feat(postit): circles+ACL UI, blog fixture→SQLite, seed default user
Bundled end-of-branch commit on feat/postit-acl-members. PostIt UI for circles + per-post ACL - Reorganise PostIt.Tests into Auth/ and Blogs/ subfolders (Bearer/OIDC scope tests vs. blog API fakes live where they belong) and introduces PostItHeadlessCollection so the Avalonia.Headless tests share a single xUnit collection instead of contending with the EF-Core test host. - Adds BlogAclApiTests (a brand-new behavioural layer over POST /api/v1/blogacl) and the fakes it relies on (BlogApiTestFakes, BlogPostAuthorDtoTests, AddCircleMember DialogTests); pulls UserId-through-OIDC-sub path into BearerScopeTests / FakeAuthorizingBrowser / OidcStubAuthority. - App.axaml.cs gets a small PushPageAsync touch-up the new tests rely on. - Drops UnitTest1.cs (xUnit scaffold, never used). Yavsc.Blogs.Tests — SQLite instead of InMemory - Bumps Yavsc.Blogs.Tests.csproj on Microsoft.EntityFrameworkCore.Sqlite and rewrites BlogsWebServerFixture to hold a single shared SqliteConnection (Cache=Shared) for the fixture lifetime, with a sync Dispose close to dodge async teardown hangs. Reason: the EF Core InMemory provider silently ignores FKs, which masked the kind of bug we are about to pin in the ACL tests. SQLite enforces them, so any future INSERT that forgets to seed its parent rows fails loudly here instead of passing the test and breaking prod. - PublishEndpointTests and BlogApiSmokeTests get a one-line tweak to follow the new connection lifecycle. Foreign-key fallout: seed the default user in the fixture - Adds BlogsWebServerFixture.SeedUser(userName). Now that SQLite enforces BlogPost.AuthorId → AspNetUsers.Id, every test that POST/PUT/DELETE a BlogPost and sends AuthorId= 'tester' in the payload needs an AspNetUsers row to satisfy the FK or it returns 500 with SQLite Error 19. - BlogApiTests wraps the existing ResetDatabase with a ResetAndSeedDefaultUser helper for the six mutating tests; the four GET-only and ModelState-only tests keep the bare ResetDatabase. - Side benefit: every test in Yavsc.Blogs.Tests now finishes cleanly instead of hanging at teardown — previously a stuck test held the shared SqliteConnection open and the next tests waited indefinitely. Verified: dotnet test src/Yavsc.Blogs.Tests passes 25/25 green from a clean run, no fixture teardown hang.
This commit is contained in:
parent
6825f74308
commit
a44c04ad77
GPG key ID:
1DD5D838E5343B06
22 changed files with 806 additions and 460 deletions
161
src/Yavsc.Blogs.Tests/BlogAclApiTests.cs
Normal file
161
src/Yavsc.Blogs.Tests/BlogAclApiTests.cs
Normal file
|
|
@ -0,0 +1,161 @@
|
|||
using System.Net;
|
||||
using System.Net.Http;
|
||||
using System.Net.Http.Json;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Yavsc.Models;
|
||||
using Yavsc.Models.Access;
|
||||
using Yavsc.Models.Blog;
|
||||
using Yavsc.Models.Relationship;
|
||||
using Yavsc.Tests.Shared;
|
||||
using static Yavsc.Constants;
|
||||
|
||||
namespace Yavsc.Blogs.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// Behavioural tests for <c>BlogAclApiController.PostCircleAuthorizationToBlogPost</c>:
|
||||
/// <c>POST /api/v1/blogacl</c> with a JSON body of
|
||||
/// <c>CircleAuthorizationToBlogPost</c> (CircleId + BlogPostId + Comment).
|
||||
///
|
||||
/// <para>Same fixture as <see cref="CircleMembersApiTests"/>:
|
||||
/// <see cref="BlogsWebServerFixture"/> provides a SQLite
|
||||
/// <c>:memory:</c> <c>ApplicationDbContext</c> (so FKs are
|
||||
/// enforced the way a real relational engine would) and JWT
|
||||
/// bearer auth via <c>TestTokenIssuer</c>. No mocks — the real
|
||||
/// DbContext receives the real INSERT attempt.</para>
|
||||
///
|
||||
/// <para>The bug being pinned by these tests: the POST endpoint
|
||||
/// calls <c>_context.CircleAuthorizationToBlogPost.Add(...)</c>
|
||||
/// then <c>SaveChangesAsync</c>. The entity has a composite
|
||||
/// key (CircleId + BlogPostId) and two FKs; EF Core refuses
|
||||
/// the INSERT with
|
||||
/// <c>System.InvalidOperationException: The value of
|
||||
/// 'CircleAuthorizationToBlogPost.BlogPostId' is unknown when
|
||||
/// attempting to save changes</c> when the principal entities
|
||||
/// (the existing <c>BlogPost</c> and <c>Circle</c>) are not
|
||||
/// attached to the DbContext in the same change-tracker graph.</para>
|
||||
/// </summary>
|
||||
[Collection("Yavsc Blogs")]
|
||||
public sealed class BlogAclApiTests : IClassFixture<BlogsWebServerFixture>
|
||||
{
|
||||
private readonly BlogsWebServerFixture _fixture;
|
||||
|
||||
public BlogAclApiTests(BlogsWebServerFixture fixture)
|
||||
{
|
||||
_fixture = fixture;
|
||||
}
|
||||
|
||||
/// <summary>Reset the in-memory database and seed <c>alice</c>.
