Initial commit (history squashed)

src/StellaOps.Authority/StellaOps.Auth.Abstractions.Tests/NetworkMaskMatcherTests.cs

@@ -0,0 +1,75 @@
+using System;
+using System.Net;
+using StellaOps.Auth.Abstractions;
+using Xunit;
+
+namespace StellaOps.Auth.Abstractions.Tests;
+
+public class NetworkMaskMatcherTests
+{
+    [Fact]
+    public void Parse_SingleAddress_YieldsHostMask()
+    {
+        var mask = NetworkMask.Parse("192.168.1.42");
+
+        Assert.Equal(32, mask.PrefixLength);
+        Assert.True(mask.Contains(IPAddress.Parse("192.168.1.42")));
+        Assert.False(mask.Contains(IPAddress.Parse("192.168.1.43")));
+    }
+
+    [Fact]
+    public void Parse_Cidr_NormalisesHostBits()
+    {
+        var mask = NetworkMask.Parse("10.0.15.9/20");
+
+        Assert.Equal("10.0.0.0/20", mask.ToString());
+        Assert.True(mask.Contains(IPAddress.Parse("10.0.8.1")));
+        Assert.False(mask.Contains(IPAddress.Parse("10.0.32.1")));
+    }
+
+    [Fact]
+    public void Contains_ReturnsFalse_ForMismatchedAddressFamily()
+    {
+        var mask = NetworkMask.Parse("192.168.0.0/16");
+
+        Assert.False(mask.Contains(IPAddress.IPv6Loopback));
+    }
+
+    [Fact]
+    public void Matcher_AllowsAll_WhenStarProvided()
+    {
+        var matcher = new NetworkMaskMatcher(new[] { "*" });
+
+        Assert.False(matcher.IsEmpty);
+        Assert.True(matcher.IsAllowed(IPAddress.Parse("203.0.113.10")));
+        Assert.True(matcher.IsAllowed(IPAddress.IPv6Loopback));
+    }
+
+    [Fact]
+    public void Matcher_ReturnsFalse_WhenNoMasksConfigured()
+    {
+        var matcher = new NetworkMaskMatcher(Array.Empty<string>());
+
+        Assert.True(matcher.IsEmpty);
+        Assert.False(matcher.IsAllowed(IPAddress.Parse("127.0.0.1")));
+        Assert.False(matcher.IsAllowed(null));
+    }
+
+    [Fact]
+    public void Matcher_SupportsIpv4AndIpv6Masks()
+    {
+        var matcher = new NetworkMaskMatcher(new[] { "192.168.0.0/24", "::1/128" });
+
+        Assert.True(matcher.IsAllowed(IPAddress.Parse("192.168.0.42")));
+        Assert.False(matcher.IsAllowed(IPAddress.Parse("10.0.0.1")));
+        Assert.True(matcher.IsAllowed(IPAddress.IPv6Loopback));
+        Assert.False(matcher.IsAllowed(IPAddress.IPv6Any));
+    }
+
+    [Fact]
+    public void Matcher_Throws_ForInvalidEntries()
+    {
+        var exception = Assert.Throws<FormatException>(() => new NetworkMaskMatcher(new[] { "invalid-mask" }));
+        Assert.Contains("invalid-mask", exception.Message, StringComparison.OrdinalIgnoreCase);
+    }
+}

src/StellaOps.Authority/StellaOps.Auth.Abstractions.Tests/StellaOps.Auth.Abstractions.Tests.csproj

@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\StellaOps.Auth.Abstractions\StellaOps.Auth.Abstractions.csproj" />
+  </ItemGroup>
+</Project>

src/StellaOps.Authority/StellaOps.Auth.Abstractions.Tests/StellaOpsPrincipalBuilderTests.cs

