470 lines
19 KiB
C#
470 lines
19 KiB
C#
using System.Net;
|
|
using System.Net.Http.Json;
|
|
using System.Security.Claims;
|
|
using System.Text.Json;
|
|
using Microsoft.Extensions.DependencyInjection;
|
|
using Yavsc.Models;
|
|
using Yavsc.Models.Blog;
|
|
using Yavsc.Server.Helpers;
|
|
using Yavsc.Tests.Shared;
|
|
|
|
namespace Yavsc.Blogs.Tests;
|
|
|
|
/// <summary>
|
|
/// Behavioural tests for <c>BlogApiController</c>. Built on the
|
|
/// <see cref="BlogsWebServerFixture"/> scaffold: in-memory
|
|
/// <c>ApplicationDbContext</c>, real <c>BlogSpotService</c>, and a
|
|
/// real <c>AddJwtBearer</c> validating HS256 tokens signed by
|
|
/// <see cref="TestTokenIssuer"/>. The production <c>BlogScope</c>
|
|
/// policy runs unmodified — sending <c>Authorization: Bearer …</c>
|
|
/// with a valid token is what gets a request through, omitting the
|
|
/// header (or sending a token signed with the wrong key) gets a
|
|
/// 401 back from the framework.
|
|
/// </summary>
|
|
[Collection("Yavsc Blogs")]
|
|
public sealed class BlogApiTests : IClassFixture<BlogsWebServerFixture>
|
|
{
|
|
private readonly BlogsWebServerFixture _fixture;
|
|
|
|
public BlogApiTests(BlogsWebServerFixture fixture)
|
|
{
|
|
_fixture = fixture;
|
|
}
|
|
|
|
/// <summary>Reset the in-memory database to a known empty state.
|
|
/// <c>UseInMemoryDatabase</c> shares its store across the
|
|
/// lifetime of the <see cref="BlogsWebServerFixture"/> instance,
|
|
/// so without a per-test reset the test order would leak
|
|
/// state between tests.</summary>
|
|
private void ResetDatabase()
|
|
{
|
|
using var scope = _fixture.Services.CreateScope();
|
|
var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
|
|
db.Database.EnsureDeleted();
|
|
db.Database.EnsureCreated();
|
|
}
|
|
|
|
/// <summary>Reset the database and seed the
|
|
/// <c>tester</c> <see cref="ApplicationUser"/> row. Required
|
|
/// for any test that POST/PUT/DELETE a <c>BlogPost</c>:
|
|
/// <c>BlogPost.AuthorId</c> is a FK to
|
|
/// <c>AspNetUsers.Id</c>, and SQLite (unlike the EF Core
|
|
/// InMemory provider) enforces it. Without the seed, the
|
|
/// POST handler hits
|
|
/// <c>SQLite Error 19: 'FOREIGN KEY constraint failed'</c>
|
|
/// at <c>SaveChanges</c> and the controller returns 500.</summary>
|
|
private void ResetAndSeedDefaultUser()
|
|
{
|
|
ResetDatabase();
|
|
_fixture.SeedUser("tester");
|
|
}
|
|
|
|
/// <summary>The fixture's <c>WebApplication</c> is bound to
|
|
/// <c>https://localhost:<random></c> via
|
|
/// <see cref="WebHostFixture.Addresses"/>. We pick the first
|
|
/// https URL and append the controller route
|
|
/// (<c>/api/v1/blog</c>, matching the production
|
|
/// <c>[Route(APIPrefix + "/blog")]</c>).</summary>
|
|
private string BlogsUrl =>
|
|
_fixture.Addresses.First(a => a.StartsWith("https://")) + "/api/v1/blog";
|
|
|
|
/// <summary>Build an authenticated client: a real
|
|
/// <c>Authorization: Bearer <jwt></c> header where the JWT
|
|
/// is signed by <see cref="TestTokenIssuer"/> and carries
|
|
/// <c>sub = subject</c>. The production <c>BlogScope</c> policy
|
|
/// reads <c>scope=blogs</c> off the same token, so
|
|
/// <c>TestTokenIssuer.Issue</c>'s default scope is enough.</summary>
|
|
private HttpClient NewClient(string subject = "tester")
|
|
{
|
|
// The fixture's self-signed certificate is not in the user's
|
|
// trust store, so we accept anything (same pattern as
|
|
// Yavsc.Org.Tests' BypassSslValidationHandler).
