Testing It

using System.Net;
using System.Net.Http.Json;
using System.Security.Claims;
using System.Text.Encodings.Web;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.AspNetCore.TestHost;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Options;
using Npgsql;
using Testcontainers.PostgreSql;
using Xunit;

[assembly: AssemblyFixture(typeof(PostgresFixture))]

// One PostgreSQL container for the whole test run.
public sealed class PostgresFixture : IAsyncLifetime
{
    private readonly PostgreSqlContainer _container = new PostgreSqlBuilder("postgres:17-alpine").Build();

    public string ConnectionStringFor(string database) =>
        new NpgsqlConnectionStringBuilder(_container.GetConnectionString()) { Database = database }.ConnectionString;

    public async ValueTask InitializeAsync() => await _container.StartAsync();

    public ValueTask DisposeAsync() => _container.DisposeAsync();
}

public sealed class OrdersApiFactory(string connectionString) : WebApplicationFactory<Program>
{
    protected override void ConfigureWebHost(IWebHostBuilder builder)
    {
        builder.UseEnvironment("Testing");
        builder.UseSetting("ConnectionStrings:Orders", connectionString);
        builder.ConfigureTestServices(services =>
        {
            services.AddAuthentication(options =>
                {
                    options.DefaultAuthenticateScheme = TestAuthHandler.Scheme;
                    options.DefaultChallengeScheme = TestAuthHandler.Scheme;
                })
                .AddScheme<AuthenticationSchemeOptions, TestAuthHandler>(TestAuthHandler.Scheme, null);
        });
    }
}

public sealed class PlaceOrderTests(PostgresFixture postgres) : IAsyncLifetime
{
    private OrdersApiFactory _factory = null!;

    public async ValueTask InitializeAsync()
    {
        // A database per test class: classes run in parallel without sharing rows.
        _factory = new OrdersApiFactory(postgres.ConnectionStringFor($"orders_{Guid.NewGuid():N}"));
        await using var scope = _factory.Services.CreateAsyncScope();
        await scope.ServiceProvider.GetRequiredService<OrdersDbContext>().Database
            .MigrateAsync(TestContext.Current.CancellationToken);
    }

    public ValueTask DisposeAsync() => _factory.DisposeAsync();

    [Fact]
    public async Task Retried_post_with_the_same_key_creates_one_order()
    {
        var ct = TestContext.Current.CancellationToken;
        var client = ClientFor("customer-42", "orders.read orders.write");
        var basket = new { lines = new[] { new { sku = "KETTLE-BLUE", quantity = 1 } } };

        var first = await PostOrder(client, "6f1c2a90", basket, ct);
        var retry = await PostOrder(client, "6f1c2a90", basket, ct);

        Assert.Equal(HttpStatusCode.Created, first.StatusCode);
        Assert.Equal(HttpStatusCode.Created, retry.StatusCode);
        Assert.Equal(first.Headers.Location, retry.Headers.Location);

        await using var scope = _factory.Services.CreateAsyncScope();
        var db = scope.ServiceProvider.GetRequiredService<OrdersDbContext>();
        Assert.Equal(1, await db.Orders.CountAsync(o => o.CustomerSubject == "customer-42", ct));
    }

    [Theory]
    [InlineData(null, null, HttpStatusCode.Unauthorized)]
    [InlineData("customer-42", "orders.read", HttpStatusCode.Forbidden)]
    public async Task Post_requires_a_token_with_the_write_scope(string? user, string? scopes, HttpStatusCode expected)
    {
        var client = user is null ? _factory.CreateClient() : ClientFor(user, scopes!);
        var response = await PostOrder(client, "b51d07e2", new { lines = new[] { new { sku = "MUG-WHITE", quantity = 2 } } },
            TestContext.Current.CancellationToken);
        Assert.Equal(expected, response.StatusCode);
    }

    [Fact]
    public async Task Invalid_quantity_is_a_validation_problem_keyed_by_path()
    {
        var client = ClientFor("customer-43", "orders.write");
        var response = await PostOrder(client, "c0ffee01", new { lines = new[] { new { sku = "MUG-WHITE", quantity = 0 } } },
            TestContext.Current.CancellationToken);

        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
        var problem = await response.Content.ReadFromJsonAsync<HttpValidationProblemDetails>(TestContext.Current.CancellationToken);
        Assert.Contains("Lines[0].Quantity", problem!.Errors.Keys);
    }

    private HttpClient ClientFor(string user, string scopes)
    {
        var client = _factory.CreateClient();
        client.DefaultRequestHeaders.Add(TestAuthHandler.UserHeader, user);
        client.DefaultRequestHeaders.Add(TestAuthHandler.ScopesHeader, scopes);
        return client;
    }

    private static Task<HttpResponseMessage> PostOrder(HttpClient client, string key, object body, CancellationToken ct)
    {
        var request = new HttpRequestMessage(HttpMethod.Post, "/api/orders") { Content = JsonContent.Create(body) };
        request.Headers.Add("Idempotency-Key", key);
        return client.SendAsync(request, ct);
    }
}

public sealed class TestAuthHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder)
    : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
{
    public const string Scheme = "Test";
    public const string UserHeader = "X-Test-User";
    public const string ScopesHeader = "X-Test-Scopes";

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        if (!Request.Headers.TryGetValue(UserHeader, out var user))
            return Task.FromResult(AuthenticateResult.NoResult());

        Claim[] claims = [new("sub", user.ToString()), new("scope", Request.Headers[ScopesHeader].ToString())];
        var principal = new ClaimsPrincipal(new ClaimsIdentity(claims, Scheme, "sub", "roles"));
        return Task.FromResult(AuthenticateResult.Success(new AuthenticationTicket(principal, Scheme)));
    }
}

// Stand-ins for types that live in Orders.Api.
public partial class Program;

public sealed class Order
{
    public long Id { get; set; }
    public required string CustomerSubject { get; set; }
}

public sealed class OrdersDbContext(DbContextOptions<OrdersDbContext> options) : DbContext(options)
{
    public DbSet<Order> Orders => Set<Order>();
}