common/UnitTests/AspNetCore/Security/PathProtection/ProtectedPathMiddlewareTests.cs

using System;
using System.Security.Claims;
using System.Threading.Tasks;
using AMWD.Common.AspNetCore.Security.PathProtection;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.VisualStudio.TestTools.UnitTesting;
using Moq;

namespace UnitTests.AspNetCore.Security.PathProtection
{
	[TestClass]
	[System.Diagnostics.CodeAnalysis.ExcludeFromCodeCoverage]
	public class ProtectedPathMiddlewareTests
	{
		private Mock<RequestDelegate> _nextMock;
		private Mock<HttpContext> _httpContextMock;
		private Mock<IAuthorizationService> _authorizationServiceMock;
		private Mock<IAuthenticationService> _authenticationServiceMock;

		private ProtectedPathOptions _options;

		[TestInitialize]
		public void InitializeTest()
		{
			_options = new ProtectedPathOptions
			{
				Path = "/secure/protected",
				PolicyName = "Protection"
			};
		}

		[TestMethod]
		public async Task ShouldValidateAccessSuccessful()
		{
			// arrange
			var middleware = GetMiddleware();
			var context = GetHttpContext(_options.Path);
			var auth = GetAuthService(true);

			// act
			await middleware.InvokeAsync(context, auth);

			// assert
			_authorizationServiceMock.Verify(s => s.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), _options.PolicyName), Times.Once);
			_authorizationServiceMock.VerifyNoOtherCalls();

			_authenticationServiceMock.Verify(s => s.ChallengeAsync(It.IsAny<HttpContext>(), It.IsAny<string>(), It.IsAny<AuthenticationProperties>()), Times.Never);
			_authenticationServiceMock.VerifyNoOtherCalls();

			_nextMock.Verify(n => n.Invoke(It.IsAny<HttpContext>()), Times.Once);
			_nextMock.VerifyNoOtherCalls();
		}

		[TestMethod]
		public async Task ShouldNotValidate()
		{
			// arrange
			var middleware = GetMiddleware();
			var context = GetHttpContext("/some/path");
			var auth = GetAuthService(true);

			// act
			await middleware.InvokeAsync(context, auth);

			// assert
			_authorizationServiceMock.Verify(s => s.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), _options.PolicyName), Times.Never);
			_authorizationServiceMock.VerifyNoOtherCalls();

			_authenticationServiceMock.Verify(s => s.ChallengeAsync(It.IsAny<HttpContext>(), It.IsAny<string>(), It.IsAny<AuthenticationProperties>()), Times.Never);
			_authenticationServiceMock.VerifyNoOtherCalls();

			_nextMock.Verify(n => n.Invoke(It.IsAny<HttpContext>()), Times.Once);
			_nextMock.VerifyNoOtherCalls();
		}

		[TestMethod]
		public async Task ShouldValidateAccessFailure()
		{
			// arrange
			var middleware = GetMiddleware();
			var context = GetHttpContext(_options.Path);
			var auth = GetAuthService(false);

			// act
			await middleware.InvokeAsync(context, auth);

			// assert
			_authorizationServiceMock.Verify(s => s.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), _options.PolicyName), Times.Once);
			_authorizationServiceMock.VerifyNoOtherCalls();

			_authenticationServiceMock.Verify(s => s.ChallengeAsync(It.IsAny<HttpContext>(), It.IsAny<string>(), It.IsAny<AuthenticationProperties>()), Times.Once);
			_authenticationServiceMock.VerifyNoOtherCalls();

			_nextMock.Verify(n => n.Invoke(It.IsAny<HttpContext>()), Times.Never);
			_nextMock.VerifyNoOtherCalls();
		}

		private ProtectedPathMiddleware GetMiddleware()
		{
			_nextMock = new Mock<RequestDelegate>();
			return new ProtectedPathMiddleware(_nextMock.Object, _options);
		}

		private HttpContext GetHttpContext(string requestPath)
		{
			var requestMock = new Mock<HttpRequest>();
			requestMock
				.Setup(r => r.Path)
				.Returns(new PathString(requestPath));

			_authenticationServiceMock = new Mock<IAuthenticationService>();

			var requestServicesMock = new Mock<IServiceProvider>();
			requestServicesMock
				.Setup(s => s.GetService(typeof(IAuthenticationService)))
				.Returns(_authenticationServiceMock.Object);

			_httpContextMock = new Mock<HttpContext>();
			_httpContextMock
				.Setup(c => c.Request)
				.Returns(requestMock.Object);
			_httpContextMock
				.Setup(c => c.RequestServices)
				.Returns(requestServicesMock.Object);

			return _httpContextMock.Object;
		}

		private IAuthorizationService GetAuthService(bool success)
		{
			_authorizationServiceMock = new Mock<IAuthorizationService>();
			_authorizationServiceMock
				.Setup(service => service.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), It.IsAny<string>()))
				.ReturnsAsync(() => success ? AuthorizationResult.Success() : AuthorizationResult.Failed());

			return _authorizationServiceMock.Object;
		}
	}
}