Task 6: AuthService + 9 unit tests (16/16 pass)
- IAuthService: LoginAsync / RefreshAsync / LogoutAsync - AuthService: refresh-token rotation, hashed storage, LastLoginAt update - AuthServiceTests: 5 login + 3 refresh + 1 logout tests via Moq + EF InMemory Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Chris Chen
@@ -0,0 +1,258 @@
|
|||||||
|
using Microsoft.AspNetCore.Identity;
|
||||||
|
using Microsoft.EntityFrameworkCore;
|
||||||
|
using Microsoft.Extensions.Configuration;
|
||||||
|
using Moq;
|
||||||
|
using ROLAC.API.Data;
|
||||||
|
using ROLAC.API.DTOs.Auth;
|
||||||
|
using ROLAC.API.Entities;
|
||||||
|
using ROLAC.API.Services;
|
||||||
|
using Xunit;
|
||||||
|
|
||||||
|
namespace ROLAC.API.Tests.Services;
|
||||||
|
|
||||||
|
public class AuthServiceTests
|
||||||
|
{
|
||||||
|
// -----------------------------------------------------------------------
|
||||||
|
// Factory helpers
|
||||||
|
// -----------------------------------------------------------------------
|
||||||
|
|
||||||
|
private static AppDbContext BuildDb() =>
|
||||||
|
new(new DbContextOptionsBuilder<AppDbContext>()
|
||||||
|
.UseInMemoryDatabase(Guid.NewGuid().ToString())
|
||||||
|
.Options);
|
||||||
|
|
||||||
|
private static IConfiguration BuildConfig() =>
|
||||||
|
new ConfigurationBuilder()
|
||||||
|
.AddInMemoryCollection(new Dictionary<string, string?>
|
||||||
|
{
|
||||||
|
{ "Jwt:RefreshTokenExpiryDays", "30" },
|
||||||
|
})
|
||||||
|
.Build();
|
||||||
|
|
||||||
|
/// <summary>Creates a <see cref="UserManager{TUser}"/> mock with sensible defaults.</summary>
|
||||||
|
private static Mock<UserManager<AppUser>> BuildUserManager(
|
||||||
|
AppUser? findResult = null,
|
||||||
|
bool passwordOk = true,
|
||||||
|
IList<string>? roles = null)
|
||||||
|
{
|
||||||
|
var store = new Mock<IUserStore<AppUser>>();
|
||||||
|
// Remaining ctor params are all optional; Moq passes them via reflection.
|
||||||
|
#pragma warning disable CS8625
|
||||||
|
var mgr = new Mock<UserManager<AppUser>>(
|
||||||
|
store.Object, null, null, null, null, null, null, null, null);
|
||||||
|
#pragma warning restore CS8625
|
||||||
|
|
||||||
|
mgr.Setup(m => m.FindByEmailAsync(It.IsAny<string>()))
|
||||||
|
.ReturnsAsync(findResult);
|
||||||
|
mgr.Setup(m => m.FindByIdAsync(It.IsAny<string>()))
|
||||||
|
.ReturnsAsync(findResult);
|
||||||
|
mgr.Setup(m => m.CheckPasswordAsync(It.IsAny<AppUser>(), It.IsAny<string>()))
|
||||||
|
.ReturnsAsync(passwordOk);
|
||||||
|
mgr.Setup(m => m.GetRolesAsync(It.IsAny<AppUser>()))
|
||||||
|
.ReturnsAsync(roles ?? new List<string> { "member" });
|
||||||
|
mgr.Setup(m => m.UpdateAsync(It.IsAny<AppUser>()))
|
||||||
|
.ReturnsAsync(IdentityResult.Success);
|
||||||
|
|
||||||
|
return mgr;
|
||||||
|
}
|
||||||
|
|
||||||
|
/// <summary>
|
||||||
|
/// ITokenService mock: GenerateAccessToken → "access-token",
|
||||||
|
/// GenerateRefreshToken → "raw-refresh", HashToken(x) → "hash:{x}".
