Adding Flags API

2026-04-07 15:30:40 -07:00
parent 7b15086fe5
commit 0ba076b650
78 changed files with 3862 additions and 81 deletions
--- a/tests/api/MicCheck.Api.Tests.Unit/Auth/AuthEndpointsTests.cs
+++ b/tests/api/MicCheck.Api.Tests.Unit/Auth/AuthEndpointsTests.cs
@@ -1,75 +1,185 @@
 using System.Net;
 using System.Net.Http.Json;
-using Microsoft.AspNetCore.Mvc.Testing;
-using Microsoft.Extensions.DependencyInjection;
-using Moq;
-using NUnit.Framework;
 using MicCheck.Api.Auth;
+using NUnit.Framework;

 namespace MicCheck.Api.Tests.Unit.Auth;

 [TestFixture]
 public class AuthEndpointsTests
 {
-    private WebApplicationFactory<Program> _factory = null!;
-    private Mock<ITokenService> _tokenService = null!;
+    private MicCheckWebApplicationFactory _factory = null!;

    [SetUp]
    public void SetUp()
    {
-        _tokenService = new Mock<ITokenService>();
-
-        _factory = new WebApplicationFactory<Program>()
-            .WithWebHostBuilder(host =>
-            {
-                host.ConfigureServices(services =>
-                {
-                    services.AddScoped<ITokenService>(_ => _tokenService.Object);
-                });
-            });
+        _factory = new MicCheckWebApplicationFactory();
    }

    [TearDown]
    public void TearDown() => _factory.Dispose();

    [Test]
-    public async Task WhenUsernameIsEmpty_ThenBadRequestIsReturned()
+    public async Task WhenRegisteringWithValidDetails_ThenOkIsReturnedWithTokens()
    {
        var client = _factory.CreateClient();

-        var response = await client.PostAsJsonAsync("/auth/token",
-            new TokenRequest("", "password123"));
-
-        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.BadRequest));
-    }
-
-    [Test]
-    public async Task WhenPasswordIsEmpty_ThenBadRequestIsReturned()
-    {
-        var client = _factory.CreateClient();
-
-        var response = await client.PostAsJsonAsync("/auth/token",
-            new TokenRequest("testuser", ""));
-
-        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.BadRequest));
-    }
-
-    [Test]
-    public async Task WhenValidCredentialsAreProvided_ThenOkIsReturnedWithToken()
-    {
-        var expectedResponse = new TokenResponse("signed.jwt.token", DateTime.UtcNow.AddHours(1));
-        _tokenService
-            .Setup(s => s.GenerateToken("testuser"))
-            .Returns(expectedResponse);
-
-        var client = _factory.CreateClient();
-
-        var response = await client.PostAsJsonAsync("/auth/token",
-            new TokenRequest("testuser", "password123"));
+        var response = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "alice@example.com", "SecurePass1!", "Alice", "Smith", "Acme Corp"));

        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));

-        var body = await response.Content.ReadFromJsonAsync<TokenResponse>();
-        Assert.That(body?.Token, Is.EqualTo(expectedResponse.Token));
+        var body = await response.Content.ReadFromJsonAsync<LoginResponse>();
+        Assert.That(body?.AccessToken, Is.Not.Null.And.Not.Empty);
+        Assert.That(body?.RefreshToken, Is.Not.Null.And.Not.Empty);
+    }
+
+    [Test]
+    public async Task WhenRegisteringWithDuplicateEmail_ThenConflictIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "alice@example.com", "SecurePass1!", "Alice", "Smith", "Acme Corp"));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "alice@example.com", "AnotherPass1!", "Alice", "Jones", "Other Corp"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Conflict));
+    }
+
+    [Test]
+    public async Task WhenLoginWithValidCredentials_ThenOkIsReturnedWithTokens()
+    {
+        var client = _factory.CreateClient();
+
+        await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "bob@example.com", "SecurePass1!", "Bob", "Jones", "BobCo"));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/login",
+            new LoginRequest("bob@example.com", "SecurePass1!"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+
+        var body = await response.Content.ReadFromJsonAsync<LoginResponse>();
+        Assert.That(body?.AccessToken, Is.Not.Null.And.Not.Empty);
+        Assert.That(body?.RefreshToken, Is.Not.Null.And.Not.Empty);
+    }
+
+    [Test]
+    public async Task WhenLoginWithWrongPassword_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "carol@example.com", "CorrectPass1!", "Carol", "White", "CarolCo"));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/login",
+            new LoginRequest("carol@example.com", "WrongPassword"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+
+    [Test]
+    public async Task WhenLoginWithUnknownEmail_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/login",
+            new LoginRequest("nobody@example.com", "SomePass1!"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+
+    [Test]
+    public async Task WhenLoginWithEmptyEmail_ThenBadRequestIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/login",
+            new LoginRequest("", "SomePass1!"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.BadRequest));
+    }
+
+    [Test]
+    public async Task WhenRefreshingWithValidToken_ThenOkIsReturnedWithNewTokens()
+    {
+        var client = _factory.CreateClient();
+
+        var registerResponse = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "dave@example.com", "SecurePass1!", "Dave", "Brown", "DaveCo"));
+        var registerBody = await registerResponse.Content.ReadFromJsonAsync<LoginResponse>();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest(registerBody!.RefreshToken));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+
+        var body = await response.Content.ReadFromJsonAsync<LoginResponse>();
+        Assert.That(body?.AccessToken, Is.Not.Null.And.Not.Empty);
+        Assert.That(body?.RefreshToken, Is.Not.EqualTo(registerBody.RefreshToken));
+    }
+
+    [Test]
+    public async Task WhenRefreshingWithInvalidToken_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest("not-a-valid-refresh-token"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+
+    [Test]
+    public async Task WhenRefreshingWithRevokedToken_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var registerResponse = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "eve@example.com", "SecurePass1!", "Eve", "Davis", "EveCo"));
+        var registerBody = await registerResponse.Content.ReadFromJsonAsync<LoginResponse>();
+
+        await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest(registerBody!.RefreshToken));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest(registerBody.RefreshToken));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+
+    [Test]
+    public async Task WhenLoggingOut_ThenNoContentIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var registerResponse = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "frank@example.com", "SecurePass1!", "Frank", "Green", "FrankCo"));
+        var registerBody = await registerResponse.Content.ReadFromJsonAsync<LoginResponse>();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/logout",
+            new LogoutRequest(registerBody!.RefreshToken));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.NoContent));
+    }
+
+    [Test]
+    public async Task WhenLoggingOutAndRefreshing_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var registerResponse = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "grace@example.com", "SecurePass1!", "Grace", "Black", "GraceCo"));
+        var registerBody = await registerResponse.Content.ReadFromJsonAsync<LoginResponse>();
+
+        await client.PostAsJsonAsync("/api/v1/auth/logout",
+            new LogoutRequest(registerBody!.RefreshToken));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest(registerBody.RefreshToken));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
    }
 }
--- a/tests/api/MicCheck.Api.Tests.Unit/Auth/TokenServiceTests.cs
+++ b/tests/api/MicCheck.Api.Tests.Unit/Auth/TokenServiceTests.cs
@@ -1,6 +1,8 @@
 using System.IdentityModel.Tokens.Jwt;
-using Microsoft.Extensions.Configuration;
 using MicCheck.Api.Auth;
+using MicCheck.Api.Organizations;
+using MicCheck.Api.Users;
+using Microsoft.Extensions.Configuration;
 using NUnit.Framework;

