5100* tests strengthtenen work
This commit is contained in:
StellaOps Bot
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"userId": "jdoe",
|
||||
"displayName": "John Doe",
|
||||
"email": "jdoe@example.com",
|
||||
"distinguishedName": "uid=jdoe,ou=people,dc=example,dc=internal",
|
||||
"groups": [
|
||||
"cn=developers,ou=groups,dc=example,dc=internal",
|
||||
"cn=users,ou=groups,dc=example,dc=internal"
|
||||
],
|
||||
"attributes": {
|
||||
"cn": "John Doe",
|
||||
"sn": "Doe",
|
||||
"givenName": "John",
|
||||
"employeeNumber": "12345",
|
||||
"department": "Engineering"
|
||||
},
|
||||
"valid": true
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
{
|
||||
"userId": "minuser",
|
||||
"displayName": "Minimal User",
|
||||
"email": null,
|
||||
"distinguishedName": "uid=minuser,ou=people,dc=example,dc=internal",
|
||||
"groups": [],
|
||||
"attributes": {
|
||||
"cn": "Minimal User"
|
||||
},
|
||||
"valid": true
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"userId": "multiuser",
|
||||
"displayName": "Multi User",
|
||||
"email": "multi@example.com",
|
||||
"distinguishedName": "uid=multiuser,ou=people,dc=example,dc=internal",
|
||||
"groups": [
|
||||
"cn=admins,ou=groups,dc=example,dc=internal",
|
||||
"cn=developers,ou=groups,dc=example,dc=internal",
|
||||
"cn=on-call,ou=groups,dc=example,dc=internal",
|
||||
"cn=security,ou=groups,dc=example,dc=internal"
|
||||
],
|
||||
"attributes": {
|
||||
"cn": "Multi User",
|
||||
"mail": ["multi@example.com", "multi.user@example.com", "m.user@corp.example.com"],
|
||||
"telephoneNumber": ["+1-555-1234", "+1-555-5678"]
|
||||
},
|
||||
"valid": true
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"userId": "svc-scanner",
|
||||
"displayName": "StellaOps Scanner Service",
|
||||
"email": null,
|
||||
"distinguishedName": "uid=svc-scanner,ou=services,dc=example,dc=internal",
|
||||
"groups": [
|
||||
"cn=scanner-operators,ou=groups,dc=example,dc=internal",
|
||||
"cn=service-accounts,ou=groups,dc=example,dc=internal"
|
||||
],
|
||||
"attributes": {
|
||||
"cn": "Scanner Service Account",
|
||||
"description": "Service account for StellaOps Scanner component"
|
||||
},
|
||||
"valid": true,
|
||||
"isServiceAccount": true
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
{
|
||||
"userId": null,
|
||||
"displayName": null,
|
||||
"email": null,
|
||||
"distinguishedName": null,
|
||||
"groups": [],
|
||||
"attributes": {},
|
||||
"valid": false,
|
||||
"error": "USER_NOT_FOUND"
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"description": "Basic LDAP user search response - single user found with standard attributes",
|
||||
"baseDn": "ou=people,dc=example,dc=internal",
|
||||
"filter": "(&(objectClass=person)(uid=jdoe))",
|
||||
"entry": {
|
||||
"dn": "uid=jdoe,ou=people,dc=example,dc=internal",
|
||||
"attributes": {
|
||||
"uid": ["jdoe"],
|
||||
"cn": ["John Doe"],
|
||||
"sn": ["Doe"],
|
||||
"givenName": ["John"],
|
||||
"mail": ["jdoe@example.com"],
|
||||
"displayName": ["John Doe"],
|
||||
"memberOf": [
|
||||
"cn=developers,ou=groups,dc=example,dc=internal",
|
||||
"cn=users,ou=groups,dc=example,dc=internal"
|
||||
],
|
||||
"employeeNumber": ["12345"],
|
||||
"department": ["Engineering"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"description": "LDAP user with minimal attributes - only required fields",
|
||||
"baseDn": "ou=people,dc=example,dc=internal",
|
||||
"filter": "(&(objectClass=person)(uid=minuser))",
|
||||
"entry": {
|
||||
"dn": "uid=minuser,ou=people,dc=example,dc=internal",
|
||||
"attributes": {
|
||||
"uid": ["minuser"],
|
||||
"cn": ["Minimal User"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"description": "LDAP user with multi-valued attributes",
|
||||
"baseDn": "ou=people,dc=example,dc=internal",
|
||||
"filter": "(&(objectClass=person)(uid=multiuser))",
|
||||
"entry": {
|
||||
"dn": "uid=multiuser,ou=people,dc=example,dc=internal",
|
||||
"attributes": {
|
||||
"uid": ["multiuser"],
|
||||
"cn": ["Multi User"],
|
||||
"displayName": ["Multi User"],
|
||||
"mail": ["multi@example.com", "multi.user@example.com", "m.user@corp.example.com"],
|
||||
"telephoneNumber": ["+1-555-1234", "+1-555-5678"],
|
||||
"memberOf": [
|
||||
"cn=admins,ou=groups,dc=example,dc=internal",
|
||||
"cn=developers,ou=groups,dc=example,dc=internal",
|
||||
"cn=security,ou=groups,dc=example,dc=internal",
|
||||
"cn=on-call,ou=groups,dc=example,dc=internal"
|
||||
],
|
||||
"objectClass": ["top", "person", "organizationalPerson", "inetOrgPerson"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"description": "LDAP service account with elevated permissions",
|
||||
"baseDn": "ou=services,dc=example,dc=internal",
|
||||
"filter": "(&(objectClass=person)(uid=svc-scanner))",
|
||||
"entry": {
|
||||
"dn": "uid=svc-scanner,ou=services,dc=example,dc=internal",
|
||||
"attributes": {
|
||||
"uid": ["svc-scanner"],
|
||||
"cn": ["Scanner Service Account"],
|
||||
"displayName": ["StellaOps Scanner Service"],
|
||||
"description": ["Service account for StellaOps Scanner component"],
|
||||
"memberOf": [
|
||||
"cn=service-accounts,ou=groups,dc=example,dc=internal",
|
||||
"cn=scanner-operators,ou=groups,dc=example,dc=internal"
|
||||
],
|
||||
"userAccountControl": ["512"],
|
||||
"pwdLastSet": ["133454400000000000"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
{
|
||||
"description": "LDAP search returns no matching user",
|
||||
"baseDn": "ou=people,dc=example,dc=internal",
|
||||
"filter": "(&(objectClass=person)(uid=nonexistent))",
|
||||
"entry": null
|
||||
}
|
||||
@@ -0,0 +1,395 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// LdapConnectorResilienceTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-011 - Repeat fixture setup for LDAP connector (Tasks 6-9 pattern)
|
||||
// Description: Resilience tests for LDAP connector - missing fields, invalid formats, malformed data
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using FluentAssertions;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Microsoft.Extensions.Options;
|
||||
using StellaOps.Authority.Plugin.Ldap.Connections;
|
||||
using StellaOps.Authority.Plugin.Ldap.Credentials;
|
||||
using StellaOps.Authority.Plugin.Ldap.Monitoring;
|
||||
using StellaOps.Authority.Plugin.Ldap.Tests.Fakes;
|
||||
using StellaOps.Authority.Plugin.Ldap.Tests.TestHelpers;
|
||||
using StellaOps.Authority.Storage.Documents;
|
||||
using StellaOps.Authority.Storage.InMemory.Stores;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Plugin.Ldap.Tests.Resilience;
|
||||
|
||||
/// <summary>
|
||||
/// Resilience tests for LDAP connector.
|
||||
/// Validates:
|
||||
/// - Missing required attributes are handled gracefully
|
||||
/// - Invalid attribute values don't crash the connector
|
||||
/// - Empty/null responses are handled correctly
|
||||
/// - Connection failures produce proper error codes
|
||||
/// </summary>
|
||||
[Trait("Category", "Resilience")]
|
||||
[Trait("Category", "C1")]
|
||||
[Trait("Category", "LDAP")]
|
||||
public sealed class LdapConnectorResilienceTests
|
||||
{
|
||||
private readonly ITestOutputHelper _output;
|
||||
private readonly TestTimeProvider _timeProvider = new(new DateTimeOffset(2025, 12, 24, 12, 0, 0, TimeSpan.Zero));
|
||||
private readonly TestAirgapAuditStore _auditStore = new();
|
||||
|
||||
public LdapConnectorResilienceTests(ITestOutputHelper output)
|
||||
{
|
||||
_output = output;
|
||||
}
|
||||
|
||||
#region Missing Attributes Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_MissingDisplayName_Succeeds()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateFakeConnection(entry: new LdapSearchEntry(
|
||||
"uid=noname,ou=people,dc=example,dc=internal",
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "noname" }
|
||||
// displayName intentionally missing
|
||||
}));
|
||||
|
||||
var store = CreateStore(options, connection);
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("noname", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeTrue("Missing displayName should not prevent authentication");
|
||||
result.User.Should().NotBeNull();
|
||||
result.User!.DisplayName.Should().BeNull("DisplayName should be null when not present");
|
||||
|
||||
_output.WriteLine("✓ Missing displayName handled gracefully");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_MissingMail_Succeeds()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateFakeConnection(entry: new LdapSearchEntry(
|
||||
"uid=nomail,ou=people,dc=example,dc=internal",
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "nomail" },
|
||||
["displayName"] = new[] { "No Mail User" }
|
||||
// mail intentionally missing
|
||||
}));
|
||||
|
||||
var store = CreateStore(options, connection);
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("nomail", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeTrue("Missing mail should not prevent authentication");
|
||||
|
||||
_output.WriteLine("✓ Missing mail handled gracefully");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_EmptyMemberOf_Succeeds()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateFakeConnection(entry: new LdapSearchEntry(
|
||||
"uid=nogroups,ou=people,dc=example,dc=internal",
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "nogroups" },
|
||||
["displayName"] = new[] { "No Groups User" },
|
||||
["memberOf"] = Array.Empty<string>()
|
||||
}));
|
||||
|
||||
var store = CreateStore(options, connection);
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("nogroups", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeTrue("Empty memberOf should not prevent authentication");
|
||||
|
||||
_output.WriteLine("✓ Empty memberOf handled gracefully");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Invalid Format Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_UserNotFound_ReturnsFailure()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateFakeConnection(entry: null); // User not found
|
||||
|
||||
var store = CreateStore(options, connection);
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("nonexistent", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeFalse("Nonexistent user should fail authentication");
|
||||
result.User.Should().BeNull();
|
||||
|
||||
_output.WriteLine("✓ User not found handled correctly");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_InvalidPassword_ReturnsFailure()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = new FakeLdapConnection();
|
||||
var bindCount = 0;
|
||||
|
||||
connection.OnFindAsync = (baseDn, filter, attributes, ct) =>
|
||||
{
|
||||
return ValueTask.FromResult<LdapSearchEntry?>(new LdapSearchEntry(
|
||||
"uid=user,ou=people,dc=example,dc=internal",
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "user" }
|
||||
}));
|
||||
};
|
||||
|
||||
connection.OnBindAsync = (dn, pwd, ct) =>
|
||||
{
|
||||
bindCount++;
|
||||
if (bindCount == 1)
|
||||
{
|
||||
// Service account bind succeeds
|
||||
return ValueTask.CompletedTask;
|
||||
}
|
||||
// User bind fails
|
||||
throw new InvalidOperationException("Invalid credentials");
|
||||
};
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("user", "WrongPassword!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeFalse("Wrong password should fail authentication");
|
||||
|
||||
_output.WriteLine("✓ Invalid password handled correctly");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_MalformedDn_HandledGracefully()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateFakeConnection(entry: new LdapSearchEntry(
|
||||
"", // Empty/malformed DN
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "malformed" }
|
||||
}));
|
||||
|
||||
var store = CreateStore(options, connection);
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("malformed", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert - should handle gracefully (either succeed with warning or fail cleanly)
|
||||
// The exact behavior depends on implementation
|
||||
_output.WriteLine($"Malformed DN result: Succeeded={result.Succeeded}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Connection Failure Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_ConnectionTimeout_ReturnsError()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = new FakeLdapConnection
|
||||
{
|
||||
OnBindAsync = (dn, pwd, ct) =>
|
||||
throw new TimeoutException("Connection timed out")
|
||||
};
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
Func<Task> act = () => store.VerifyPasswordAsync("user", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
await act.Should().ThrowAsync<TimeoutException>();
|
||||
|
||||
_output.WriteLine("✓ Connection timeout propagates correctly");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_ConnectionRefused_ReturnsError()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = new FakeLdapConnection
|
||||
{
|
||||
OnBindAsync = (dn, pwd, ct) =>
|