|
|
var handler = new HttpClientHandler
|
|
{
|
|
ServerCertificateCustomValidationCallback = (_, _, _, _) => true
|
|
};
|
|
var http = new HttpClient(handler)
|
|
{
|
|
BaseAddress = new Uri(_fixture.Addresses.First(a => a.StartsWith("https://")))
|
|
};
|
|
http.DefaultRequestHeaders.Authorization =
|
|
new System.Net.Http.Headers.AuthenticationHeaderValue(
|
|
"Bearer", TestTokenIssuer.Issue(subject));
|
|
return http;
|
|
}
|
|
|
|
/// <summary>Build an unauthenticated client. Used to assert that
|
|
/// the <c>BlogScope</c> policy fails closed when no bearer
|
|
/// token is presented.</summary>
|
|
private HttpClient NewAnonymousClient()
|
|
{
|
|
var handler = new HttpClientHandler
|
|
{
|
|
ServerCertificateCustomValidationCallback = (_, _, _, _) => true
|
|
};
|
|
return new HttpClient(handler)
|
|
{
|
|
BaseAddress = new Uri(_fixture.Addresses.First(a => a.StartsWith("https://")))
|
|
};
|
|
}
|
|
|
|
[Fact]
|
|
public async Task GetBlogs_returns_200_with_empty_list_when_no_posts()
|
|
{
|
|
ResetDatabase();
|
|
using var http = NewClient();
|
|
|
|
var response = await http.GetAsync("/api/v1/blog",
|
|
TestContext.Current.CancellationToken);
|
|
|
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
|
|
|
|
var body = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
|
|
// Empty table → empty JSON array. We compare as a JsonDocument
|
|
// so a future change in formatting (whitespace, indentation)
|
|
// doesn't break the assertion.
|
|
using var doc = JsonDocument.Parse(body);
|
|
Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
|
|
Assert.Equal(0, doc.RootElement.GetArrayLength());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PostBlog_creates_a_post_and_Get_returns_it_in_the_list()
|
|
{
|
|
ResetAndSeedDefaultUser();
|
|
using var http = NewClient();
|
|
|
|
// Create a minimal BlogPost. The server assigns Id, so we
|
|
// send 0 + an explicit AuthorId; the production
|
|
// BlogSpotService.Create() tolerates that.
|
|
var draft = new BlogPost
|
|
{
|
|
Id = 0,
|
|
Title = "Premier billet",
|
|
AuthorId = "tester",
|
|
Article = "Contenu de test.",
|
|
DateCreated = DateTime.UtcNow,
|
|
DateModified = DateTime.UtcNow
|
|
};
|
|
|
|
var postResponse = await http.PostAsJsonAsync("/api/v1/blog", draft,
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.Created, postResponse.StatusCode);
|
|
|
|
// The POST returns the server-issued post (with a real Id).
|
|
var created = await postResponse.Content.ReadFromJsonAsync<BlogPost>(
|
|
TestContext.Current.CancellationToken
|
|
);
|
|
Assert.NotNull(created);
|
|
Assert.NotEqual(0, created!.Id);
|
|
Assert.Equal(draft.Title, created.Title);
|
|
|
|
// The list should now contain exactly one entry.
