89 lines
3.3 KiB
C#
89 lines
3.3 KiB
C#
using Microsoft.Extensions.Configuration;
|
|
using Tiku.Api.Options;
|
|
using Tiku.Application.Security;
|
|
using Tiku.Infrastructure.Commerce;
|
|
|
|
namespace Tiku.IntegrationTests.Api;
|
|
|
|
public sealed class ProductionConfigurationTests
|
|
{
|
|
[Fact]
|
|
public void Database_connection_is_required_outside_development()
|
|
{
|
|
var configuration = new ConfigurationBuilder().Build();
|
|
|
|
var exception = Assert.Throws<InvalidOperationException>(() =>
|
|
OptionsValidation.ResolveDatabaseConnectionString(configuration, isDevelopment: false));
|
|
|
|
Assert.Contains("Database connection is required", exception.Message, StringComparison.Ordinal);
|
|
}
|
|
|
|
[Fact]
|
|
public void Development_database_default_uses_current_system_user_without_a_password()
|
|
{
|
|
var configuration = new ConfigurationBuilder().Build();
|
|
|
|
var connectionString = OptionsValidation.ResolveDatabaseConnectionString(
|
|
configuration,
|
|
isDevelopment: true);
|
|
|
|
Assert.Contains($"Username={Environment.UserName}", connectionString, StringComparison.Ordinal);
|
|
Assert.DoesNotContain("Password=", connectionString, StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
[Fact]
|
|
public void Production_requires_an_explicit_rsa_private_key()
|
|
{
|
|
var options = new JwtOptions
|
|
{
|
|
KeyId = "production-key",
|
|
PrivateKeyPem = string.Empty
|
|
};
|
|
|
|
Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
|
|
Assert.True(OptionsValidation.BeValidJwtOptions(options, isProduction: false));
|
|
|
|
options.PrivateKeyPem = TestJwtKeys.PrivateKeyPem;
|
|
Assert.True(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
|
|
}
|
|
|
|
[Fact]
|
|
public void Jwt_configuration_rejects_development_kid_malformed_keys_and_current_kid_in_old_key_set()
|
|
{
|
|
var options = new JwtOptions
|
|
{
|
|
KeyId = "development-ephemeral",
|
|
PrivateKeyPem = TestJwtKeys.PrivateKeyPem
|
|
};
|
|
Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
|
|
|
|
options.KeyId = "current-key";
|
|
options.PrivateKeyPem = "-----BEGIN PRIVATE KEY-----\ninvalid\n-----END PRIVATE KEY-----";
|
|
Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: false));
|
|
|
|
options.PrivateKeyPem = TestJwtKeys.PrivateKeyPem;
|
|
options.PublicKeys[options.KeyId] = TestJwtKeys.PublicKeyPem;
|
|
Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: false));
|
|
|
|
options.PublicKeys.Clear();
|
|
options.PublicKeys["old-key"] = TestJwtKeys.PublicKeyPem;
|
|
Assert.True(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
|
|
}
|
|
|
|
[Fact]
|
|
public void Tenant_secret_encryption_requires_a_32_byte_base64_key()
|
|
{
|
|
Assert.False(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions()));
|
|
Assert.False(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions
|
|
{
|
|
KeyId = "key-v1",
|
|
MasterKey = Convert.ToBase64String(new byte[16])
|
|
}));
|
|
Assert.True(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions
|
|
{
|
|
KeyId = "key-v1",
|
|
MasterKey = Convert.ToBase64String(new byte[32])
|
|
}));
|
|
}
|
|
}
|