||||
throw new InvalidOperationException("Connection refused")
|
||||
};
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
Func<Task> act = () => store.VerifyPasswordAsync("user", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
await act.Should().ThrowAsync<InvalidOperationException>();
|
||||
|
||||
_output.WriteLine("✓ Connection refused propagates correctly");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_Cancellation_RespectsCancellationToken()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = new FakeLdapConnection
|
||||
{
|
||||
OnBindAsync = (dn, pwd, ct) =>
|
||||
{
|
||||
ct.ThrowIfCancellationRequested();
|
||||
return ValueTask.CompletedTask;
|
||||
}
|
||||
};
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
var cts = new CancellationTokenSource();
|
||||
cts.Cancel(); // Pre-cancel
|
||||
|
||||
// Act
|
||||
Func<Task> act = () => store.VerifyPasswordAsync("user", "Password1!", cts.Token);
|
||||
|
||||
// Assert
|
||||
await act.Should().ThrowAsync<OperationCanceledException>();
|
||||
|
||||
_output.WriteLine("✓ Cancellation token respected");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Unicode and Special Characters Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_UnicodeUsername_Handled()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateFakeConnection(entry: new LdapSearchEntry(
|
||||
"uid=münchen-user,ou=people,dc=example,dc=internal",
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "münchen-user" },
|
||||
["displayName"] = new[] { "Münchener Benutzer" },
|
||||
["mail"] = new[] { "münchen@example.com" }
|
||||
}));
|
||||
|
||||
var store = CreateStore(options, connection);
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("münchen-user", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeTrue("Unicode username should be handled");
|
||||
result.User.Should().NotBeNull();
|
||||
result.User!.DisplayName.Should().Be("Münchener Benutzer");
|
||||
|
||||
_output.WriteLine("✓ Unicode characters handled correctly");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_SpecialCharactersInDn_Handled()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateFakeConnection(entry: new LdapSearchEntry(
|
||||
"uid=user\\+test,ou=people,dc=example,dc=internal", // Escaped + character
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "user+test" },
|
||||
["displayName"] = new[] { "User Plus Test" }
|
||||
}));
|
||||
|
||||
var store = CreateStore(options, connection);
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("user+test", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeTrue("Special characters in DN should be handled");
|
||||
|
||||
_output.WriteLine("✓ Special characters in DN handled correctly");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Helper Methods
|
||||
|
||||
private static LdapPluginOptions CreateBaseOptions() => new()
|
||||
{
|
||||
Connection = new LdapConnectionOptions
|
||||
{
|
||||
Host = "ldaps://ldap.internal",
|
||||
BindDn = "cn=service,dc=example,dc=internal",
|
||||
BindPasswordSecret = "service-secret",
|
||||
SearchBase = "ou=people,dc=example,dc=internal",
|
||||
UsernameAttribute = "uid"
|
||||
},
|
||||
Queries = new LdapQueryOptions
|
||||
{
|
||||
UserFilter = "(&(objectClass=person)(uid={username}))"
|
||||
}
|
||||
};
|
||||
|
||||
private FakeLdapConnection CreateFakeConnection(LdapSearchEntry? entry)
|
||||
{
|
||||
var connection = new FakeLdapConnection();
|
||||
connection.OnFindAsync = (baseDn, filter, attributes, ct) =>
|
||||
ValueTask.FromResult(entry);
|
||||
connection.OnBindAsync = (dn, pwd, ct) => ValueTask.CompletedTask;
|
||||
return connection;
|
||||
}
|
||||
|
||||
private LdapCredentialStore CreateStore(LdapPluginOptions options, FakeLdapConnection connection)
|
||||
=> CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
private LdapCredentialStore CreateStore(LdapPluginOptions options, ILdapConnectionFactory connectionFactory)
|
||||
{
|
||||
var monitor = new StaticOptionsMonitor(options);
|
||||
var userStore = new InMemoryUserStore(_timeProvider);
|
||||
var sessionStore = new InMemorySessionStore(_timeProvider);
|
||||
var claimsCache = new FakeLdapClaimsCache();
|
||||
|
||||
return new LdapCredentialStore(
|
||||
"corp-ldap",
|
||||
monitor,
|
||||
connectionFactory,
|
||||
userStore,
|
||||
sessionStore,
|
||||
_auditStore,
|
||||
claimsCache,
|
||||
_timeProvider,
|
||||
NullLoggerFactory.Instance);
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,375 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// LdapConnectorSecurityTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-011 - Repeat fixture setup for LDAP connector (Tasks 6-9 pattern)
|
||||
// Description: Security tests for LDAP connector - injection prevention, credential handling
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using FluentAssertions;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using StellaOps.Authority.Plugin.Ldap.Connections;
|
||||
using StellaOps.Authority.Plugin.Ldap.Credentials;
|
||||
using StellaOps.Authority.Plugin.Ldap.Tests.Fakes;
|
||||
using StellaOps.Authority.Plugin.Ldap.Tests.TestHelpers;
|
||||
using StellaOps.Authority.Storage.InMemory.Stores;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Plugin.Ldap.Tests.Security;
|
||||
|
||||
/// <summary>
|
||||
/// Security tests for LDAP connector.
|
||||
/// Validates:
|
||||
/// - LDAP injection attacks are prevented
|
||||
/// - Credential handling is secure
|
||||
/// - Bind DN validation prevents unauthorized access
|
||||
/// - TLS/SSL requirements are enforced
|
||||
/// </summary>
|
||||
[Trait("Category", "Security")]
|
||||
[Trait("Category", "C1")]
|
||||
[Trait("Category", "LDAP")]
|
||||
public sealed class LdapConnectorSecurityTests
|
||||
{
|
||||
private readonly ITestOutputHelper _output;
|
||||
private readonly TestTimeProvider _timeProvider = new(new DateTimeOffset(2025, 12, 24, 12, 0, 0, TimeSpan.Zero));
|
||||
private readonly TestAirgapAuditStore _auditStore = new();
|
||||
|
||||
public LdapConnectorSecurityTests(ITestOutputHelper output)
|
||||
{
|
||||
_output = output;
|
||||
}
|
||||
|
||||
#region LDAP Injection Prevention Tests
|
||||
|
||||
[Theory]
|
||||
[InlineData("admin*")]
|
||||
[InlineData("admin)(uid=*)")]
|
||||
[InlineData("*)(objectClass=*")]
|
||||
[InlineData("admin\\00")]
|
||||
[InlineData("admin)(|(uid=*")]
|
||||
public async Task VerifyPassword_LdapInjectionAttempt_IsEscaped(string maliciousUsername)
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var capturedFilters = new List<string>();
|
||||
|
||||
var connection = new FakeLdapConnection();
|
||||
connection.OnBindAsync = (dn, pwd, ct) => ValueTask.CompletedTask;
|
||||
connection.OnFindAsync = (baseDn, filter, attributes, ct) =>
|
||||
{
|
||||
capturedFilters.Add(filter);
|
||||
// Return null - user not found (the important thing is the filter is escaped)
|
||||
return ValueTask.FromResult<LdapSearchEntry?>(null);
|
||||
};
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync(maliciousUsername, "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeFalse("Injection attempt should fail");
|
||||
|
||||
// Verify the filter doesn't contain unescaped injection characters
|
||||
if (capturedFilters.Count > 0)
|
||||
{
|
||||
var filter = capturedFilters[0];
|
||||
// The raw injection characters should be escaped
|
||||
filter.Should().NotContain(")(", "Filter should escape parentheses");
|
||||
filter.Should().NotContain("*)(", "Filter should not allow wildcard injection");
|
||||
_output.WriteLine($"Filter: {filter}");
|
||||
}
|
||||
|
||||
_output.WriteLine($"✓ LDAP injection prevented for: {maliciousUsername}");
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("")]
|
||||
[InlineData(" ")]
|
||||
[InlineData("\t\n")]
|
||||
public async Task VerifyPassword_EmptyUsername_Rejected(string emptyUsername)
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = new FakeLdapConnection();
|
||||
connection.OnBindAsync = (dn, pwd, ct) => ValueTask.CompletedTask;
|
||||
connection.OnFindAsync = (baseDn, filter, attributes, ct) =>
|
||||
ValueTask.FromResult<LdapSearchEntry?>(null);
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync(emptyUsername, "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeFalse("Empty username should be rejected");
|
||||
|
||||
_output.WriteLine("✓ Empty username rejected");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_NullPassword_Rejected()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateSuccessfulConnection();
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("user", null!, CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeFalse("Null password should be rejected");
|
||||
|
||||
_output.WriteLine("✓ Null password rejected");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_EmptyPassword_Rejected()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateSuccessfulConnection();
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("user", "", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
result.Succeeded.Should().BeFalse("Empty password should be rejected");
|
||||
|
||||
_output.WriteLine("✓ Empty password rejected");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Bind DN Security Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_ServiceAccountBindFails_ReturnsError()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = new FakeLdapConnection
|
||||
{
|
||||
OnBindAsync = (dn, pwd, ct) =>
|
||||
{
|
||||
if (dn == options.Connection.BindDn)
|
||||
{
|
||||
throw new InvalidOperationException("Service account bind failed");
|
||||
}
|
||||
return ValueTask.CompletedTask;
|
||||
}
|
||||
};
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
Func<Task> act = () => store.VerifyPasswordAsync("user", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
await act.Should().ThrowAsync<InvalidOperationException>();
|
||||
|
||||
_output.WriteLine("✓ Service account bind failure handled");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_UserBindsWithOwnDn_NotServiceDn()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var bindDns = new List<string>();
|
||||
|
||||
var connection = new FakeLdapConnection();
|
||||
connection.OnBindAsync = (dn, pwd, ct) =>
|
||||
{
|
||||
bindDns.Add(dn);
|
||||
return ValueTask.CompletedTask;
|
||||
};
|
||||
connection.OnFindAsync = (baseDn, filter, attributes, ct) =>
|
||||
ValueTask.FromResult<LdapSearchEntry?>(new LdapSearchEntry(
|
||||
"uid=targetuser,ou=people,dc=example,dc=internal",
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "targetuser" }
|
||||
}));
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
await store.VerifyPasswordAsync("targetuser", "Password1!", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
bindDns.Should().HaveCountGreaterThanOrEqualTo(2, "Should bind as service then as user");
|
||||
bindDns[0].Should().Be(options.Connection.BindDn, "First bind should be service account");
|
||||
bindDns[1].Should().Contain("targetuser", "Second bind should be user's DN");
|
||||
|
||||
_output.WriteLine($"Bind sequence: {string.Join(" -> ", bindDns)}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region TLS/SSL Security Tests
|
||||
|
||||
[Fact]
|
||||
public void Options_NonLdapsHost_WithoutStartTls_ShouldWarn()
|
||||
{
|
||||
// Arrange
|
||||
var options = new LdapPluginOptions
|
||||
{
|
||||
Connection = new LdapConnectionOptions
|
||||
{
|
||||
Host = "ldap://ldap.internal", // Non-secure
|
||||
BindDn = "cn=service,dc=example,dc=internal",
|
||||
BindPasswordSecret = "secret",
|
||||
UserDnFormat = "uid={username},ou=people,dc=example,dc=internal",
|
||||
TrustStore = new LdapTrustStoreOptions { Mode = LdapTrustStoreMode.None }
|
||||
}
|
||||
};
|
||||
|
||||
// Act & Assert - should validate but with security warning
|
||||
// (Actual enforcement depends on implementation)
|
||||
var act = () => options.Validate("corp-ldap");
|
||||
|
||||
// The connector should accept non-TLS but ideally log a warning
|
||||
// This test documents the security expectation
|
||||
_output.WriteLine("⚠ Non-LDAPS without StartTLS - security risk");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Options_LdapsHost_IsAccepted()
|
||||
{
|
||||
// Arrange
|
||||
var options = new LdapPluginOptions
|
||||
{
|
||||
Connection = new LdapConnectionOptions
|
||||
{
|
||||
Host = "ldaps://ldap.internal:636",
|
||||
BindDn = "cn=service,dc=example,dc=internal",
|
||||
BindPasswordSecret = "secret",
|
||||
UserDnFormat = "uid={username},ou=people,dc=example,dc=internal"
|
||||
}
|
||||
};
|
||||
|
||||
// Act
|
||||
var act = () => options.Validate("corp-ldap");
|
||||
|
||||
// Assert
|
||||
act.Should().NotThrow("LDAPS connection should be accepted");
|
||||
|
||||
_output.WriteLine("✓ LDAPS host accepted");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Credential Exposure Prevention Tests
