WIP

tests/api/MicCheck.Api.Tests.Unit/Authorization/AuthEndpointsTests.cs

@@ -0,0 +1,185 @@
+using System.Net;
+using System.Net.Http.Json;
+using MicCheck.Api.Authorization;
+using NUnit.Framework;
+
+namespace MicCheck.Api.Tests.Unit.Authorization;
+
+[TestFixture]
+public class AuthEndpointsTests
+{
+    private MicCheckWebApplicationFactory _factory = null!;
+
+    [SetUp]
+    public void SetUp()
+    {
+        _factory = new MicCheckWebApplicationFactory();
+    }
+
+    [TearDown]
+    public void TearDown() => _factory.Dispose();
+
+    [Test]
+    public async Task WhenRegisteringWithValidDetails_ThenOkIsReturnedWithTokens()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "alice@example.com", "SecurePass1!", "Alice", "Smith", "Acme Corp"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+
+        var body = await response.Content.ReadFromJsonAsync<LoginResponse>();
+        Assert.That(body?.AccessToken, Is.Not.Null.And.Not.Empty);
+        Assert.That(body?.RefreshToken, Is.Not.Null.And.Not.Empty);
+    }
+
+    [Test]
+    public async Task WhenRegisteringWithDuplicateEmail_ThenConflictIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "alice@example.com", "SecurePass1!", "Alice", "Smith", "Acme Corp"));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "alice@example.com", "AnotherPass1!", "Alice", "Jones", "Other Corp"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Conflict));
+    }
+
+    [Test]
+    public async Task WhenLoginWithValidCredentials_ThenOkIsReturnedWithTokens()
+    {
+        var client = _factory.CreateClient();
+
+        await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "bob@example.com", "SecurePass1!", "Bob", "Jones", "BobCo"));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/login",
+            new LoginRequest("bob@example.com", "SecurePass1!"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+
+        var body = await response.Content.ReadFromJsonAsync<LoginResponse>();
+        Assert.That(body?.AccessToken, Is.Not.Null.And.Not.Empty);
+        Assert.That(body?.RefreshToken, Is.Not.Null.And.Not.Empty);
+    }
+
+    [Test]
+    public async Task WhenLoginWithWrongPassword_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "carol@example.com", "CorrectPass1!", "Carol", "White", "CarolCo"));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/login",
+            new LoginRequest("carol@example.com", "WrongPassword"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+
+    [Test]
+    public async Task WhenLoginWithUnknownEmail_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/login",
+            new LoginRequest("nobody@example.com", "SomePass1!"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+
+    [Test]
+    public async Task WhenLoginWithEmptyEmail_ThenBadRequestIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/login",
+            new LoginRequest("", "SomePass1!"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.BadRequest));
+    }
+
+    [Test]
+    public async Task WhenRefreshingWithValidToken_ThenOkIsReturnedWithNewTokens()
+    {
+        var client = _factory.CreateClient();
+
+        var registerResponse = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "dave@example.com", "SecurePass1!", "Dave", "Brown", "DaveCo"));
+        var registerBody = await registerResponse.Content.ReadFromJsonAsync<LoginResponse>();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest(registerBody!.RefreshToken));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+
+        var body = await response.Content.ReadFromJsonAsync<LoginResponse>();
+        Assert.That(body?.AccessToken, Is.Not.Null.And.Not.Empty);
+        Assert.That(body?.RefreshToken, Is.Not.EqualTo(registerBody.RefreshToken));
+    }
+
+    [Test]
+    public async Task WhenRefreshingWithInvalidToken_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest("not-a-valid-refresh-token"));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+
+    [Test]
+    public async Task WhenRefreshingWithRevokedToken_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var registerResponse = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "eve@example.com", "SecurePass1!", "Eve", "Davis", "EveCo"));
+        var registerBody = await registerResponse.Content.ReadFromJsonAsync<LoginResponse>();
+
+        await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest(registerBody!.RefreshToken));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest(registerBody.RefreshToken));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+
+    [Test]
+    public async Task WhenLoggingOut_ThenNoContentIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var registerResponse = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "frank@example.com", "SecurePass1!", "Frank", "Green", "FrankCo"));
+        var registerBody = await registerResponse.Content.ReadFromJsonAsync<LoginResponse>();
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/logout",
+            new LogoutRequest(registerBody!.RefreshToken));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.NoContent));
+    }
+
+    [Test]
+    public async Task WhenLoggingOutAndRefreshing_ThenUnauthorizedIsReturned()
+    {
+        var client = _factory.CreateClient();
+
+        var registerResponse = await client.PostAsJsonAsync("/api/v1/auth/register", new RegisterRequest(
+            "grace@example.com", "SecurePass1!", "Grace", "Black", "GraceCo"));
+        var registerBody = await registerResponse.Content.ReadFromJsonAsync<LoginResponse>();
+
+        await client.PostAsJsonAsync("/api/v1/auth/logout",
+            new LogoutRequest(registerBody!.RefreshToken));
+
+        var response = await client.PostAsJsonAsync("/api/v1/auth/refresh",
+            new RefreshRequest(registerBody.RefreshToken));
+
+        Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+    }
+}

tests/api/MicCheck.Api.Tests.Unit/Authorization/ProjectPermissionRequirementHandlerTests.cs

