350 lines
13 KiB
C#
350 lines
13 KiB
C#
using System.Net;
|
|
using System.Net.Http.Json;
|
|
using System.Text.Json;
|
|
using Microsoft.Extensions.DependencyInjection;
|
|
using Microsoft.Extensions.Options;
|
|
using Tiku.Application.Auth;
|
|
using Tiku.Api.Contracts;
|
|
using Tiku.Domain.Identity;
|
|
using Tiku.Domain.Tenancy;
|
|
using Tiku.Infrastructure.Auth;
|
|
using Tiku.Infrastructure.Commerce;
|
|
using Tiku.Infrastructure.Persistence;
|
|
|
|
namespace Tiku.IntegrationTests.Api;
|
|
|
|
public sealed class AuthEndpointTests
|
|
{
|
|
[Fact]
|
|
public async Task Custom_host_rejects_jwt_from_another_tenant_and_ignores_spoofed_tenant_header()
|
|
{
|
|
await using var factory = new ApiTestFactory();
|
|
var tenantB = await SeedLoginUserAsync(factory);
|
|
var tenantAId = Guid.NewGuid();
|
|
await factory.SeedAsync(
|
|
new Tenant
|
|
{
|
|
Id = tenantAId,
|
|
Slug = "tenant-a",
|
|
Name = "Tenant A",
|
|
Status = TenantStatus.Active,
|
|
Mode = TenantMode.Saas
|
|
},
|
|
new TenantDomain
|
|
{
|
|
TenantId = tenantAId,
|
|
Host = "a.example.test",
|
|
DomainType = TenantDomainType.Custom,
|
|
Status = TenantDomainStatus.Active,
|
|
IsPrimary = true
|
|
});
|
|
using var client = factory.CreateClient();
|
|
var loginResponse = await client.PostAsJsonAsync(
|
|
"/api/auth/login/password",
|
|
new PasswordLoginDto
|
|
{
|
|
TenantCode = tenantB.TenantId.ToString("N"),
|
|
Phone = tenantB.Phone,
|
|
Password = "passw0rd!"
|
|
});
|
|
var loginJson = await ReadJsonAsync(loginResponse);
|
|
var accessToken = loginJson.RootElement.GetProperty("tokens").GetProperty("accessToken").GetString();
|
|
|
|
using var jwtRequest = new HttpRequestMessage(HttpMethod.Get, "/api/me");
|
|
jwtRequest.Headers.Host = "a.example.test";
|
|
jwtRequest.Headers.Authorization = new("Bearer", accessToken);
|
|
var jwtResponse = await client.SendAsync(jwtRequest);
|
|
|
|
using var spoofRequest = new HttpRequestMessage(HttpMethod.Post, "/api/auth/login/password");
|
|
spoofRequest.Headers.Host = "a.example.test";
|
|
spoofRequest.Headers.Add("x-tenant-code", tenantB.TenantId.ToString("N"));
|
|
spoofRequest.Content = JsonContent.Create(new PasswordLoginDto
|
|
{
|
|
Phone = tenantB.Phone,
|
|
Password = "passw0rd!"
|
|
});
|
|
var spoofResponse = await client.SendAsync(spoofRequest);
|
|
|
|
Assert.Equal(HttpStatusCode.Forbidden, jwtResponse.StatusCode);
|
|
Assert.NotEqual(HttpStatusCode.OK, spoofResponse.StatusCode);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Password_login_can_access_current_user_and_tenant()
|
|
{
|
|
await using var factory = new ApiTestFactory();
|
|
var seed = await SeedLoginUserAsync(factory);
|
|
using var client = factory.CreateClient();
|
|
|
|
var loginResponse = await client.PostAsJsonAsync(
|
|
"/api/auth/login/password",
|
|
new PasswordLoginDto
|
|
{
|
|
TenantCode = seed.TenantId.ToString("N"),
|
|
Phone = seed.Phone,
|
|
Password = "passw0rd!"
