feat(security): DisableLoginGuard refuses DisableLogin outside Development without explicit ack

2026-07-08 14:52:00 -04:00
parent c3a9e708a2
commit 74c295e37a
3 changed files with 58 additions and 0 deletions
@@ -0,0 +1,30 @@
+using ZB.MOM.WW.ScadaBridge.Security.Auth;
+using Xunit;
+
+namespace ZB.MOM.WW.ScadaBridge.Security.Tests;
+
+public class DisableLoginGuardTests
+{
+    [Theory]
+    [InlineData("Production")]
+    [InlineData("Staging")]
+    [InlineData("")]
+    public void Validate_DisableLoginOutsideDevelopment_WithoutAck_Throws(string env)
+    {
+        var ex = Assert.Throws<InvalidOperationException>(
+            () => DisableLoginGuard.Validate(disableLogin: true, environmentName: env, allowOutsideDevelopment: false));
+        Assert.Contains("DisableLogin", ex.Message);
+        Assert.Contains("Development", ex.Message);
+    }
+
+    [Theory]
+    [InlineData("Development", false)] // dev env: allowed without ack
+    [InlineData("development", false)] // case-insensitive env name
+    [InlineData("Production", true)]   // explicit second ack key
+    public void Validate_Allowed_DoesNotThrow(string env, bool ack)
+        => DisableLoginGuard.Validate(true, env, ack);
+
+    [Fact]
+    public void Validate_FlagOff_NeverThrows()
+        => DisableLoginGuard.Validate(false, "Production", false);
+}