|
|
var listResponse = await http.GetAsync("/api/v1/blog",
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.OK, listResponse.StatusCode);
|
|
|
|
using var doc = JsonDocument.Parse(await listResponse.Content.ReadAsStringAsync(
|
|
TestContext.Current.CancellationToken
|
|
));
|
|
Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
|
|
Assert.Equal(1, doc.RootElement.GetArrayLength());
|
|
Assert.Equal(created.Id, doc.RootElement[0].GetProperty("id").GetInt64());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PostBlog_sets_AuthorId_on_created_post_and_list_entry()
|
|
{
|
|
ResetAndSeedDefaultUser();
|
|
using var http = NewClient(subject: "tester");
|
|
|
|
var draft = new BlogPost
|
|
{
|
|
Id = 0,
|
|
Title = "Billet avec auteur",
|
|
AuthorId = "payload-attacker",
|
|
Article = "Contenu de test.",
|
|
DateCreated = DateTime.UtcNow,
|
|
DateModified = DateTime.UtcNow
|
|
};
|
|
|
|
var postResponse = await http.PostAsJsonAsync("/api/v1/blog", draft,
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.Created, postResponse.StatusCode);
|
|
|
|
var created = await postResponse.Content.ReadFromJsonAsync<BlogPost>(
|
|
TestContext.Current.CancellationToken
|
|
);
|
|
Assert.NotNull(created);
|
|
Assert.Equal("tester", created!.AuthorId);
|
|
|
|
var listResponse = await http.GetAsync("/api/v1/blog",
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.OK, listResponse.StatusCode);
|
|
|
|
using var doc = JsonDocument.Parse(await listResponse.Content.ReadAsStringAsync(
|
|
TestContext.Current.CancellationToken
|
|
));
|
|
Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
|
|
Assert.Equal(1, doc.RootElement.GetArrayLength());
|
|
Assert.Equal("tester", doc.RootElement[0].GetProperty("authorId").GetString());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PostBlogComment_returns_201_for_existing_post()
|
|
{
|
|
ResetAndSeedDefaultUser();
|
|
using var http = NewClient(subject: "tester");
|
|
|
|
var draft = new BlogPost
|
|
{
|
|
Id = 0,
|
|
Title = "Billet commentable",
|
|
AuthorId = "payload-attacker",
|
|
Article = "Contenu de test.",
|
|
DateCreated = DateTime.UtcNow,
|
|
DateModified = DateTime.UtcNow
|
|
};
|
|
|
|
var postResponse = await http.PostAsJsonAsync("/api/v1/blog", draft,
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.Created, postResponse.StatusCode);
|
|
|
|
var createdPost = await postResponse.Content.ReadFromJsonAsync<BlogPost>(
|
|
TestContext.Current.CancellationToken
|
|
);
|
|
Assert.NotNull(createdPost);
|
|
Thread.Sleep(100);
|
|
var commentResponse = await http.PostAsJsonAsync("/api/v1/blogcomments", new
|
|
{
|
|
Article = "Premier commentaire",
|
|
ReceiverId = createdPost!.Id
|
|
}, TestContext.Current.CancellationToken);
|
|
|
|
Assert.Equal(HttpStatusCode.Created, commentResponse.StatusCode);
|
|
|
|
using var doc = JsonDocument.Parse(
|
|
await commentResponse.Content.ReadAsStringAsync(
|
|
TestContext.Current.CancellationToken
|
|
));
|
|
Assert.True(doc.RootElement.TryGetProperty("id", out var id));
|
|
Assert.True(id.GetInt64() > 0);
|
|
Assert.True(doc.RootElement.TryGetProperty("dateCreated", out _));
|
|
}
|
|
|
|
[Fact]
|
|
public void GetUserId_reads_NameIdentifier_when_sub_was_mapped()
|
|
{
|
|
var principal = new ClaimsPrincipal(
|
|
new ClaimsIdentity(
|
|
[new Claim(ClaimTypes.NameIdentifier, "tester")],
|
|
authenticationType: "Bearer"));
|
|
|
|
Assert.Equal("tester", principal.GetUserId());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task GetBlog_returns_401_when_no_token_is_provided()
|
|
{
|
|
ResetDatabase();
|
|
using var http = NewAnonymousClient();
|
|
|
|
// No Authorization header → the JwtBearer middleware
|
|
// produces an unauthenticated principal, the BlogScope
|
|
// policy's RequireAuthenticatedUser requirement fails, and
|
|
// the framework returns 401. This is the proof that the
|
|
// production policy is wired in the test host and not
|
|
// short-circuited by a test-only auth bypass.
|
|
var response = await http.GetAsync("/api/v1/blog",
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PutBlog_with_valid_token_and_owner_returns_204_and_Get_reflects_update()
|
|
{
|
|
ResetAndSeedDefaultUser();
|
|
// The JWT's sub must match the post's AuthorId:
|
|
// PermissionHandler.IsOwner checks blog.AuthorId == user.GetUserId(),
|
|
// and UserHelpers.GetUserId reads "sub" off the principal.