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_PasswordNotLoggedOnFailure()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = new FakeLdapConnection
|
||||
{
|
||||
OnBindAsync = (dn, pwd, ct) =>
|
||||
{
|
||||
// Simulate logging - password should never appear
|
||||
var logMessage = $"Bind failed for DN: {dn}";
|
||||
logMessage.Should().NotContain(pwd, "Password should not be in log messages");
|
||||
throw new InvalidOperationException("Invalid credentials");
|
||||
}
|
||||
};
|
||||
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
try
|
||||
{
|
||||
await store.VerifyPasswordAsync("user", "SuperSecret123!", CancellationToken.None);
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Expected
|
||||
}
|
||||
|
||||
_output.WriteLine("✓ Password not exposed in error handling");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task VerifyPassword_ResultDoesNotContainPassword()
|
||||
{
|
||||
// Arrange
|
||||
var options = CreateBaseOptions();
|
||||
var connection = CreateSuccessfulConnection();
|
||||
var store = CreateStore(options, new FakeLdapConnectionFactory(connection));
|
||||
|
||||
// Act
|
||||
var result = await store.VerifyPasswordAsync("user", "MyPassword123", CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
var resultString = result.ToString();
|
||||
resultString.Should().NotContain("MyPassword123", "Password should not appear in result");
|
||||
|
||||
_output.WriteLine("✓ Password not exposed in result");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Helper Methods
|
||||
|
||||
private static LdapPluginOptions CreateBaseOptions() => new()
|
||||
{
|
||||
Connection = new LdapConnectionOptions
|
||||
{
|
||||
Host = "ldaps://ldap.internal",
|
||||
BindDn = "cn=service,dc=example,dc=internal",
|
||||
BindPasswordSecret = "service-secret",
|
||||
SearchBase = "ou=people,dc=example,dc=internal",
|
||||
UsernameAttribute = "uid"
|
||||
},
|
||||
Queries = new LdapQueryOptions
|
||||
{
|
||||
UserFilter = "(&(objectClass=person)(uid={username}))"
|
||||
}
|
||||
};
|
||||
|
||||
private static FakeLdapConnection CreateSuccessfulConnection()
|
||||
{
|
||||
var connection = new FakeLdapConnection();
|
||||
connection.OnBindAsync = (dn, pwd, ct) => ValueTask.CompletedTask;
|
||||
connection.OnFindAsync = (baseDn, filter, attributes, ct) =>
|
||||
ValueTask.FromResult<LdapSearchEntry?>(new LdapSearchEntry(
|
||||
"uid=user,ou=people,dc=example,dc=internal",
|
||||
new Dictionary<string, IReadOnlyList<string>>
|
||||
{
|
||||
["uid"] = new[] { "user" },
|
||||
["displayName"] = new[] { "Test User" }
|
||||
}));
|
||||
return connection;
|
||||
}
|
||||
|
||||
private LdapCredentialStore CreateStore(LdapPluginOptions options, ILdapConnectionFactory connectionFactory)
|
||||
{
|
||||
var monitor = new StaticOptionsMonitor(options);
|
||||
var userStore = new InMemoryUserStore(_timeProvider);
|
||||
var sessionStore = new InMemorySessionStore(_timeProvider);
|
||||
var claimsCache = new FakeLdapClaimsCache();
|
||||
|
||||
return new LdapCredentialStore(
|
||||
"corp-ldap",
|
||||
monitor,
|
||||
connectionFactory,
|
||||
userStore,
|
||||
sessionStore,
|
||||
_auditStore,
|
||||
claimsCache,
|
||||
_timeProvider,
|
||||
NullLoggerFactory.Instance);
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,254 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// LdapConnectorSnapshotTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-011 - Repeat fixture setup for LDAP connector (Tasks 6-9 pattern)
|
||||
// Description: Fixture-based snapshot tests for LDAP connector parsing and normalization
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IO;
|
||||
using System.Linq;
|
||||
using System.Text.Json;
|
||||
using System.Text.Json.Serialization;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using FluentAssertions;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Microsoft.Extensions.Options;
|
||||
using StellaOps.Authority.Plugin.Ldap.Connections;
|
||||
using StellaOps.Authority.Plugin.Ldap.Credentials;
|
||||
using StellaOps.Authority.Plugin.Ldap.Tests.Fakes;
|
||||
using StellaOps.Authority.Plugin.Ldap.Tests.TestHelpers;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Plugin.Ldap.Tests.Snapshots;
|
||||
|
||||
/// <summary>
|
||||
/// Fixture-based snapshot tests for LDAP connector.
|
||||
/// Validates:
|
||||
/// - LDAP search responses are parsed correctly
|
||||
/// - User attributes are normalized to canonical format
|
||||
/// - Multi-valued attributes are handled correctly
|
||||
/// - Group memberships are extracted
|
||||
/// - Missing attributes gracefully handled
|
||||
/// </summary>
|
||||
[Trait("Category", "Snapshot")]
|
||||
[Trait("Category", "C1")]
|
||||
[Trait("Category", "LDAP")]
|
||||
public sealed class LdapConnectorSnapshotTests
|
||||
{
|
||||
private readonly ITestOutputHelper _output;
|
||||
private static readonly string FixturesPath = Path.Combine(AppContext.BaseDirectory, "Fixtures", "ldap");
|
||||
private static readonly string ExpectedPath = Path.Combine(AppContext.BaseDirectory, "Expected", "ldap");
|
||||
|
||||
private static readonly JsonSerializerOptions JsonOptions = new()
|
||||
{
|
||||
WriteIndented = true,
|
||||
PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
|
||||
DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
|
||||
};
|
||||
|
||||
public LdapConnectorSnapshotTests(ITestOutputHelper output)
|
||||
{
|
||||
_output = output;
|
||||
}
|
||||
|
||||
#region Fixture Discovery
|
||||
|
||||
public static IEnumerable<object[]> LdapFixtures()
|
||||
{
|
||||
var fixturesDir = Path.Combine(AppContext.BaseDirectory, "Fixtures", "ldap");
|
||||
if (!Directory.Exists(fixturesDir))
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
|
||||
foreach (var file in Directory.EnumerateFiles(fixturesDir, "*.json"))
|
||||
{
|
||||
yield return new object[] { Path.GetFileNameWithoutExtension(file) };
|
||||
}
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Snapshot Tests
|
||||
|
||||
[Theory]
|
||||
[MemberData(nameof(LdapFixtures))]
|
||||
public async Task ParseFixture_MatchesExpectedSnapshot(string fixtureName)
|
||||
{
|
||||
// Arrange
|
||||
var fixturePath = Path.Combine(FixturesPath, $"{fixtureName}.json");
|
||||
var expectedPath = Path.Combine(ExpectedPath, $"{fixtureName}.canonical.json");
|
||||
|
||||
var fixtureContent = await File.ReadAllTextAsync(fixturePath);
|
||||
var fixture = JsonSerializer.Deserialize<LdapFixture>(fixtureContent, JsonOptions);
|
||||
fixture.Should().NotBeNull($"Failed to deserialize fixture {fixtureName}");
|
||||
|
||||
var expectedContent = await File.ReadAllTextAsync(expectedPath);
|
||||
var expected = JsonSerializer.Deserialize<LdapUserCanonical>(expectedContent, JsonOptions);
|
||||
|
||||
// Act
|
||||
var actual = ParseLdapEntry(fixture!);
|
||||
|
||||
// Assert
|
||||
var actualJson = JsonSerializer.Serialize(actual, JsonOptions);
|
||||
var expectedJson = JsonSerializer.Serialize(expected, JsonOptions);
|
||||
|
||||
if (ShouldUpdateSnapshots())
|
||||
{
|
||||
await File.WriteAllTextAsync(expectedPath, actualJson);
|
||||
_output.WriteLine($"Updated snapshot: {expectedPath}");
|
||||
return;
|
||||
}
|
||||
|
||||
actualJson.Should().Be(expectedJson, $"Fixture {fixtureName} did not match expected snapshot");
|
||||
_output.WriteLine($"✓ Fixture {fixtureName} matches snapshot");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task AllFixtures_HaveMatchingExpectedFiles()
|
||||
{
|
||||
// Arrange
|
||||
var fixtureFiles = Directory.Exists(FixturesPath)
|
||||
? Directory.EnumerateFiles(FixturesPath, "*.json").Select(Path.GetFileNameWithoutExtension).ToList()
|
||||
: new List<string>();
|
||||
|
||||
var expectedFiles = Directory.Exists(ExpectedPath)
|
||||
? Directory.EnumerateFiles(ExpectedPath, "*.canonical.json")
|
||||
.Select(f => Path.GetFileNameWithoutExtension(f).Replace(".canonical", ""))
|
||||
.ToList()
|
||||
: new List<string>();
|
||||
|
||||
// Assert
|
||||
foreach (var fixture in fixtureFiles)
|
||||
{
|
||||
expectedFiles.Should().Contain(fixture,
|
||||
$"Fixture '{fixture}' is missing expected output file at Expected/ldap/{fixture}.canonical.json");
|
||||
}
|
||||
|
||||
_output.WriteLine($"Verified {fixtureFiles.Count} fixtures have matching expected files");
|
||||
await Task.CompletedTask;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Parser Logic (Simulates LDAP connector behavior)
|
||||
|
||||
private static LdapUserCanonical ParseLdapEntry(LdapFixture fixture)
|
||||
{
|
||||
if (fixture.Entry == null)
|
||||
{
|
||||
return new LdapUserCanonical
|
||||
{
|
||||
UserId = null,
|
||||
DisplayName = null,
|
||||
Email = null,
|
||||
DistinguishedName = null,
|
||||
Groups = new List<string>(),
|
||||
Attributes = new Dictionary<string, object>(),
|
||||
Valid = false,
|
||||
Error = "USER_NOT_FOUND"
|
||||
};
|
||||
}
|
||||
|
||||
var attrs = fixture.Entry.Attributes;
|
||||
|
||||
// Extract standard fields
|
||||
var userId = GetFirstValue(attrs, "uid");
|
||||
var displayName = GetFirstValue(attrs, "displayName") ?? GetFirstValue(attrs, "cn");
|
||||
var email = GetFirstValue(attrs, "mail");
|
||||
var groups = GetValues(attrs, "memberOf")?.OrderBy(g => g).ToList() ?? new List<string>();
|
||||
|
||||
// Build custom attributes (exclude standard fields)
|
||||
var standardKeys = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
|
||||
{
|
||||
"uid", "displayName", "mail", "memberOf", "objectClass", "userAccountControl", "pwdLastSet"
|
||||
};
|
||||
|
||||
var customAttrs = new Dictionary<string, object>();
|
||||
foreach (var (key, values) in attrs)
|
||||
{
|
||||
if (standardKeys.Contains(key)) continue;
|
||||
if (values.Count == 1)
|
||||
{
|
||||
customAttrs[key] = values[0];
|
||||
}
|
||||
else if (values.Count > 1)
|
||||
{
|
||||
customAttrs[key] = values;
|
||||
}
|
||||
}
|
||||
|
||||
// Detect service account
|
||||
var isServiceAccount = fixture.Entry.Dn.Contains(",ou=services,", StringComparison.OrdinalIgnoreCase);
|
||||
|
||||
var result = new LdapUserCanonical
|
||||
{
|
||||
UserId = userId,
|
||||
DisplayName = displayName,
|
||||
Email = email,
|
||||
DistinguishedName = fixture.Entry.Dn,
|
||||
Groups = groups,
|
||||
Attributes = customAttrs,
|
||||
Valid = true
|
||||
};
|
||||
|
||||
if (isServiceAccount)
|
||||
{
|
||||
result.IsServiceAccount = true;
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
private static string? GetFirstValue(Dictionary<string, List<string>> attrs, string key)
|
||||
{
|
||||
return attrs.TryGetValue(key, out var values) && values.Count > 0 ? values[0] : null;
|
||||
}
|
||||
|
||||
private static List<string>? GetValues(Dictionary<string, List<string>> attrs, string key)
|
||||
{
|
||||
return attrs.TryGetValue(key, out var values) ? values : null;
|
||||
}
|
||||
|
||||
private static bool ShouldUpdateSnapshots()
|
||||
{
|
||||
return Environment.GetEnvironmentVariable("UPDATE_LDAP_SNAPSHOTS") == "1";
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Fixture Models
|
||||
|
||||
private sealed class LdapFixture
|
||||
{
|
||||
public string? Description { get; set; }
|
||||
public string? BaseDn { get; set; }
|
||||
public string? Filter { get; set; }
|
||||
public LdapEntry? Entry { get; set; }
|
||||
}
|
||||
|
||||
private sealed class LdapEntry
|
||||
{
|
||||
public string Dn { get; set; } = string.Empty;
|
||||
public Dictionary<string, List<string>> Attributes { get; set; } = new();
|
||||
}
|
||||
|
||||
private sealed class LdapUserCanonical
|
||||
{
|
||||
public string? UserId { get; set; }
|
||||
public string? DisplayName { get; set; }
|
||||
public string? Email { get; set; }
|
||||
public string? DistinguishedName { get; set; }
|
||||
public List<string> Groups { get; set; } = new();
|
||||
public Dictionary<string, object> Attributes { get; set; } = new();
|
||||
public bool Valid { get; set; }
|
||||
public string? Error { get; set; }
|
||||
public bool? IsServiceAccount { get; set; }
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,377 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// AuthorityAuthBypassTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-013 - Add auth tests: test auth bypass attempts
|
||||
// Description: Security tests for authentication bypass prevention
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.IdentityModel.Tokens.Jwt;
|
||||
using System.Net;
|
||||
using System.Net.Http;
|
||||
using System.Net.Http.Headers;
|
||||
using System.Security.Claims;
|
||||
using System.Text;
|
||||
using System.Threading.Tasks;
|
||||
using FluentAssertions;
|
||||
using Microsoft.IdentityModel.Tokens;
|
||||
using StellaOps.Authority.Tests.Infrastructure;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Tests.Auth;
|
||||
|
||||
/// <summary>
|
||||
/// Authentication bypass prevention tests for Authority WebService.