|
|
});
|
|
var loginJson = await ReadJsonAsync(loginResponse);
|
|
var accessToken = loginJson.RootElement
|
|
.GetProperty("tokens")
|
|
.GetProperty("accessToken")
|
|
.GetString();
|
|
|
|
client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
|
|
var meResponse = await client.GetAsync("/api/me");
|
|
var tenantResponse = await client.GetAsync("/api/tenants/current");
|
|
|
|
Assert.Equal(HttpStatusCode.OK, loginResponse.StatusCode);
|
|
Assert.Equal(HttpStatusCode.OK, meResponse.StatusCode);
|
|
Assert.Equal(HttpStatusCode.OK, tenantResponse.StatusCode);
|
|
Assert.Contains(seed.UserId.ToString(), await meResponse.Content.ReadAsStringAsync(), StringComparison.OrdinalIgnoreCase);
|
|
Assert.Contains(seed.TenantId.ToString(), await tenantResponse.Content.ReadAsStringAsync(), StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Sms_login_can_access_current_user()
|
|
{
|
|
await using var factory = new ApiTestFactory();
|
|
var seed = await SeedLoginUserAsync(factory);
|
|
await SeedSmsCodeAsync(factory, seed.TenantId, seed.Phone, "123456");
|
|
using var client = factory.CreateClient();
|
|
|
|
var loginResponse = await client.PostAsJsonAsync(
|
|
"/api/auth/login/sms",
|
|
new SmsLoginDto
|
|
{
|
|
TenantCode = seed.TenantId.ToString("N"),
|
|
Phone = seed.Phone,
|
|
Code = "123456"
|
|
});
|
|
var loginJson = await ReadJsonAsync(loginResponse);
|
|
var accessToken = loginJson.RootElement
|
|
.GetProperty("tokens")
|
|
.GetProperty("accessToken")
|
|
.GetString();
|
|
|
|
client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
|
|
var meResponse = await client.GetAsync("/api/me");
|
|
|
|
Assert.Equal(HttpStatusCode.OK, loginResponse.StatusCode);
|
|
Assert.Equal(HttpStatusCode.OK, meResponse.StatusCode);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Logout_revokes_access_and_refresh_tokens()
|
|
{
|
|
await using var factory = new ApiTestFactory();
|
|
var seed = await SeedLoginUserAsync(factory);
|
|
using var client = factory.CreateClient();
|
|
var loginResponse = await client.PostAsJsonAsync(
|
|
"/api/auth/login/password",
|
|
new PasswordLoginDto
|
|
{
|
|
TenantCode = seed.TenantId.ToString("N"),
|
|
Phone = seed.Phone,
|
|
Password = "passw0rd!"
|
|
});
|
|
var loginJson = await ReadJsonAsync(loginResponse);
|
|
var tokens = loginJson.RootElement.GetProperty("tokens");
|
|
var accessToken = tokens.GetProperty("accessToken").GetString();
|
|
var refreshToken = tokens.GetProperty("refreshToken").GetString();
|
|
|
|
var logoutResponse = await client.PostAsJsonAsync(
|
|
"/api/auth/logout",
|
|
new RefreshSessionDto { RefreshToken = refreshToken! });
|
|
client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
|
|
var meResponse = await client.GetAsync("/api/me");
|
|
var refreshResponse = await client.PostAsJsonAsync(
|
|
"/api/auth/refresh",
|
|
new RefreshSessionDto { RefreshToken = refreshToken! });
|
|
|
|
Assert.Equal(HttpStatusCode.NoContent, logoutResponse.StatusCode);
|
|
Assert.Equal(HttpStatusCode.Unauthorized, meResponse.StatusCode);
|
|
Assert.Equal(HttpStatusCode.Unauthorized, refreshResponse.StatusCode);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Wechat_miniapp_login_can_access_current_user()
|
|
{
|
|
await using var factory = new ApiTestFactory(new FakeWechatOAuthClient());
|
|
var tenantId = Guid.NewGuid();
|
|
var secretRef = "tenant_secrets:identity:wechat_miniapp:default";
|
|
var protectedSecret = ProtectTenantSecret(
|
|
tenantId,
|
|
secretRef,
|
|
JsonSerializer.SerializeToElement(new { appSecret = "wx-app-secret" }));
|
|
await factory.SeedAsync(
|
|
new Tenant
|
|
{
|
|
Id = tenantId,
|
|
Slug = tenantId.ToString("N"),
|
|
Name = "Wechat Tenant"
|
|
},
|
|
new TenantExternalProvider
|
|
{
|
|
TenantId = tenantId,
|
|
Provider = "wechat_miniapp",
|
|
Capability = TenantExternalProviderCapability.Identity,
|
|
Status = TenantExternalProviderStatus.Active,
|
|
SecretRef = secretRef,
|
|
ConfigPublic = JsonSerializer.SerializeToElement(new
|
|
{
|
|
appId = "wx-app-id"
|
|
})
|
|
},
|
|
new TenantSecret
|
|
{
|
|
TenantId = tenantId,
|
|
Purpose = "identity",
|
|
Provider = "wechat_miniapp",
|
|
SecretKey = "default",
|
|
SecretRef = secretRef,
|
|
Status = TenantSecretStatus.Active,
|
|
EncryptionKeyId = protectedSecret.KeyId,
|
|
EncryptedPayload = protectedSecret.Ciphertext,
