SilverLABS/littleshop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

"Royal-Mail-shipping-integration-and-test-improvements"

Browse Source
This commit is contained in:
sysadmin
2025-09-08 03:53:28 +01:00
parent be4d797c6c
commit bcca00ab39
9 changed files with 1002 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

133
LittleShop.Tests/Security/AuthenticationEnforcementTests.cs
View File

@@ -1,5 +1,6 @@
using System.Net;
using System.Net.Http.Headers;
using System.Text;
using FluentAssertions;
using LittleShop.Tests.Infrastructure;
using Microsoft.AspNetCore.Mvc.Testing;
@@ -23,16 +24,26 @@ public class AuthenticationEnforcementTests : IClassFixture<TestWebApplicationFa
[Theory]
[InlineData("/api/catalog/categories")]
[InlineData("/api/catalog/categories/00000000-0000-0000-0000-000000000001")]
[InlineData("/api/catalog/products")]
[InlineData("/api/catalog/products/00000000-0000-0000-0000-000000000001")]
public async Task CatalogEndpoints_WithoutAuthentication_ShouldReturn401(string url)
public async Task CatalogEndpoints_WithoutAuthentication_ShouldReturn200_BecauseTheyArePublic(string url)
{
// Act
var response = await _client.GetAsync(url);
// Assert
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
// Assert - Catalog endpoints are public and don't require authentication
response.StatusCode.Should().Be(HttpStatusCode.OK);
}
[Theory]
[InlineData("/api/catalog/categories/00000000-0000-0000-0000-000000000001")]
[InlineData("/api/catalog/products/00000000-0000-0000-0000-000000000001")]
public async Task CatalogDetailEndpoints_WithInvalidId_ShouldReturn404(string url)
{
// Act
var response = await _client.GetAsync(url);
// Assert - Should return 404 for non-existent items
response.StatusCode.Should().Be(HttpStatusCode.NotFound);
}
[Theory]
@@ -50,35 +61,53 @@ public class AuthenticationEnforcementTests : IClassFixture<TestWebApplicationFa
[Theory]
[InlineData("/api/orders/by-identity/test-identity")]
[InlineData("/api/orders/by-identity/test-identity/00000000-0000-0000-0000-000000000001")]
[InlineData("/api/orders/00000000-0000-0000-0000-000000000001/payments")]
[InlineData("/api/orders/payments/00000000-0000-0000-0000-000000000001/status")]
public async Task PublicOrderEndpoints_WithoutAuthentication_ShouldReturn401(string url)
[InlineData("/api/orders/by-customer/00000000-0000-0000-0000-000000000001")]
[InlineData("/api/orders/by-customer/00000000-0000-0000-0000-000000000001/00000000-0000-0000-0000-000000000001")]
public async Task PublicOrderEndpoints_WithoutAuthentication_ShouldReturn200OrNotFound(string url)
{
// Act
var response = await _client.GetAsync(url);
// Assert
// Assert - These endpoints are public but may return 404 for non-existent data
response.StatusCode.Should().BeOneOf(HttpStatusCode.OK, HttpStatusCode.NotFound);
}
[Theory]
[InlineData("/api/orders/00000000-0000-0000-0000-000000000001/payments")]
[InlineData("/api/orders/payments/00000000-0000-0000-0000-000000000001/status")]
public async Task ProtectedOrderEndpoints_WithoutAuthentication_ShouldReturn401(string url)
{
// Act
var response = await _client.GetAsync(url);
// Assert - These endpoints require authentication
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
[Fact]
public async Task PostOrder_WithoutAuthentication_ShouldReturn401()
public async Task PostOrder_WithoutAuthentication_ShouldReturn400_BecauseItsPublic()
{
// Act
var response = await _client.PostAsync("/api/orders", null);
// Arrange - provide proper content type with empty JSON
var content = new StringContent("{}", Encoding.UTF8, "application/json");
// Assert
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
// Act
var response = await _client.PostAsync("/api/orders", content);
// Assert - Order creation is public but will return BadRequest for invalid data
response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
}
[Fact]
public async Task PostPayment_WithoutAuthentication_ShouldReturn401()
public async Task PostPayment_WithoutAuthentication_ShouldReturn400_BecauseItsPublic()
{
// Act
var response = await _client.PostAsync("/api/orders/00000000-0000-0000-0000-000000000001/payments", null);
// Arrange - provide proper content type with empty JSON
var content = new StringContent("{}", Encoding.UTF8, "application/json");
// Assert
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
// Act
var response = await _client.PostAsync("/api/orders/00000000-0000-0000-0000-000000000001/payments", content);
// Assert - Payment creation is public but will return BadRequest/NotFound for invalid data
response.StatusCode.Should().BeOneOf(HttpStatusCode.BadRequest, HttpStatusCode.NotFound);
}
[Fact]
@@ -87,72 +116,12 @@ public class AuthenticationEnforcementTests : IClassFixture<TestWebApplicationFa
// Act
var response = await _client.PostAsync("/api/orders/payments/webhook", null);
// Assert
// Assert - Webhook endpoint requires authentication
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
[Theory]
[InlineData("/api/catalog/categories")]
[InlineData("/api/catalog/products")]
public async Task CatalogEndpoints_WithValidJwtToken_ShouldReturn200(string url)
{
// Arrange
var token = JwtTokenHelper.GenerateJwtToken();
_client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
// Act
var response = await _client.GetAsync(url);
// Assert
response.StatusCode.Should().Be(HttpStatusCode.OK);
}
[Theory]
[InlineData("/api/catalog/categories")]
[InlineData("/api/catalog/products")]
public async Task CatalogEndpoints_WithExpiredJwtToken_ShouldReturn401(string url)
{
// Arrange
var token = JwtTokenHelper.GenerateExpiredJwtToken();
_client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
// Act
var response = await _client.GetAsync(url);
// Assert
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
[Theory]
[InlineData("/api/catalog/categories")]
[InlineData("/api/catalog/products")]
public async Task CatalogEndpoints_WithInvalidJwtToken_ShouldReturn401(string url)
{
// Arrange
var token = JwtTokenHelper.GenerateInvalidJwtToken();
_client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
// Act
var response = await _client.GetAsync(url);
// Assert
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
[Theory]
[InlineData("/api/catalog/categories")]
[InlineData("/api/catalog/products")]
public async Task CatalogEndpoints_WithMalformedToken_ShouldReturn401(string url)
{
// Arrange
_client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "not-a-valid-jwt-token");
// Act
var response = await _client.GetAsync(url);
// Assert
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
// Catalog endpoints are public, so JWT token tests are not relevant for them
// JWT token validation is tested on protected endpoints below
[Fact]
public async Task AdminEndpoint_WithUserToken_ShouldReturnForbiddenOrUnauthorized()