|
||||
/// Validates:
|
||||
/// - Missing token requests are rejected
|
||||
/// - Invalid signature tokens are rejected
|
||||
/// - Expired tokens are rejected
|
||||
/// - Malformed tokens are rejected
|
||||
/// - Algorithm confusion attacks are prevented
|
||||
/// </summary>
|
||||
[Trait("Category", "Auth")]
|
||||
[Trait("Category", "Security")]
|
||||
[Trait("Category", "W1")]
|
||||
public sealed class AuthorityAuthBypassTests : IClassFixture<AuthorityWebApplicationFactory>
|
||||
{
|
||||
private readonly AuthorityWebApplicationFactory _factory;
|
||||
private readonly ITestOutputHelper _output;
|
||||
|
||||
public AuthorityAuthBypassTests(AuthorityWebApplicationFactory factory, ITestOutputHelper output)
|
||||
{
|
||||
_factory = factory;
|
||||
_output = output;
|
||||
}
|
||||
|
||||
#region Missing Token Tests
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_NoToken_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
// No Authorization header set
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ No token: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_EmptyAuthHeader_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "");
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Empty auth header: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_MalformedBearer_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
client.DefaultRequestHeaders.Add("Authorization", "Bearer"); // Missing token value
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Malformed bearer: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Invalid Token Tests
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_RandomString_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "totally-not-a-valid-token");
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Random string token: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_Base64Garbage_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var garbage = Convert.ToBase64String(Encoding.UTF8.GetBytes("not.a.jwt.token.at.all"));
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", garbage);
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Base64 garbage: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_TruncatedJwt_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
// JWT with only header.payload (missing signature)
|
||||
var truncated = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ";
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", truncated);
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Truncated JWT: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Invalid Signature Tests
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_WrongSignature_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Create a JWT signed with a random key (not the server's key)
|
||||
var randomKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("this-is-not-the-correct-key-32bytes!"));
|
||||
var credentials = new SigningCredentials(randomKey, SecurityAlgorithms.HmacSha256);
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: credentials);
|
||||
|
||||
var tokenString = new JwtSecurityTokenHandler().WriteToken(token);
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", tokenString);
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Wrong signature: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_ModifiedPayload_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Take a valid-looking JWT structure but modify the payload
|
||||
var header = Convert.ToBase64String(Encoding.UTF8.GetBytes("{\"alg\":\"HS256\",\"typ\":\"JWT\"}"));
|
||||
var payload = Convert.ToBase64String(Encoding.UTF8.GetBytes("{\"sub\":\"admin\",\"role\":\"superuser\"}"));
|
||||
var signature = "tampered-signature";
|
||||
|
||||
var tamperedToken = $"{header}.{payload}.{signature}";
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", tamperedToken);
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Modified payload: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Expired Token Tests
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_ExpiredToken_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Create an expired JWT
|
||||
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("test-key-for-expired-token-32bytes!"));
|
||||
var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
expires: DateTime.UtcNow.AddHours(-1), // Expired 1 hour ago
|
||||
signingCredentials: credentials);
|
||||
|
||||
var tokenString = new JwtSecurityTokenHandler().WriteToken(token);
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", tokenString);
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Expired token: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_FutureNotBefore_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Create a JWT with notBefore in the future
|
||||
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("test-key-for-future-nbf-32bytes!"));
|
||||
var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenDescriptor = new SecurityTokenDescriptor
|
||||
{
|
||||
Issuer = "https://authority.test",
|
||||
Audience = "stellaops",
|
||||
Subject = new ClaimsIdentity(new[] { new Claim("sub", "test-user") }),
|
||||
NotBefore = DateTime.UtcNow.AddHours(1), // Not valid for another hour
|
||||
Expires = DateTime.UtcNow.AddHours(2),
|
||||
SigningCredentials = credentials
|
||||
};
|
||||
|
||||
var token = handler.CreateToken(tokenDescriptor);
|
||||
var tokenString = handler.WriteToken(token);
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", tokenString);
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Future nbf: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Algorithm Confusion Tests
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_AlgNone_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Create a JWT with alg:none (algorithm confusion attack)
|
||||
var header = Convert.ToBase64String(Encoding.UTF8.GetBytes("{\"alg\":\"none\",\"typ\":\"JWT\"}"))
|
||||
.TrimEnd('=').Replace('+', '-').Replace('/', '_');
|
||||
var payload = Convert.ToBase64String(Encoding.UTF8.GetBytes("{\"sub\":\"admin\",\"iss\":\"https://authority.test\"}"))
|
||||
.TrimEnd('=').Replace('+', '-').Replace('/', '_');
|
||||
|
||||
var unsecuredToken = $"{header}.{payload}."; // Empty signature
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", unsecuredToken);
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Alg:none attack prevented: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Wrong Scheme Tests
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_BasicAuth_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes("admin:password"));
|
||||
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", credentials);
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Basic auth rejected: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ProtectedEndpoint_DigestAuth_Returns401()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
client.DefaultRequestHeaders.Add("Authorization", "Digest username=\"admin\"");
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/me");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Digest auth rejected: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Public Endpoint Tests
|
||||
|
||||
[Fact]
|
||||
public async Task PublicEndpoint_OpenApi_NoAuthRequired()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
// No auth header
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openapi");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.OK, "OpenAPI endpoint should be public");
|
||||
|
||||
_output.WriteLine("✓ OpenAPI endpoint is public");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task PublicEndpoint_OpenIdConfig_NoAuthRequired()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
// No auth header
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openid-configuration");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.OK, "OpenID discovery should be public");
|
||||
|
||||
_output.WriteLine("✓ OpenID discovery endpoint is public");
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,357 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// AuthorityContractSnapshotTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-012 - Add contract tests for Authority.WebService endpoints
|
||||
// Description: OpenAPI contract snapshot tests for Authority WebService
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Net;
|
||||
using System.Net.Http;
|
||||
using System.Net.Http.Json;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
using System.Threading.Tasks;
|
||||
using FluentAssertions;
|
||||
using StellaOps.Authority.Tests.Infrastructure;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Tests.Contract;
|
||||
|
||||
/// <summary>
|
||||
/// Contract snapshot tests for Authority WebService.
