Joseph Doherty
513fa1aa16
Comment/XML-doc changes only: - add summaries to ~10k test methods, fixtures, fakes and helpers (+ <param> on theories, <returns> on async Task methods, <inheritdoc/> on interface implementations the checker can resolve) - strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N, #NN, Component-0NN) from comments, keeping the explanatory text; reword false positives in comments only - real docs on fakes implementing BCL/library interfaces (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime) - reword the last 5 src/ false positives (CWE-1236, failures-1, year-0001, M365) Only non-comment edits: four one-line nested classes split across lines so members can carry docs. Build 0 errors / 0 warnings.
50 lines
2.0 KiB
C#
50 lines
2.0 KiB
C#
using Microsoft.AspNetCore.Authentication;
|
|
using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Auth;
|
|
|
|
/// <summary>
|
|
/// Regression tests for session expiry. <c>AuthEndpoints</c> previously stamped a
|
|
/// fixed <c>expires_at = UtcNow + 30 min</c> claim and a 30-minute absolute cookie
|
|
/// <c>ExpiresUtc</c> with no sliding refresh, contradicting the documented
|
|
/// "sliding refresh, 30-minute idle timeout" policy. The login handler must now
|
|
/// build <see cref="AuthenticationProperties"/> that let the cookie middleware
|
|
/// own expiry (sliding window) rather than imposing a contradictory fixed
|
|
/// absolute cap.
|
|
/// </summary>
|
|
public class SessionExpiryPolicyTests
|
|
{
|
|
/// <summary>Verifies that the sign-in properties do not impose a fixed absolute expiry.</summary>
|
|
[Fact]
|
|
public void BuildSignInProperties_DoesNotSetFixedAbsoluteExpiry()
|
|
{
|
|
var props = AuthEndpoints.BuildSignInProperties();
|
|
|
|
// A fixed ExpiresUtc would re-introduce the hard 30-minute cap that
|
|
// overrides the middleware's sliding window. Expiry must be owned by
|
|
// the cookie middleware (ExpireTimeSpan + SlidingExpiration).
|
|
Assert.Null(props.ExpiresUtc);
|
|
}
|
|
|
|
/// <summary>Verifies that the sign-in properties request a persistent cookie.</summary>
|
|
[Fact]
|
|
public void BuildSignInProperties_IsPersistent()
|
|
{
|
|
var props = AuthEndpoints.BuildSignInProperties();
|
|
|
|
Assert.True(props.IsPersistent);
|
|
}
|
|
|
|
/// <summary>Verifies that the sign-in properties allow a sliding refresh of the cookie.</summary>
|
|
[Fact]
|
|
public void BuildSignInProperties_AllowsSlidingRefresh()
|
|
{
|
|
var props = AuthEndpoints.BuildSignInProperties();
|
|
|
|
// AllowRefresh left null/true lets the cookie middleware slide the
|
|
// expiry on activity. A false value would freeze the session to an
|
|
// absolute cap — the bug this finding pins.
|
|
Assert.NotEqual(false, props.AllowRefresh);
|
|
}
|
|
}
|