Files
satellite-provider/SatelliteProvider.IntegrationTests/Program.cs
T
Oleksandr Bezdieniezhnykh f979e18811 [AZ-494] Enable JWT iss/aud validation with fail-fast startup
Option B per user decision: production ships with empty Jwt.Issuer /
Jwt.Audience in appsettings.json so the API process refuses to start
unless JWT_ISSUER + JWT_AUDIENCE env vars are supplied. Development
ships with grep-friendly DEV-ONLY- placeholders so local + docker
flows keep working unchanged.

AuthenticationServiceCollectionExtensions flips ValidateIssuer +
ValidateAudience to true and wires ValidIssuer / ValidAudience via a
new ResolveRequiredOrThrow helper that all three required values
(secret, iss, aud) now share. JwtTokenFactory.Create + CreateExpired
gain optional iss / aud parameters (default null) so existing call
sites compile unchanged. JwtTestHelpers adds MintAuthenticated /
MintExpired wrappers that resolve iss + aud from env, plus
ResolveIssuerOrThrow / ResolveAudienceOrThrow. PerfBootstrap.MintToken
+ Program.cs JWT bootstrap migrated to the new surface so the perf
harness and the integration runner both validate against the same
contract.

Adds 4 fail-fast unit tests (missing/empty issuer + audience), 2
negative integration scenarios (WrongIssuer_Returns401,
WrongAudience_Returns401), and re-tags every existing integration
mint site via MintAuthenticated.

Compose, .env.example, run-tests.sh, run-performance-tests.sh all
load + export JWT_ISSUER + JWT_AUDIENCE alongside JWT_SECRET.

Resolves F-AUTH-2 (security_report.md + owasp_review.md). AC-7
(cross-repo suite/_docs/10_auth.md write) deferred — outside this
workspace; tracked in deploy_cycle2.md R3 follow-up.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-12 02:28:48 +03:00