|
|
// A mismatched sub → AuthorizationFailureException →
|
|
// Challenge() (401) from the controller. The 204 in this
|
|
// test is the proof that the real authorization chain
|
|
// accepted the request, end-to-end.
|
|
using var http = NewClient(subject: "tester");
|
|
|
|
// Seed a post we can update.
|
|
var draft = new BlogPost
|
|
{
|
|
Id = 0,
|
|
Title = "Avant",
|
|
AuthorId = "tester",
|
|
Article = "Contenu initial.",
|
|
DateCreated = DateTime.UtcNow,
|
|
DateModified = DateTime.UtcNow
|
|
};
|
|
var postResponse = await http.PostAsJsonAsync("/api/v1/blog", draft,
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.Created, postResponse.StatusCode);
|
|
|
|
var created = (await postResponse.Content.ReadFromJsonAsync<BlogPost>(
|
|
TestContext.Current.CancellationToken
|
|
))!;
|
|
|
|
// PUT with the server-issued Id; the controller rejects
|
|
// mismatched id/blog.Id with 400, so we keep them aligned.
|
|
var update = new BlogPost
|
|
{
|
|
Id = created.Id,
|
|
Title = "Après",
|
|
AuthorId = created.AuthorId,
|
|
Article = created.Article,
|
|
DateCreated = created.DateCreated,
|
|
DateModified = DateTime.UtcNow
|
|
};
|
|
var putResponse = await http.PutAsJsonAsync($"/api/v1/blog/{created.Id}",
|
|
update,
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.NoContent, putResponse.StatusCode);
|
|
|
|
// The list should now reflect the new title.
|
|
var listResponse = await http.GetAsync("/api/v1/blog",
|
|
TestContext.Current.CancellationToken);
|
|
Assert.Equal(HttpStatusCode.OK, listResponse.StatusCode);
|
|
using var doc = JsonDocument.Parse(
|
|
await listResponse.Content.ReadAsStringAsync(
|
|
TestContext.Current.CancellationToken
|
|
));
|
|
Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
|
|
Assert.Equal(1, doc.RootElement.GetArrayLength());
|
|
Assert.Equal("Après", doc.RootElement[0].GetProperty("title").GetString());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task DeleteBlog_removes_a_post_and_Get_returns_an_empty_list()
|
|
{
|
|
ResetAndSeedDefaultUser();
|
|
using var http = NewClient();
|
|
|
|
// Seed a post we can delete.
|
|
var draft = new BlogPost
|
|
{
|
|
Id = 0,
|
|
Title = "À supprimer",
|
|
AuthorId = "tester",
|
|
Article = "Contenu.",
|
|
DateCreated = DateTime.UtcNow,
|
|
DateModified = DateTime.UtcNow
|
|
};
|
|
var postResponse = await http.PostAsJsonAsync("/api/v1/blog", draft,
|
|
TestContext.Current.CancellationToken);
|
|
var created = (await postResponse.Content.ReadFromJsonAsync<BlogPost>(
|
|
TestContext.Current.CancellationToken
|
|
))!;
|
|
|
|
var deleteResponse = await http.DeleteAsync($"/api/v1/blog/{created.Id}",
|
|
TestContext.Current.CancellationToken
|
|
);
|
|
Assert.Equal(HttpStatusCode.OK, deleteResponse.StatusCode);
|
|
|
|
// The list should now be empty.