@@ -0,0 +1,180 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using MicCheck.Api.Authorization;
+using MicCheck.Api.Data;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.EntityFrameworkCore;
+using Moq;
+using NUnit.Framework;
+
+namespace MicCheck.Api.Tests.Unit.Authorization;
+
+[TestFixture]
+public class ProjectPermissionRequirementHandlerTests
+{
+    private MicCheckDbContext _db = null!;
+    private Mock<IHttpContextAccessor> _httpContextAccessor = null!;
+    private ProjectPermissionRequirementHandler _handler = null!;
+
+    [SetUp]
+    public void SetUp()
+    {
+        var options = new DbContextOptionsBuilder<MicCheckDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString())
+            .Options;
+        _db = new MicCheckDbContext(options);
+
+        _httpContextAccessor = new Mock<IHttpContextAccessor>();
+        _handler = new ProjectPermissionRequirementHandler(_db, _httpContextAccessor.Object);
+    }
+
+    [TearDown]
+    public void TearDown() => _db.Dispose();
+
+    private static AuthorizationHandlerContext CreateContext(
+        ClaimsPrincipal user,
+        ProjectPermission permission = ProjectPermission.ViewProject)
+    {
+        var requirement = new ProjectPermissionRequirement(permission);
+        return new AuthorizationHandlerContext([requirement], user, null);
+    }
+
+    private static ClaimsPrincipal CreateUserWithClaims(params Claim[] claims)
+    {
+        return new ClaimsPrincipal(new ClaimsIdentity(claims, "Bearer"));
+    }
+
+    private void SetupRouteProjectId(int projectId)
+    {
+        var httpContext = new DefaultHttpContext();
+        httpContext.Request.RouteValues["projectId"] = projectId.ToString();
+        _httpContextAccessor.Setup(a => a.HttpContext).Returns(httpContext);
+    }
+
+    [Test]
+    public async Task WhenUserIsOrganizationAdmin_ThenRequirementSucceeds()
+    {
+        var user = CreateUserWithClaims(
+            new Claim(JwtRegisteredClaimNames.Sub, "1"),
+            new Claim("OrganizationRole", "Admin"));
+
+        var context = CreateContext(user);
+
+        await _handler.HandleAsync(context);
+
+        Assert.That(context.HasSucceeded, Is.True);
+    }
+
+    [Test]
+    public async Task WhenUserHasRequiredPermission_ThenRequirementSucceeds()
+    {
+        _db.UserProjectPermissions.Add(new UserProjectPermission
+        {
+            UserId = 1,
+            ProjectId = 10,
+            Permissions = [ProjectPermission.ViewProject]
+        });
+        await _db.SaveChangesAsync();
+
+        SetupRouteProjectId(10);
+
+        var user = CreateUserWithClaims(
+            new Claim(JwtRegisteredClaimNames.Sub, "1"));
+
+        var context = CreateContext(user, ProjectPermission.ViewProject);
+
+        await _handler.HandleAsync(context);
+
+        Assert.That(context.HasSucceeded, Is.True);
+    }
+
+    [Test]
+    public async Task WhenUserIsProjectAdmin_ThenAllPermissionsAreGranted()
+    {
+        _db.UserProjectPermissions.Add(new UserProjectPermission
+        {
+            UserId = 2,
+            ProjectId = 20,
+            IsAdmin = true,
+            Permissions = []
+        });
+        await _db.SaveChangesAsync();
+
+        SetupRouteProjectId(20);
+
+        var user = CreateUserWithClaims(
+            new Claim(JwtRegisteredClaimNames.Sub, "2"));
+
+        var context = CreateContext(user, ProjectPermission.DeleteFeature);
+
+        await _handler.HandleAsync(context);
+
+        Assert.That(context.HasSucceeded, Is.True);
+    }
+
+    [Test]
+    public async Task WhenUserDoesNotHaveRequiredPermission_ThenRequirementFails()
+    {
+        _db.UserProjectPermissions.Add(new UserProjectPermission
+        {
+            UserId = 3,
+            ProjectId = 30,
+            Permissions = [ProjectPermission.ViewProject]
+        });
+        await _db.SaveChangesAsync();
+
+        SetupRouteProjectId(30);
+
+        var user = CreateUserWithClaims(
+            new Claim(JwtRegisteredClaimNames.Sub, "3"));
+
+        var context = CreateContext(user, ProjectPermission.DeleteFeature);
+
+        await _handler.HandleAsync(context);
+
+        Assert.That(context.HasSucceeded, Is.False);
+    }
+
+    [Test]
+    public async Task WhenUserHasNoProjectPermissionRecord_ThenRequirementFails()
+    {
+        SetupRouteProjectId(99);
+
+        var user = CreateUserWithClaims(
+            new Claim(JwtRegisteredClaimNames.Sub, "5"));
+
+        var context = CreateContext(user);
+
+        await _handler.HandleAsync(context);
+
+        Assert.That(context.HasSucceeded, Is.False);
+    }
+
+    [Test]
+    public async Task WhenUserIdClaimIsMissing_ThenRequirementFails()
+    {
+        var user = CreateUserWithClaims();
+
+        var context = CreateContext(user);
+
+        await _handler.HandleAsync(context);
+
+        Assert.That(context.HasSucceeded, Is.False);
+    }
+
+    [Test]
+    public async Task WhenProjectIdIsNotInRoute_ThenRequirementFails()
+    {
+        _httpContextAccessor.Setup(a => a.HttpContext).Returns(new DefaultHttpContext());
+
+        var user = CreateUserWithClaims(
+            new Claim(JwtRegisteredClaimNames.Sub, "1"));
+
+        var context = CreateContext(user);
+
+        await _handler.HandleAsync(context);
+
+        Assert.That(context.HasSucceeded, Is.False);
+    }
+}

