1+ // Copyright (c) .NET Foundation. All rights reserved.
2+ // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
3+
4+ using System ;
5+ using System . Net ;
6+ using System . Threading . Tasks ;
7+ using Microsoft . AspNetCore . Authorization ;
8+ using Microsoft . AspNetCore . Builder ;
9+ using Microsoft . AspNetCore . Hosting ;
10+ using Microsoft . AspNetCore . Http ;
11+ using Microsoft . AspNetCore . TestHost ;
12+ using Microsoft . Extensions . DependencyInjection ;
13+ using Xunit ;
14+
15+ namespace Microsoft . AspNetCore . Routing . FunctionalTests
16+ {
17+ public class EndpointRoutingIntegrationTest
18+ {
19+ private static readonly RequestDelegate TestDelegate = async context => await Task . Yield ( ) ;
20+ private static readonly string AuthErrorMessage = "Endpoint / contains authorization metadata, but a middleware was not found that supports authorization." +
21+ Environment . NewLine +
22+ "Configure your application startup by adding app.UseAuthorization() inside the call to Configure(..) in the application startup code. " +
23+ "The call to app.UseAuthorization() must appear between app.UseRouting() and app.UseEndpoints(...)." ;
24+
25+ private static readonly string CORSErrorMessage = "Endpoint / contains CORS metadata, but a middleware was not found that supports CORS." +
26+ Environment . NewLine +
27+ "Configure your application startup by adding app.UseCors() inside the call to Configure(..) in the application startup code. " +
28+ "The call to app.UseAuthorization() must appear between app.UseRouting() and app.UseEndpoints(...)." ;
29+
30+ [ Fact ]
31+ public async Task AuthorizationMiddleware_WhenNoAuthMetadataIsConfigured ( )
32+ {
33+ // Arrange
34+ var builder = new WebHostBuilder ( ) ;
35+ builder . Configure ( app =>
36+ {
37+ app . UseRouting ( ) ;
38+ app . UseAuthorization ( ) ;
39+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) ) ;
40+ } )
41+ . ConfigureServices ( services =>
42+ {
43+ services . AddAuthorization ( ) ;
44+ services . AddRouting ( ) ;
45+ } ) ;
46+
47+ using var server = new TestServer ( builder ) ;
48+
49+ var response = await server . CreateRequest ( "/" ) . SendAsync ( "GET" ) ;
50+
51+ response . EnsureSuccessStatusCode ( ) ;
52+ }
53+
54+ [ Fact ]
55+ public async Task AuthorizationMiddleware_WhenEndpointIsNotFound ( )
56+ {
57+ // Arrange
58+ var builder = new WebHostBuilder ( ) ;
59+ builder . Configure ( app =>
60+ {
61+ app . UseRouting ( ) ;
62+ app . UseAuthorization ( ) ;
63+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) ) ;
64+ } )
65+ . ConfigureServices ( services =>
66+ {
67+ services . AddAuthorization ( ) ;
68+ services . AddRouting ( ) ;
69+ } ) ;
70+
71+ using var server = new TestServer ( builder ) ;
72+
73+ var response = await server . CreateRequest ( "/not-found" ) . SendAsync ( "GET" ) ;
74+
75+ Assert . Equal ( HttpStatusCode . NotFound , response . StatusCode ) ;
76+ }
77+
78+ [ Fact ]
79+ public async Task AuthorizationMiddleware_WithAuthorizedEndpoint ( )
80+ {
81+ // Arrange
82+ var builder = new WebHostBuilder ( ) ;
83+ builder . Configure ( app =>
84+ {
85+ app . UseRouting ( ) ;
86+ app . UseAuthorization ( ) ;
87+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) . RequireAuthorization ( ) ) ;
88+ } )
89+ . ConfigureServices ( services =>
90+ {
91+ services . AddAuthorization ( options => options . DefaultPolicy = new AuthorizationPolicyBuilder ( ) . RequireAssertion ( _ => true ) . Build ( ) ) ;
92+ services . AddRouting ( ) ;
93+ } ) ;
94+
95+ using var server = new TestServer ( builder ) ;
96+
97+ var response = await server . CreateRequest ( "/" ) . SendAsync ( "GET" ) ;
98+
99+ response . EnsureSuccessStatusCode ( ) ;
100+ }
101+
102+ [ Fact ]
103+ public async Task AuthorizationMiddleware_NotConfigured_Throws ( )
104+ {
105+ // Arrange
106+ var builder = new WebHostBuilder ( ) ;
107+ builder . Configure ( app =>
108+ {
109+ app . UseRouting ( ) ;
110+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) . RequireAuthorization ( ) ) ;
111+
112+ } )
113+ . ConfigureServices ( services =>
114+ {
115+ services . AddAuthorization ( options => options . DefaultPolicy = new AuthorizationPolicyBuilder ( ) . RequireAssertion ( _ => true ) . Build ( ) ) ;