|
||||
/// The shared SQLite <c>:memory:</c> store persists across
|
||||
/// requests, so each test starts from a clean slate.</summary>
|
||||
private void ResetDatabaseWithAlice()
|
||||
{
|
||||
using var scope = _fixture.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
db.Database.EnsureDeleted();
|
||||
db.Database.EnsureCreated();
|
||||
|
||||
db.Users.Add(new ApplicationUser
|
||||
{
|
||||
Id = "alice",
|
||||
UserName = "alice",
|
||||
Email = "alice@example.com",
|
||||
EmailConfirmed = true,
|
||||
FullName = "Alice Dupont",
|
||||
Avatar = "/avatars/alice.png",
|
||||
});
|
||||
db.SaveChanges();
|
||||
}
|
||||
|
||||
/// <summary>Create a circle owned by <paramref name="ownerId"/>
|
||||
/// directly in the SQLite store and return its server-assigned
|
||||
/// id.</summary>
|
||||
private long SeedCircle(string ownerId, string name)
|
||||
{
|
||||
using var scope = _fixture.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
var circle = new Circle { OwnerId = ownerId, Name = name };
|
||||
db.Circle.Add(circle);
|
||||
db.SaveChanges();
|
||||
return circle.Id;
|
||||
}
|
||||
|
||||
/// <summary>Create a blog post owned by <paramref name="authorId"/>
|
||||
/// directly in the SQLite store and return its server-assigned
|
||||
/// id.</summary>
|
||||
private long SeedBlogPost(string authorId, string title)
|
||||
{
|
||||
using var scope = _fixture.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
||||
var post = new BlogPost
|
||||
{
|
||||
AuthorId = authorId,
|
||||
Title = title,
|
||||
Article = "Test article body.",
|
||||
DateCreated = DateTime.UtcNow,
|
||||
DateModified = DateTime.UtcNow,
|
||||
};
|
||||
db.BlogSpot.Add(post);
|
||||
db.SaveChanges();
|
||||
return post.Id;
|
||||
}
|
||||
|
||||
private string BlogAclUrl()
|
||||
=> $"{_fixture.Addresses.First(a => a.StartsWith("https://"))}/{APIPrefix}/blogacl";
|
||||
|
||||
private HttpClient NewClient(string subject)
|
||||
{
|
||||
var handler = new HttpClientHandler
|
||||
{
|
||||
ServerCertificateCustomValidationCallback = (_, _, _, _) => true
|
||||
};
|
||||
var http = new HttpClient(handler)
|
||||
{
|
||||
BaseAddress = new Uri(_fixture.Addresses.First(a => a.StartsWith("https://")))
|
||||
};
|
||||
// The Blogs fixture disables JwtSecurityTokenHandler's
|
||||
// inbound claim-type remap, so the JWT's "sub" stays "sub"
|
||||
// rather than being rewritten to ClaimTypes.NameIdentifier.
|
||||
// The controller, however, reads the user id via
|
||||
// User.FindFirstValue(ClaimTypes.NameIdentifier), so we add
|
||||
// an explicit nameid claim to keep the legacy lookup happy.
|
||||
http.DefaultRequestHeaders.Authorization =
|
||||
new System.Net.Http.Headers.AuthenticationHeaderValue(
|
||||
"Bearer",
|
||||
TestTokenIssuer.Issue(
|
||||
subject,
|
||||
extraClaims: new[]
|
||||
{
|
||||
new System.Security.Claims.Claim(
|
||||
System.Security.Claims.ClaimTypes.NameIdentifier,
|
||||
subject),
|
||||
}));
|
||||
return http;
|
||||
}
|
||||
|
||||
/// <summary>PostIt sends only the FK ids (<c>CircleId</c> +
|
||||
/// <c>BlogPostId</c>) plus scalar fields, never the navigation
|
||||
/// properties <c>Target</c> / <c>Allowed</c>. The controller
|
||||
/// must accept that shape and persist the ACL row.</summary>
|
||||
[Fact]
|
||||
public async Task PostCircleAuthorization_returns_201_when_adding_existing_circle_to_existing_post()
|
||||
{
|
||||
ResetDatabaseWithAlice();
|
||||
var circleId = SeedCircle("alice", "Famille");
|
||||
var postId = SeedBlogPost("alice", "Billet de test");
|
||||
using var http = NewClient("alice");
|
||||
|
||||
// Mirror PostIt's payload: scalar FK ids only, no nav props.
|
||||
var payload = new CircleAuthorizationToBlogPost
|
||||
{
|
||||
CircleId = circleId,
|
||||
BlogPostId = postId,
|
||||
Comment = true,
|
||||
};
|
||||
|
||||
var response = await http.PostAsJsonAsync(BlogAclUrl(), payload);
|
||||
|
||||
// Expected: 201 Created (per controller line 133: return
|
||||
// CreatedAtRoute("GetCircleAuthorizationToBlogPost", ...)).
|
||||
Assert.Equal(HttpStatusCode.Created, response.StatusCode);
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue