tiku-backend.net/Tiku.IntegrationTests/Api/CapabilityAuthorizationTests.cs

using Microsoft.Extensions.DependencyInjection;
using Tiku.Application.Security;
using Tiku.Domain.Commerce;
using Tiku.Domain.Platform;
using Tiku.Domain.Tenancy;
using Tiku.Infrastructure.Persistence;

namespace Tiku.IntegrationTests.Api;

public sealed class CapabilityAuthorizationTests
{
    [Fact]
    public async Task Entitlement_is_database_backed_and_past_due_is_read_only()
    {
        await using var factory = new ApiTestFactory();
        var tenantId = Guid.NewGuid();
        await factory.SeedAsync(
            new Tenant { Id = tenantId, Slug = tenantId.ToString("N"), Name = "Capability Tenant" },
            new PlatformSaasPlan { Code = "capability-test", Name = "Capability Test" },
            new ProductModule { Code = "content", Name = "Content" },
            new TenantSubscription
            {
                TenantId = tenantId,
                PlanCode = "capability-test",
                Status = TenantSubscriptionStatus.Active,
                StartsAt = DateTimeOffset.UtcNow.AddDays(-1),
                ExpiresAt = DateTimeOffset.UtcNow.AddDays(30)
            });

        using var scope = factory.CreateSystemScope("Verify capability authorization");
        var evaluator = scope.ServiceProvider.GetRequiredService<ICapabilityAccessEvaluator>();
        Assert.False(await evaluator.IsAllowedAsync(tenantId, "content", CapabilityOperation.Read));

        var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
        dbContext.PlanModuleEntitlements.Add(new PlanModuleEntitlement
        {
            PlanCode = "capability-test",
            ModuleCode = "content"
        });
        await dbContext.SaveChangesAsync();
        Assert.True(await evaluator.IsAllowedAsync(tenantId, "content", CapabilityOperation.Write));

        var subscription = dbContext.TenantSubscriptions.Single(item => item.TenantId == tenantId);
        subscription.Status = TenantSubscriptionStatus.PastDue;
        await dbContext.SaveChangesAsync();
        Assert.True(await evaluator.IsAllowedAsync(tenantId, "content", CapabilityOperation.Read));
        Assert.False(await evaluator.IsAllowedAsync(tenantId, "content", CapabilityOperation.Write));
    }
}