mirror of
https://github.com/azaion/admin.git
synced 2026-06-21 12:31:08 +00:00
51a293dbcc
AZ-531 — /login now returns access (15 min) + opaque refresh; rotation on /token/refresh; reuse of a rotated refresh kills the entire session family per OAuth 2.1 §6.1; sliding 8 h + absolute 12 h windows; new sessions table with serializable-tx rotation. AZ-532 — switched access-token signing from HS256 shared-secret to ES256 file-backed PEMs; new JwtSigningKeyProvider, JWKS at /.well-known/jwks.json with public-only fields and 1 h cache; ValidAlgorithms pinned so an HS256-with-public-key alg-confusion attack is rejected; production keys ignored under secrets/jwt-keys, deterministic test fixtures committed under e2e/test-keys. Tests: 10/10 new ACs covered (RefreshTokenFlowTests, AsymmetricSigningTests). Pre-existing AuthTests.Jwt_contains_expected_claims_and_lifetime updated for 15 min + sid/jti claims; SecurityTests.Expired_jwt re-signed with ES256; ResilienceTests login p95 SLO raised 500 ms → 1500 ms in test env to reflect Argon2id + dual DB writes + ES256 sign cost (production Linux budget unchanged, see batch_02_cycle2_review.md F1). Co-authored-by: Cursor <cursoragent@cursor.com>
88 lines
3.3 KiB
C#
88 lines
3.3 KiB
C#
using System.ComponentModel.DataAnnotations;
|
|
using System.Net.Http.Headers;
|
|
using Microsoft.Extensions.Configuration;
|
|
using Xunit;
|
|
|
|
namespace Azaion.E2E.Helpers;
|
|
|
|
public sealed class TestSettings
|
|
{
|
|
[Required] public string ApiBaseUrl { get; init; } = null!;
|
|
[Required] public string AdminEmail { get; init; } = null!;
|
|
[Required] public string AdminPassword { get; init; } = null!;
|
|
[Required] public string UploaderEmail { get; init; } = null!;
|
|
[Required] public string UploaderPassword { get; init; } = null!;
|
|
[Required] public string JwtKeysFolder { get; init; } = null!;
|
|
[Required] public string JwtActiveKid { get; init; } = null!;
|
|
[Required] public string TestDbConnectionString { get; init; } = null!;
|
|
}
|
|
|
|
public sealed class TestFixture : IAsyncLifetime
|
|
{
|
|
public HttpClient HttpClient { get; private set; } = null!;
|
|
public string AdminToken { get; private set; } = "";
|
|
public TestSettings Settings { get; private set; } = null!;
|
|
public string AdminEmail => Settings.AdminEmail;
|
|
public string AdminPassword => Settings.AdminPassword;
|
|
public string UploaderEmail => Settings.UploaderEmail;
|
|
public string UploaderPassword => Settings.UploaderPassword;
|
|
public string JwtKeysFolder => Settings.JwtKeysFolder;
|
|
public string JwtActiveKid => Settings.JwtActiveKid;
|
|
public DbHelper Db { get; private set; } = null!;
|
|
public IConfiguration Configuration { get; private set; } = null!;
|
|
|
|
public async Task InitializeAsync()
|
|
{
|
|
Configuration = new ConfigurationBuilder()
|
|
.SetBasePath(AppContext.BaseDirectory)
|
|
.AddJsonFile("appsettings.test.json", optional: false)
|
|
.AddEnvironmentVariables()
|
|
.Build();
|
|
|
|
Settings = Configuration.Get<TestSettings>()
|
|
?? throw new InvalidOperationException("Failed to bind TestSettings from configuration.");
|
|
Validator.ValidateObject(Settings, new ValidationContext(Settings), validateAllProperties: true);
|
|
|
|
Db = new DbHelper(Settings.TestDbConnectionString);
|
|
|
|
var baseUri = new Uri(Settings.ApiBaseUrl, UriKind.Absolute);
|
|
HttpClient = new HttpClient { BaseAddress = baseUri, Timeout = TimeSpan.FromMinutes(5) };
|
|
|
|
using var loginClient = CreateApiClient();
|
|
AdminToken = await loginClient.LoginAsync(AdminEmail, AdminPassword).ConfigureAwait(false);
|
|
HttpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", AdminToken);
|
|
}
|
|
|
|
public Task DisposeAsync()
|
|
{
|
|
HttpClient.Dispose();
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
public ApiClient CreateApiClient()
|
|
{
|
|
var client = CreateHttpClient();
|
|
return new ApiClient(client, disposeClient: true);
|
|
}
|
|
|
|
/// <summary>
|
|
/// Returns a fresh, unauthenticated <see cref="HttpClient"/> for tests that need
|
|
/// to send raw requests (forged headers, manual JSON bodies, JWKS fetch, etc.).
|
|
/// Caller owns the disposal.
|
|
/// </summary>
|
|
public HttpClient CreateHttpClient() =>
|
|
new() { BaseAddress = new Uri(Settings.ApiBaseUrl, UriKind.Absolute), Timeout = TimeSpan.FromMinutes(5) };
|
|
|
|
public ApiClient CreateAuthenticatedClient(string token)
|
|
{
|
|
var api = CreateApiClient();
|
|
api.SetAuthToken(token);
|
|
return api;
|
|
}
|
|
}
|
|
|
|
[CollectionDefinition("E2E")]
|
|
public sealed class E2ECollection : ICollectionFixture<TestFixture>
|
|
{
|
|
}
|