@@ -0,0 +1,74 @@
+using System;
+using System.Linq;
+using System.Security.Claims;
+using StellaOps.Auth.Abstractions;
+using Xunit;
+
+namespace StellaOps.Auth.Abstractions.Tests;
+
+public class StellaOpsPrincipalBuilderTests
+{
+    [Fact]
+    public void NormalizedScopes_AreSortedDeduplicatedLowerCased()
+    {
+        var builder = new StellaOpsPrincipalBuilder()
+            .WithScopes(new[] { "Feedser.Jobs.Trigger", " feedser.jobs.trigger ", "AUTHORITY.USERS.MANAGE" })
+            .WithAudiences(new[] { " api://feedser ", "api://cli", "api://feedser" });
+
+        Assert.Equal(
+            new[] { "authority.users.manage", "feedser.jobs.trigger" },
+            builder.NormalizedScopes);
+
+        Assert.Equal(
+            new[] { "api://cli", "api://feedser" },
+            builder.Audiences);
+    }
+
+    [Fact]
+    public void Build_ConstructsClaimsPrincipalWithNormalisedValues()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var builder = new StellaOpsPrincipalBuilder()
+            .WithSubject(" user-1 ")
+            .WithClientId(" cli-01 ")
+            .WithTenant(" default ")
+            .WithName("  Jane Doe ")
+            .WithIdentityProvider(" internal ")
+            .WithSessionId(" session-123 ")
+            .WithTokenId(Guid.NewGuid().ToString("N"))
+            .WithAuthenticationMethod("password")
+            .WithAuthenticationType(" custom ")
+            .WithScopes(new[] { "Feedser.Jobs.Trigger", "AUTHORITY.USERS.MANAGE" })
+            .WithAudience(" api://feedser ")
+            .WithIssuedAt(now)
+            .WithExpires(now.AddMinutes(5))
+            .AddClaim(" custom ", " value ");
+
+        var principal = builder.Build();
+        var identity = Assert.IsType<ClaimsIdentity>(principal.Identity);
+
+        Assert.Equal("custom", identity.AuthenticationType);
+        Assert.Equal("Jane Doe", identity.Name);
+        Assert.Equal("user-1", principal.FindFirstValue(StellaOpsClaimTypes.Subject));
+        Assert.Equal("cli-01", principal.FindFirstValue(StellaOpsClaimTypes.ClientId));
+        Assert.Equal("default", principal.FindFirstValue(StellaOpsClaimTypes.Tenant));
+        Assert.Equal("internal", principal.FindFirstValue(StellaOpsClaimTypes.IdentityProvider));
+        Assert.Equal("session-123", principal.FindFirstValue(StellaOpsClaimTypes.SessionId));
+        Assert.Equal("value", principal.FindFirstValue("custom"));
+
+        var scopeClaims = principal.Claims.Where(claim => claim.Type == StellaOpsClaimTypes.ScopeItem).Select(claim => claim.Value).ToArray();
+        Assert.Equal(new[] { "authority.users.manage", "feedser.jobs.trigger" }, scopeClaims);
+
+        var scopeList = principal.FindFirstValue(StellaOpsClaimTypes.Scope);
+        Assert.Equal("authority.users.manage feedser.jobs.trigger", scopeList);
+
+        var audienceClaims = principal.Claims.Where(claim => claim.Type == StellaOpsClaimTypes.Audience).Select(claim => claim.Value).ToArray();
+        Assert.Equal(new[] { "api://feedser" }, audienceClaims);
+
+        var issuedAt = principal.FindFirstValue("iat");
+        Assert.Equal(now.ToUnixTimeSeconds().ToString(), issuedAt);
+
+        var expires = principal.FindFirstValue("exp");
+        Assert.Equal(now.AddMinutes(5).ToUnixTimeSeconds().ToString(), expires);
+    }
+}

src/StellaOps.Authority/StellaOps.Auth.Abstractions.Tests/StellaOpsProblemResultFactoryTests.cs

@@ -0,0 +1,53 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http.HttpResults;
+using Microsoft.AspNetCore.Mvc;
+using StellaOps.Auth.Abstractions;
+using Xunit;
+
+namespace StellaOps.Auth.Abstractions.Tests;
+
+public class StellaOpsProblemResultFactoryTests
+{
+    [Fact]
+    public void AuthenticationRequired_ReturnsCanonicalProblem()
+    {
+        var result = StellaOpsProblemResultFactory.AuthenticationRequired(instance: "/jobs");
+
+        Assert.Equal(StatusCodes.Status401Unauthorized, result.StatusCode);
+        var details = Assert.IsType<ProblemDetails>(result.ProblemDetails);
+        Assert.Equal("https://docs.stella-ops.org/problems/authentication-required", details.Type);
+        Assert.Equal("Authentication required", details.Title);
+        Assert.Equal("/jobs", details.Instance);
+        Assert.Equal("unauthorized", details.Extensions["error"]);
+        Assert.Equal(details.Detail, details.Extensions["error_description"]);
+    }
+
+    [Fact]
+    public void InvalidToken_UsesProvidedDetail()
+    {
+        var result = StellaOpsProblemResultFactory.InvalidToken("expired refresh token");
+
+        var details = Assert.IsType<ProblemDetails>(result.ProblemDetails);
+        Assert.Equal(StatusCodes.Status401Unauthorized, result.StatusCode);
+        Assert.Equal("expired refresh token", details.Detail);
+        Assert.Equal("invalid_token", details.Extensions["error"]);
+    }
+
+    [Fact]
+    public void InsufficientScope_AddsScopeExtensions()
+    {
+        var result = StellaOpsProblemResultFactory.InsufficientScope(
+            new[] { StellaOpsScopes.FeedserJobsTrigger },
+            new[] { StellaOpsScopes.AuthorityUsersManage },
+            instance: "/jobs/trigger");
+
+        Assert.Equal(StatusCodes.Status403Forbidden, result.StatusCode);
+
+        var details = Assert.IsType<ProblemDetails>(result.ProblemDetails);
+        Assert.Equal("https://docs.stella-ops.org/problems/insufficient-scope", details.Type);
+        Assert.Equal("insufficient_scope", details.Extensions["error"]);
+        Assert.Equal(new[] { StellaOpsScopes.FeedserJobsTrigger }, Assert.IsType<string[]>(details.Extensions["required_scopes"]));
+        Assert.Equal(new[] { StellaOpsScopes.AuthorityUsersManage }, Assert.IsType<string[]>(details.Extensions["granted_scopes"]));
+        Assert.Equal("/jobs/trigger", details.Instance);
+    }
+}