|
|
EncryptionNonce = protectedSecret.Nonce,
|
|
EncryptionTag = protectedSecret.Tag
|
|
});
|
|
using var client = factory.CreateClient();
|
|
|
|
var loginResponse = await client.PostAsJsonAsync(
|
|
"/api/auth/oauth/wechat-miniapp",
|
|
new OAuthCodeDto
|
|
{
|
|
TenantCode = tenantId.ToString("N"),
|
|
Code = "wx-code"
|
|
});
|
|
var loginJson = await ReadJsonAsync(loginResponse);
|
|
var accessToken = loginJson.RootElement
|
|
.GetProperty("tokens")
|
|
.GetProperty("accessToken")
|
|
.GetString();
|
|
|
|
client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
|
|
var meResponse = await client.GetAsync("/api/me");
|
|
using var scope = factory.CreateSystemScope();
|
|
var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
|
|
|
|
Assert.Equal(HttpStatusCode.OK, loginResponse.StatusCode);
|
|
Assert.Equal(HttpStatusCode.OK, meResponse.StatusCode);
|
|
Assert.Contains(dbContext.UserIdentities, identity =>
|
|
identity.Provider == "wechat_miniapp" &&
|
|
identity.OpenId == "mini-open-id" &&
|
|
identity.UnionId == "union-id");
|
|
}
|
|
|
|
private static async Task<(Guid TenantId, Guid UserId, string Phone)> SeedLoginUserAsync(
|
|
ApiTestFactory factory)
|
|
{
|
|
var tenantId = Guid.NewGuid();
|
|
var userId = Guid.NewGuid();
|
|
var phone = "13800000000";
|
|
var passwordHash = new PasswordHasher().Hash("passw0rd!");
|
|
|
|
await factory.SeedAsync(
|
|
new Tenant
|
|
{
|
|
Id = tenantId,
|
|
Slug = tenantId.ToString("N"),
|
|
Name = "Test Tenant"
|
|
},
|
|
new User
|
|
{
|
|
Id = userId,
|
|
Phone = phone,
|
|
Name = "Test User"
|
|
},
|
|
new TenantMembership
|
|
{
|
|
TenantId = tenantId,
|
|
UserId = userId,
|
|
Role = TenantRole.TenantAdmin,
|
|
Status = MembershipStatus.Active
|
|
},
|
|
new UserIdentity
|
|
{
|
|
UserId = userId,
|
|
Provider = "password",
|
|
ProviderSubject = phone,
|
|
Phone = phone,
|
|
SecretPayload = CreateSecretPayload(passwordHash)
|
|
});
|
|
|
|
return (tenantId, userId, phone);
|
|
}
|
|
|
|
private static async Task SeedSmsCodeAsync(
|
|
ApiTestFactory factory,
|
|
Guid tenantId,
|
|
string phone,
|
|
string code)
|
|
{
|
|
using var scope = factory.CreateSystemScope();
|
|
var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
|
|
dbContext.SmsVerificationCodes.Add(new SmsVerificationCode
|
|
{
|
|
TenantId = tenantId,
|
|
Phone = phone,
|
|
Purpose = SmsPurpose.Login,
|
|
CodeHash = SmsCodeHashing.Hash(tenantId, phone, SmsPurpose.Login, code),
|
|
Status = SmsVerificationStatus.Sent,
|
|
ExpiresAt = DateTimeOffset.UtcNow.AddMinutes(5)
|
|
});
|
|
await dbContext.SaveChangesAsync();
|
|
}
|
|
|
|
private static async Task<JsonDocument> ReadJsonAsync(HttpResponseMessage response)
|
|
{
|
|
var stream = await response.Content.ReadAsStreamAsync();
|
|
return await JsonDocument.ParseAsync(stream);
|
|
}
|
|
|
|
private static JsonElement CreateSecretPayload(string passwordHash)
|
|
{
|
|
using var document = JsonDocument.Parse(
|
|
$$"""{"passwordHash":{{JsonSerializer.Serialize(passwordHash)}}}""");
|
|
return document.RootElement.Clone();
|
|
}
|
|
|
|
private static ProtectedTenantSecret ProtectTenantSecret(Guid tenantId, string secretRef, JsonElement payload)
|
|
{
|
|
var protector = new TenantSecretProtector(Options.Create(new TenantSecretEncryptionOptions
|
|
{
|
|
KeyId = "development-v1",
|
|
MasterKey = TenantSecretEncryptionOptions.DevelopmentMasterKey
|
|
}));
|
|
return protector.Protect(tenantId, secretRef, payload);
|
|
}
|
|
|
|
private sealed class FakeWechatOAuthClient : IWechatOAuthClient
|
|
{
|
|
public Task<WechatIdentity> ExchangeWebCodeAsync(
|
|
WechatProviderOptions options,
|
|
string code,
|
|
CancellationToken cancellationToken = default)
|
|
{
|
|
return Task.FromResult(new WechatIdentity(
|
|
"web-open-id",
|
|
"union-id",
|
|
"Wechat User",
|
|
"https://example.test/avatar.png",
|
|
null,
|
|
"""{"openid":"web-open-id","unionid":"union-id"}"""));
|
|
}
|
|
|
|
public Task<WechatIdentity> ExchangeMiniAppCodeAsync(
|
|
WechatProviderOptions options,
|
|
string code,
|
|
CancellationToken cancellationToken = default)
|
|
{
|
|
return Task.FromResult(new WechatIdentity(
|
|
"mini-open-id",
|
|
"union-id",
|
|
null,
|
|
null,
|
|
"session-key",
|
|
"""{"openid":"mini-open-id","unionid":"union-id","session_key":"session-key"}"""));
|
|
}
|
|
}
|
|
}
|