IdentityShroud/IdentityShroud.Api.Tests/Apis/RealmApisTests.cs

using System.Buffers.Text;
using System.Net;
using System.Net.Http.Json;
using System.Security.Cryptography;
using System.Text.Json.Nodes;
using IdentityShroud.Core.EFCore;
using IdentityShroud.Core.Model;
using IdentityShroud.Core.Tests.Fixtures;
using IdentityShroud.TestUtils.Asserts;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;

namespace IdentityShroud.Api.Tests.Apis;

public class RealmApisTests : IClassFixture<ApplicationFactory>
{
    private readonly ApplicationFactory _factory;

    public RealmApisTests(ApplicationFactory factory)
    {
        _factory = factory;

        using var scope = _factory.Services.CreateScope();
        var db = scope.ServiceProvider.GetRequiredService<Db>();
        if (!db.Database.EnsureCreated())
        {
            db.Database.ExecuteSqlRaw("TRUNCATE realm CASCADE;");
        }
    }

    [Theory]
    [InlineData(null, null, null, false, "Name")]
    [InlineData(null, null, "Foo", true, "")]
    [InlineData(null, null, "", false, "Name")]
    [InlineData(null, "foo", "Foo", true, "")]
    [InlineData(null, "f/oo", "Foo", false, "Slug")]
    [InlineData(null, "", "Foo", false, "Slug")]
    [InlineData("0814934a-efe2-4784-ba84-a184c0b9de9e", "foo", "Foo", true, "")]
    [InlineData("00000000-0000-0000-0000-000000000000", "foo", "Foo", false, "Id")]
    public async Task Create(string? id, string? slug, string? name, bool succeeds, string fieldName)
    {
        var client = _factory.CreateClient();

        Guid? inputId = id is null ? (Guid?)null : new Guid(id);
        
        // act
        var response = await client.PostAsync("/api/v1/realms", JsonContent.Create(new
            {
                Id = inputId,
                Slug = slug,
                Name = name,
            }),
            TestContext.Current.CancellationToken);
#if DEBUG
        string contents = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
#endif

        if (succeeds)
        {
            Assert.Equal(HttpStatusCode.Created, response.StatusCode);
            // await factory.RealmService.Received(1).Create(
            //     Arg.Is<RealmCreateRequest>(r => r.Id == inputId && r.Slug == slug && r.Name == name),
            //     Arg.Any<CancellationToken>());
        }
        else
        {
            Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
            var problemDetails =
                await response.Content.ReadFromJsonAsync<ValidationProblemDetails>(
                    TestContext.Current.CancellationToken);

            Assert.Contains(problemDetails!.Errors, e => e.Key == fieldName);
            // await factory.RealmService.DidNotReceive().Create(
            //     Arg.Any<RealmCreateRequest>(),
            //     Arg.Any<CancellationToken>());
        }
    }

    [Fact]
    public async Task GetOpenIdConfiguration_Success()
    {
        // setup
        await ScopedContextAsync(async db =>
        {
            db.Realms.Add(new Realm() { Slug = "foo", Name = "Foo" });
            await db.SaveChangesAsync(TestContext.Current.CancellationToken);
        });

        // act
        var client = _factory.CreateClient();
        var response = await client.GetAsync("auth/realms/foo/.well-known/openid-configuration",
            TestContext.Current.CancellationToken);

        // verify
#if DEBUG
        string contents = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
#endif
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);        
        
        var result = await response.Content.ReadFromJsonAsync<JsonObject>(TestContext.Current.CancellationToken);
        Assert.NotNull(result);
        JsonObjectAssert.Equal("http://localhost/auth/realms/foo/openid-connect/auth", result, "authorization_endpoint");
        JsonObjectAssert.Equal("http://localhost/auth/realms/foo", result, "issuer");
        JsonObjectAssert.Equal("http://localhost/auth/realms/foo/openid-connect/token", result, "token_endpoint");
        JsonObjectAssert.Equal("http://localhost/auth/realms/foo/openid-connect/jwks", result, "jwks_uri");
    }

    [Theory]
    [InlineData("")]
    [InlineData("bar")]
    public async Task GetOpenIdConfiguration_NotFound(string slug)
    {
        // act
        var client = _factory.CreateClient();
        var response = await client.GetAsync($"/realms/{slug}/.well-known/openid-configuration",
            TestContext.Current.CancellationToken);
        
        // verify
        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
    }

    [Fact]
    public async Task GetJwks()
    {
        var client = _factory.CreateClient();
        var createResponse = await client.PostAsync("/api/v1/realms", JsonContent.Create(new
            {
                Slug = "foo",
                Name = "Test'",
            }),
            TestContext.Current.CancellationToken);
        Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
        
        // act
        var response = await client.GetAsync("/auth/realms/foo/openid-connect/jwks",
            TestContext.Current.CancellationToken);
        
        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        JsonObject? payload = await response.Content.ReadFromJsonAsync<JsonObject>(TestContext.Current.CancellationToken);

        Assert.NotNull(payload);
        string? kid = JsonObjectAssert.NavigateToPath(payload, "keys[0].kid")?.AsValue().ToString();
        Assert.NotNull(kid);
        Assert.True(kid.Length >= 16);

        //if (JsonObjectAssert.NavigateToPath(payload, "keys[0].kty")?.AsValue().ToString() == "RSA")

        JsonObjectAssert.Equal("RSA", payload, "keys[0].kty");
        string? n = payload["keys"]?[0]?["n"]?.AsValue().ToString();
        string? e = payload["keys"]?[0]?["e"]?.AsValue().ToString();
        AssertRsaParams(n, e);
    }
    
    private async Task ScopedContextAsync(
        Func<Db, Task> action
    ) 
    {
        using var scope = _factory.Services.CreateScope();
        var db = scope.ServiceProvider.GetRequiredService<Db>();
        await action(db);
    }

    private static void AssertRsaParams(string? n, string? e)
    {
        Assert.NotNull(n);
        Assert.NotNull(e);

        var rsa = RSA.Create();
        rsa.ImportParameters(new RSAParameters
        {
            Modulus = Base64Url.DecodeFromChars(n),
            Exponent = Base64Url.DecodeFromChars(e)
        });

        // If n and e are complete nonsense, this will throw
        var encrypted = rsa.Encrypt(new byte[] { 1, 2, 3 }, RSAEncryptionPadding.OaepSHA256);
        Assert.NotNull(encrypted);
        Assert.NotEmpty(encrypted);    
    }
}