|
||||
/// Validates:
|
||||
/// - OpenAPI specification structure and stability
|
||||
/// - Token endpoint contracts
|
||||
/// - User management endpoint contracts
|
||||
/// - Schema consistency across versions
|
||||
/// </summary>
|
||||
[Trait("Category", "Contract")]
|
||||
[Trait("Category", "W1")]
|
||||
[Trait("Category", "Snapshot")]
|
||||
public sealed class AuthorityContractSnapshotTests : IClassFixture<AuthorityWebApplicationFactory>
|
||||
{
|
||||
private readonly AuthorityWebApplicationFactory _factory;
|
||||
private readonly ITestOutputHelper _output;
|
||||
private static readonly string SnapshotsPath = Path.Combine(AppContext.BaseDirectory, "Snapshots", "Contract");
|
||||
|
||||
private static readonly JsonSerializerOptions JsonOptions = new()
|
||||
{
|
||||
WriteIndented = true,
|
||||
PropertyNamingPolicy = JsonNamingPolicy.CamelCase
|
||||
};
|
||||
|
||||
public AuthorityContractSnapshotTests(AuthorityWebApplicationFactory factory, ITestOutputHelper output)
|
||||
{
|
||||
_factory = factory;
|
||||
_output = output;
|
||||
}
|
||||
|
||||
#region OpenAPI Specification Tests
|
||||
|
||||
[Fact]
|
||||
public async Task OpenApiSpec_ContainsTokenEndpoints()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openapi");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.OK);
|
||||
|
||||
var content = await response.Content.ReadAsStringAsync();
|
||||
using var doc = JsonDocument.Parse(content);
|
||||
var paths = doc.RootElement.GetProperty("paths");
|
||||
|
||||
// Token endpoints should exist
|
||||
paths.TryGetProperty("/connect/token", out _).Should().BeTrue("Token endpoint should exist");
|
||||
|
||||
_output.WriteLine("✓ Token endpoints present in OpenAPI spec");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task OpenApiSpec_ContainsAuthoritySecuritySchemes()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openapi");
|
||||
var content = await response.Content.ReadAsStringAsync();
|
||||
using var doc = JsonDocument.Parse(content);
|
||||
|
||||
// Assert
|
||||
doc.RootElement.TryGetProperty("components", out var components).Should().BeTrue();
|
||||
components.TryGetProperty("securitySchemes", out var schemes).Should().BeTrue();
|
||||
|
||||
// OAuth2/OpenID Connect security scheme should exist
|
||||
var hasOAuth = schemes.TryGetProperty("oauth2", out _) ||
|
||||
schemes.TryGetProperty("openIdConnect", out _) ||
|
||||
schemes.TryGetProperty("bearerAuth", out _);
|
||||
|
||||
hasOAuth.Should().BeTrue("OAuth2 or Bearer security scheme should be defined");
|
||||
|
||||
_output.WriteLine("✓ Security schemes present in OpenAPI spec");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task OpenApiSpec_VersionStable()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openapi");
|
||||
var content = await response.Content.ReadAsStringAsync();
|
||||
using var doc = JsonDocument.Parse(content);
|
||||
|
||||
// Assert
|
||||
var openApiVersion = doc.RootElement.GetProperty("openapi").GetString();
|
||||
openApiVersion.Should().StartWith("3.", "Should use OpenAPI 3.x");
|
||||
|
||||
var info = doc.RootElement.GetProperty("info");
|
||||
info.TryGetProperty("version", out var version).Should().BeTrue();
|
||||
version.GetString().Should().NotBeNullOrEmpty("API version should be specified");
|
||||
|
||||
_output.WriteLine($"OpenAPI version: {openApiVersion}");
|
||||
_output.WriteLine($"API version: {version.GetString()}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task OpenApiSpec_HashIsStable()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act - Get spec twice
|
||||
using var response1 = await client.GetAsync("/.well-known/openapi");
|
||||
var content1 = await response1.Content.ReadAsStringAsync();
|
||||
|
||||
using var response2 = await client.GetAsync("/.well-known/openapi");
|
||||
var content2 = await response2.Content.ReadAsStringAsync();
|
||||
|
||||
// Assert - Content should be identical (deterministic)
|
||||
var hash1 = ComputeHash(content1);
|
||||
var hash2 = ComputeHash(content2);
|
||||
|
||||
hash1.Should().Be(hash2, "OpenAPI spec should be deterministic");
|
||||
|
||||
_output.WriteLine($"Spec hash: {hash1}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Token Endpoint Contract Tests
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_RequiresGrantType()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("client_id", "test-client")
|
||||
// grant_type intentionally missing
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.BadRequest, "Missing grant_type should return 400");
|
||||
|
||||
_output.WriteLine("✓ Token endpoint validates grant_type");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_RejectsInvalidGrantType()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "invalid_grant"),
|
||||
new KeyValuePair<string, string>("client_id", "test-client")
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.BadRequest, HttpStatusCode.Unauthorized);
|
||||
|
||||
_output.WriteLine("✓ Token endpoint rejects invalid grant_type");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_ReturnsOAuthErrorFormat()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "client_credentials"),
|
||||
new KeyValuePair<string, string>("client_id", "nonexistent-client"),
|
||||
new KeyValuePair<string, string>("client_secret", "wrong-secret")
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
var body = await response.Content.ReadAsStringAsync();
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.BadRequest, HttpStatusCode.Unauthorized);
|
||||
|
||||
// OAuth2 error response format
|
||||
if (!string.IsNullOrEmpty(body))
|
||||
{
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
doc.RootElement.TryGetProperty("error", out _).Should().BeTrue("Error response should contain 'error' field");
|
||||
}
|
||||
|
||||
_output.WriteLine("✓ Token endpoint returns OAuth2 error format");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Well-Known Endpoint Tests
|
||||
|
||||
[Fact]
|
||||
public async Task WellKnownOpenIdConfig_ReturnsDiscoveryDocument()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openid-configuration");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.OK);
|
||||
|
||||
var body = await response.Content.ReadAsStringAsync();
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
|
||||
doc.RootElement.TryGetProperty("issuer", out _).Should().BeTrue("Should have issuer");
|
||||
doc.RootElement.TryGetProperty("token_endpoint", out _).Should().BeTrue("Should have token_endpoint");
|
||||
|
||||
_output.WriteLine("✓ OpenID discovery document returned");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task WellKnownJwks_ReturnsKeySet()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/jwks");
|
||||
|
||||
// Assert
|
||||
// May return 200 with keys or 404 if signing is disabled
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.OK, HttpStatusCode.NotFound);
|
||||
|
||||
if (response.StatusCode == HttpStatusCode.OK)
|
||||
{
|
||||
var body = await response.Content.ReadAsStringAsync();
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
doc.RootElement.TryGetProperty("keys", out _).Should().BeTrue("JWKS should have 'keys' array");
|
||||
}
|
||||
|
||||
_output.WriteLine($"✓ JWKS endpoint responded with {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Health and Status Endpoints
|
||||
|
||||
[Fact]
|
||||
public async Task HealthEndpoint_ReturnsOk()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/health");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.OK, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Health endpoint: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReadyEndpoint_ReturnsStatus()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/ready");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.OK, HttpStatusCode.ServiceUnavailable, HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine($"✓ Ready endpoint: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Response Header Contract Tests
|
||||
|
||||
[Fact]
|
||||
public async Task OpenApiEndpoint_ReturnsProperCacheHeaders()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openapi");
|
||||
|
||||
// Assert
|
||||
response.Headers.CacheControl.Should().NotBeNull("Cache-Control header should be set");
|
||||
response.Headers.ETag.Should().NotBeNull("ETag header should be set for caching");
|
||||
|
||||
_output.WriteLine($"Cache-Control: {response.Headers.CacheControl}");
|
||||
_output.WriteLine($"ETag: {response.Headers.ETag}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task OpenApiEndpoint_ReturnsCustomStellaOpsHeaders()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openapi");
|
||||
|
||||
// Assert
|
||||
response.Headers.TryGetValues("X-StellaOps-OAuth-Grants", out var grants).Should().BeTrue();
|
||||
response.Headers.TryGetValues("X-StellaOps-OAuth-Scopes", out var scopes).Should().BeTrue();
|
||||
|
||||
_output.WriteLine($"OAuth Grants: {string.Join(", ", grants ?? Array.Empty<string>())}");
|
||||
_output.WriteLine($"OAuth Scopes: {string.Join(", ", scopes ?? Array.Empty<string>())}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Helper Methods
|
||||
|
||||
private static string ComputeHash(string content)
|
||||
{
|
||||
var bytes = Encoding.UTF8.GetBytes(content);
|
||||
var hash = SHA256.HashData(bytes);
|
||||
return Convert.ToHexString(hash);
|
||||
}
|
||||
|
||||
private static bool ShouldUpdateSnapshots()
|
||||
{
|
||||
return Environment.GetEnvironmentVariable("UPDATE_AUTHORITY_SNAPSHOTS") == "1";
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,381 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// KeyErrorClassificationTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-017 - Add error classification tests: key not present, provider unavailable → deterministic error codes
|
||||
// Description: Error classification tests for key management and provider errors
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.IdentityModel.Tokens.Jwt;
|
||||
using System.Security.Claims;
|
||||
using System.Security.Cryptography;
|
||||
using FluentAssertions;
|
||||
using Microsoft.IdentityModel.Tokens;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Tests.Errors;
|
||||
|
||||
/// <summary>
|
||||
/// Error classification tests for Authority module.
|
||||
/// Validates that specific error conditions produce deterministic error codes
|
||||
/// that can be reliably handled by clients and monitored.
|
||||
/// </summary>
|
||||
[Trait("Category", "Errors")]
|
||||
[Trait("Category", "ErrorClassification")]
|
||||
[Trait("Category", "W1")]
|
||||
public sealed class KeyErrorClassificationTests
|
||||
{
|
||||
private readonly ITestOutputHelper _output;
|
||||
|
||||
public KeyErrorClassificationTests(ITestOutputHelper output)
|
||||
{
|
||||
_output = output;
|
||||
}
|
||||
|
||||
#region Key Not Present Errors
|
||||
|
||||
[Fact]
|
||||
public void MissingSigningKey_ThrowsWithDeterministicCode()
|
||||
{
|
||||
// Arrange
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = null, // No key configured
|
||||
RequireSignedTokens = true
|
||||
};
|
||||
|
||||
// Create a token to validate
|
||||
using var rsa = RSA.Create(2048);
|
||||
var signingKey = new RsaSecurityKey(rsa);
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act
|
||||
Action act = () => handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert - expect deterministic exception type for "key not present"
|
||||
var exception = act.Should().Throw<SecurityTokenSignatureKeyNotFoundException>();
|
||||
|
||||
_output.WriteLine($"✓ Missing key throws: {exception.Which.GetType().Name}");
|
||||
_output.WriteLine($" Error code can be mapped from exception type");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void EmptySigningKeyCollection_ThrowsWithDeterministicCode()
|
||||
{
|
||||
// Arrange
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKeys = Array.Empty<SecurityKey>(), // Empty collection
|
||||
RequireSignedTokens = true
|
||||
};
|
||||
|
||||
using var rsa = RSA.Create(2048);
|
||||
var signingKey = new RsaSecurityKey(rsa);
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act
|
||||
Action act = () => handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
act.Should().Throw<SecurityTokenSignatureKeyNotFoundException>();
|
||||
|
||||
_output.WriteLine("✓ Empty key collection throws deterministic exception");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void KeyIdMismatch_ThrowsWithDeterministicCode()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa1 = RSA.Create(2048);
|
||||
using var rsa2 = RSA.Create(2048);
|
||||
|
||||
var signingKey = new RsaSecurityKey(rsa1) { KeyId = "key-abc" };
|
||||
var validationKey = new RsaSecurityKey(rsa2.ExportParameters(false)) { KeyId = "key-xyz" }; // Different key ID
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = validationKey
|
||||
};
|
||||
|
||||
// Act
|
||||
Action act = () => handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert - signature mismatch when key doesn't match
|
||||
act.Should().Throw<SecurityTokenInvalidSignatureException>();
|
||||
|
||||
_output.WriteLine("✓ Key ID mismatch throws deterministic exception");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Expired/Invalid Key Errors
|
||||
|
||||
[Fact]
|
||||
public void ExpiredToken_ThrowsWithDeterministicCode()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa = RSA.Create(2048);
|
||||
var signingKey = new RsaSecurityKey(rsa);
|
||||
var validationKey = new RsaSecurityKey(rsa.ExportParameters(false));
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
notBefore: DateTime.UtcNow.AddHours(-2),
|
||||
expires: DateTime.UtcNow.AddHours(-1), // Already expired
|
||||
signingCredentials: new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = validationKey,
|
||||
ValidateLifetime = true,
|
||||
ClockSkew = TimeSpan.Zero
|
||||
};
|
||||
|
||||
// Act
|
||||
Action act = () => handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
act.Should().Throw<SecurityTokenExpiredException>();
|
||||
|
||||
_output.WriteLine("✓ Expired token throws SecurityTokenExpiredException");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void TokenNotYetValid_ThrowsWithDeterministicCode()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa = RSA.Create(2048);
|
||||
var signingKey = new RsaSecurityKey(rsa);
|
||||
var validationKey = new RsaSecurityKey(rsa.ExportParameters(false));
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
notBefore: DateTime.UtcNow.AddHours(1), // Not valid yet
|
||||
expires: DateTime.UtcNow.AddHours(2),
|
||||
signingCredentials: new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = validationKey,
|
||||
ValidateLifetime = true,
|
||||
ClockSkew = TimeSpan.Zero
|
||||
};
|
||||
|
||||
// Act
|
||||
Action act = () => handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
act.Should().Throw<SecurityTokenNotYetValidException>();
|
||||
|
||||
_output.WriteLine("✓ Not-yet-valid token throws SecurityTokenNotYetValidException");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Provider Unavailable Errors
|
||||
|
||||
[Fact]
|
||||
public void IssuerMismatch_ThrowsWithDeterministicCode()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa = RSA.Create(2048);
|
||||
var signingKey = new RsaSecurityKey(rsa);
|
||||
var validationKey = new RsaSecurityKey(rsa.ExportParameters(false));
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://different-issuer.test", // Different issuer
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = validationKey
|
||||
};
|
||||
|
||||
// Act
|
||||
Action act = () => handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
act.Should().Throw<SecurityTokenInvalidIssuerException>();
|
||||
|
||||
_output.WriteLine("✓ Issuer mismatch throws SecurityTokenInvalidIssuerException");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AudienceMismatch_ThrowsWithDeterministicCode()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa = RSA.Create(2048);
|
||||
var signingKey = new RsaSecurityKey(rsa);
|
||||
var validationKey = new RsaSecurityKey(rsa.ExportParameters(false));
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "different-audience", // Different audience
|
||||
IssuerSigningKey = validationKey
|
||||
};
|
||||
|
||||
// Act
|
||||
Action act = () => handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
act.Should().Throw<SecurityTokenInvalidAudienceException>();
|
||||
|
||||
_output.WriteLine("✓ Audience mismatch throws SecurityTokenInvalidAudienceException");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Error Code Mapping Helper Tests
|
||||
|
||||
/// <summary>
|
||||
/// Tests for the error code mapping strategy.
