Joseph Doherty
513fa1aa16
Comment/XML-doc changes only: - add summaries to ~10k test methods, fixtures, fakes and helpers (+ <param> on theories, <returns> on async Task methods, <inheritdoc/> on interface implementations the checker can resolve) - strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N, #NN, Component-0NN) from comments, keeping the explanatory text; reword false positives in comments only - real docs on fakes implementing BCL/library interfaces (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime) - reword the last 5 src/ false positives (CWE-1236, failures-1, year-0001, M365) Only non-comment edits: four one-line nested classes split across lines so members can carry docs. Build 0 errors / 0 warnings.
79 lines
4.9 KiB
C#
79 lines
4.9 KiB
C#
using Microsoft.AspNetCore.Components.Authorization;
|
|
using ZB.MOM.WW.ScadaBridge.CentralUI.Services;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Microsoft.Extensions.DependencyInjection;
|
|
using Microsoft.Extensions.Options;
|
|
using NSubstitute;
|
|
using ZB.MOM.WW.Auth.Abstractions.Roles;
|
|
using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
|
|
using ZB.MOM.WW.ScadaBridge.Security;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Auth;
|
|
|
|
public class CircuitRevocationRegressionTests
|
|
{
|
|
/// <summary>Verifies that an explicit server auto-login does not remap the synthetic cookie principal.</summary>
|
|
/// <returns>A task that represents the asynchronous operation.</returns>
|
|
[Fact]
|
|
public async Task ExplicitServerAutoLogin_DoesNotRemapSyntheticCookiePrincipal()
|
|
{
|
|
var initial = SessionClaimBuilder.Build("developer", "Developer", [],
|
|
new RoleMappingResult(Roles.All, [], true), DateTimeOffset.UtcNow);
|
|
var mapper = Substitute.For<IGroupRoleMapper<string>>();
|
|
mapper.MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>())
|
|
.Returns(new GroupRoleMapping<string>([], Scope: new RoleMappingResult([], [], false)));
|
|
var services = new ServiceCollection().AddLogging();
|
|
services.AddSingleton(mapper);
|
|
services.AddSingleton<TimeProvider>(TimeProvider.System);
|
|
services.AddSingleton(Options.Create(new SecurityOptions()));
|
|
services.AddSingleton(Options.Create(new ZB.MOM.WW.ScadaBridge.Security.Auth.AuthDisableLoginOptions { DisableLogin = true }));
|
|
services.AddScoped<CookieSessionValidator>();
|
|
services.AddSingleton<IHttpContextAccessor>(new HttpContextAccessor { HttpContext = new DefaultHttpContext { User = initial } });
|
|
services.AddScoped<AuthenticationStateProvider, CookieAuthenticationStateProvider>();
|
|
using var provider = services.BuildServiceProvider();
|
|
using var scope = provider.CreateScope();
|
|
var auth = scope.ServiceProvider.GetRequiredService<AuthenticationStateProvider>();
|
|
var state = await auth.GetAuthoritativeStateAsync();
|
|
Assert.Contains(state.User.Claims, claim => claim.Type == JwtTokenService.RoleClaimType && claim.Value == Roles.Administrator);
|
|
await mapper.DidNotReceive().MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
/// <summary>Verifies that the same circuit rechecks role mapping and site scope after a grant is revoked.</summary>
|
|
/// <returns>A task that represents the asynchronous operation.</returns>
|
|
[Fact]
|
|
public async Task SameCircuit_RechecksMappingAndScope_AfterGrantRevocation()
|
|
{
|
|
var mapping = new RoleMappingResult([Roles.Deployer, Roles.Administrator], ["1"], false);
|
|
var mapper = Substitute.For<IGroupRoleMapper<string>>();
|
|
mapper.MapAsync(Arg.Any<IReadOnlyList<string>>(), Arg.Any<CancellationToken>())
|
|
.Returns(_ => new GroupRoleMapping<string>(mapping.Roles, Scope: mapping));
|
|
var initial = SessionClaimBuilder.Build("alice", "Alice", ["group"], mapping, DateTimeOffset.UtcNow);
|
|
var services = new ServiceCollection().AddLogging();
|
|
services.AddSingleton(mapper);
|
|
var transaction = Substitute.For<IConfigurationCommandTransaction>();
|
|
services.AddSingleton(transaction);
|
|
services.AddScoped<ConfigurationCommandService>();
|
|
services.AddSingleton<TimeProvider>(TimeProvider.System);
|
|
services.AddSingleton(Options.Create(new SecurityOptions()));
|
|
services.AddScoped<CookieSessionValidator>();
|
|
services.AddSingleton<IHttpContextAccessor>(new HttpContextAccessor { HttpContext = new DefaultHttpContext { User = initial } });
|
|
services.AddScoped<AuthenticationStateProvider, CookieAuthenticationStateProvider>();
|
|
using var provider = services.BuildServiceProvider();
|
|
using var scope = provider.CreateScope();
|
|
var auth = scope.ServiceProvider.GetRequiredService<AuthenticationStateProvider>();
|
|
var sites = new SiteScopeService(auth);
|
|
Assert.True(await sites.IsSiteAllowedAsync(1));
|
|
mapping = new RoleMappingResult([Roles.Viewer], ["2"], false);
|
|
var refreshed = await auth.GetAuthenticationStateAsync();
|
|
Assert.DoesNotContain(Roles.Deployer, refreshed.User.FindAll(JwtTokenService.RoleClaimType).Select(c => c.Value));
|
|
Assert.False(await sites.IsSiteAllowedAsync(1));
|
|
Assert.True(await sites.IsSiteAllowedAsync(2));
|
|
// The already-created circuit facade must deny before starting any save transaction.
|
|
var commands = scope.ServiceProvider.GetRequiredService<ConfigurationCommandService>();
|
|
await Assert.ThrowsAsync<UnauthorizedAccessException>(() => commands.ExecuteAsync(new CreateRoleMappingCommand("blocked", Roles.Viewer)));
|
|
await transaction.DidNotReceive().ExecuteAsync(Arg.Any<Func<IServiceProvider, Task<object?>>>());
|
|
}
|
|
}
|