ehoandClaude Sonnet 5
a09c4ed87b
Splits backend CallerIdentity into the two ADR-0002 §3 actor kinds (ZorgverlenerCaller/MedewerkerCaller), a stub X-Medewerker/X-Rollen header path mirroring WP-53's citizen stub, and Authz.CanBeoordelen as the first medewerker capability — backend-only, no consumer until WP-64. Also fixes the backlog README's stale WP-61 status (done, but table said todo). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
97 lines
3.5 KiB
C#
97 lines
3.5 KiB
C#
using BigRegister.Api.Data;
|
|
using BigRegister.Domain.Authorization;
|
|
using Microsoft.AspNetCore.Http;
|
|
|
|
namespace BigRegister.Tests;
|
|
|
|
/// WP-53 (extended WP-62): the dev stub identity provider — role from X-Role (unchanged
|
|
/// behaviour, applies to either actor kind), subject BSN from X-Subject defaulting to the
|
|
/// single seeded citizen so every existing request (none of which send X-Subject) resolves
|
|
/// exactly as before this WP. X-Medewerker (+ X-Rollen) selects the medewerker actor kind.
|
|
public class StubIdentityProviderTests
|
|
{
|
|
private static CallerIdentity Resolve(
|
|
string? role = null, string? subject = null, string? medewerker = null, string? rollen = null)
|
|
{
|
|
var ctx = new DefaultHttpContext();
|
|
if (role is not null) ctx.Request.Headers["X-Role"] = role;
|
|
if (subject is not null) ctx.Request.Headers["X-Subject"] = subject;
|
|
if (medewerker is not null) ctx.Request.Headers["X-Medewerker"] = medewerker;
|
|
if (rollen is not null) ctx.Request.Headers["X-Rollen"] = rollen;
|
|
return new StubIdentityProvider().Resolve(ctx);
|
|
}
|
|
|
|
private static ZorgverlenerCaller ResolveZorgverlener(string? role = null, string? subject = null) =>
|
|
Assert.IsType<ZorgverlenerCaller>(Resolve(role, subject));
|
|
|
|
[Fact]
|
|
public void No_headers_resolves_to_the_seeded_citizen_as_a_drafter()
|
|
{
|
|
var caller = ResolveZorgverlener(role: null, subject: null);
|
|
Assert.Equal(DocumentStore.DemoOwner, caller.Bsn);
|
|
Assert.Equal(PrincipalRole.Drafter, caller.Role);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("approver", PrincipalRole.Approver)]
|
|
[InlineData("admin", PrincipalRole.Admin)]
|
|
[InlineData("something-unknown", PrincipalRole.Drafter)]
|
|
public void X_role_maps_to_the_principal_role(string header, PrincipalRole expected)
|
|
{
|
|
Assert.Equal(expected, Resolve(header, subject: null).Role);
|
|
}
|
|
|
|
[Fact]
|
|
public void X_subject_overrides_the_default_bsn()
|
|
{
|
|
var caller = ResolveZorgverlener(role: null, subject: "999888777");
|
|
Assert.Equal("999888777", caller.Bsn);
|
|
}
|
|
|
|
[Fact]
|
|
public void No_headers_resolves_a_zorgverlener_kind()
|
|
{
|
|
Assert.IsType<ZorgverlenerCaller>(Resolve());
|
|
}
|
|
|
|
[Fact]
|
|
public void X_medewerker_resolves_a_medewerker_with_the_default_behandelaar_rol()
|
|
{
|
|
var caller = Assert.IsType<MedewerkerCaller>(Resolve(medewerker: "m.jansen"));
|
|
Assert.Equal("m.jansen", caller.MedewerkerId);
|
|
Assert.Equal("m.jansen", caller.SubjectId);
|
|
Assert.Contains(MedewerkerRol.Behandelaar, caller.Rollen);
|
|
}
|
|
|
|
[Fact]
|
|
public void X_medewerker_takes_precedence_over_x_subject()
|
|
{
|
|
var caller = Resolve(subject: "999888777", medewerker: "m.jansen");
|
|
Assert.IsType<MedewerkerCaller>(caller);
|
|
}
|
|
|
|
[Fact]
|
|
public void Empty_x_medewerker_falls_through_to_the_zorgverlener_default()
|
|
{
|
|
var caller = Assert.IsType<ZorgverlenerCaller>(Resolve(medewerker: ""));
|
|
Assert.Equal(DocumentStore.DemoOwner, caller.Bsn);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("behandelaar", new[] { MedewerkerRol.Behandelaar })]
|
|
[InlineData("Behandelaar, behandelaar", new[] { MedewerkerRol.Behandelaar })]
|
|
[InlineData("geen", new MedewerkerRol[0])]
|
|
public void X_rollen_parses_known_tokens_and_drops_unknown_ones(string rollen, MedewerkerRol[] expected)
|
|
{
|
|
var caller = Assert.IsType<MedewerkerCaller>(Resolve(medewerker: "m.jansen", rollen: rollen));
|
|
Assert.Equal(expected, caller.Rollen);
|
|
}
|
|
|
|
[Fact]
|
|
public void X_role_still_applies_to_a_medewerker()
|
|
{
|
|
var caller = Resolve(role: "admin", medewerker: "m.jansen");
|
|
Assert.Equal(PrincipalRole.Admin, caller.Role);
|
|
}
|
|
}
|