monorepo/LCU.Library.Internal.Security/LCU.Library.Internal.SecurityTests/Service/AzureAdVerificationServiceTest.cs

using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using LCU.Library.Internal.Security.Models.Configuration;
using LCU.Library.Internal.Security.Service;
using Newtonsoft.Json;
using NUnit.Framework;

namespace LCU.Library.Internal.SecurityTests.Service
{
    public class AzureAdVerificationServiceTest
    {
        private readonly IAzureAdVerificationService _adVerification;

        private readonly AzureAdJwtRetrievalConfiguration _configuration = new AzureAdJwtRetrievalConfiguration
        {
            Role = Guid.NewGuid().ToString()
        };

        public AzureAdVerificationServiceTest()
        {
            _adVerification = new AzureAdVerificationService(null!, _configuration);
        }
        
        [TestCase(null, null)]
        [TestCase("", null)]
        [TestCase(null, "")]
        [TestCase("", "")]
        public void ValidateJwtHasAuthorizedRole_MissingOrEmptyRoleAndGroupClaims_ReturnsFalse(string? roleClaims, string? groupClaims)
        {
            var claims = new List<Claim>();
            if(roleClaims is {}) claims.Add(new Claim("roles", roleClaims));
            if(groupClaims is {}) claims.Add(new Claim("groups", groupClaims));
            var token = new JwtSecurityToken(claims: claims);

            var authorized = _adVerification.ValidateJwtHasAuthorizedRole(token);
            
            Assert.That(authorized, Is.False);
        }
        
        [Test]
        public void ValidateJwtHasAuthorizedRole_RoleClaimContainsConfiguredRole_ReturnsTrue()
        {
            var claims = new List<Claim>
            {
                new Claim("roles", JsonConvert.SerializeObject(new[] { _configuration.Role }))
            };
            var token = new JwtSecurityToken(claims: claims);

            var authorized = _adVerification.ValidateJwtHasAuthorizedRole(token);

            Assert.That(authorized, Is.True);
        }

        [Test]
        public void ValidateJwtHasAuthorizedRole_GroupClaimContainsConfiguredRole_ReturnsTrue()
        {
            var claims = new List<Claim>
            {
                new Claim("groups", JsonConvert.SerializeObject(new[] { _configuration.Role }))
            };
            var token = new JwtSecurityToken(claims: claims);

            var authorized = _adVerification.ValidateJwtHasAuthorizedRole(token);
            
            Assert.That(authorized, Is.True);
        }
    }
}