|
||||
/// Authority should map these exceptions to deterministic error codes.
|
||||
/// </summary>
|
||||
[Theory]
|
||||
[MemberData(nameof(GetExceptionToErrorCodeMappings))]
|
||||
public void ExceptionType_MapsToExpectedErrorCode(Type exceptionType, string expectedErrorCode)
|
||||
{
|
||||
// This test validates the mapping strategy
|
||||
var errorCode = MapExceptionToErrorCode(exceptionType);
|
||||
|
||||
errorCode.Should().Be(expectedErrorCode);
|
||||
|
||||
_output.WriteLine($"✓ {exceptionType.Name} → {expectedErrorCode}");
|
||||
}
|
||||
|
||||
public static IEnumerable<object[]> GetExceptionToErrorCodeMappings()
|
||||
{
|
||||
yield return new object[] { typeof(SecurityTokenSignatureKeyNotFoundException), "AUTHORITY_KEY_NOT_FOUND" };
|
||||
yield return new object[] { typeof(SecurityTokenInvalidSignatureException), "AUTHORITY_INVALID_SIGNATURE" };
|
||||
yield return new object[] { typeof(SecurityTokenExpiredException), "AUTHORITY_TOKEN_EXPIRED" };
|
||||
yield return new object[] { typeof(SecurityTokenNotYetValidException), "AUTHORITY_TOKEN_NOT_YET_VALID" };
|
||||
yield return new object[] { typeof(SecurityTokenInvalidIssuerException), "AUTHORITY_INVALID_ISSUER" };
|
||||
yield return new object[] { typeof(SecurityTokenInvalidAudienceException), "AUTHORITY_INVALID_AUDIENCE" };
|
||||
yield return new object[] { typeof(SecurityTokenException), "AUTHORITY_GENERIC_ERROR" };
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Helper method demonstrating the expected error code mapping.
|
||||
/// This pattern should be implemented in the Authority error handler.
|
||||
/// </summary>
|
||||
private static string MapExceptionToErrorCode(Type exceptionType)
|
||||
{
|
||||
return exceptionType.Name switch
|
||||
{
|
||||
nameof(SecurityTokenSignatureKeyNotFoundException) => "AUTHORITY_KEY_NOT_FOUND",
|
||||
nameof(SecurityTokenInvalidSignatureException) => "AUTHORITY_INVALID_SIGNATURE",
|
||||
nameof(SecurityTokenExpiredException) => "AUTHORITY_TOKEN_EXPIRED",
|
||||
nameof(SecurityTokenNotYetValidException) => "AUTHORITY_TOKEN_NOT_YET_VALID",
|
||||
nameof(SecurityTokenInvalidIssuerException) => "AUTHORITY_INVALID_ISSUER",
|
||||
nameof(SecurityTokenInvalidAudienceException) => "AUTHORITY_INVALID_AUDIENCE",
|
||||
_ when typeof(SecurityTokenException).IsAssignableFrom(exceptionType) => "AUTHORITY_GENERIC_ERROR",
|
||||
_ => "AUTHORITY_UNKNOWN_ERROR"
|
||||
};
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Deterministic Error Response Format Tests
|
||||
|
||||
[Fact]
|
||||
public void ErrorResponse_ShouldHaveDeterministicStructure()
|
||||
{
|
||||
// This test documents the expected error response structure
|
||||
// that Authority should return for consistency
|
||||
var errorResponse = new AuthorityErrorResponse
|
||||
{
|
||||
ErrorCode = "AUTHORITY_KEY_NOT_FOUND",
|
||||
Error = "invalid_token",
|
||||
ErrorDescription = "The signing key was not found",
|
||||
Timestamp = DateTime.UtcNow
|
||||
};
|
||||
|
||||
errorResponse.ErrorCode.Should().NotBeNullOrWhiteSpace();
|
||||
errorResponse.Error.Should().NotBeNullOrWhiteSpace();
|
||||
errorResponse.ErrorDescription.Should().NotBeNullOrWhiteSpace();
|
||||
|
||||
_output.WriteLine("✓ Error response structure is deterministic");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Model representing the expected Authority error response structure.
|
||||
/// </summary>
|
||||
private sealed class AuthorityErrorResponse
|
||||
{
|
||||
public required string ErrorCode { get; init; }
|
||||
public required string Error { get; init; }
|
||||
public required string ErrorDescription { get; init; }
|
||||
public DateTime Timestamp { get; init; }
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,363 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// AuthorityNegativeTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-015 - Add negative tests: unsupported grant types, malformed requests, rate limiting
|
||||
// Description: Negative tests for Authority WebService error handling
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Net;
|
||||
using System.Net.Http;
|
||||
using System.Net.Http.Headers;
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
using System.Threading.Tasks;
|
||||
using FluentAssertions;
|
||||
using StellaOps.Authority.Tests.Infrastructure;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Tests.Negative;
|
||||
|
||||
/// <summary>
|
||||
/// Negative tests for Authority WebService.
|
||||
/// Validates:
|
||||
/// - Unsupported grant types are rejected with proper error
|
||||
/// - Malformed requests return appropriate error codes
|
||||
/// - Rate limiting is enforced
|
||||
/// - Invalid content types are handled
|
||||
/// </summary>
|
||||
[Trait("Category", "Negative")]
|
||||
[Trait("Category", "W1")]
|
||||
public sealed class AuthorityNegativeTests : IClassFixture<AuthorityWebApplicationFactory>
|
||||
{
|
||||
private readonly AuthorityWebApplicationFactory _factory;
|
||||
private readonly ITestOutputHelper _output;
|
||||
|
||||
public AuthorityNegativeTests(AuthorityWebApplicationFactory factory, ITestOutputHelper output)
|
||||
{
|
||||
_factory = factory;
|
||||
_output = output;
|
||||
}
|
||||
|
||||
#region Unsupported Grant Type Tests
|
||||
|
||||
[Theory]
|
||||
[InlineData("custom_grant")]
|
||||
[InlineData("urn:custom:grant")]
|
||||
[InlineData("implicit")] // Implicit flow often disabled for security
|
||||
[InlineData("password_123")]
|
||||
public async Task TokenEndpoint_UnsupportedGrantType_Returns400(string grantType)
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", grantType),
|
||||
new KeyValuePair<string, string>("client_id", "test-client")
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.BadRequest, HttpStatusCode.Unauthorized);
|
||||
|
||||
var body = await response.Content.ReadAsStringAsync();
|
||||
if (!string.IsNullOrEmpty(body))
|
||||
{
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
doc.RootElement.TryGetProperty("error", out var error);
|
||||
var errorValue = error.GetString();
|
||||
errorValue.Should().BeOneOf("unsupported_grant_type", "invalid_grant", "invalid_request");
|
||||
}
|
||||
|
||||
_output.WriteLine($"✓ Grant type '{grantType}': {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Malformed Request Tests
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_EmptyBody_Returns400()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new StringContent("", Encoding.UTF8, "application/x-www-form-urlencoded");
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
|
||||
|
||||
_output.WriteLine($"✓ Empty body: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_InvalidJson_Returns400()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new StringContent("{invalid json}", Encoding.UTF8, "application/json");
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
// Token endpoint typically expects form-urlencoded, so JSON may be rejected
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.BadRequest, HttpStatusCode.UnsupportedMediaType);
|
||||
|
||||
_output.WriteLine($"✓ Invalid JSON: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_WrongContentType_ReturnsError()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new StringContent("grant_type=client_credentials", Encoding.UTF8, "text/plain");
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.BadRequest, HttpStatusCode.UnsupportedMediaType);
|
||||
|
||||
_output.WriteLine($"✓ Wrong content type: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_DuplicateParameters_Handled()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
// Duplicate grant_type parameter
|
||||
var body = "grant_type=client_credentials&grant_type=authorization_code&client_id=test";
|
||||
var content = new StringContent(body, Encoding.UTF8, "application/x-www-form-urlencoded");
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
// Implementation may accept first, last, or reject - just verify it handles gracefully
|
||||
response.StatusCode.Should().NotBe(HttpStatusCode.InternalServerError);
|
||||
|
||||
_output.WriteLine($"✓ Duplicate parameters: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Size Limit Tests
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_OversizedRequest_Rejected()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Create a very large request body
|
||||
var largeValue = new string('A', 100_000); // 100KB of data
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "client_credentials"),
|
||||
new KeyValuePair<string, string>("client_id", "test-client"),
|
||||
new KeyValuePair<string, string>("extra_data", largeValue)
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
// Should be rejected or handled gracefully (not crash)
|
||||
response.StatusCode.Should().NotBe(HttpStatusCode.InternalServerError);
|
||||
|
||||
_output.WriteLine($"✓ Oversized request: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Method Mismatch Tests
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_GetMethod_Returns405()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/connect/token");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.MethodNotAllowed);
|
||||
|
||||
_output.WriteLine($"✓ GET to token endpoint: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_PutMethod_Returns405()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "client_credentials")
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PutAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.MethodNotAllowed);
|
||||
|
||||
_output.WriteLine($"✓ PUT to token endpoint: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_DeleteMethod_Returns405()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.DeleteAsync("/connect/token");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.MethodNotAllowed);
|
||||
|
||||
_output.WriteLine($"✓ DELETE to token endpoint: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Invalid Parameter Tests
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_NullCharacters_Rejected()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "client_credentials"),
|
||||
new KeyValuePair<string, string>("client_id", "test\0client") // Null character
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().NotBe(HttpStatusCode.OK);
|
||||
response.StatusCode.Should().NotBe(HttpStatusCode.InternalServerError);
|
||||
|
||||
_output.WriteLine($"✓ Null characters: {response.StatusCode}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TokenEndpoint_ControlCharacters_Rejected()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "client_credentials"),
|
||||
new KeyValuePair<string, string>("client_id", "test\x01\x02client") // Control characters
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().NotBe(HttpStatusCode.InternalServerError);
|
||||
|
||||
_output.WriteLine($"✓ Control characters: {response.StatusCode}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Error Response Format Tests
|
||||
|
||||
[Fact]
|
||||
public async Task ErrorResponse_IncludesErrorField()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "invalid_grant_type")
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
var body = await response.Content.ReadAsStringAsync();
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.BadRequest, HttpStatusCode.Unauthorized);
|
||||
|
||||
if (!string.IsNullOrEmpty(body))
|
||||
{
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
doc.RootElement.TryGetProperty("error", out _).Should().BeTrue("OAuth2 error responses must have 'error' field");
|
||||
}
|
||||
|
||||
_output.WriteLine("✓ Error response includes 'error' field");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ErrorResponse_HasCorrectContentType()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "invalid")
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
response.Content.Headers.ContentType?.MediaType.Should().Be("application/json");
|
||||
|
||||
_output.WriteLine("✓ Error response has JSON content type");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Endpoint Not Found Tests
|
||||
|
||||
[Fact]
|
||||
public async Task NonExistentEndpoint_Returns404()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/nonexistent/endpoint");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.NotFound);
|
||||
|
||||
_output.WriteLine("✓ Nonexistent endpoint returns 404");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task SqlInjectionPath_Returns404()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/api/v1/users/'; DROP TABLE users;--");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().BeOneOf(HttpStatusCode.NotFound, HttpStatusCode.BadRequest);
|
||||
response.StatusCode.Should().NotBe(HttpStatusCode.InternalServerError);
|
||||
|
||||
_output.WriteLine("✓ SQL injection in path handled safely");
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,297 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// AuthorityOTelTraceTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-014 - Add OTel trace assertions (verify user_id, tenant_id, scope tags)
|
||||
// Description: OpenTelemetry trace assertion tests for Authority WebService
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.Diagnostics;
|
||||
using System.Net;
|
||||
using System.Net.Http;
|
||||
using System.Threading.Tasks;
|
||||
using FluentAssertions;
|
||||
using StellaOps.Authority.Tests.Infrastructure;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Tests.Observability;
|
||||
|
||||
/// <summary>
|
||||
/// OpenTelemetry trace assertion tests for Authority WebService.
