs
View file

@ -1,97 +0,0 @@
using System;
using System.Net.Http;
using System.Threading.Tasks;
using IdentityModel.OidcClient.Browser;
namespace PostIt.Tests;
/// <summary>
/// A minimal <see cref="IBrowser"/> for tests. Captures the authorize
/// URL emitted by OidcClient, extracts its <c>state</c>, and returns a
/// BrowserResult that mimics the OIDC redirect-with-code callback.
///
/// The paired <see cref="OIDCStubAuthority"/>'s token endpoint accepts
/// any authorization code, so we don't need to mint a real one here.
/// </summary>
public sealed class FakeAuthorizingBrowser
{
private readonly string _redirectUri;
private readonly HttpClient _http = new();
public FakeAuthorizingBrowser(string redirectUri)
{
_redirectUri = redirectUri;
}
public IdentityModel.OidcClient.Browser.IBrowser CreateBrowser() => new Impl(_redirectUri, _http);
private sealed class Impl : IdentityModel.OidcClient.Browser.IBrowser
{
private readonly string _redirectUri;
private readonly HttpClient _http;
public Impl(string redirectUri, HttpClient http)
{
_redirectUri = redirectUri;
_http = http;
}
public async Task<BrowserResult> InvokeAsync(BrowserOptions options, System.Threading.CancellationToken cancellationToken = default)
{
// Touch the authorize URL so any 4xx/5xx surfaces; we don't
// actually need its response body because we synthesize the
// redirect below from the original URL's query string.
var startUri = new Uri(options.StartUrl);
try
{
using var resp = await _http.GetAsync(startUri, cancellationToken);
// Ignore the status: the stub has no real /connect/authorize.
}
catch
{
// Network errors are expected against the stub; continue.
}
// Pull `state` from the authorize URL so the OidcClient can
// verify it against its own nonces.
var state = ParseQuery(startUri.Query).GetValueOrDefault("state");
if (string.IsNullOrEmpty(state))
{
return new BrowserResult
{
ResultType = BrowserResultType.UserCancel,
ErrorDescription = "no state in authorize URL"
};
}
// Synthesize the redirect that the OIDC server would have
// sent back. The scheme and path match whatever the test
// configured (loopback for the historical test harness,
// postit://callback for the custom-scheme path).
var baseUri = _redirectUri;
if (!baseUri.EndsWith("/")) baseUri += "/";
var redirectUri =
$"{baseUri}?code=test-auth-code&state={Uri.EscapeDataString(state)}";
return new BrowserResult
{
ResultType = BrowserResultType.Success,
Response = redirectUri
};
}
private static System.Collections.Generic.Dictionary<string, string> ParseQuery(string query)
{
var dict = new System.Collections.Generic.Dictionary<string, string>(StringComparer.Ordinal);
if (string.IsNullOrEmpty(query)) return dict;
if (query.StartsWith("?")) query = query[1..];
foreach (var pair in query.Split('&', StringSplitOptions.RemoveEmptyEntries))
{
var eq = pair.IndexOf('=');
if (eq < 0) { dict[pair] = ""; continue; }
dict[pair[..eq]] = Uri.UnescapeDataString(pair[(eq + 1)..]);
}
return dict;
}
}
}