Testing Authorization

using System.Security.Claims;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authorization.Infrastructure;
using Xunit;

namespace Shop.Api.Tests;

public sealed record Order(int Id, string CustomerId, string Status);

public static class OrderOperations
{
    public static readonly OperationAuthorizationRequirement Read = new() { Name = nameof(Read) };
    public static readonly OperationAuthorizationRequirement Cancel = new() { Name = nameof(Cancel) };
}

public sealed class OrderAuthorizationHandler : AuthorizationHandler<OperationAuthorizationRequirement, Order>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context, OperationAuthorizationRequirement requirement, Order order)
    {
        var isOwner = context.User.FindFirstValue("sub") == order.CustomerId;
        var allowed = requirement.Name == nameof(OrderOperations.Read)
            ? isOwner || context.User.IsInRole("support")
            : isOwner;
        if (allowed) context.Succeed(requirement);
        return Task.CompletedTask;
    }
}

public sealed class OrderAuthorizationHandlerTests
{
    private static readonly Order Placed = new(1042, "cust-17", "Placed");

    [Theory]
    [InlineData("cust-17", "", "Read", true)]
    [InlineData("cust-17", "", "Cancel", true)]
    [InlineData("cust-42", "", "Read", false)]
    [InlineData("staff-3", "support", "Read", true)]
    [InlineData("staff-3", "support", "Cancel", false)]
    public async Task Decides_by_owner_and_role(string subject, string role, string operation, bool expected)
    {
        var claims = new List<Claim> { new("sub", subject) };
        if (role.Length > 0) claims.Add(new Claim("role", role));
        // Authentication type makes the identity authenticated; the last argument makes IsInRole read "role".
        var user = new ClaimsPrincipal(new ClaimsIdentity(claims, "Test", "sub", "role"));
        var requirement = operation == "Read" ? OrderOperations.Read : OrderOperations.Cancel;
        var context = new AuthorizationHandlerContext([requirement], user, Placed);

        await new OrderAuthorizationHandler().HandleAsync(context);

        Assert.Equal(expected, context.HasSucceeded);
    }
}

using System.Net;
using System.Net.Http.Headers;
using System.Security.Claims;
using System.Text.Encodings.Web;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.AspNetCore.TestHost;
using Microsoft.Extensions.Options;
using Xunit;

public sealed class OrderAccessMatrixTests(AuthenticatedApiFactory factory) : IClassFixture<AuthenticatedApiFactory>
{
    [Theory]
    [InlineData(null, "/orders/1042", HttpStatusCode.Unauthorized)]
    [InlineData("alice", "/orders/1042", HttpStatusCode.OK)]
    [InlineData("dave", "/orders/1042", HttpStatusCode.NotFound)]
    [InlineData("alice", "/admin/orders", HttpStatusCode.Forbidden)]
    [InlineData("bob-support", "/admin/orders", HttpStatusCode.OK)]
    public async Task Access_matrix(string? persona, string path, HttpStatusCode expected)
    {
        // A client per row: the persona never leaks into another test case.
        using var client = persona is null ? factory.CreateClient() : factory.CreateClientAs(persona);

        using var response = await client.GetAsync(path, TestContext.Current.CancellationToken);

        Assert.Equal(expected, response.StatusCode);
    }
}

// The factory, handler and personas below are the ones from Authenticated Integration Tests (net-test-auth).
public sealed class AuthenticatedApiFactory : WebApplicationFactory<Program>
{
    protected override void ConfigureWebHost(IWebHostBuilder builder) =>
        builder.ConfigureTestServices(services =>
            services.AddAuthentication(options =>
                {
                    options.DefaultScheme = TestAuthHandler.SchemeName;
                    options.DefaultAuthenticateScheme = TestAuthHandler.SchemeName;
                    options.DefaultChallengeScheme = TestAuthHandler.SchemeName;
                })
                .AddScheme<AuthenticationSchemeOptions, TestAuthHandler>(TestAuthHandler.SchemeName, null));

    public HttpClient CreateClientAs(string persona)
    {
        var client = CreateClient();
        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(TestAuthHandler.SchemeName, persona);
        return client;
    }
}