|
||||||
|
/// </summary>
|
||||||
|
private static Mock<ITokenService> BuildTokenService()
|
||||||
|
{
|
||||||
|
var svc = new Mock<ITokenService>();
|
||||||
|
svc.Setup(t => t.GenerateAccessToken(It.IsAny<AppUser>(), It.IsAny<IList<string>>()))
|
||||||
|
.Returns("access-token");
|
||||||
|
svc.Setup(t => t.GenerateRefreshToken())
|
||||||
|
.Returns("raw-refresh");
|
||||||
|
svc.Setup(t => t.HashToken(It.IsAny<string>()))
|
||||||
|
.Returns<string>(s => $"hash:{s}");
|
||||||
|
return svc;
|
||||||
|
}
|
||||||
|
|
||||||
|
private static AuthService BuildSut(
|
||||||
|
Mock<UserManager<AppUser>> umMock,
|
||||||
|
Mock<ITokenService> tsMock,
|
||||||
|
AppDbContext db)
|
||||||
|
=> new(umMock.Object, tsMock.Object, db, BuildConfig());
|
||||||
|
|
||||||
|
// -----------------------------------------------------------------------
|
||||||
|
// Login tests
|
||||||
|
// -----------------------------------------------------------------------
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Login_ValidCredentials_ReturnsAccessTokenAndRefreshToken()
|
||||||
|
{
|
||||||
|
var user = new AppUser { Id = "u1", Email = "a@b.com", UserName = "a@b.com", IsActive = true };
|
||||||
|
var um = BuildUserManager(findResult: user, roles: new[] { "member" });
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var db = BuildDb();
|
||||||
|
var sut = BuildSut(um, ts, db);
|
||||||
|
|
||||||
|
var (response, raw) = await sut.LoginAsync(new LoginRequest { Email = "a@b.com", Password = "P@ssw0rd!" });
|
||||||
|
|
||||||
|
Assert.Equal("access-token", response.AccessToken);
|
||||||
|
Assert.Equal(900, response.ExpiresIn);
|
||||||
|
Assert.Equal("u1", response.User.Id);
|
||||||
|
Assert.Equal("a@b.com", response.User.Email);
|
||||||
|
Assert.Contains("member", response.User.Roles);
|
||||||
|
Assert.Equal("raw-refresh", raw);
|
||||||
|
|
||||||
|
// Persisted in DB
|
||||||
|
var stored = db.RefreshTokens.Single();
|
||||||
|
Assert.Equal("hash:raw-refresh", stored.TokenHash);
|
||||||
|
Assert.Equal("u1", stored.UserId);
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Login_UnknownEmail_ThrowsUnauthorized()
|
||||||
|
{
|
||||||
|
var um = BuildUserManager(findResult: null);
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var sut = BuildSut(um, ts, BuildDb());
|
||||||
|
|
||||||
|
await Assert.ThrowsAsync<UnauthorizedAccessException>(
|
||||||
|
() => sut.LoginAsync(new LoginRequest { Email = "nope@b.com", Password = "P@ssw0rd!" }));
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Login_WrongPassword_ThrowsUnauthorized()
|
||||||
|
{
|
||||||
|
var user = new AppUser { Id = "u1", Email = "a@b.com", UserName = "a@b.com", IsActive = true };
|
||||||
|
var um = BuildUserManager(findResult: user, passwordOk: false);
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var sut = BuildSut(um, ts, BuildDb());
|
||||||
|
|
||||||
|
await Assert.ThrowsAsync<UnauthorizedAccessException>(
|
||||||
|
() => sut.LoginAsync(new LoginRequest { Email = "a@b.com", Password = "wrong" }));
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Login_InactiveAccount_ThrowsUnauthorized()
|
||||||
|
{
|
||||||
|
var user = new AppUser { Id = "u1", Email = "a@b.com", UserName = "a@b.com", IsActive = false };
|
||||||
|
var um = BuildUserManager(findResult: user, passwordOk: true);
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var sut = BuildSut(um, ts, BuildDb());
|
||||||
|
|
||||||
|
await Assert.ThrowsAsync<UnauthorizedAccessException>(
|
||||||
|