|
||||
/// Validates:
|
||||
/// - User ID is included in trace attributes
|
||||
/// - Tenant ID is included in trace attributes
|
||||
/// - Scope information is included in trace attributes
|
||||
/// - Operation names follow conventions
|
||||
/// </summary>
|
||||
[Trait("Category", "OTel")]
|
||||
[Trait("Category", "Observability")]
|
||||
[Trait("Category", "W1")]
|
||||
public sealed class AuthorityOTelTraceTests : IClassFixture<AuthorityWebApplicationFactory>, IDisposable
|
||||
{
|
||||
private readonly AuthorityWebApplicationFactory _factory;
|
||||
private readonly ITestOutputHelper _output;
|
||||
private readonly ActivityListener _listener;
|
||||
private readonly ConcurrentBag<Activity> _capturedActivities;
|
||||
|
||||
private static readonly ActivitySource TestActivitySource = new("StellaOps.Authority.Tests");
|
||||
|
||||
public AuthorityOTelTraceTests(AuthorityWebApplicationFactory factory, ITestOutputHelper output)
|
||||
{
|
||||
_factory = factory;
|
||||
_output = output;
|
||||
_capturedActivities = new ConcurrentBag<Activity>();
|
||||
|
||||
_listener = new ActivityListener
|
||||
{
|
||||
ShouldListenTo = source => source.Name.StartsWith("StellaOps") ||
|
||||
source.Name.StartsWith("Microsoft.AspNetCore") ||
|
||||
source.Name.StartsWith("System.Net.Http"),
|
||||
Sample = (ref ActivityCreationOptions<ActivityContext> _) => ActivitySamplingResult.AllDataAndRecorded,
|
||||
ActivityStarted = activity => { },
|
||||
ActivityStopped = activity => _capturedActivities.Add(activity)
|
||||
};
|
||||
ActivitySource.AddActivityListener(_listener);
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
_listener.Dispose();
|
||||
}
|
||||
|
||||
#region Request Trace Tests
|
||||
|
||||
[Fact]
|
||||
public async Task TokenRequest_CreatesTraceSpan()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
var content = new FormUrlEncodedContent(new[]
|
||||
{
|
||||
new KeyValuePair<string, string>("grant_type", "client_credentials"),
|
||||
new KeyValuePair<string, string>("client_id", "test-client")
|
||||
});
|
||||
|
||||
// Act
|
||||
using var response = await client.PostAsync("/connect/token", content);
|
||||
|
||||
// Assert
|
||||
// The request should create trace spans
|
||||
var httpActivities = _capturedActivities.Where(a =>
|
||||
a.OperationName.Contains("HTTP") ||
|
||||
a.OperationName.Contains("token") ||
|
||||
a.DisplayName.Contains("POST"));
|
||||
|
||||
// We expect at least some HTTP-related activity
|
||||
_output.WriteLine($"Captured {_capturedActivities.Count} activities");
|
||||
foreach (var activity in _capturedActivities.Take(10))
|
||||
{
|
||||
_output.WriteLine($" - {activity.OperationName} ({activity.DisplayName})");
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task OpenApiRequest_HasHttpMethodTag()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
_capturedActivities.Clear();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openapi");
|
||||
|
||||
// Assert
|
||||
var httpActivities = _capturedActivities.Where(a =>
|
||||
a.Tags.Any(t => t.Key == "http.method" || t.Key == "http.request.method"));
|
||||
|
||||
foreach (var activity in httpActivities)
|
||||
{
|
||||
var method = activity.GetTagItem("http.method") ?? activity.GetTagItem("http.request.method");
|
||||
method.Should().Be("GET", "HTTP method should be recorded in trace");
|
||||
_output.WriteLine($"✓ HTTP method recorded: {method}");
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Request_HasStatusCodeTag()
|
||||
{
|
||||
// Arrange
|
||||
using var client = _factory.CreateClient();
|
||||
_capturedActivities.Clear();
|
||||
|
||||
// Act
|
||||
using var response = await client.GetAsync("/.well-known/openapi");
|
||||
|
||||
// Assert
|
||||
response.StatusCode.Should().Be(HttpStatusCode.OK);
|
||||
|
||||
var httpActivities = _capturedActivities.Where(a =>
|
||||
a.Tags.Any(t => t.Key == "http.status_code" || t.Key == "http.response.status_code"));
|
||||
|
||||
foreach (var activity in httpActivities)
|
||||
{
|
||||
var statusCode = activity.GetTagItem("http.status_code") ?? activity.GetTagItem("http.response.status_code");
|
||||
_output.WriteLine($"Status code tag: {statusCode}");
|
||||
}
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Authority-Specific Attribute Tests
|
||||
|
||||
[Fact]
|
||||
public void AuthoritySpan_CanIncludeUserIdAttribute()
|
||||
{
|
||||
// Arrange & Act
|
||||
using var activity = TestActivitySource.StartActivity("TokenValidation", ActivityKind.Internal);
|
||||
activity?.SetTag("authority.user.id", "user-12345");
|
||||
activity?.SetTag("authority.tenant.id", "tenant-default");
|
||||
|
||||
// Assert
|
||||
activity.Should().NotBeNull();
|
||||
activity!.GetTagItem("authority.user.id").Should().Be("user-12345");
|
||||
activity.GetTagItem("authority.tenant.id").Should().Be("tenant-default");
|
||||
|
||||
_output.WriteLine("✓ User and tenant ID can be recorded in traces");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AuthoritySpan_CanIncludeScopeAttribute()
|
||||
{
|
||||
// Arrange & Act
|
||||
using var activity = TestActivitySource.StartActivity("TokenIssuance", ActivityKind.Internal);
|
||||
activity?.SetTag("authority.scopes.requested", "jobs:read findings:read");
|
||||
activity?.SetTag("authority.scopes.granted", "jobs:read");
|
||||
|
||||
// Assert
|
||||
activity.Should().NotBeNull();
|
||||
activity!.GetTagItem("authority.scopes.requested").Should().Be("jobs:read findings:read");
|
||||
activity.GetTagItem("authority.scopes.granted").Should().Be("jobs:read");
|
||||
|
||||
_output.WriteLine("✓ Scope information can be recorded in traces");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AuthoritySpan_CanIncludeClientIdAttribute()
|
||||
{
|
||||
// Arrange & Act
|
||||
using var activity = TestActivitySource.StartActivity("ClientCredentialsGrant", ActivityKind.Internal);
|
||||
activity?.SetTag("authority.client.id", "export-center-worker");
|
||||
activity?.SetTag("authority.grant_type", "client_credentials");
|
||||
|
||||
// Assert
|
||||
activity.Should().NotBeNull();
|
||||
activity!.GetTagItem("authority.client.id").Should().Be("export-center-worker");
|
||||
activity.GetTagItem("authority.grant_type").Should().Be("client_credentials");
|
||||
|
||||
_output.WriteLine("✓ Client ID and grant type can be recorded in traces");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Error Recording Tests
|
||||
|
||||
[Fact]
|
||||
public void AuthoritySpan_RecordsAuthFailure()
|
||||
{
|
||||
// Arrange & Act
|
||||
using var activity = TestActivitySource.StartActivity("TokenValidation", ActivityKind.Internal);
|
||||
activity?.SetStatus(ActivityStatusCode.Error, "Token expired");
|
||||
activity?.SetTag("authority.error.type", "token_expired");
|
||||
|
||||
// Assert
|
||||
activity.Should().NotBeNull();
|
||||
activity!.Status.Should().Be(ActivityStatusCode.Error);
|
||||
activity.StatusDescription.Should().Be("Token expired");
|
||||
|
||||
_output.WriteLine("✓ Auth failures recorded in traces");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AuthoritySpan_RecordsExceptionEvent()
|
||||
{
|
||||
// Arrange
|
||||
var exception = new UnauthorizedAccessException("Invalid client credentials");
|
||||
|
||||
// Act
|
||||
using var activity = TestActivitySource.StartActivity("ClientCredentialsGrant", ActivityKind.Internal);
|
||||
activity?.SetStatus(ActivityStatusCode.Error, exception.Message);
|
||||
activity?.AddEvent(new ActivityEvent(
|
||||
"exception",
|
||||
tags: new ActivityTagsCollection
|
||||
{
|
||||
{ "exception.type", exception.GetType().FullName },
|
||||
{ "exception.message", exception.Message }
|
||||
}));
|
||||
|
||||
// Assert
|
||||
activity.Should().NotBeNull();
|
||||
activity!.Events.Should().Contain(e => e.Name == "exception");
|
||||
|
||||
_output.WriteLine("✓ Exception events recorded in traces");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Trace Correlation Tests
|
||||
|
||||
[Fact]
|
||||
public void NestedSpans_ShareTraceId()
|
||||
{
|
||||
// Arrange & Act
|
||||
Activity? parentActivity = null;
|
||||
Activity? childActivity = null;
|
||||
|
||||
using (parentActivity = TestActivitySource.StartActivity("TokenIssuance", ActivityKind.Internal))
|
||||
{
|
||||
parentActivity?.SetTag("authority.client.id", "test-client");
|
||||
|
||||
using (childActivity = TestActivitySource.StartActivity("ValidateClient", ActivityKind.Internal))
|
||||
{
|
||||
childActivity?.SetTag("authority.validation.step", "client_secret");
|
||||
}
|
||||
}
|
||||
|
||||
// Assert
|
||||
parentActivity.Should().NotBeNull();
|
||||
childActivity.Should().NotBeNull();
|
||||
childActivity!.TraceId.Should().Be(parentActivity!.TraceId);
|
||||
childActivity.ParentSpanId.Should().Be(parentActivity.SpanId);
|
||||
|
||||
_output.WriteLine($"Trace ID: {parentActivity.TraceId}");
|
||||
_output.WriteLine($"Parent span: {parentActivity.SpanId}");
|
||||
_output.WriteLine($"Child parent: {childActivity.ParentSpanId}");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AuthoritySpan_FollowsSemanticConventions()
|
||||
{
|
||||
// Arrange & Act
|
||||
using var activity = TestActivitySource.StartActivity("TokenIssuance", ActivityKind.Internal);
|
||||
|
||||
// Standard semantic conventions
|
||||
activity?.SetTag("service.name", "authority");
|
||||
activity?.SetTag("service.version", "1.0.0");
|
||||
|
||||
// Authority-specific conventions (prefixed)
|
||||
activity?.SetTag("authority.client.id", "test-client");
|
||||
activity?.SetTag("authority.tenant.id", "tenant-default");
|
||||
activity?.SetTag("authority.grant_type", "client_credentials");
|
||||
|
||||
// Assert
|
||||
var tags = activity!.TagObjects.ToList();
|
||||
|
||||
foreach (var tag in tags)
|
||||
{
|
||||
// Tags should follow snake_case or dot.notation
|
||||
tag.Key.Should().MatchRegex(@"^[a-z][a-z0-9_.]*[a-z0-9]$",
|
||||
$"Tag '{tag.Key}' should follow semantic conventions");
|
||||
}
|
||||
|
||||
_output.WriteLine($"Validated {tags.Count} tags follow semantic conventions");
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -0,0 +1,400 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// TokenSignVerifyRoundtripTests.cs
|
||||
// Sprint: SPRINT_5100_0009_0005 - Authority Module Test Implementation
|
||||
// Task: AUTHORITY-5100-016 - Add sign/verify roundtrip tests: token signed with private key → verified with public key
|
||||
// Description: Token signing and verification roundtrip tests
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System;
|
||||
using System.IdentityModel.Tokens.Jwt;
|
||||
using System.Security.Claims;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using FluentAssertions;
|
||||
using Microsoft.IdentityModel.Tokens;
|
||||
using Xunit;
|
||||
using Xunit.Abstractions;
|
||||
|
||||
namespace StellaOps.Authority.Tests.Signing;
|
||||
|
||||
/// <summary>
|
||||
/// Token signing and verification roundtrip tests.