 namespace MicCheck.Api.Tests.Unit.Auth;
@@ -27,29 +29,43 @@ public class TokenServiceTests
        _tokenService = new TokenService(_configuration);
    }

+    private static User BuildUser(int id = 1, string email = "alice@example.com") =>
+        new()
+        {
+            Email = email,
+            FirstName = "Alice",
+            LastName = "Smith",
+            PasswordHash = "hashed",
+            IsActive = true,
+            CreatedAt = DateTimeOffset.UtcNow
+        };
+
    [Test]
-    public void WhenAUsernameIsProvided_ThenATokenIsReturned()
+    public void WhenAUserIsProvided_ThenATokenIsReturned()
    {
-        var result = _tokenService.GenerateToken("testuser");
+        var result = _tokenService.GenerateToken(BuildUser());

        Assert.That(result.Token, Is.Not.Null.And.Not.Empty);
    }

    [Test]
-    public void WhenATokenIsGenerated_ThenItContainsTheUsernameAsSubjectClaim()
+    public void WhenATokenIsGenerated_ThenItContainsTheUserEmailClaim()
    {
-        var result = _tokenService.GenerateToken("testuser");
+        var user = BuildUser(email: "bob@example.com");
+
+        var result = _tokenService.GenerateToken(user);

        var handler = new JwtSecurityTokenHandler();
        var jwt = handler.ReadJwtToken(result.Token);

-        Assert.That(jwt.Subject, Is.EqualTo("testuser"));
+        Assert.That(jwt.Claims.Any(c => c.Type == JwtRegisteredClaimNames.Email && c.Value == "bob@example.com"),
+            Is.True);
    }

    [Test]
    public void WhenATokenIsGenerated_ThenItHasAFutureExpiry()
    {
-        var result = _tokenService.GenerateToken("testuser");
+        var result = _tokenService.GenerateToken(BuildUser());

        Assert.That(result.ExpiresAt, Is.GreaterThan(DateTime.UtcNow));
    }
@@ -57,11 +73,31 @@ public class TokenServiceTests
    [Test]
    public void WhenATokenIsGenerated_ThenItHasTheConfiguredIssuer()
    {
-        var result = _tokenService.GenerateToken("testuser");
+        var result = _tokenService.GenerateToken(BuildUser());

        var handler = new JwtSecurityTokenHandler();
        var jwt = handler.ReadJwtToken(result.Token);

        Assert.That(jwt.Issuer, Is.EqualTo("MicCheck"));
    }
+
+    [Test]
+    public void WhenUserBelongsToOrganizations_ThenTokenContainsOrganizationClaims()
+    {
+        var user = BuildUser();
+        user.Organizations.Add(new OrganizationUser
+        {
+            OrganizationId = 42,
+            UserId = user.Id,
+            Role = OrganizationRole.Admin
+        });
+
+        var result = _tokenService.GenerateToken(user);
+
+        var handler = new JwtSecurityTokenHandler();
+        var jwt = handler.ReadJwtToken(result.Token);
+
+        Assert.That(jwt.Claims.Any(c => c.Type == "OrganizationId" && c.Value == "42"), Is.True);
+        Assert.That(jwt.Claims.Any(c => c.Type == "OrganizationRole" && c.Value == "Admin"), Is.True);
+    }
 }