() => sut.LoginAsync(new LoginRequest { Email = "a@b.com", Password = "P@ssw0rd!" }));
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Login_Success_UpdatesLastLoginAt()
|
||||||
|
{
|
||||||
|
var user = new AppUser { Id = "u1", Email = "a@b.com", UserName = "a@b.com", IsActive = true };
|
||||||
|
var um = BuildUserManager(findResult: user);
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var sut = BuildSut(um, ts, BuildDb());
|
||||||
|
|
||||||
|
await sut.LoginAsync(new LoginRequest { Email = "a@b.com", Password = "P@ssw0rd!" });
|
||||||
|
|
||||||
|
um.Verify(m => m.UpdateAsync(It.Is<AppUser>(u => u.LastLoginAt != null)), Times.Once);
|
||||||
|
}
|
||||||
|
|
||||||
|
// -----------------------------------------------------------------------
|
||||||
|
// Refresh tests
|
||||||
|
// -----------------------------------------------------------------------
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Refresh_ValidToken_RotatesRefreshToken()
|
||||||
|
{
|
||||||
|
const string rawOld = "old-raw";
|
||||||
|
const string rawNew = "raw-refresh"; // what BuildTokenService returns
|
||||||
|
|
||||||
|
var user = new AppUser { Id = "u1", Email = "a@b.com", UserName = "a@b.com", IsActive = true };
|
||||||
|
var um = BuildUserManager(findResult: user);
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var db = BuildDb();
|
||||||
|
|
||||||
|
// Seed an active token
|
||||||
|
db.RefreshTokens.Add(new RefreshToken
|
||||||
|
{
|
||||||
|
UserId = "u1",
|
||||||
|
TokenHash = "hash:old-raw",
|
||||||
|
ExpiresAt = DateTime.UtcNow.AddDays(30),
|
||||||
|
CreatedAt = DateTime.UtcNow.AddHours(-1),
|
||||||
|
});
|
||||||
|
await db.SaveChangesAsync();
|
||||||
|
|
||||||
|
var sut = BuildSut(um, ts, db);
|
||||||
|
var (response, newRaw) = await sut.RefreshAsync(rawOld);
|
||||||
|
|
||||||
|
Assert.Equal("access-token", response.AccessToken);
|
||||||
|
Assert.Equal(rawNew, newRaw);
|
||||||
|
|
||||||
|
// Old token revoked
|
||||||
|
var old = db.RefreshTokens.First(rt => rt.TokenHash == "hash:old-raw");
|
||||||
|
Assert.NotNull(old.RevokedAt);
|
||||||
|
Assert.Equal("hash:raw-refresh", old.ReplacedByHash);
|
||||||
|
|
||||||
|
// New token stored
|
||||||
|
var newTok = db.RefreshTokens.First(rt => rt.TokenHash == "hash:raw-refresh");
|
||||||
|
Assert.Null(newTok.RevokedAt);
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Refresh_UnknownToken_ThrowsUnauthorized()
|
||||||
|
{
|
||||||
|
var um = BuildUserManager();
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var sut = BuildSut(um, ts, BuildDb());
|
||||||
|
|
||||||
|
await Assert.ThrowsAsync<UnauthorizedAccessException>(
|
||||||
|
() => sut.RefreshAsync("no-such-token"));
|
||||||
|
}
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Refresh_ExpiredToken_ThrowsUnauthorized()
|
||||||
|
{
|
||||||
|
var db = BuildDb();
|
||||||
|
db.RefreshTokens.Add(new RefreshToken
|
||||||
|
{
|
||||||
|
UserId = "u1",
|
||||||
|
TokenHash = "hash:expired-raw",
|
||||||
|
ExpiresAt = DateTime.UtcNow.AddDays(-1), // already expired
|
||||||
|
CreatedAt = DateTime.UtcNow.AddDays(-31),
|
||||||
|
});
|
||||||
|
await db.SaveChangesAsync();
|
||||||
|
|
||||||
|
var um = BuildUserManager();
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var sut = BuildSut(um, ts, db);
|
||||||
|
|
||||||
|
await Assert.ThrowsAsync<UnauthorizedAccessException>(
|
||||||
|
() => sut.RefreshAsync("expired-raw"));
|
||||||
|
}
|
||||||
|
|
||||||
|
// -----------------------------------------------------------------------
|
||||||
|
