Added new middleware to protect paths by authorization (also static files)

2023-06-27 11:01:54 +02:00
parent 371283e653
commit 28377a89eb
11 changed files with 249 additions and 8 deletions
--- a/UnitTests/AspNetCore/Security/PathProtection/ProtectedPathMiddlewareTests.cs
+++ b/UnitTests/AspNetCore/Security/PathProtection/ProtectedPathMiddlewareTests.cs
@@ -0,0 +1,141 @@
+using System;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using AMWD.Common.AspNetCore.Security.PathProtection;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+
+namespace UnitTests.AspNetCore.Security.PathProtection
+{
+	[TestClass]
+	[System.Diagnostics.CodeAnalysis.ExcludeFromCodeCoverage]
+	public class ProtectedPathMiddlewareTests
+	{
+		private Mock<RequestDelegate> nextMock;
+		private Mock<HttpContext> httpContextMock;
+		private Mock<IAuthorizationService> authorizationServiceMock;
+		private Mock<IAuthenticationService> authenticationServiceMock;
+
+		private ProtectedPathOptions options;
+
+		[TestInitialize]
+		public void InitializeTest()
+		{
+			options = new ProtectedPathOptions
+			{
+				Path = "/secure/protected",
+				PolicyName = "Protection"
+			};
+		}
+
+		[TestMethod]
+		public async Task ShouldValidateAccessSuccessful()
+		{
+			// arrange
+			var middleware = GetMiddleware();
+			var context = GetHttpContext(options.Path);
+			var auth = GetAuthService(true);
+
+			// act
+			await middleware.InvokeAsync(context, auth);
+
+			// assert
+			authorizationServiceMock.Verify(s => s.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), options.PolicyName), Times.Once);
+			authorizationServiceMock.VerifyNoOtherCalls();
+
+			authenticationServiceMock.Verify(s => s.ChallengeAsync(It.IsAny<HttpContext>(), It.IsAny<string>(), It.IsAny<AuthenticationProperties>()), Times.Never);
+			authenticationServiceMock.VerifyNoOtherCalls();
+
+			nextMock.Verify(n => n.Invoke(It.IsAny<HttpContext>()), Times.Once);
+			nextMock.VerifyNoOtherCalls();
+		}
+
+		[TestMethod]
+		public async Task ShouldNotValidate()
+		{
+			// arrange
+			var middleware = GetMiddleware();
+			var context = GetHttpContext("/some/path");
+			var auth = GetAuthService(true);
+
+			// act
+			await middleware.InvokeAsync(context, auth);
+
+			// assert
+			authorizationServiceMock.Verify(s => s.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), options.PolicyName), Times.Never);
+			authorizationServiceMock.VerifyNoOtherCalls();
+
+			authenticationServiceMock.Verify(s => s.ChallengeAsync(It.IsAny<HttpContext>(), It.IsAny<string>(), It.IsAny<AuthenticationProperties>()), Times.Never);
+			authenticationServiceMock.VerifyNoOtherCalls();
+
+			nextMock.Verify(n => n.Invoke(It.IsAny<HttpContext>()), Times.Once);
+			nextMock.VerifyNoOtherCalls();
+		}
+
+		[TestMethod]
+		public async Task ShouldValidateAccessFailure()
+		{
+			// arrange
+			var middleware = GetMiddleware();
+			var context = GetHttpContext(options.Path);
+			var auth = GetAuthService(false);
+
+			// act
+			await middleware.InvokeAsync(context, auth);
+
+			// assert
+			authorizationServiceMock.Verify(s => s.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), options.PolicyName), Times.Once);
+			authorizationServiceMock.VerifyNoOtherCalls();
+
+			authenticationServiceMock.Verify(s => s.ChallengeAsync(It.IsAny<HttpContext>(), It.IsAny<string>(), It.IsAny<AuthenticationProperties>()), Times.Once);
+			authenticationServiceMock.VerifyNoOtherCalls();
+
+			nextMock.Verify(n => n.Invoke(It.IsAny<HttpContext>()), Times.Never);
+			nextMock.VerifyNoOtherCalls();
+		}
+
+		private ProtectedPathMiddleware GetMiddleware()
+		{
+			nextMock = new Mock<RequestDelegate>();
+			return new ProtectedPathMiddleware(nextMock.Object, options);
+		}
+
+		private HttpContext GetHttpContext(string requestPath)
+		{
+			var requestMock = new Mock<HttpRequest>();
+			requestMock
+				.Setup(r => r.Path)
+				.Returns(new PathString(requestPath));
+
+			authenticationServiceMock = new Mock<IAuthenticationService>();
+
+			var requestServicesMock = new Mock<IServiceProvider>();
+			requestServicesMock
+				.Setup(s => s.GetService(typeof(IAuthenticationService)))
+				.Returns(authenticationServiceMock.Object);
+
+			httpContextMock = new Mock<HttpContext>();
+			httpContextMock
+				.Setup(c => c.Request)
+				.Returns(requestMock.Object);
+			httpContextMock
+				.Setup(c => c.RequestServices)
+				.Returns(requestServicesMock.Object);
+
+			return httpContextMock.Object;
+		}
+
+		private IAuthorizationService GetAuthService(bool success)
+		{
+			authorizationServiceMock = new Mock<IAuthorizationService>();
+			authorizationServiceMock
+				.Setup(service => service.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), It.IsAny<string>()))
+				.ReturnsAsync(() => success ? AuthorizationResult.Success() : AuthorizationResult.Failed());
+
+			return authorizationServiceMock.Object;
+		}
+	}
+}