Adding security

2026-03-24 09:49:29 -05:00
parent 69648a3b8f
commit a3b74e62a9
59 changed files with 2480 additions and 0 deletions
@@ -0,0 +1,70 @@
+using System;
+using System.Collections.Generic;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using LCU.Library.Internal.Security.Models.Configuration;
+using LCU.Library.Internal.Security.Service;
+using Newtonsoft.Json;
+using NUnit.Framework;
+
+namespace LCU.Library.Internal.SecurityTests.Service
+{
+    public class AzureAdVerificationServiceTest
+    {
+        private readonly IAzureAdVerificationService _adVerification;
+
+        private readonly AzureAdJwtRetrievalConfiguration _configuration = new AzureAdJwtRetrievalConfiguration
+        {
+            Role = Guid.NewGuid().ToString()
+        };
+
+        public AzureAdVerificationServiceTest()
+        {
+            _adVerification = new AzureAdVerificationService(null!, _configuration);
+        }
+        
+        [TestCase(null, null)]
+        [TestCase("", null)]
+        [TestCase(null, "")]
+        [TestCase("", "")]
+        public void ValidateJwtHasAuthorizedRole_MissingOrEmptyRoleAndGroupClaims_ReturnsFalse(string? roleClaims, string? groupClaims)
+        {
+            var claims = new List<Claim>();
+            if(roleClaims is {}) claims.Add(new Claim("roles", roleClaims));
+            if(groupClaims is {}) claims.Add(new Claim("groups", groupClaims));
+            var token = new JwtSecurityToken(claims: claims);
+
+            var authorized = _adVerification.ValidateJwtHasAuthorizedRole(token);
+            
+            Assert.That(authorized, Is.False);
+        }
+        
+        [Test]
+        public void ValidateJwtHasAuthorizedRole_RoleClaimContainsConfiguredRole_ReturnsTrue()
+        {
+            var claims = new List<Claim>
+            {
+                new Claim("roles", JsonConvert.SerializeObject(new[] { _configuration.Role }))
+            };
+            var token = new JwtSecurityToken(claims: claims);
+
+            var authorized = _adVerification.ValidateJwtHasAuthorizedRole(token);
+
+            Assert.That(authorized, Is.True);
+        }
+
+        [Test]
+        public void ValidateJwtHasAuthorizedRole_GroupClaimContainsConfiguredRole_ReturnsTrue()
+        {
+            var claims = new List<Claim>
+            {
+                new Claim("groups", JsonConvert.SerializeObject(new[] { _configuration.Role }))
+            };
+            var token = new JwtSecurityToken(claims: claims);
+
+            var authorized = _adVerification.ValidateJwtHasAuthorizedRole(token);
+            
+            Assert.That(authorized, Is.True);
+        }
+    }
+}
@@ -0,0 +1,110 @@
+using System;
+using System.Collections.Generic;
+using System.IdentityModel.Tokens.Jwt;
+using System.Threading.Tasks;
+using LCU.Library.Internal.Security.Models.AuthRequest;
+using LCU.Library.Internal.Security.Service;
+using Microsoft.AspNetCore.Mvc;
+using NUnit.Framework;
+
+namespace LCU.Library.Internal.SecurityTests.Service
+{
+    public class UsernamePasswordAuthorizationServiceTest
+    {
+        private readonly IUsernamePasswordAuthorizationService _service;
+
+        private readonly FakeAzureAdVerificationService _activeDirectoryService = new FakeAzureAdVerificationService();
+
+        public UsernamePasswordAuthorizationServiceTest()
+        {
+            _service = new UsernamePasswordAuthorizationService(_activeDirectoryService);
+        }
+
+        [Test]
+        public async Task OnAuthorizationAsync_NullJWTFromAd_ReturnsUnauthorized()
+        {
+            var authResult = await _service.OnAuthorizationAsync(AuthRequestFactory());
+
+            Assert.IsInstanceOf<UnauthorizedResult>(authResult);
+        }
+
+        [Test]
+        public async Task OnAuthorizationAsync_JWTNotAuthorizedByRole_ReturnsForbidden()
+        {
+            var request = AuthRequestFactory();
+            _activeDirectoryService.SetAuthenticable(request.UserName, request.Password);
+
+            var authResult = await _service.OnAuthorizationAsync(request);
+
+            Assert.IsInstanceOf<ForbidResult>(authResult);
+        }
+
+        [Test]
+        public async Task OnAuthorizationAsync_JWTAuthorized_ReturnsNull()
+        {
+            var request = AuthRequestFactory();
+            _activeDirectoryService.SetAuthenticable(request.UserName, request.Password);
+            _activeDirectoryService.SetAuthorized(request.UserName, request.Password);
+
+            var authResult = await _service.OnAuthorizationAsync(request);
+
+            Assert.IsNull(authResult);
+        }
+
+        private static AuthRequest AuthRequestFactory() => new AuthRequest
+        {
+            UserName = Guid.NewGuid().ToString(),
+            Password = Guid.NewGuid().ToString()
+        };
+
+        private class FakeAzureAdVerificationService : IAzureAdVerificationService
+        {
+            private readonly IDictionary<string, IDictionary<string, JwtSecurityToken>> _tokens =
+                new Dictionary<string, IDictionary<string, JwtSecurityToken>>();
+
+            private readonly IList<JwtSecurityToken> _authorizedTokens = new List<JwtSecurityToken>();
+
+            public void SetAuthenticable(string userName, string password)
+            {
+                if (_tokens.TryGetValue(userName, out var userPasswords))
+                {
+                    userPasswords[password] = new JwtSecurityToken();
+                }
+                else
+                {
+                    _tokens[userName] = new Dictionary<string, JwtSecurityToken>
+                    {
+                        [password] = new JwtSecurityToken()
+                    };
+                }
+            }
+
+            public void SetAuthorized(string userName, string password)
+            {
+                _authorizedTokens.Add(_tokens[userName][password]);
+            }
+
+            public Task<JwtSecurityToken> GetTokenForWebApiUsingUsernamePasswordAsync(string userName, string password)
+            {
+                return Task.FromResult
+                (
+                    _tokens.TryGetValue(userName, out var userPassword)
+                        ? userPassword.TryGetValue(password, out var token)
+                            ? token
+                            : null
+                        : null
+                );
+            }
+
+            public bool ValidateJwtHasAuthorizedRole(JwtSecurityToken jsonToken)
+            {
+                return _authorizedTokens.Contains(jsonToken);
+            }
+            
+            public bool ValidateJwtHasAuthorizedRole(JwtSecurityToken jsonToken, List<string> approvedRoles)
+            {
+                return _authorizedTokens.Contains(jsonToken);
+            }
+        }
+    }
+}