tests/api/MicCheck.Api.Tests.Unit/Authorization/TokenServiceTests.cs

@@ -0,0 +1,103 @@
+using System.IdentityModel.Tokens.Jwt;
+using MicCheck.Api.Authorization;
+using MicCheck.Api.Organizations;
+using MicCheck.Api.Users;
+using Microsoft.Extensions.Configuration;
+using NUnit.Framework;
+
+namespace MicCheck.Api.Tests.Unit.Authorization;
+
+[TestFixture]
+public class TokenServiceTests
+{
+    private IConfiguration _configuration = null!;
+    private TokenService _tokenService = null!;
+
+    [SetUp]
+    public void SetUp()
+    {
+        _configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["Jwt:SecretKey"] = "test-secret-key-that-is-long-enough-32c",
+                ["Jwt:Issuer"] = "MicCheck",
+                ["Jwt:Audience"] = "MicCheck",
+                ["Jwt:ExpiryMinutes"] = "60",
+            })
+            .Build();
+
+        _tokenService = new TokenService(_configuration);
+    }
+
+    private static User BuildUser(int id = 1, string email = "alice@example.com") =>
+        new()
+        {
+            Email = email,
+            FirstName = "Alice",
+            LastName = "Smith",
+            PasswordHash = "hashed",
+            IsActive = true,
+            CreatedAt = DateTimeOffset.UtcNow
+        };
+
+    [Test]
+    public void WhenAUserIsProvided_ThenATokenIsReturned()
+    {
+        var result = _tokenService.GenerateToken(BuildUser());
+
+        Assert.That(result.Token, Is.Not.Null.And.Not.Empty);
+    }
+
+    [Test]
+    public void WhenATokenIsGenerated_ThenItContainsTheUserEmailClaim()
+    {
+        var user = BuildUser(email: "bob@example.com");
+
+        var result = _tokenService.GenerateToken(user);
+
+        var handler = new JwtSecurityTokenHandler();
+        var jwt = handler.ReadJwtToken(result.Token);
+
+        Assert.That(jwt.Claims.Any(c => c.Type == JwtRegisteredClaimNames.Email && c.Value == "bob@example.com"),
+            Is.True);
+    }
+
+    [Test]
+    public void WhenATokenIsGenerated_ThenItHasAFutureExpiry()
+    {
+        var result = _tokenService.GenerateToken(BuildUser());
+
+        Assert.That(result.ExpiresAt, Is.GreaterThan(DateTime.UtcNow));
+    }
+
+    [Test]
+    public void WhenATokenIsGenerated_ThenItHasTheConfiguredIssuer()
+    {
+        var result = _tokenService.GenerateToken(BuildUser());
+
+        var handler = new JwtSecurityTokenHandler();
+        var jwt = handler.ReadJwtToken(result.Token);
+
+        Assert.That(jwt.Issuer, Is.EqualTo("MicCheck"));
+    }
+
+    [Test]
+    public void WhenUserBelongsToOrganizations_ThenTokenContainsOrganizationClaims()
+    {
+        var user = BuildUser();
+        user.Organizations.Add(new OrganizationUser
+        {
+            OrganizationId = 42,
+            UserId = user.Id,
+            Role = OrganizationRole.Admin
+        });
+
+        var result = _tokenService.GenerateToken(user);
+
+        var handler = new JwtSecurityTokenHandler();
+        var jwt = handler.ReadJwtToken(result.Token);
+
+        Assert.That(jwt.Claims.Any(c => c.Type == "OrganizationId" && c.Value == "42"), Is.True);
+        Assert.That(jwt.Claims.Any(c => c.Type == "OrganizationRole" && c.Value == "Admin"), Is.True);
+    }
+}