ScadaBridge/tests/ZB.MOM.WW.ScadaBridge.Security.Tests/PassiveSessionRegressionTests.cs

using System.Security.Claims;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
using ZB.MOM.WW.Auth.Abstractions.Roles;

namespace ZB.MOM.WW.ScadaBridge.Security.Tests;

public class PassiveSessionRegressionTests
{
    private static readonly DateTimeOffset Start = new(2026, 9, 9, 12, 0, 0, TimeSpan.Zero);

    /// <summary>Verifies that a passive ping refreshes roles without advancing the activity timestamp and that the session then expires.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task PassivePing_RefreshesRolesWithoutAdvancingActivity_ThenExpires()
    {
        var clock = new Clock { Now = Start.AddMinutes(16) };
        IGroupRoleMapper<string> mapper = new Mapper();
        var services = new ServiceCollection().AddSingleton<TimeProvider>(clock).AddLogging();
        services.AddSingleton(mapper);
        services.AddSingleton<IAuthenticationService>(new Auth());
        services.AddSingleton(Options.Create(new SecurityOptions()));
        services.AddScoped<CookieSessionValidator>();
        using var provider = services.BuildServiceProvider();
        var principal = SessionClaimBuilder.Build("alice", "Alice", ["group"],
            new RoleMappingResult([Roles.Deployer], ["1"], false), Start);
        var ctx = Context(provider, principal, "/auth/ping");
        await ServiceCollectionExtensions.OnValidatePrincipalAsync(ctx);
        Assert.Equal(Start.ToString("o"), ctx.Principal!.FindFirst(JwtTokenService.LastActivityClaimType)!.Value);
        Assert.Contains(Roles.Viewer, ctx.Principal.FindAll(JwtTokenService.RoleClaimType).Select(c => c.Value));
        clock.Now = Start.AddMinutes(31);
        var expired = Context(provider, ctx.Principal, "/auth/ping");
        await ServiceCollectionExtensions.OnValidatePrincipalAsync(expired);
        Assert.Null(expired.Principal);
    }

    private static CookieValidatePrincipalContext Context(IServiceProvider sp, ClaimsPrincipal principal, string path)
    {
        var http = new DefaultHttpContext { RequestServices = sp };
        http.Request.Path = path;
        return new CookieValidatePrincipalContext(http,
            new AuthenticationScheme("Cookies", null, typeof(CookieAuthenticationHandler)),
            new CookieAuthenticationOptions(), new AuthenticationTicket(principal, new AuthenticationProperties(), "Cookies"));
    }

    private sealed class Mapper : IGroupRoleMapper<string>
    {
        /// <summary>Maps every group to the Viewer role.</summary>
        /// <param name="groups">The directory groups.</param>
        /// <param name="ct">The cancellation token.</param>
        /// <returns>The canned role mapping.</returns>
        public Task<GroupRoleMapping<string>> MapAsync(IReadOnlyList<string> groups, CancellationToken ct)
            => Task.FromResult(new GroupRoleMapping<string>([Roles.Viewer], new RoleMappingResult([Roles.Viewer], ["2"], false)));
    }
    private sealed class Auth : IAuthenticationService
    {
        /// <summary>Returns no authentication result.</summary>
        /// <param name="c">The HTTP context.</param>
        /// <param name="s">The authentication scheme.</param>
        /// <returns>An empty authenticate result.</returns>
        public Task<AuthenticateResult> AuthenticateAsync(HttpContext c, string? s) => Task.FromResult(AuthenticateResult.NoResult());
        /// <summary>Does nothing.</summary>
        /// <param name="c">The HTTP context.</param>
        /// <param name="s">The authentication scheme.</param>
        /// <param name="p">The authentication properties.</param>
        /// <returns>A task that represents the asynchronous operation.</returns>
        public Task ChallengeAsync(HttpContext c, string? s, AuthenticationProperties? p) => Task.CompletedTask;
        /// <summary>Does nothing.</summary>
        /// <param name="c">The HTTP context.</param>
        /// <param name="s">The authentication scheme.</param>
        /// <param name="p">The authentication properties.</param>
        /// <returns>A task that represents the asynchronous operation.</returns>
        public Task ForbidAsync(HttpContext c, string? s, AuthenticationProperties? p) => Task.CompletedTask;
        /// <summary>Does nothing.</summary>
        /// <param name="c">The HTTP context.</param>
        /// <param name="s">The authentication scheme.</param>
        /// <param name="u">The principal to sign in.</param>
        /// <param name="p">The authentication properties.</param>
        /// <returns>A task that represents the asynchronous operation.</returns>
        public Task SignInAsync(HttpContext c, string? s, ClaimsPrincipal u, AuthenticationProperties? p) => Task.CompletedTask;
        /// <summary>Does nothing.</summary>
        /// <param name="c">The HTTP context.</param>
        /// <param name="s">The authentication scheme.</param>
        /// <param name="p">The authentication properties.</param>
        /// <returns>A task that represents the asynchronous operation.</returns>
        public Task SignOutAsync(HttpContext c, string? s, AuthenticationProperties? p) => Task.CompletedTask;
    }
    private sealed class Clock : TimeProvider
    {
        /// <summary>Gets or sets the current time the clock reports.</summary>
        public DateTimeOffset Now { get; set; }
        /// <inheritdoc />
        public override DateTimeOffset GetUtcNow() => Now;
    }
}