62 lines
2.3 KiB
C#
62 lines
2.3 KiB
C#
using ItWorx.KnowledgeHub.Infrastructure.Automation;
|
|
|
|
namespace ItWorx.KnowledgeHub.IntegrationTests.Automation;
|
|
|
|
/// <summary>
|
|
/// Pure, deterministic parsing tests for <see cref="ServiceAccountTokenIssuer"/> — no
|
|
/// database or container required. Regression coverage for a real defect: the
|
|
/// base64url alphabet used for the public ID can itself contain '_', the same
|
|
/// character used to delimit it from the secret. A naive `Split('_', 3)` mis-parsed
|
|
/// roughly 1 in 6 randomly generated tokens; this was found via a flaky integration
|
|
/// test (<see cref="ServiceAccountTests"/>) failing its very first bearer-authenticated
|
|
/// call, not by inspection. See ADR-015.
|
|
/// </summary>
|
|
public sealed class ServiceAccountTokenIssuerTests
|
|
{
|
|
private readonly ServiceAccountTokenIssuer _issuer = new();
|
|
|
|
[Fact]
|
|
public void Round_trips_a_freshly_issued_token()
|
|
{
|
|
var issued = _issuer.IssueNewToken();
|
|
|
|
var parsed = _issuer.TryParse(issued.RawToken, out var publicId, out var secret);
|
|
|
|
Assert.True(parsed);
|
|
Assert.Equal(issued.PublicId, publicId);
|
|
Assert.Equal(_issuer.HashSecret(secret), issued.SecretHash);
|
|
}
|
|
|
|
[Fact]
|
|
public void A_public_id_that_itself_contains_an_underscore_is_still_parsed_correctly()
|
|
{
|
|
// A synthetic token shaped exactly like a real one, deliberately constructed so
|
|
// the 12-character public ID contains '_' characters — the exact case that
|
|
// broke a delimiter-scanning parser.
|
|
const string publicIdWithUnderscores = "a_b_c_d_e_f_";
|
|
const string secret = "the-real-secret-value";
|
|
var rawToken = $"ikh_{publicIdWithUnderscores}_{secret}";
|
|
|
|
var parsed = _issuer.TryParse(rawToken, out var publicId, out var parsedSecret);
|
|
|
|
Assert.True(parsed);
|
|
Assert.Equal(publicIdWithUnderscores, publicId);
|
|
Assert.Equal(secret, parsedSecret);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("")]
|
|
[InlineData("not-a-token")]
|
|
[InlineData("ikh_")]
|
|
[InlineData("ikh_short")]
|
|
[InlineData("ikh_123456789012")]
|
|
[InlineData("ikh_123456789012_")]
|
|
[InlineData("bearer_123456789012_secret")]
|
|
public void Malformed_or_incomplete_tokens_are_rejected(string presented)
|
|
{
|
|
var parsed = _issuer.TryParse(presented, out _, out _);
|
|
|
|
Assert.False(parsed);
|
|
}
|
|
}
|