Joseph Doherty
513fa1aa16
Comment/XML-doc changes only: - add summaries to ~10k test methods, fixtures, fakes and helpers (+ <param> on theories, <returns> on async Task methods, <inheritdoc/> on interface implementations the checker can resolve) - strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N, #NN, Component-0NN) from comments, keeping the explanatory text; reword false positives in comments only - real docs on fakes implementing BCL/library interfaces (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime) - reword the last 5 src/ false positives (CWE-1236, failures-1, year-0001, M365) Only non-comment edits: four one-line nested classes split across lines so members can carry docs. Build 0 errors / 0 warnings.
67 lines
2.9 KiB
C#
67 lines
2.9 KiB
C#
using Microsoft.AspNetCore.Authentication;
|
|
using Microsoft.AspNetCore.Authentication.Cookies;
|
|
using Microsoft.Extensions.DependencyInjection;
|
|
using ZB.MOM.WW.ScadaBridge.Security;
|
|
using ZB.MOM.WW.ScadaBridge.Security.Auth;
|
|
using Xunit;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.Security.Tests;
|
|
|
|
public class DisableLoginRegistrationTests
|
|
{
|
|
private static async Task<AuthenticationScheme?> ResolveCookieSchemeAsync(bool disableLogin)
|
|
{
|
|
var services = new ServiceCollection();
|
|
services.AddLogging();
|
|
services.AddSecurity(disableLogin);
|
|
await using var sp = services.BuildServiceProvider();
|
|
var provider = sp.GetRequiredService<IAuthenticationSchemeProvider>();
|
|
return await provider.GetSchemeAsync(CookieAuthenticationDefaults.AuthenticationScheme);
|
|
}
|
|
|
|
/// <summary>Verifies that when the disable-login flag is true, the auto-login handler is registered under the cookie scheme.</summary>
|
|
/// <returns>A task that represents the asynchronous operation.</returns>
|
|
[Fact]
|
|
public async Task FlagTrue_RegistersAutoLoginHandlerUnderCookieScheme()
|
|
{
|
|
var scheme = await ResolveCookieSchemeAsync(disableLogin: true);
|
|
Assert.Equal(typeof(AutoLoginAuthenticationHandler), scheme!.HandlerType);
|
|
}
|
|
|
|
/// <summary>Verifies that when the disable-login flag is false, the cookie handler is registered.</summary>
|
|
/// <returns>A task that represents the asynchronous operation.</returns>
|
|
[Fact]
|
|
public async Task FlagFalse_RegistersCookieHandler()
|
|
{
|
|
var scheme = await ResolveCookieSchemeAsync(disableLogin: false);
|
|
Assert.Equal(typeof(CookieAuthenticationHandler), scheme!.HandlerType);
|
|
}
|
|
|
|
/// <summary>
|
|
/// When <c>disableLogin: false</c> (the production path) the idle-timeout /
|
|
/// role-refresh hook MUST be wired on the cookie scheme's
|
|
/// <see cref="Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationEvents.OnValidatePrincipal"/>.
|
|
/// This pin-test ensures a future refactor cannot silently drop the hook without
|
|
/// a red test.
|
|
/// </summary>
|
|
/// <returns>A task that represents the asynchronous operation.</returns>
|
|
[Fact]
|
|
public async Task FlagFalse_CookieScheme_OnValidatePrincipalIsWired()
|
|
{
|
|
var services = new ServiceCollection();
|
|
services.AddLogging();
|
|
// Provide default SecurityOptions so the PostConfigure that reads
|
|
// IOptions<SecurityOptions> (cookie-hardening + name) can resolve successfully.
|
|
services.Configure<SecurityOptions>(_ => { });
|
|
services.AddSecurity(disableLogin: false);
|
|
|
|
await using var sp = services.BuildServiceProvider();
|
|
|
|
var options = sp
|
|
.GetRequiredService<Microsoft.Extensions.Options.IOptionsMonitor<CookieAuthenticationOptions>>()
|
|
.Get(CookieAuthenticationDefaults.AuthenticationScheme);
|
|
|
|
Assert.NotNull(options.Events?.OnValidatePrincipal);
|
|
}
|
|
}
|