wangziqi/tiku-backend.net
1
0
Fork 0
forked from gongxuegit/tiku-backend.net
Code Pull Requests Activity

feat: harden SaaS authentication and authorization

Browse Source
This commit is contained in:
xiong
2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
Tiku.IntegrationTests/Api/ProductionConfigurationTests.cs
View File

@@ -32,15 +32,42 @@ public sealed class ProductionConfigurationTests
}
[Fact]
public void Production_rejects_the_committed_development_jwt_key()
public void Production_requires_an_explicit_rsa_private_key()
{
var options = new JwtOptions
{
SigningKey = OptionsValidation.DevelopmentSigningKey
KeyId = "production-key",
PrivateKeyPem = string.Empty
};
Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
Assert.True(OptionsValidation.BeValidJwtOptions(options, isProduction: false));
options.PrivateKeyPem = TestJwtKeys.PrivateKeyPem;
Assert.True(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
}
[Fact]
public void Jwt_configuration_rejects_development_kid_malformed_keys_and_current_kid_in_old_key_set()
{
var options = new JwtOptions
{
KeyId = "development-ephemeral",
PrivateKeyPem = TestJwtKeys.PrivateKeyPem
};
Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
options.KeyId = "current-key";
options.PrivateKeyPem = "-----BEGIN PRIVATE KEY-----\ninvalid\n-----END PRIVATE KEY-----";
Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: false));
options.PrivateKeyPem = TestJwtKeys.PrivateKeyPem;
options.PublicKeys[options.KeyId] = TestJwtKeys.PublicKeyPem;
Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: false));
options.PublicKeys.Clear();
options.PublicKeys["old-key"] = TestJwtKeys.PublicKeyPem;
Assert.True(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
}
[Fact]