public async Task CanAccessOrderAuthorizationHandler_SearchOrdersWithoutAuth_ShouldFail(SearchOrderQuery query)
{
//Arrange
var requirements = new[] { new CanAccessOrderAuthorizationRequirement() };
var user = new ClaimsPrincipal(new ClaimsIdentity());
var context = new AuthorizationHandlerContext(requirements, user, query);
var subject = new CanAccessOrderAuthorizationHandler();
//Act
await subject.HandleAsync(context);
//Assert
context.HasFailed.Should().BeTrue();
}
public async Task CanAccessOrderAuthorizationHandler_SearchOrdersBelongToUser_ShouldSucceed(SearchOrderQuery query)
{
//Arrange
var requirements = new[] { new CanAccessOrderAuthorizationRequirement() };
var userId = "userId";
var user = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim("name", userId) }));
var context = new AuthorizationHandlerContext(requirements, user, query);
var subject = new CanAccessOrderAuthorizationHandler();
//Act
await subject.HandleAsync(context);
//Assert
context.HasSucceeded.Should().BeTrue();
query.CustomerId.Should().Be("userId");
}
public async Task CanAccessOrderAuthorizationHandler_OrderBelongAnotherUser_ShouldFail()
{
//Arrange
var requirements = new[] { new CanAccessOrderAuthorizationRequirement() };
var userId = "userId";
var user = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim("name", userId) }));
var resource = new CustomerOrder {
CustomerId = "AnotherUserId"
};
var context = new AuthorizationHandlerContext(requirements, user, resource);
var subject = new CanAccessOrderAuthorizationHandler();
//Act
await subject.HandleAsync(context);
//Assert
context.HasFailed.Should().BeTrue();
}