187 lines
7.2 KiB
C#

using SatelliteProvider.TestSupport;
namespace SatelliteProvider.IntegrationTests;
class Program
{
static async Task<int> Main(string[] args)
{
// AZ-492: perf-harness bootstrap subcommands short-circuit before any
// HTTP / DB setup so they can be invoked from scripts/run-performance-tests.sh
// on a host that only has the .NET SDK installed.
if (args.Length > 0)
{
if (args[0].Equals("--mint-only", StringComparison.OrdinalIgnoreCase))
{
return PerfBootstrap.MintToken();
}
if (args[0].Equals("--gen-uav-fixture", StringComparison.OrdinalIgnoreCase))
{
return PerfBootstrap.GenerateUavFixture(args);
}
}
var apiUrl = Environment.GetEnvironmentVariable("API_URL") ?? "http://api:8080";
var modeEnv = Environment.GetEnvironmentVariable("INTEGRATION_TESTS_MODE")?.Trim().ToLowerInvariant();
var modeArg = args.FirstOrDefault(a => a.Equals("--smoke", StringComparison.OrdinalIgnoreCase) || a.Equals("--full", StringComparison.OrdinalIgnoreCase));
if (modeArg != null)
{
TestRunMode.Smoke = modeArg.Equals("--smoke", StringComparison.OrdinalIgnoreCase);
}
else if (!string.IsNullOrEmpty(modeEnv))
{
TestRunMode.Smoke = modeEnv == "smoke";
}
// AZ-493: opt-out of the startup DB reset so a developer can inspect leftover state.
var keepStateEnv = Environment.GetEnvironmentVariable("INTEGRATION_KEEP_STATE")?.Trim();
var keepState = args.Any(a => a.Equals("--keep-state", StringComparison.OrdinalIgnoreCase))
|| string.Equals(keepStateEnv, "1", StringComparison.Ordinal)
|| string.Equals(keepStateEnv, "true", StringComparison.OrdinalIgnoreCase);
var connectionString = Environment.GetEnvironmentVariable("DB_CONNECTION_STRING")
?? "Host=postgres;Port=5432;Database=satelliteprovider;Username=postgres;Password=postgres";
string jwtSecret;
string jwtIssuer;
string jwtAudience;
try
{
jwtSecret = JwtTestHelpers.ResolveSecretOrThrow();
jwtIssuer = JwtTestHelpers.ResolveIssuerOrThrow();
jwtAudience = JwtTestHelpers.ResolveAudienceOrThrow();
}
catch (InvalidOperationException ex)
{
Console.WriteLine("❌ Integration tests cannot start: JWT configuration is incomplete.");
Console.WriteLine($" {ex.Message}");
return 1;
}
Console.WriteLine("Starting Integration Tests");
Console.WriteLine("=========================");
Console.WriteLine($"API URL : {apiUrl}");
Console.WriteLine($"Mode : {(TestRunMode.Smoke ? "smoke (fast subset, tightened timeouts)" : "full")}");
Console.WriteLine($"State : {(keepState ? "keep (DB reset skipped)" : "reset (clean DB at startup, AZ-493)")}");
Console.WriteLine($"Auth : JWT_SECRET resolved ({System.Text.Encoding.UTF8.GetByteCount(jwtSecret)} bytes); iss={jwtIssuer}; aud={jwtAudience}");
Console.WriteLine();
using var httpClient = new HttpClient
{
BaseAddress = new Uri(apiUrl),
Timeout = TimeSpan.FromMinutes(15)
};
var defaultToken = JwtTestHelpers.MintAuthenticated(jwtSecret);
JwtTestHelpers.AttachDefaultAuthorization(httpClient, defaultToken);
try
{
Console.WriteLine("Waiting for API to be ready...");
await WaitForApiReady(httpClient);
Console.WriteLine("✓ API is ready");
if (keepState)
{
Console.WriteLine("⚠ --keep-state / INTEGRATION_KEEP_STATE set; skipping DB reset (AZ-493)");
}
else
{
try
{
await new IntegrationTestDatabaseReset(connectionString).EnsureCleanStateAsync();
}
catch (InvalidOperationException ex)
{
Console.WriteLine($"❌ DB reset refused: {ex.Message}");
return 1;
}
}
Console.WriteLine();
await JwtIntegrationTests.RunAll(apiUrl, jwtSecret);
await UavUploadTests.RunAll(apiUrl, jwtSecret);
if (TestRunMode.Smoke)
{
await RunSmokeSuite(httpClient);
}
else
{
await RunFullSuite(httpClient);
}
Console.WriteLine();
Console.WriteLine("=========================");
Console.WriteLine("All tests completed successfully!");
return 0;
}
catch (Exception ex)
{
Console.WriteLine();
Console.WriteLine("❌ Integration tests failed");
Console.WriteLine($"Error: {ex.Message}");
Console.WriteLine($"Stack trace: {ex.StackTrace}");
return 1;
}
}
static async Task RunSmokeSuite(HttpClient httpClient)
{
await TileTests.RunGetTileByLatLonTest(httpClient);
await RegionTests.RunRegionProcessingTest_200m_Zoom18(httpClient);
await BasicRouteTests.RunSimpleRouteTest(httpClient);
await ExtendedRouteTests.RunRouteWithTilesZipTest(httpClient);
await SecurityTests.RunAll(httpClient);
await StubAndErrorContractTests.RunAll(httpClient);
await IdempotentPostTests.RunAll(httpClient);
await MigrationTests.RunAll();
}
static async Task RunFullSuite(HttpClient httpClient)
{
await TileTests.RunGetTileByLatLonTest(httpClient);
await RegionTests.RunRegionProcessingTest_200m_Zoom18(httpClient);
await RegionTests.RunRegionProcessingTest_400m_Zoom17(httpClient);
await RegionTests.RunRegionProcessingTest_500m_Zoom18(httpClient);
await BasicRouteTests.RunSimpleRouteTest(httpClient);
await BasicRouteTests.RunRouteWithRegionProcessingAndStitching(httpClient);
await ExtendedRouteTests.RunRouteWithTilesZipTest(httpClient);
await ComplexRouteTests.RunComplexRouteWithStitching(httpClient);
await ComplexRouteTests.RunComplexRouteWithStitchingAndGeofences(httpClient);
await ExtendedRouteTests.RunExtendedRouteEast(httpClient);
await SecurityTests.RunAll(httpClient);
await StubAndErrorContractTests.RunAll(httpClient);
await IdempotentPostTests.RunAll(httpClient);
await MigrationTests.RunAll();
}
static async Task WaitForApiReady(HttpClient httpClient, int maxRetries = 30)
{
for (int i = 0; i < maxRetries; i++)
{
try
{
var response = await httpClient.GetAsync("/");
if (response.IsSuccessStatusCode || response.StatusCode == System.Net.HttpStatusCode.NotFound)
{
return;
}
}
catch
{
}
Console.WriteLine($" Attempt {i + 1}/{maxRetries} - waiting 2 seconds...");
await Task.Delay(2000);
}
throw new Exception("API did not become ready in time");
}
}