public async Task Should_return_forbidden_when_user_has_no_permission() { var sut = new ApiPermissionAttribute(Permissions.AppSchemasCreate); await sut.OnActionExecutionAsync(actionExecutingContext, next); Assert.Equal(403, (actionExecutingContext.Result as StatusCodeResult)?.StatusCode); Assert.False(isNextCalled); }
public async Task Should_return_forbidden_when_route_data_has_no_value() { user.AddClaim(new Claim(SquidexClaimTypes.Permissions, "squidex.apps.other-app")); var sut = new ApiPermissionAttribute(Permissions.AppSchemasCreate); await sut.OnActionExecutionAsync(actionExecutingContext, next); Assert.Equal(403, (actionExecutingContext.Result as StatusCodeResult)?.StatusCode); Assert.False(isNextCalled); }
public async Task Should_call_next_when_user_has_correct_permission() { actionExecutingContext.RouteData.Values["app"] = "my-app"; user.AddClaim(new Claim(SquidexClaimTypes.Permissions, "squidex.apps.my-app")); var sut = new ApiPermissionAttribute(Permissions.AppSchemasCreate); await sut.OnActionExecutionAsync(actionExecutingContext, next); Assert.Null(actionExecutingContext.Result); Assert.True(isNextCalled); }
public async Task Should_return_forbidden_when_user_has_wrong_permission() { actionExecutingContext.RouteData.Values["app"] = "my-app"; user.AddClaim(new Claim(SquidexClaimTypes.Permissions, "squidex.apps.other-app")); var sut = new ApiPermissionAttribute(Permissions.AppSchemasRead); await sut.OnActionExecutionAsync(actionExecutingContext, next); Assert.Equal(403, (actionExecutingContext.Result as StatusCodeResult)?.StatusCode); Assert.False(isNextCalled); }
public async Task Should_return_forbidden_when_user_has_wrong_permission() { actionExecutingContext.HttpContext.Features.Set <IAppFeature>(new AppFeature(NamedId.Of(DomainId.NewGuid(), "my-app"))); user.AddClaim(new Claim(SquidexClaimTypes.Permissions, "squidex.apps.other-app")); SetContext(); var sut = new ApiPermissionAttribute(Permissions.AppSchemasCreate); await sut.OnActionExecutionAsync(actionExecutingContext, next); Assert.Equal(403, (actionExecutingContext.Result as StatusCodeResult)?.StatusCode); Assert.False(isNextCalled); }
public async Task Should_make_permission_check_with_app_feature() { actionExecutingContext.HttpContext.Features.Set <IAppFeature>(new AppFeature(NamedId.Of(DomainId.NewGuid(), "my-app"))); user.AddClaim(new Claim(SquidexClaimTypes.Permissions, "squidex.apps.my-app")); SetContext(); var sut = new ApiPermissionAttribute(Permissions.AppSchemasCreate); await sut.OnActionExecutionAsync(actionExecutingContext, next); Assert.Null(actionExecutingContext.Result); Assert.True(isNextCalled); }
public async Task Should_make_permission_check_with_schema_feature() { actionExecutingContext.HttpContext.Features.Set <IAppFeature>(new AppFeature(Mocks.App(appId))); actionExecutingContext.HttpContext.Features.Set <ISchemaFeature>(new SchemaFeature(Mocks.Schema(appId, schemaId))); user.AddClaim(new Claim(SquidexClaimTypes.Permissions, "squidex.apps.my-app.schemas.my-schema")); SetContext(); var sut = new ApiPermissionAttribute(Permissions.AppSchemasUpdate); await sut.OnActionExecutionAsync(actionExecutingContext, next); Assert.Null(actionExecutingContext.Result); Assert.True(isNextCalled); }