feat: establish dotnet engineering foundation

Tiku.IntegrationTests/Api/ProductionConfigurationTests.cs

@@ -0,0 +1,61 @@
+using Microsoft.Extensions.Configuration;
+using Tiku.Api.Options;
+using Tiku.Application.Security;
+using Tiku.Infrastructure.Commerce;
+
+namespace Tiku.IntegrationTests.Api;
+
+public sealed class ProductionConfigurationTests
+{
+    [Fact]
+    public void Database_connection_is_required_outside_development()
+    {
+        var configuration = new ConfigurationBuilder().Build();
+
+        var exception = Assert.Throws<InvalidOperationException>(() =>
+            OptionsValidation.ResolveDatabaseConnectionString(configuration, isDevelopment: false));
+
+        Assert.Contains("Database connection is required", exception.Message, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void Development_database_default_uses_current_system_user_without_a_password()
+    {
+        var configuration = new ConfigurationBuilder().Build();
+
+        var connectionString = OptionsValidation.ResolveDatabaseConnectionString(
+            configuration,
+            isDevelopment: true);
+
+        Assert.Contains($"Username={Environment.UserName}", connectionString, StringComparison.Ordinal);
+        Assert.DoesNotContain("Password=", connectionString, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void Production_rejects_the_committed_development_jwt_key()
+    {
+        var options = new JwtOptions
+        {
+            SigningKey = OptionsValidation.DevelopmentSigningKey
+        };
+
+        Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
+        Assert.True(OptionsValidation.BeValidJwtOptions(options, isProduction: false));
+    }
+
+    [Fact]
+    public void Tenant_secret_encryption_requires_a_32_byte_base64_key()
+    {
+        Assert.False(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions()));
+        Assert.False(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions
+        {
+            KeyId = "key-v1",
+            MasterKey = Convert.ToBase64String(new byte[16])
+        }));
+        Assert.True(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions
+        {
+            KeyId = "key-v1",
+            MasterKey = Convert.ToBase64String(new byte[32])
+        }));
+    }
+}