[URP-306] create a framework for running tests on services and api

backend/src/Controllers/OrganisationController.cs

@@ -26,6 +26,7 @@ CancellationToken cancellationToken
                 error switch
                 {
                     GetOrganisationByIdError.NotFound => NotFound(),
+                    GetOrganisationByIdError.NotAllowed => Forbid(),
                     _ => throw new UnreachableException(
                         "Unhandled GetOrganisationByIdError variant."
                     ),
@@ -60,6 +61,7 @@ CancellationToken cancellationToken
                 error switch
                 {
                     UpdateOrganisationDetailsError.NotFound => NotFound(),
+                    UpdateOrganisationDetailsError.NotAllowed => Forbid(),
                     _ => throw new UnreachableException(
                         "Unhandled UpdateOrganisationDetailsError variant."
                     ),

backend/src/Controllers/Utilities/UkpsClaimTypes.cs

@@ -0,0 +1,7 @@
+namespace UKPS.Api.Controllers.Utilities;
+
+public static class UkpsClaimTypes
+{
+    public const string OrganisationId = "organisation_id";
+    public const string UserRole = "user_role";
+}

backend/src/Controllers/Utilities/WebApiCurrentUserInfoService.cs

@@ -0,0 +1,44 @@
+using System.Globalization;
+using System.Security.Claims;
+using UKPS.Api.Enums;
+using UKPS.Api.Services.Interfaces;
+
+namespace UKPS.Api.Controllers.Utilities;
+
+internal class WebApiCurrentUserInfoService : ICurrentUserInfoService
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    private ClaimsPrincipal Principal =>
+        _httpContextAccessor.HttpContext?.User ?? new ClaimsPrincipal();
+
+    public WebApiCurrentUserInfoService(IHttpContextAccessor httpContextAccessor)
+    {
+        _httpContextAccessor = httpContextAccessor;
+    }
+
+    public CurrentUser GetCurrentUserInfo()
+    {
+        return new CurrentUser { OrganisationId = FindOrganisationId(), UserRole = FindUserRole() };
+    }
+
+    private int FindOrganisationId()
+    {
+        string? organisationIdClaim = Principal.FindFirstValue(UkpsClaimTypes.OrganisationId);
+        return int.TryParse(organisationIdClaim, CultureInfo.InvariantCulture, out var orgId)
+            ? orgId
+            : throw new InvalidOperationException(
+                $"Invalid {UkpsClaimTypes.OrganisationId} claim value."
+            );
+    }
+
+    private UserRole FindUserRole()
+    {
+        string? userRoleClaim = Principal.FindFirstValue(UkpsClaimTypes.UserRole);
+        return Enum.TryParse<UserRole>(userRoleClaim, out var role) && Enum.IsDefined(role)
+            ? role
+            : throw new InvalidOperationException(
+                $"Invalid {UkpsClaimTypes.UserRole} claim value."
+            );
+    }
+}

backend/src/Program.cs

@@ -3,8 +3,10 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.OpenApi;
 using Scalar.AspNetCore;
+using UKPS.Api.Controllers.Utilities;
 using UKPS.Api.Data;
 using UKPS.Api.Services;
+using UKPS.Api.Services.Interfaces;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -18,6 +20,8 @@
 );
 
 // Add services to the container.
+builder.Services.AddHttpContextAccessor();
+builder.Services.AddScoped<ICurrentUserInfoService, WebApiCurrentUserInfoService>();
 builder.Services.AddUkpsServices();
 
 builder.Services.ConfigureHttpJsonOptions(options =>

backend/src/Services/DependencyInjectionManager.cs

@@ -7,7 +7,6 @@ internal static class DependencyInjectionManager
 {
     public static IServiceCollection AddUkpsServices(this IServiceCollection services)
     {
-        services.TryAddScoped<ICurrentUserInfoService, MockCurrentUserInfoService>();
         services.TryAddScoped<IOrganisationAuthoriser, OrganisationAuthoriser>();
         services.TryAddScoped<IOrganisationService, OrganisationService>();
         services.TryAddScoped<IOrganisationMembershipService, OrganisationMembershipService>();

backend/tests/Controllers/OrganisationControllerTests.cs

@@ -86,6 +86,25 @@ public async Task GetOrganisationById_OrganisationDoesNotExist_ReturnsNotFound()
         result.Result.ShouldBeOfType<NotFoundResult>();
     }
 