// Accepts "Authorization: Test <persona> [claim=value ...]" and nothing else.
public sealed class TestAuthHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder)
    : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
{
    public const string SchemeName = "Test";

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        var header = Request.Headers.Authorization.ToString();
        if (!header.StartsWith(SchemeName + " ", StringComparison.Ordinal))
            return Task.FromResult(AuthenticateResult.NoResult());   // anonymous: the 401 path stays testable

        var parts = header[(SchemeName.Length + 1)..].Split(' ', StringSplitOptions.RemoveEmptyEntries);
        if (parts.Length == 0 || !TestUsers.Personas.TryGetValue(parts[0], out var baseClaims))
            return Task.FromResult(AuthenticateResult.Fail($"Unknown test persona '{header}'"));

        var claims = new List<Claim>(baseClaims);
        foreach (var extra in parts.Skip(1))
        {
            var pair = extra.Split('=', 2);
            claims.Add(new Claim(pair[0], pair[1]));
        }

        var identity = new ClaimsIdentity(claims, Scheme.Name, nameType: "sub", roleType: "role");
        return Task.FromResult(AuthenticateResult.Success(new AuthenticationTicket(new ClaimsPrincipal(identity), Scheme.Name)));
    }
}

public static class TestUsers
{
    public static readonly Dictionary<string, Claim[]> Personas = new()
    {
        ["alice"] = [new("sub", "cust-17"), new("tenant", "acme")],
        ["dave"] = [new("sub", "cust-42"), new("tenant", "acme")],
        ["bob-support"] = [new("sub", "staff-3"), new("tenant", "acme"), new("role", "support")],
    };
}

// Stand-in so this file compiles on its own. Delete it in a real test project: in .NET 10 the API's
// generated Program is already public, and a Program declared here would shadow it (CS0436).
public partial class Program;

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.Extensions.Options;
using Xunit;

public sealed class EndpointSecurityTests(WebApplicationFactory<Program> factory) : IClassFixture<WebApplicationFactory<Program>>
{
    // Every entry here is a reviewed decision to make a route public.
    private static readonly HashSet<string> PublicRoutes =
    [
        "/health/live",
        "/health/ready",
        "/products",
        "/products/{id:int}",
    ];

    [Fact]
    public void Every_endpoint_is_protected_or_explicitly_public()
    {
        var endpoints = factory.Services.GetRequiredService<EndpointDataSource>().Endpoints.OfType<RouteEndpoint>();
        // With a fallback policy, an endpoint without metadata is still protected.
        var hasFallback = factory.Services.GetRequiredService<IOptions<AuthorizationOptions>>().Value.FallbackPolicy is not null;
        var problems = new List<string>();

        foreach (var endpoint in endpoints)
        {
            var route = endpoint.RoutePattern.RawText ?? endpoint.DisplayName ?? "?";
            var isAnonymous = endpoint.Metadata.GetMetadata<IAllowAnonymous>() is not null;
            var isProtected = endpoint.Metadata.GetMetadata<IAuthorizeData>() is not null
                || endpoint.Metadata.GetMetadata<AuthorizationPolicy>() is not null
                || endpoint.Metadata.GetMetadata<IAuthorizationRequirementData>() is not null;

            if (isAnonymous && !PublicRoutes.Contains(route)) problems.Add($"{route} is AllowAnonymous but not on the public list");
            else if (!isAnonymous && !isProtected && !hasFallback) problems.Add($"{route} has no authorization metadata");
        }

        Assert.True(problems.Count == 0, string.Join(Environment.NewLine, problems));
    }
}

// Stand-in so this file compiles on its own. Delete it in a real test project: in .NET 10 the API's
// generated Program is already public, and a Program declared here would shadow it (CS0436).
public partial class Program;