cesnimda
58 lines
2.3 KiB
C#
58 lines
2.3 KiB
C#
using System.Net;
|
|
using FluentAssertions;
|
|
using Microsoft.AspNetCore.Mvc.Testing;
|
|
using Microsoft.Extensions.Configuration;
|
|
using Microsoft.Extensions.Hosting;
|
|
using Xunit;
|
|
|
|
namespace InboxIntel.IntegrationTests;
|
|
|
|
/// <summary>
|
|
/// Test host that disables startup auto-migration so the factory boots without
|
|
/// a live PostgreSQL instance. The auth tests below never touch the database
|
|
/// (the challenge happens in middleware before any controller runs).
|
|
/// </summary>
|
|
public class TestAppFactory : WebApplicationFactory<Program>
|
|
{
|
|
protected override IHost CreateHost(IHostBuilder builder)
|
|
{
|
|
builder.ConfigureHostConfiguration(cfg => cfg.AddInMemoryCollection(new Dictionary<string, string?>
|
|
{
|
|
["Database:AutoMigrate"] = "false",
|
|
// Dummy OAuth creds so the Google challenge produces a real 302 redirect
|
|
// (an empty ClientId can make the handler throw instead of redirecting).
|
|
["GoogleOAuth:ClientId"] = "test-client-id",
|
|
["GoogleOAuth:ClientSecret"] = "test-client-secret"
|
|
}));
|
|
return base.CreateHost(builder);
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Smoke tests proving the host boots and authorization is enforced. A fuller
|
|
/// suite would swap PostgreSQL for a Testcontainers instance and the Gmail
|
|
/// client for a fake, then exercise sync -> analytics end to end.
|
|
/// </summary>
|
|
public class AuthEndpointsTests : IClassFixture<TestAppFactory>
|
|
{
|
|
private readonly TestAppFactory _factory;
|
|
public AuthEndpointsTests(TestAppFactory factory) => _factory = factory;
|
|
|
|
[Fact]
|
|
public async Task Protected_endpoint_challenges_when_anonymous()
|
|
{
|
|
var client = _factory.CreateClient(new WebApplicationFactoryClientOptions { AllowAutoRedirect = false });
|
|
var resp = await client.GetAsync("/api/v1/analytics/dashboard");
|
|
// Unauthenticated -> redirect to Google challenge (302) or 401.
|
|
resp.StatusCode.Should().BeOneOf(HttpStatusCode.Found, HttpStatusCode.Unauthorized);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Login_endpoint_is_anonymous()
|
|
{
|
|
var client = _factory.CreateClient(new WebApplicationFactoryClientOptions { AllowAutoRedirect = false });
|
|
var resp = await client.GetAsync("/api/v1/auth/login");
|
|
resp.StatusCode.Should().Be(HttpStatusCode.Redirect); // 302 to Google
|
|
}
|
|
}
|