mxaccessgw/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/AlarmFeedAuthorizationTests.cs

using System.Net;
using System.Reflection;
using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Routing;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Options;
using ZB.MOM.WW.MxGateway.Server;
using ZB.MOM.WW.MxGateway.Server.Configuration;
using ZB.MOM.WW.MxGateway.Server.Dashboard;
using ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
using AuthenticationOptions = ZB.MOM.WW.MxGateway.Server.Configuration.AuthenticationOptions;

namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;

/// <summary>
/// Covers SEC-40: the alarm feed requires a real authenticated dashboard role, so the read-only
/// environment bypasses (<c>Authentication:Mode=Disabled</c>, anonymous localhost) no longer
/// receive galaxy-wide alarm metadata.
/// </summary>
/// <remarks>
/// The enforcement is a requirement TYPE distinction — <see cref="DashboardAuthorizationHandler"/>
/// is an <c>AuthorizationHandler&lt;DashboardAuthorizationRequirement&gt;</c> and therefore never
/// runs for <see cref="AuthenticatedDashboardRoleRequirement"/> — so the tests below assert both
/// halves: that both handlers together still deny a bypassed caller, and that the policy the two
/// alarm surfaces actually carry is built from that requirement rather than the bypassable one.
/// Asserting only the handler would pass even if the hub were left on the old policy.
/// </remarks>
public sealed class AlarmFeedAuthorizationTests
{
    /// <summary>
    /// The bypass that satisfies <see cref="DashboardAuthorizationRequirement.AnyDashboardRole"/>
    /// — auth disabled AND a loopback request with <c>AllowAnonymousLocalhost</c> on, i.e. both
    /// arms at once — does not satisfy the alarm requirement, with the real bypass handler present
    /// in the same evaluation.
    /// </summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task AlarmRequirement_AnonymousLocalhostAndAuthDisabled_DoesNotSucceed()
    {
        AuthorizationHandlerContext context = await EvaluateAsync(
            new ClaimsPrincipal(new ClaimsIdentity()),
            AuthenticatedDashboardRoleRequirement.AnyDashboardRole);

        Assert.False(context.HasSucceeded);
    }

    /// <summary>
    /// Control: the SAME evaluation environment satisfies the bypassable requirement. Without this
    /// pairing the test above could pass because the bypass was misconfigured rather than because
    /// the requirement type excludes it.
    /// </summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task ViewerRequirement_AnonymousLocalhostAndAuthDisabled_StillSucceeds()
    {
        AuthorizationHandlerContext context = await EvaluateAsync(
            new ClaimsPrincipal(new ClaimsIdentity()),
            DashboardAuthorizationRequirement.AnyDashboardRole);

        Assert.True(context.HasSucceeded);
    }

    /// <summary>
    /// An authenticated Viewer — the ordinary LDAP-logged-in dashboard user — does satisfy the
    /// alarm requirement: SEC-40 excludes the environment bypasses, not Viewers. Alarm metadata
    /// stays galaxy-wide for them because the monitor is gateway-central and carries no
    /// per-session provenance to tag-scope by.
    /// </summary>
    /// <param name="role">The dashboard role the authenticated caller holds.</param>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Theory]
    [InlineData(DashboardRoles.Viewer)]
    [InlineData(DashboardRoles.Admin)]
    public async Task AlarmRequirement_AuthenticatedDashboardRole_Succeeds(string role)
    {
        AuthorizationHandlerContext context = await EvaluateAsync(
            CreatePrincipal(role),
            AuthenticatedDashboardRoleRequirement.AnyDashboardRole);

        Assert.True(context.HasSucceeded);
    }

    /// <summary>
    /// A principal carrying a dashboard role claim but no authentication type does not satisfy the
    /// requirement: "real role claim" means an authenticated identity, matching how the session
    /// ACL and <c>DashboardSessionAdminService</c> read a role.
    /// </summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task AlarmRequirement_UnauthenticatedRoleClaim_DoesNotSucceed()
    {
        ClaimsPrincipal principal = new(new ClaimsIdentity(
            [new Claim(ClaimTypes.Role, DashboardRoles.Admin)],
            authenticationType: null,
            nameType: ClaimTypes.Name,
            roleType: ClaimTypes.Role));