+    [Fact]
+    public async Task GetOrganisationById_ActionNotAllowed_ReturnsForbidden()
+    {
+        var sampleOrganisationId = 1;
+        _organisationServiceMock
+            .GetOrganisationById(sampleOrganisationId, TestContext.Current.CancellationToken)
+            .Returns(
+                Result<OrganisationDetailsDto, GetOrganisationByIdError>.Err(
+                    new GetOrganisationByIdError.NotAllowed(sampleOrganisationId)
+                )
+            );
+        ActionResult<OrganisationDetailsDto> result = await _controller.GetOrganisationById(
+            1,
+            TestContext.Current.CancellationToken
+        );
+
+        result.Result.ShouldBeOfType<ForbidResult>();
+    }
+
     [Fact]
     public async Task GetOrganisationById_IdProvided_PassesIdToService()
     {
@@ -120,6 +139,30 @@ public async Task UpdateOrganisationDetails_OrganisationExists_ReturnsOk()
         ok.Value.ShouldBe(expected);
     }
 
+    [Fact]
+    public async Task UpdateOrganisation_ActionNotAllowed_ReturnsForbidden()
+    {
+        var sampleOrganisationId = 1;
+        _organisationServiceMock
+            .UpdateOrganisationDetails(
+                sampleOrganisationId,
+                Arg.Any<UpdateOrganisationDetailsDto>(),
+                TestContext.Current.CancellationToken
+            )
+            .Returns(
+                Result<OrganisationDetailsDto, UpdateOrganisationDetailsError>.Err(
+                    new UpdateOrganisationDetailsError.NotAllowed(sampleOrganisationId)
+                )
+            );
+        ActionResult<OrganisationDetailsDto> result = await _controller.UpdateOrganisationDetails(
+            sampleOrganisationId,
+            CreateUpdateOrganisationDetailsDto(),
+            TestContext.Current.CancellationToken
+        );
+
+        result.Result.ShouldBeOfType<ForbidResult>();
+    }
+
     [Fact]
     public async Task UpdateOrganisationDetails_OrganisationDoesNotExist_ReturnsNotFound()
     {

backend/tests/Controllers/Utilities/WebApiCurrentUserInfoServiceTests.cs

@@ -0,0 +1,109 @@
+using System.Security.Claims;
+using Bogus;
+using Microsoft.AspNetCore.Http;
+using NSubstitute;
+using Shouldly;
+using UKPS.Api.Controllers.Utilities;
+using UKPS.Api.Enums;
+using UKPS.Api.Services.Interfaces;
+
+namespace UKPS.Api.Tests.Controllers.Utilities;
+
+public class WebApiCurrentUserInfoServiceTests
+{
+    [Fact]
+    public void GetCurrentUserInfo_ShouldReturnCurrentUser_WhenClaimsAreValid()
+    {
+        Randomizer.Seed = new Random(0);
+        var faker = new Faker();
+        foreach (var userRole in Enum.GetValues<UserRole>())
+        {
+            var organisationId = faker.Random.Int(min: 0);
+            var service = CreateService(
+                new Claim(UkpsClaimTypes.OrganisationId, $"{organisationId}"),
+                new Claim(UkpsClaimTypes.UserRole, userRole.ToString())
+            );
+
+            CurrentUser result = service.GetCurrentUserInfo();
+
+            result.OrganisationId.ShouldBe(organisationId);
+            result.UserRole.ShouldBe(userRole);
+        }
+    }
+
+    [Fact]
+    public void GetCurrentUserInfo_ShouldThrow_WhenOrganisationIdClaimIsMissing()
+    {
+        var service = CreateService(
+            new Claim(UkpsClaimTypes.UserRole, UserRole.Champion.ToString())
+        );
+
+        var exception = Should.Throw<InvalidOperationException>(() => service.GetCurrentUserInfo());
+
+        exception.Message.ShouldBe($"Invalid {UkpsClaimTypes.OrganisationId} claim value.");
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("abc")]
+    [InlineData("1.5")]
+    public void GetCurrentUserInfo_ShouldThrow_WhenOrganisationIdClaimIsInvalid(string claimValue)
+    {
+        var service = CreateService(
+            new Claim(UkpsClaimTypes.OrganisationId, claimValue),
+            new Claim(UkpsClaimTypes.UserRole, UserRole.Super.ToString())
+        );
+
+        var exception = Should.Throw<InvalidOperationException>(() => service.GetCurrentUserInfo());
+
+        exception.Message.ShouldBe($"Invalid {UkpsClaimTypes.OrganisationId} claim value.");
+    }
+
+    [Fact]
+    public void GetCurrentUserInfo_ShouldThrow_WhenUserRoleClaimIsMissing()
+    {
+        var service = CreateService(new Claim(UkpsClaimTypes.OrganisationId, "123"));
+
+        var exception = Should.Throw<InvalidOperationException>(() => service.GetCurrentUserInfo());
+
+        exception.Message.ShouldBe($"Invalid {UkpsClaimTypes.UserRole} claim value.");
+    }
+
+    [Theory]
+    [InlineData("123")]
+    public void GetCurrentUserInfo_ShouldThrow_WhenUserRoleClaimIsInvalid(string claimValue)
+    {
+        var service = CreateService(
+            new Claim(UkpsClaimTypes.OrganisationId, "123"),
+            new Claim(UkpsClaimTypes.UserRole, claimValue)
+        );
+
+        var exception = Should.Throw<InvalidOperationException>(() => service.GetCurrentUserInfo());
+
+        exception.Message.ShouldBe($"Invalid {UkpsClaimTypes.UserRole} claim value.");
+    }
+
+    [Fact]
+    public void GetCurrentUserInfo_ShouldThrow_WhenHttpContextIsNull()
+    {
+        var accessor = Substitute.For<IHttpContextAccessor>();
+        accessor.HttpContext.Returns((HttpContext?)null);
+
+        var service = new WebApiCurrentUserInfoService(accessor);
+
+        Should.Throw<InvalidOperationException>(() => service.GetCurrentUserInfo());
+    }
+
+    private static WebApiCurrentUserInfoService CreateService(params Claim[] claims)
+    {
+        var httpContext = new DefaultHttpContext
+        {
+            User = new ClaimsPrincipal(new ClaimsIdentity(claims, "Test")),
+        };
+
+        var accessor = Substitute.For<IHttpContextAccessor>();
+        accessor.HttpContext.Returns(httpContext);
+
+        return new WebApiCurrentUserInfoService(accessor);
+    }
+}

