95 lines
3.3 KiB
C#
95 lines
3.3 KiB
C#
using System.Security.Cryptography;
|
|
using System.Security.Cryptography.X509Certificates;
|
|
using Tiku.Infrastructure.Security;
|
|
|
|
namespace Tiku.UnitTests.Security;
|
|
|
|
public sealed class DataProtectionKeyRingOptionsTests
|
|
{
|
|
[Fact]
|
|
public void Development_allows_an_unencrypted_key_ring()
|
|
{
|
|
var options = new DataProtectionKeyRingOptions();
|
|
|
|
Assert.True(DataProtectionKeyRingOptions.BeValid(options, requireCertificate: false));
|
|
Assert.Null(options.LoadCertificate(requireCertificate: false));
|
|
}
|
|
|
|
[Fact]
|
|
public void Production_requires_a_certificate_path()
|
|
{
|
|
var options = new DataProtectionKeyRingOptions();
|
|
|
|
Assert.False(DataProtectionKeyRingOptions.BeValid(options, requireCertificate: true));
|
|
var exception = Assert.Throws<InvalidOperationException>(() =>
|
|
options.LoadCertificate(requireCertificate: true));
|
|
Assert.Contains("required outside Development", exception.Message, StringComparison.Ordinal);
|
|
}
|
|
|
|
[Fact]
|
|
public void Application_name_is_always_required()
|
|
{
|
|
var options = new DataProtectionKeyRingOptions
|
|
{
|
|
ApplicationName = " ",
|
|
CertificatePath = "/configured/key-ring.pfx"
|
|
};
|
|
|
|
Assert.False(DataProtectionKeyRingOptions.BeValid(options, requireCertificate: false));
|
|
Assert.False(DataProtectionKeyRingOptions.BeValid(options, requireCertificate: true));
|
|
}
|
|
|
|
[Fact]
|
|
public void Configured_certificate_file_must_be_loadable()
|
|
{
|
|
var options = new DataProtectionKeyRingOptions
|
|
{
|
|
CertificatePath = Path.Combine(
|
|
Path.GetTempPath(),
|
|
$"missing-data-protection-{Guid.NewGuid():N}.pfx")
|
|
};
|
|
|
|
Assert.True(DataProtectionKeyRingOptions.BeValid(options, requireCertificate: true));
|
|
var exception = Assert.Throws<InvalidOperationException>(() =>
|
|
options.LoadCertificate(requireCertificate: true));
|
|
Assert.Contains("could not be loaded", exception.Message, StringComparison.Ordinal);
|
|
}
|
|
|
|
[Fact]
|
|
public void Password_protected_pkcs12_certificate_with_private_key_is_loaded()
|
|
{
|
|
const string password = "unit-test-certificate-password";
|
|
var certificatePath = Path.Combine(
|
|
Path.GetTempPath(),
|
|
$"data-protection-{Guid.NewGuid():N}.pfx");
|
|
|
|
try
|
|
{
|
|
using var rsa = RSA.Create(2048);
|
|
var request = new CertificateRequest(
|
|
"CN=Tiku Data Protection Unit Test",
|
|
rsa,
|
|
HashAlgorithmName.SHA256,
|
|
RSASignaturePadding.Pkcs1);
|
|
using var certificate = request.CreateSelfSigned(
|
|
DateTimeOffset.UtcNow.AddMinutes(-1),
|
|
DateTimeOffset.UtcNow.AddDays(1));
|
|
File.WriteAllBytes(certificatePath, certificate.Export(X509ContentType.Pfx, password));
|
|
|
|
var options = new DataProtectionKeyRingOptions
|
|
{
|
|
CertificatePath = certificatePath,
|
|
CertificatePassword = password
|
|
};
|
|
|
|
using var loaded = options.LoadCertificate(requireCertificate: true);
|
|
Assert.NotNull(loaded);
|
|
Assert.True(loaded.HasPrivateKey);
|
|
}
|
|
finally
|
|
{
|
|
File.Delete(certificatePath);
|
|
}
|
|
}
|
|
}
|