        AuthorizationHandlerContext context = await EvaluateAsync(
            principal,
            AuthenticatedDashboardRoleRequirement.AnyDashboardRole);

        Assert.False(context.HasSucceeded);
    }

    /// <summary>
    /// The registered policy is built from the non-bypassable requirement and from neither
    /// <see cref="DashboardAuthorizationRequirement"/> nor a role list the bypass handler could
    /// reach, and it still accepts both hub-capable schemes so an external hub client can
    /// authenticate with a bearer token.
    /// </summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task AlarmsPolicy_IsRegisteredWithNonBypassableRequirement()
    {
        await using WebApplication app = GatewayApplication.Build([]);
        IAuthorizationPolicyProvider provider = app.Services
            .GetRequiredService<IAuthorizationPolicyProvider>();

        AuthorizationPolicy? policy = await provider
            .GetPolicyAsync(DashboardAuthenticationDefaults.AlarmsPolicy);

        Assert.NotNull(policy);
        Assert.Contains(policy.Requirements, r => r is AuthenticatedDashboardRoleRequirement);
        Assert.DoesNotContain(policy.Requirements, r => r is DashboardAuthorizationRequirement);
        Assert.Equal(
            [
                DashboardAuthenticationDefaults.AuthenticationScheme,
                DashboardAuthenticationDefaults.HubAuthenticationScheme,
            ],
            policy.AuthenticationSchemes);
    }

    /// <summary>
    /// Both readers of the one central monitor carry the alarm policy: the hub (external clients)
    /// and the <c>/alarms</c> Razor endpoint (the in-page reader). Gating only the hub would leave
    /// the same metadata one navigation away for a bypassed caller.
    /// </summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    [Fact]
    public async Task AlarmsHubAndAlarmsPage_BothCarryTheAlarmsPolicy()
    {
        AuthorizeAttribute? hubAttribute = typeof(AlarmsHub)
            .GetCustomAttribute<AuthorizeAttribute>(inherit: false);

        Assert.Equal(DashboardAuthenticationDefaults.AlarmsPolicy, hubAttribute?.Policy);

        await using WebApplication app = GatewayApplication.Build([]);
        RouteEndpoint alarmsPage = ((IEndpointRouteBuilder)app).DataSources
            .SelectMany(source => source.Endpoints)
            .OfType<RouteEndpoint>()
            .Single(endpoint => endpoint.RoutePattern.RawText == "/alarms");

        Assert.Contains(
            alarmsPage.Metadata.OfType<IAuthorizeData>(),
            data => data.Policy == DashboardAuthenticationDefaults.AlarmsPolicy);
    }

    /// <summary>
    /// Runs BOTH dashboard authorization handlers over one requirement in the most permissive
    /// environment the gateway supports (auth disabled, loopback, anonymous localhost allowed),
    /// mirroring how the authorization service invokes every registered handler.
    /// </summary>
    /// <param name="principal">The caller.</param>
    /// <param name="requirement">The single requirement under evaluation.</param>
    /// <returns>The context after both handlers have run.</returns>
    private static async Task<AuthorizationHandlerContext> EvaluateAsync(
        ClaimsPrincipal principal,
        IAuthorizationRequirement requirement)
    {
        DefaultHttpContext httpContext = new();
        httpContext.Connection.RemoteIpAddress = IPAddress.Loopback;

        IOptions<GatewayOptions> options = Options.Create(new GatewayOptions
        {
            Authentication = new AuthenticationOptions { Mode = AuthenticationMode.Disabled },
            Dashboard = new DashboardOptions { AllowAnonymousLocalhost = true },
        });

        AuthorizationHandlerContext context = new([requirement], principal, httpContext);

        await new DashboardAuthorizationHandler(
            new HttpContextAccessor { HttpContext = httpContext },
            options).HandleAsync(context);
        await new AuthenticatedDashboardRoleHandler().HandleAsync(context);

        return context;
    }

    private static ClaimsPrincipal CreatePrincipal(string role) =>
        new(new ClaimsIdentity(
            [new Claim(ClaimTypes.Role, role)],
            DashboardAuthenticationDefaults.AuthenticationScheme,
            ClaimTypes.Name,
            ClaimTypes.Role));
}