register-referentie/services/bff/Bff.Tests/BffFactory.cs

using System.Text;
using Bff.Api;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.AspNetCore.TestHost;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.IdentityModel.Protocols;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.IdentityModel.Tokens;

namespace Bff.Tests;

/// <summary>
/// Test host for the BFF. It swaps the downstream clients for in-memory fakes and reconfigures the
/// JWT bearer to validate against a local test key (no live Keycloak) — so token validation is
/// exercised in-process with tokens the tests mint (ADR-0010).
/// </summary>
internal sealed class BffFactory : WebApplicationFactory<Program>
{
    public static readonly SymmetricSecurityKey TestSigningKey =
        new(Encoding.UTF8.GetBytes("bff-test-signing-key-that-is-at-least-256-bits-long!"));

    public FakeDomainClient Domain { get; } = new();
    public FakeProjectionClient Projection { get; } = new();

    private static void ValidateWithTestKey(IServiceCollection services, string scheme) =>
        services.Configure<JwtBearerOptions>(scheme, options =>
        {
            // Validate locally against the test key and NEVER reach out for OIDC metadata. A static
            // configuration manager guarantees this regardless of Configure/PostConfigure ordering —
            // clearing Authority alone left the medewerker scheme fetching metadata under CI timing
            // (2s hang → 401), because JwtBearer's PostConfigure could still build a ConfigurationManager.
            options.Authority = null;
            options.MetadataAddress = null!;
            options.RequireHttpsMetadata = false;
            options.Configuration = new OpenIdConnectConfiguration();
            options.ConfigurationManager =
                new StaticConfigurationManager<OpenIdConnectConfiguration>(new OpenIdConnectConfiguration());
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = false,
                ValidateAudience = false,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = TestSigningKey,
                ClockSkew = TimeSpan.Zero,
            };
        });

    protected override void ConfigureWebHost(IWebHostBuilder builder)
    {
        builder.UseSetting("Keycloak:Authority", "https://keycloak.invalid/realms/digid");
        builder.UseSetting("Keycloak:MedewerkerAuthority", "https://keycloak.invalid/realms/medewerker");
        builder.UseSetting("Downstream:Domain:BaseUrl", "http://domain.invalid/");
        builder.UseSetting("Downstream:Projection:BaseUrl", "http://projection.invalid/");

        builder.ConfigureTestServices(services =>
        {
            services.AddSingleton<IDomainClient>(Domain);
            services.AddSingleton<IProjectionClient>(Projection);

            // Both realms validate locally against the test key (no live Keycloak). The medewerker
            // scheme keeps its OnTokenValidated role-lifting from Program.cs — only the validation
            // parameters are swapped here.
            ValidateWithTestKey(services, JwtBearerDefaults.AuthenticationScheme);
            ValidateWithTestKey(services, "medewerker");
        });
    }
}

/// <summary>Captures the bsn the BFF forwarded and returns a canned acceptance.</summary>
internal sealed class FakeDomainClient : IDomainClient
{
    public string? SubmittedBsn { get; private set; }
    public SubmitAccepted Result { get; set; } = new("reg-123", "Ingediend");
    public List<WerkbakItem> Werkbak { get; } = [];

    public Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default)
    {
        SubmittedBsn = bsn;
        return Task.FromResult(Result);
    }

    public (string RegistrationId, string Bsn)? Withdrawn { get; private set; }

    /// <summary>Whether the fake domain reports the withdrawal as done (true → 204) or not-found/not-owned
    /// (false → 404). Tests set this to exercise the relay.</summary>
    public bool WithdrawSucceeds { get; set; } = true;

    public Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
    {
        Withdrawn = (registrationId, bsn);
        return Task.FromResult(WithdrawSucceeds);
    }

    public (string RegistrationId, string Bsn)? DocumentsProvidedFor { get; private set; }

    /// <summary>Whether the fake domain reports the provide-documents as done (true → 204) or
    /// not-found/not-owned (false → 404). Tests set this to exercise the relay.</summary>
    public bool ProvideDocumentsSucceeds { get; set; } = true;

    public Task<bool> ProvideDocumentsAsync(string registrationId, string bsn, CancellationToken ct = default)
    {
        DocumentsProvidedFor = (registrationId, bsn);
        return Task.FromResult(ProvideDocumentsSucceeds);
    }

    public (string RegistrationId, string Besluit)? Decided { get; private set; }

    public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
        => Task.FromResult<IReadOnlyList<WerkbakItem>>(Werkbak);

    public Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
    {
        Decided = (registrationId, besluit);
        return Task.CompletedTask;
    }
}

/// <summary>Serves a configurable set of projection rows.</summary>
internal sealed class FakeProjectionClient : IProjectionClient
{
    public List<ProjectionEntry> Entries { get; } = [];

    public Task<IReadOnlyList<ProjectionEntry>> GetRegisterAsync(CancellationToken ct = default)
        => Task.FromResult<IReadOnlyList<ProjectionEntry>>(Entries);
}