Initial curated itworx-knowledge-hub source from 3b1751d0d9dee551aa6994eee0093704dc334817

tests/backend/ItWorx.KnowledgeHub.IntegrationTests/Automation/ServiceAccountTokenIssuerTests.cs

@@ -0,0 +1,61 @@
+using ItWorx.KnowledgeHub.Infrastructure.Automation;
+
+namespace ItWorx.KnowledgeHub.IntegrationTests.Automation;
+
+/// <summary>
+/// Pure, deterministic parsing tests for <see cref="ServiceAccountTokenIssuer"/> — no
+/// database or container required. Regression coverage for a real defect: the
+/// base64url alphabet used for the public ID can itself contain '_', the same
+/// character used to delimit it from the secret. A naive `Split('_', 3)` mis-parsed
+/// roughly 1 in 6 randomly generated tokens; this was found via a flaky integration
+/// test (<see cref="ServiceAccountTests"/>) failing its very first bearer-authenticated
+/// call, not by inspection. See ADR-015.
+/// </summary>
+public sealed class ServiceAccountTokenIssuerTests
+{
+    private readonly ServiceAccountTokenIssuer _issuer = new();
+
+    [Fact]
+    public void Round_trips_a_freshly_issued_token()
+    {
+        var issued = _issuer.IssueNewToken();
+
+        var parsed = _issuer.TryParse(issued.RawToken, out var publicId, out var secret);
+
+        Assert.True(parsed);
+        Assert.Equal(issued.PublicId, publicId);
+        Assert.Equal(_issuer.HashSecret(secret), issued.SecretHash);
+    }
+
+    [Fact]
+    public void A_public_id_that_itself_contains_an_underscore_is_still_parsed_correctly()
+    {
+        // A synthetic token shaped exactly like a real one, deliberately constructed so
+        // the 12-character public ID contains '_' characters — the exact case that
+        // broke a delimiter-scanning parser.
+        const string publicIdWithUnderscores = "a_b_c_d_e_f_";
+        const string secret = "the-real-secret-value";
+        var rawToken = $"ikh_{publicIdWithUnderscores}_{secret}";
+
+        var parsed = _issuer.TryParse(rawToken, out var publicId, out var parsedSecret);
+
+        Assert.True(parsed);
+        Assert.Equal(publicIdWithUnderscores, publicId);
+        Assert.Equal(secret, parsedSecret);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("not-a-token")]
+    [InlineData("ikh_")]
+    [InlineData("ikh_short")]
+    [InlineData("ikh_123456789012")]
+    [InlineData("ikh_123456789012_")]
+    [InlineData("bearer_123456789012_secret")]
+    public void Malformed_or_incomplete_tokens_are_rejected(string presented)
+    {
+        var parsed = _issuer.TryParse(presented, out _, out _);
+
+        Assert.False(parsed);
+    }
+}