- WebApplicationFactoryClientOptions.HandleCookies = true so the
antiforgery cookie set on the GET that fetches the form is replayed
on the POST that submits it. Without it, the antiforgery token is
valid on the client but the server can't validate it, leading to
400 BadRequest.
- Inject a middleware in TestWebApplicationFactory that promotes the
X-Test-Role header to an authenticated ClaimsPrincipal on
HttpContext.User, so anything that reads User.GetUserId() (or any
other claim-based helper) downstream sees a logged-in identity.
The TestAuthPolicyProvider only short-circuits [Authorize(...)]
checks; it does not touch HttpContext.User, which is what user
code reads.
- Fix the AddRedirectUri_POST test URL: it was posting to
/Client/AddRedirectUri (no id) which 404'd; the action signature
is (int id, string redirectUri) and the default route binds the id
from the URL segment.
WIP: the MapStaticAssets() default lookup at
{AssemblyName}.staticwebassets.endpoints.json still needs the
manifest to be renamed on copy — the Yavsc.Org.Tests.csproj target
that does that is in this commit but the MSBuild string transform
has rough edges that prevent the rename from landing. Will revisit.
The partial class ClientController had two constructors declared
across ClientController.cs and ClientController.Collections.cs.
ASP.NET Core DI failed to pick one at request time with:
System.InvalidOperationException: Multiple constructors accepting
all given argument types have been found in type
'Yavsc.Controllers.ClientController'.
Move IHtmlLocalizer<ClientController> into the primary constructor
in ClientController.cs and drop the duplicate one in
ClientController.Collections.cs. The Collections partial now keeps
only its readonly field and action methods; the constructor and
field assignment are unified on the main file.
Also add the missing 'using Microsoft.AspNetCore.Mvc.Localization;'
to ClientController.cs so IHtmlLocalizer resolves.