116+ services . AddRouting ( ) ;
117+ } ) ;
118+
119+ using var server = new TestServer ( builder ) ;
120+
121+ var ex = await Assert . ThrowsAsync < InvalidOperationException > ( ( ) => server . CreateRequest ( "/" ) . SendAsync ( "GET" ) ) ;
122+ Assert . Equal ( AuthErrorMessage , ex . Message ) ;
123+ }
124+
125+ [ Fact ]
126+ public async Task AuthorizationMiddleware_NotConfigured_WhenEndpointIsNotFound ( )
127+ {
128+ // Arrange
129+ var builder = new WebHostBuilder ( ) ;
130+ builder . Configure ( app =>
131+ {
132+ app . UseRouting ( ) ;
133+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) . RequireAuthorization ( ) ) ;
134+ } )
135+ . ConfigureServices ( services =>
136+ {
137+ services . AddRouting ( ) ;
138+ } ) ;
139+
140+ using var server = new TestServer ( builder ) ;
141+
142+ var response = await server . CreateRequest ( "/not-found" ) . SendAsync ( "GET" ) ;
143+
144+ Assert . Equal ( HttpStatusCode . NotFound , response . StatusCode ) ;
145+ }
146+
147+ [ Fact ]
148+ public async Task AuthorizationMiddleware_ConfiguredBeforeRouting_Throws ( )
149+ {
150+ // Arrange
151+ var builder = new WebHostBuilder ( ) ;
152+ builder . Configure ( app =>
153+ {
154+ app . UseAuthorization ( ) ;
155+ app . UseRouting ( ) ;
156+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) . RequireAuthorization ( ) ) ;
157+ } )
158+ . ConfigureServices ( services =>
159+ {
160+ services . AddAuthorization ( options => options . DefaultPolicy = new AuthorizationPolicyBuilder ( ) . RequireAssertion ( _ => true ) . Build ( ) ) ;
161+ services . AddRouting ( ) ;
162+ } ) ;
163+
164+ using var server = new TestServer ( builder ) ;
165+
166+ var ex = await Assert . ThrowsAsync < InvalidOperationException > ( ( ) => server . CreateRequest ( "/" ) . SendAsync ( "GET" ) ) ;
167+ Assert . Equal ( AuthErrorMessage , ex . Message ) ;
168+ }
169+
170+ [ Fact ]
171+ public async Task AuthorizationMiddleware_ConfiguredAfterRouting_Throws ( )
172+ {
173+ // Arrange
174+ var builder = new WebHostBuilder ( ) ;
175+ builder . Configure ( app =>
176+ {
177+ app . UseRouting ( ) ;
178+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) . RequireAuthorization ( ) ) ;
179+ app . UseAuthorization ( ) ;
180+ } )
181+ . ConfigureServices ( services =>
182+ {
183+ services . AddAuthorization ( options => options . DefaultPolicy = new AuthorizationPolicyBuilder ( ) . RequireAssertion ( _ => true ) . Build ( ) ) ;
184+ services . AddRouting ( ) ;
185+ } ) ;
186+
187+ using var server = new TestServer ( builder ) ;
188+
189+ var ex = await Assert . ThrowsAsync < InvalidOperationException > ( ( ) => server . CreateRequest ( "/" ) . SendAsync ( "GET" ) ) ;
190+ Assert . Equal ( AuthErrorMessage , ex . Message ) ;
191+ }
192+
193+ [ Fact ]
194+ public async Task CorsMiddleware_WithCorsEndpoint ( )
195+ {
196+ // Arrange
197+ var builder = new WebHostBuilder ( ) ;
198+ builder . Configure ( app =>
199+ {
200+ app . UseRouting ( ) ;
201+ app . UseCors ( ) ;
202+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) . RequireCors ( policy => policy . AllowAnyOrigin ( ) ) ) ;
203+ } )
204+ . ConfigureServices ( services =>
205+ {
206+ services . AddCors ( ) ;
207+ services . AddRouting ( ) ;
208+ } ) ;
209+
210+ using var server = new TestServer ( builder ) ;
211+
212+ var response = await server . CreateRequest ( "/" ) . SendAsync ( "PUT" ) ;
213+
214+ response . EnsureSuccessStatusCode ( ) ;
215+ }
216+
217+ [ Fact ]
218+ public async Task CorsMiddleware_ConfiguredBeforeRouting_Throws ( )
219+ {
220+ // Arrange
221+ var builder = new WebHostBuilder ( ) ;
222+ builder . Configure ( app =>
223+ {
224+ app . UseCors ( ) ;
225+ app . UseRouting ( ) ;
226+ app . UseEndpoints ( b => b . Map ( "/" , TestDelegate ) . RequireCors ( policy => policy . AllowAnyOrigin ( ) ) ) ;
227+ } )
228+ . ConfigureServices ( services =>
229+ {
230+ services . AddCors ( ) ;
231+ services . AddRouting ( ) ;
232+ } ) ;
233+
234+ using var server = new TestServer ( builder ) ;
235+
236+ var ex = await Assert . ThrowsAsync < InvalidOperationException > ( ( ) => server . CreateRequest ( "/" ) . SendAsync ( "GET" ) ) ;
237+ Assert . Equal ( CORSErrorMessage , ex . Message ) ;
238+ }
239+ }
240+ }
0 commit comments