public void ReturnsUnauthorizedResultIfUserDoesntHavePermission()
{
// Arrange
var db = GetInMemoryDb();
var serviceFilter = new DynamicallyAuthorizeServiceFilter(db);
var filterContext = ActionExecutingContextProvider.GetActionExecutingContext("GET");
filterContext.HttpContext.User = A.Fake <ClaimsPrincipal>();
filterContext.RouteData.Values["action"] = "This";
filterContext.RouteData.Values["controller"] = "DoesntReallyMatterButItsNeeded";
// Act
serviceFilter.OnActionExecuting(filterContext);
// Assert
filterContext.Result.ShouldBeOfType <UnauthorizedResult>();
}
public void AdminUserIsLetThrough()
{
// Arrange
var db = GetInMemoryDb();
var serviceFilter = new DynamicallyAuthorizeServiceFilter(db);
var filterContext = ActionExecutingContextProvider.GetActionExecutingContext("GET");
var user = A.Fake <ClaimsPrincipal>();
A.CallTo(() => user.IsInRole(OnlineStore.Infrastructure.Constants.Roles.ADMIN_ROLE)).Returns(true);
filterContext.HttpContext.User = user;
// Act
serviceFilter.OnActionExecuting(filterContext);
// Assert
A.CallToSet(() => filterContext.Result)
.To(() => A <IActionResult>
.That
.IsInstanceOf(typeof(UnauthorizedResult)))
.MustNotHaveHappened();
}
public async Task RegularUserWithPermissionIsLetThrough()
{
// Arrange
var db = GetInMemoryDb();
string actionToTestOn = "TestAction";
string controllerToTestOn = "TestController";
var role = await AddSampleRoleToDatabase(db, actionToTestOn, controllerToTestOn);
var filterContext = SetupFilterContextWithUser();
var serviceFilter = new DynamicallyAuthorizeServiceFilter(db);
// Act
serviceFilter.OnActionExecuting(filterContext);
// Assert
A.CallToSet(() => filterContext.Result)
.To(() => A <IActionResult>
.That.IsInstanceOf(typeof(UnauthorizedResult)))
.MustNotHaveHappened();
ActionExecutingContext SetupFilterContextWithUser()
{
var context = ActionExecutingContextProvider.GetActionExecutingContext("GET");
context.RouteData.Values["action"] = actionToTestOn;
context.RouteData.Values["controller"] = controllerToTestOn;
var user = A.Fake <ClaimsPrincipal>();
A.CallTo(() => user.IsInRole(role.Name)).Returns(true);
context.HttpContext.User = user;
return(context);
}
}