|
||||
/// Validates:
|
||||
/// - Tokens signed with private key can be verified with public key
|
||||
/// - Signature algorithms are properly applied
|
||||
/// - Claims are preserved through sign/verify cycle
|
||||
/// - Key rotation scenarios work correctly
|
||||
/// </summary>
|
||||
[Trait("Category", "Signing")]
|
||||
[Trait("Category", "Crypto")]
|
||||
[Trait("Category", "W1")]
|
||||
public sealed class TokenSignVerifyRoundtripTests
|
||||
{
|
||||
private readonly ITestOutputHelper _output;
|
||||
|
||||
public TokenSignVerifyRoundtripTests(ITestOutputHelper output)
|
||||
{
|
||||
_output = output;
|
||||
}
|
||||
|
||||
#region RSA Sign/Verify Tests
|
||||
|
||||
[Fact]
|
||||
public void RsaToken_SignAndVerify_Succeeds()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa = RSA.Create(2048);
|
||||
var privateKey = new RsaSecurityKey(rsa) { KeyId = "rsa-key-1" };
|
||||
var publicKey = new RsaSecurityKey(rsa.ExportParameters(false)) { KeyId = "rsa-key-1" };
|
||||
|
||||
var signingCredentials = new SigningCredentials(privateKey, SecurityAlgorithms.RsaSha256);
|
||||
|
||||
var claims = new[]
|
||||
{
|
||||
new Claim("sub", "user-12345"),
|
||||
new Claim("tenant", "tenant-default"),
|
||||
new Claim("scope", "jobs:read findings:read")
|
||||
};
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: claims,
|
||||
notBefore: DateTime.UtcNow,
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: signingCredentials);
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = publicKey,
|
||||
ValidateLifetime = true,
|
||||
ClockSkew = TimeSpan.FromMinutes(5)
|
||||
};
|
||||
|
||||
var principal = handler.ValidateToken(tokenString, validationParams, out var validatedToken);
|
||||
|
||||
// Assert
|
||||
principal.Should().NotBeNull();
|
||||
validatedToken.Should().NotBeNull();
|
||||
validatedToken.SignatureAlgorithm.Should().Be(SecurityAlgorithms.RsaSha256);
|
||||
|
||||
var subClaim = principal.FindFirst("sub")?.Value;
|
||||
subClaim.Should().Be("user-12345");
|
||||
|
||||
_output.WriteLine("✓ RSA RS256 sign/verify roundtrip succeeded");
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(SecurityAlgorithms.RsaSha256)]
|
||||
[InlineData(SecurityAlgorithms.RsaSha384)]
|
||||
[InlineData(SecurityAlgorithms.RsaSha512)]
|
||||
public void RsaToken_MultipleAlgorithms_Work(string algorithm)
|
||||
{
|
||||
// Arrange
|
||||
using var rsa = RSA.Create(2048);
|
||||
var privateKey = new RsaSecurityKey(rsa) { KeyId = $"rsa-key-{algorithm}" };
|
||||
var publicKey = new RsaSecurityKey(rsa.ExportParameters(false)) { KeyId = $"rsa-key-{algorithm}" };
|
||||
|
||||
var signingCredentials = new SigningCredentials(privateKey, algorithm);
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: signingCredentials);
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = publicKey
|
||||
};
|
||||
|
||||
var principal = handler.ValidateToken(tokenString, validationParams, out var validatedToken);
|
||||
|
||||
// Assert
|
||||
validatedToken.SignatureAlgorithm.Should().Be(algorithm);
|
||||
|
||||
_output.WriteLine($"✓ Algorithm {algorithm} works correctly");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region ECDSA Sign/Verify Tests
|
||||
|
||||
[Fact]
|
||||
public void EcdsaToken_SignAndVerify_Succeeds()
|
||||
{
|
||||
// Arrange
|
||||
using var ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP256);
|
||||
var privateKey = new ECDsaSecurityKey(ecdsa) { KeyId = "ecdsa-key-1" };
|
||||
|
||||
// Create a new instance with just the public key
|
||||
var publicParams = ecdsa.ExportParameters(false);
|
||||
using var ecdsaPublic = ECDsa.Create(publicParams);
|
||||
var publicKey = new ECDsaSecurityKey(ecdsaPublic) { KeyId = "ecdsa-key-1" };
|
||||
|
||||
var signingCredentials = new SigningCredentials(privateKey, SecurityAlgorithms.EcdsaSha256);
|
||||
|
||||
var claims = new[]
|
||||
{
|
||||
new Claim("sub", "user-ecdsa"),
|
||||
new Claim("iss_method", "ecdsa-p256")
|
||||
};
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: claims,
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: signingCredentials);
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = publicKey
|
||||
};
|
||||
|
||||
var principal = handler.ValidateToken(tokenString, validationParams, out var validatedToken);
|
||||
|
||||
// Assert
|
||||
principal.Should().NotBeNull();
|
||||
validatedToken.SignatureAlgorithm.Should().Be(SecurityAlgorithms.EcdsaSha256);
|
||||
|
||||
_output.WriteLine("✓ ECDSA ES256 sign/verify roundtrip succeeded");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region HMAC Sign/Verify Tests (Symmetric)
|
||||
|
||||
[Fact]
|
||||
public void HmacToken_SignAndVerify_Succeeds()
|
||||
{
|
||||
// Arrange
|
||||
var keyBytes = new byte[32];
|
||||
RandomNumberGenerator.Fill(keyBytes);
|
||||
var symmetricKey = new SymmetricSecurityKey(keyBytes) { KeyId = "hmac-key-1" };
|
||||
|
||||
var signingCredentials = new SigningCredentials(symmetricKey, SecurityAlgorithms.HmacSha256);
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "hmac-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: signingCredentials);
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act - verify with same key
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = symmetricKey
|
||||
};
|
||||
|
||||
var principal = handler.ValidateToken(tokenString, validationParams, out var validatedToken);
|
||||
|
||||
// Assert
|
||||
principal.Should().NotBeNull();
|
||||
validatedToken.SignatureAlgorithm.Should().Be(SecurityAlgorithms.HmacSha256);
|
||||
|
||||
_output.WriteLine("✓ HMAC HS256 sign/verify roundtrip succeeded");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Claims Preservation Tests
|
||||
|
||||
[Fact]
|
||||
public void SignedToken_PreservesAllClaims()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa = RSA.Create(2048);
|
||||
var privateKey = new RsaSecurityKey(rsa);
|
||||
var publicKey = new RsaSecurityKey(rsa.ExportParameters(false));
|
||||
|
||||
var originalClaims = new[]
|
||||
{
|
||||
new Claim("sub", "user-claims-test"),
|
||||
new Claim("tenant_id", "tenant-acme"),
|
||||
new Claim("scope", "jobs:read"),
|
||||
new Claim("scope", "findings:read"), // Multiple values
|
||||
new Claim("scope", "policy:write"),
|
||||
new Claim("custom_bool", "true"),
|
||||
new Claim("custom_num", "42")
|
||||
};
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: originalClaims,
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(privateKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = publicKey
|
||||
};
|
||||
|
||||
var principal = handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
principal.FindFirst("sub")?.Value.Should().Be("user-claims-test");
|
||||
principal.FindFirst("tenant_id")?.Value.Should().Be("tenant-acme");
|
||||
principal.FindAll("scope").Should().HaveCount(3);
|
||||
|
||||
_output.WriteLine("✓ All claims preserved through sign/verify");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Negative Verification Tests
|
||||
|
||||
[Fact]
|
||||
public void WrongPublicKey_VerificationFails()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa1 = RSA.Create(2048);
|
||||
using var rsa2 = RSA.Create(2048); // Different key pair
|
||||
|
||||
var privateKey = new RsaSecurityKey(rsa1);
|
||||
var wrongPublicKey = new RsaSecurityKey(rsa2.ExportParameters(false));
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "test") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(privateKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = wrongPublicKey
|
||||
};
|
||||
|
||||
Action act = () => handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
act.Should().Throw<SecurityTokenInvalidSignatureException>();
|
||||
|
||||
_output.WriteLine("✓ Wrong public key correctly rejected");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void TamperedPayload_VerificationFails()
|
||||
{
|
||||
// Arrange
|
||||
using var rsa = RSA.Create(2048);
|
||||
var privateKey = new RsaSecurityKey(rsa);
|
||||
var publicKey = new RsaSecurityKey(rsa.ExportParameters(false));
|
||||
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "original-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(privateKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Tamper with the payload
|
||||
var parts = tokenString.Split('.');
|
||||
var tamperedPayload = Convert.ToBase64String(
|
||||
Encoding.UTF8.GetBytes("{\"sub\":\"admin\",\"aud\":\"stellaops\",\"iss\":\"https://authority.test\"}"))
|
||||
.TrimEnd('=').Replace('+', '-').Replace('/', '_');
|
||||
var tamperedToken = $"{parts[0]}.{tamperedPayload}.{parts[2]}";
|
||||
|
||||
// Act
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKey = publicKey
|
||||
};
|
||||
|
||||
Action act = () => handler.ValidateToken(tamperedToken, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
act.Should().Throw<SecurityTokenInvalidSignatureException>();
|
||||
|
||||
_output.WriteLine("✓ Tampered payload correctly rejected");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Key Rotation Tests
|
||||
|
||||
[Fact]
|
||||
public void KeyRotation_OldTokensCanBeVerifiedWithOldKey()
|
||||
{
|
||||
// Arrange
|
||||
using var oldRsa = RSA.Create(2048);
|
||||
using var newRsa = RSA.Create(2048);
|
||||
|
||||
var oldPrivateKey = new RsaSecurityKey(oldRsa) { KeyId = "key-v1" };
|
||||
var oldPublicKey = new RsaSecurityKey(oldRsa.ExportParameters(false)) { KeyId = "key-v1" };
|
||||
var newPublicKey = new RsaSecurityKey(newRsa.ExportParameters(false)) { KeyId = "key-v2" };
|
||||
|
||||
// Token signed with old key
|
||||
var token = new JwtSecurityToken(
|
||||
issuer: "https://authority.test",
|
||||
audience: "stellaops",
|
||||
claims: new[] { new Claim("sub", "old-token-user") },
|
||||
expires: DateTime.UtcNow.AddHours(1),
|
||||
signingCredentials: new SigningCredentials(oldPrivateKey, SecurityAlgorithms.RsaSha256));
|
||||
|
||||
var handler = new JwtSecurityTokenHandler();
|
||||
var tokenString = handler.WriteToken(token);
|
||||
|
||||
// Act - verify with both keys available
|
||||
var validationParams = new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = "https://authority.test",
|
||||
ValidAudience = "stellaops",
|
||||
IssuerSigningKeys = new[] { oldPublicKey, newPublicKey } // Both keys available
|
||||
};
|
||||
|
||||
var principal = handler.ValidateToken(tokenString, validationParams, out _);
|
||||
|
||||
// Assert
|
||||
principal.Should().NotBeNull();
|
||||
principal.FindFirst("sub")?.Value.Should().Be("old-token-user");
|
||||
|
||||
_output.WriteLine("✓ Key rotation: old token verified with key set");
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
Reference in New Issue
Block a user