backend/tests/Fixtures/ApiFactory.cs

@@ -1,14 +1,31 @@
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
 
 namespace UKPS.Api.Tests.Fixtures;
 
 public sealed class ApiFactory(string connectionString) : WebApplicationFactory<Program>
 {
+    public TestAuthenticationOptions AuthOptions { get; } = new TestAuthenticationOptions();
+
     protected override void ConfigureWebHost(IWebHostBuilder builder)
     {
         ArgumentNullException.ThrowIfNull(builder);
 
+        builder.ConfigureTestServices(services =>
+        {
+            services.AddSingleton(AuthOptions);
+
+            services
+                .AddAuthentication(TestAuthHandler.AuthenticationScheme)
+                .AddScheme<AuthenticationSchemeOptions, TestAuthHandler>(
+                    TestAuthHandler.AuthenticationScheme,
+                    _ => { }
+                );
+        });
+
         builder.UseSetting("ConnectionStrings:DefaultConnection", connectionString);
     }
 }

backend/tests/Fixtures/TestAuthHandler.cs

@@ -0,0 +1,33 @@
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace UKPS.Api.Tests.Fixtures;
+
+public class TestAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public const string AuthenticationScheme = "TestScheme";
+    private readonly TestAuthenticationOptions _authOptions;
+
+    public TestAuthHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder,
+        TestAuthenticationOptions authOptions
+    )
+        : base(options, logger, encoder)
+    {
+        _authOptions = authOptions;
+    }
+
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        var identity = new ClaimsIdentity(_authOptions.Claims);
+
+        var ticket = new AuthenticationTicket(new ClaimsPrincipal(identity), AuthenticationScheme);
+
+        return Task.FromResult(AuthenticateResult.Success(ticket));
+    }
+}

backend/tests/Fixtures/TestAuthenticationOptions.cs

@@ -0,0 +1,16 @@
+using System.Security.Claims;
+using UKPS.Api.Controllers.Utilities;
+using UKPS.Api.Enums;
+
+namespace UKPS.Api.Tests.Fixtures;
+
+public class TestAuthenticationOptions
+{
+    public static IReadOnlyCollection<Claim> DefaultClaims { get; } =
+    [
+        new Claim(UkpsClaimTypes.UserRole, UserRole.Super.ToString()),
+        new Claim(UkpsClaimTypes.OrganisationId, $"{1}"),
+    ];
+
+    public ICollection<Claim> Claims { get; } = DefaultClaims.ToList();
+}

backend/tests/Services/OrganisationMembershipServiceTests.cs

@@ -11,6 +11,7 @@
 using UKPS.Api.Tests.Utilities.AssertionHelpers;
 using UKPS.Api.Tests.Utilities.Data;
 using UKPS.Api.Tests.Utilities.Data.Fakers;
+using UKPS.Api.Tests.Utilities.Harnesses;
 
 namespace UKPS.Api.Tests.Services;