ScadaBridge/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/SecretsAuthorizationTests.cs

using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.DependencyInjection;
using ZB.MOM.WW.ScadaBridge.Security;
using ZB.MOM.WW.Secrets.Ui;

namespace ZB.MOM.WW.ScadaBridge.Host.Tests;

/// <summary>
/// Offline behavioral proof: composing the Secrets.Ui authorization
/// (<c>Configure&lt;AuthorizationOptions&gt;(o =&gt; o.AddSecretsAuthorization())</c>) on top of
/// ScadaBridge's own <see cref="AuthorizationPolicies.AddScadaBridgeAuthorization"/> yields the
/// two named policies <c>secrets:manage</c> + <c>secrets:reveal</c>, and — because ScadaBridge
/// builds identities with <c>RoleClaimType = ZbClaimTypes.Role</c> and the library's admin role is
/// literally <c>"Administrator"</c> — an <c>Administrator</c> principal is authorized for BOTH,
/// while a non-admin / anonymous principal is denied BOTH. This is the offline evidence for the
/// "no app-specific policy remap needed" decision, exercised against the real
/// <see cref="IAuthorizationService"/> rather than mere registration.
/// </summary>
public class SecretsAuthorizationTests
{
    private const string ManagePolicy = "secrets:manage";
    private const string RevealPolicy = "secrets:reveal";

    private static IServiceProvider BuildProvider()
    {
        var services = new ServiceCollection();
        services.AddLogging();
        // Mirror the Central composition: ScadaBridge's own authorization first
        // (registers the core authorization services + ScadaBridge policies via
        // AddAuthorization), then the additive Secrets.Ui policy configuration.
        services.AddScadaBridgeAuthorization();
        services.Configure<AuthorizationOptions>(o => o.AddSecretsAuthorization());
        return services.BuildServiceProvider();
    }

    private static ClaimsPrincipal PrincipalWithRole(string role)
    {
        // Build the identity EXACTLY as ScadaBridge does: role claims under
        // JwtTokenService.RoleClaimType (== ZbClaimTypes.Role == ClaimTypes.Role) and
        // roleType set to the same, so IsInRole (used by the library's RequireRole) resolves.
        var identity = new ClaimsIdentity(
            new[] { new Claim(JwtTokenService.RoleClaimType, role) },
            authenticationType: "Test",
            nameType: JwtTokenService.UsernameClaimType,
            roleType: JwtTokenService.RoleClaimType);
        return new ClaimsPrincipal(identity);
    }

    /// <summary>Verifies both secrets policies are registered.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task BothSecretsPolicies_AreRegistered()
    {
        var provider = BuildProvider();
        var policyProvider = provider.GetRequiredService<IAuthorizationPolicyProvider>();

        Assert.NotNull(await policyProvider.GetPolicyAsync(ManagePolicy));
        Assert.NotNull(await policyProvider.GetPolicyAsync(RevealPolicy));
    }

    /// <summary>Verifies that an administrator is authorized for both manage and reveal.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task Administrator_IsAuthorized_ForBothManageAndReveal()
    {
        var provider = BuildProvider();
        var authService = provider.GetRequiredService<IAuthorizationService>();
        var admin = PrincipalWithRole(Roles.Administrator);

        Assert.True((await authService.AuthorizeAsync(admin, ManagePolicy)).Succeeded);
        Assert.True((await authService.AuthorizeAsync(admin, RevealPolicy)).Succeeded);
    }

    /// <summary>Verifies that a non-administrator role is denied both manage and reveal.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task NonAdministratorRole_IsDenied_ForBothManageAndReveal()
    {
        var provider = BuildProvider();
        var authService = provider.GetRequiredService<IAuthorizationService>();
        var viewer = PrincipalWithRole(Roles.Viewer);

        Assert.False((await authService.AuthorizeAsync(viewer, ManagePolicy)).Succeeded);
        Assert.False((await authService.AuthorizeAsync(viewer, RevealPolicy)).Succeeded);
    }

    /// <summary>Verifies that an anonymous principal is denied both manage and reveal.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task AnonymousPrincipal_IsDenied_ForBothManageAndReveal()
    {
        var provider = BuildProvider();
        var authService = provider.GetRequiredService<IAuthorizationService>();
        var anonymous = new ClaimsPrincipal(new ClaimsIdentity());

        Assert.False((await authService.AuthorizeAsync(anonymous, ManagePolicy)).Succeeded);
        Assert.False((await authService.AuthorizeAsync(anonymous, RevealPolicy)).Succeeded);
    }
}