|
|
var listResponse = await http.GetAsync("/api/v1/blog",
|
|
TestContext.Current.CancellationToken);
|
|
String response = await listResponse.Content.ReadAsStringAsync(
|
|
TestContext.Current.CancellationToken
|
|
);
|
|
using var doc = JsonDocument.Parse(response);
|
|
Assert.Equal(0, doc.RootElement.GetArrayLength());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PostBlog_from_PostIt_shape_returns_201_not_400()
|
|
{
|
|
// Regression test for the "Save" button in PostIt: from the
|
|
// user's point of view, they type a Title and an Article in
|
|
// the editor pane and tap "Save". The VM serialises the
|
|
// SelectedPost via JsonContent.Create (camelCase, System.Text.Json
|
|
// defaults) and POSTs it to /api/v1/blog. This test sends
|
|
// exactly that payload — same fields, same types, same
|
|
// serialiser (PostAsJsonAsync is wired to the same
|
|
// System.Net.Http.Json pipeline that YavscApiClient uses on
|
|
// the PostIt side) — and asserts that the server accepts it
|
|
// with 201 Created, not 400 BadRequest. If the controller's
|
|
// ModelState validation starts rejecting the PostIt payload
|
|
// (missing field, wrong casing, etc.), this test fails
|
|
// before the regression reaches a user.
|
|
ResetAndSeedDefaultUser();
|
|
using var http = NewClient(subject: "tester");
|
|
|
|
// Mirrors what MainPageViewModel.Save builds: a BlogPost with
|
|
// Id=0 (so the controller treats it as a create), Title and
|
|
// Article filled in by the user, and DateCreated/DateModified
|
|
// stamped by the VM. AuthorId is what the OIDC sub resolves
|
|
// to in the test fixture.
|
|
var draft = new BlogPost
|
|
{
|
|
Id = 0,
|
|
Title = "Mon premier billet",
|
|
AuthorId = "tester",
|
|
Article = "Contenu du billet de test.",
|
|
DateCreated = DateTime.UtcNow,
|
|
DateModified = DateTime.UtcNow
|
|
};
|
|
|
|
var response = await http.PostAsJsonAsync("/api/v1/blog", draft,
|
|
TestContext.Current.CancellationToken);
|
|
|
|
// Dump the body on failure so the test name + the response
|
|
// payload are enough to start a fix; the framework's
|
|
// assertion message is otherwise opaque (just "Expected
|
|
// Created, got BadRequest").
|
|
if (response.StatusCode != HttpStatusCode.Created)
|
|
{
|
|
var body = await response.Content.ReadAsStringAsync(
|
|
TestContext.Current.CancellationToken
|
|
);
|
|
Assert.Fail(string.Format("Expected 201 Created, got {0} {1}. Body: {2}", (int)response.StatusCode, response.StatusCode, body));
|
|
}
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PostBlog_with_empty_title_returns_400()
|
|
{
|
|
// Mirrors the buggy branch in MainPageViewModel.Save: when
|
|
// the user taps "Save" without a SelectedPost (e.g. they
|
|
// typed into the editor without first clicking an item in
|
|
// the list, so the {Binding SelectedPost.Title, Mode=TwoWay}
|
|
// XAML binding had no target and the keystrokes were
|
|
// silently dropped), the VM builds a BlogPost with
|
|
// Title = string.Empty and POSTs it. BlogPost.Title carries
|
|
// [Required] → ModelState.IsValid fails → 400 BadRequest.
|
|
// This is the regression we are hunting. The 400 is
|
|
// expected here: the test pins the *current* controller
|
|
// behaviour so a future change that, say, makes Title
|
|
// nullable in the model or drops [Required], triggers a
|
|
// conscious update of the test (and probably of the VM).
|
|
ResetDatabase();
|
|
using var http = NewClient(subject: "tester");
|
|
|
|
var draft = new BlogPost
|
|
{
|
|
Id = 0,
|
|
Title = string.Empty,
|
|
AuthorId = "tester",
|
|
Article = "Article non vide, mais titre vide.",
|
|
DateCreated = DateTime.UtcNow,
|
|
DateModified = DateTime.UtcNow
|
|
};
|
|
|
|
var response = await http.PostAsJsonAsync("/api/v1/blog", draft,
|
|
TestContext.Current.CancellationToken);
|
|
|
|
if (response.StatusCode != HttpStatusCode.BadRequest)
|
|
{
|
|
var body = await response.Content.ReadAsStringAsync(
|
|
TestContext.Current.CancellationToken
|
|
);
|
|
Assert.Fail(string.Format("Expected 400 BadRequest (empty Title is invalid), got {0} {1}. Body: {2}", (int)response.StatusCode, response.StatusCode, body));
|
|
}
|
|
}
|
|
}
|