save progress

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/SbomEndpointsTests.cs

@@ -0,0 +1,112 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Http.Json;
+using System.Text;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using StellaOps.Scanner.Storage.ObjectStore;
+using StellaOps.Scanner.WebService.Contracts;
+using Xunit;
+
+namespace StellaOps.Scanner.WebService.Tests;
+
+public sealed class SbomEndpointsTests
+{
+    [Fact]
+    public async Task SubmitSbomAcceptsCycloneDxJson()
+    {
+        using var secrets = new TestSurfaceSecretsScope();
+        using var factory = new ScannerApplicationFactory(configuration =>
+        {
+            configuration["scanner:authority:enabled"] = "false";
+        }, configureServices: services =>
+        {
+            services.RemoveAll<IArtifactObjectStore>();
+            services.AddSingleton<IArtifactObjectStore>(new InMemoryArtifactObjectStore());
+        });
+
+        using var client = factory.CreateClient();
+        var scanId = await CreateScanAsync(client);
+
+        var sbomJson = """
+            {
+              "bomFormat": "CycloneDX",
+              "specVersion": "1.6",
+              "version": 1,
+              "components": []
+            }
+            """;
+
+        using var request = new HttpRequestMessage(HttpMethod.Post, $"/api/v1/scans/{scanId}/sbom")
+        {
+            Content = new StringContent(sbomJson, Encoding.UTF8, "application/vnd.cyclonedx+json")
+        };
+
+        var response = await client.SendAsync(request);
+        Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
+
+        var payload = await response.Content.ReadFromJsonAsync<SbomAcceptedResponseDto>();
+        Assert.NotNull(payload);
+        Assert.False(string.IsNullOrWhiteSpace(payload!.SbomId));
+        Assert.Equal("cyclonedx", payload.Format);
+        Assert.Equal(0, payload.ComponentCount);
+        Assert.StartsWith("sha256:", payload.Digest, StringComparison.Ordinal);
+    }
+
+    private static async Task<string> CreateScanAsync(HttpClient client)
+    {
+        var response = await client.PostAsJsonAsync("/api/v1/scans", new ScanSubmitRequest
+        {
+            Image = new ScanImageDescriptor
+            {
+                Reference = "example.com/demo:1.0",
+                Digest = "sha256:0123456789abcdef"
+            }
+        });
+
+        Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
+
+        var payload = await response.Content.ReadFromJsonAsync<ScanSubmitResponse>();
+        Assert.NotNull(payload);
+        Assert.False(string.IsNullOrWhiteSpace(payload!.ScanId));
+        return payload.ScanId;
+    }
+
+    private sealed class InMemoryArtifactObjectStore : IArtifactObjectStore
+    {
+        private readonly ConcurrentDictionary<string, byte[]> _objects = new(StringComparer.Ordinal);
+
+        public async Task PutAsync(ArtifactObjectDescriptor descriptor, Stream content, CancellationToken cancellationToken)
+        {
+            ArgumentNullException.ThrowIfNull(descriptor);
+            ArgumentNullException.ThrowIfNull(content);
+
+            using var buffer = new MemoryStream();
+            await content.CopyToAsync(buffer, cancellationToken).ConfigureAwait(false);
+
+            var key = $"{descriptor.Bucket}:{descriptor.Key}";
+            _objects[key] = buffer.ToArray();
+        }
+
+        public Task<Stream?> GetAsync(ArtifactObjectDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            ArgumentNullException.ThrowIfNull(descriptor);
+
+            var key = $"{descriptor.Bucket}:{descriptor.Key}";
+            if (!_objects.TryGetValue(key, out var bytes))
+            {
+                return Task.FromResult<Stream?>(null);
+            }
+
+            return Task.FromResult<Stream?>(new MemoryStream(bytes, writable: false));
+        }
+
+        public Task DeleteAsync(ArtifactObjectDescriptor descriptor, CancellationToken cancellationToken)
+        {
+            ArgumentNullException.ThrowIfNull(descriptor);
+            var key = $"{descriptor.Bucket}:{descriptor.Key}";
+            _objects.TryRemove(key, out _);
+            return Task.CompletedTask;
+        }
+    }
+}