// Logout tests
|
||||||
|
// -----------------------------------------------------------------------
|
||||||
|
|
||||||
|
[Fact]
|
||||||
|
public async Task Logout_ValidToken_RevokesRefreshToken()
|
||||||
|
{
|
||||||
|
const string raw = "my-raw-token";
|
||||||
|
|
||||||
|
var db = BuildDb();
|
||||||
|
db.RefreshTokens.Add(new RefreshToken
|
||||||
|
{
|
||||||
|
UserId = "u1",
|
||||||
|
TokenHash = "hash:my-raw-token",
|
||||||
|
ExpiresAt = DateTime.UtcNow.AddDays(30),
|
||||||
|
CreatedAt = DateTime.UtcNow.AddHours(-1),
|
||||||
|
});
|
||||||
|
await db.SaveChangesAsync();
|
||||||
|
|
||||||
|
var um = BuildUserManager();
|
||||||
|
var ts = BuildTokenService();
|
||||||
|
var sut = BuildSut(um, ts, db);
|
||||||
|
|
||||||
|
await sut.LogoutAsync(raw);
|
||||||
|
|
||||||
|
var token = db.RefreshTokens.Single();
|
||||||
|
Assert.NotNull(token.RevokedAt);
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,145 @@
|
|||||||
|
using Microsoft.AspNetCore.Identity;
|
||||||
|
using Microsoft.EntityFrameworkCore;
|
||||||
|
using Microsoft.Extensions.Configuration;
|
||||||
|
using ROLAC.API.Data;
|
||||||
|
using ROLAC.API.DTOs.Auth;
|
||||||
|
using ROLAC.API.Entities;
|
||||||
|
|
||||||
|
namespace ROLAC.API.Services;
|
||||||
|
|
||||||
|
public class AuthService : IAuthService
|
||||||
|
{
|
||||||
|
private readonly UserManager<AppUser> _userManager;
|
||||||
|
private readonly ITokenService _tokenService;
|
||||||
|
private readonly AppDbContext _db;
|
||||||
|
private readonly int _refreshTokenExpiryDays;
|
||||||
|
|
||||||
|
public AuthService(
|
||||||
|
UserManager<AppUser> userManager,
|
||||||
|
ITokenService tokenService,
|
||||||
|
AppDbContext db,
|
||||||
|
IConfiguration config)
|
||||||
|
{
|
||||||
|
_userManager = userManager;
|
||||||
|
_tokenService = tokenService;
|
||||||
|
_db = db;
|
||||||
|
_refreshTokenExpiryDays = int.Parse(config["Jwt:RefreshTokenExpiryDays"] ?? "30");
|
||||||
|
}
|
||||||
|
|
||||||
|
// -------------------------------------------------------------------------
|
||||||
|
// Login
|
||||||
|
// -------------------------------------------------------------------------
|
||||||
|
|
||||||
|
public async Task<(LoginResponse Response, string RawRefreshToken)> LoginAsync(
|
||||||
|
LoginRequest request, string? ipAddress = null, string? deviceInfo = null)
|
||||||
|
{
|
||||||
|
var user = await _userManager.FindByEmailAsync(request.Email);
|
||||||
|
if (user is null)
|
||||||
|
throw new UnauthorizedAccessException("Invalid credentials.");
|
||||||
|
|
||||||
|
if (!await _userManager.CheckPasswordAsync(user, request.Password))
|
||||||
|
throw new UnauthorizedAccessException("Invalid credentials.");
|
||||||
|
|
||||||
|
if (!user.IsActive)
|
||||||
|
throw new UnauthorizedAccessException("Account is inactive.");
|
||||||
|
|
||||||
|
var roles = await _userManager.GetRolesAsync(user);
|
||||||
|
var accessToken = _tokenService.GenerateAccessToken(user, roles);
|
||||||
|
var rawRefresh = _tokenService.GenerateRefreshToken();
|
||||||
|
var tokenHash = _tokenService.HashToken(rawRefresh);
|
||||||
|
|
||||||
|
_db.RefreshTokens.Add(new RefreshToken
|
||||||
|
{
|
||||||
|
UserId = user.Id,
|
||||||
|
TokenHash = tokenHash,
|
||||||
|
ExpiresAt = DateTime.UtcNow.AddDays(_refreshTokenExpiryDays),
|
||||||
|
CreatedAt = DateTime.UtcNow,
|
||||||
|
IpAddress = ipAddress,
|
||||||
|
DeviceInfo = deviceInfo,
|
||||||
|
});
|
||||||
|
|
||||||
|
user.LastLoginAt = DateTime.UtcNow;
|
||||||
|
await _userManager.UpdateAsync(user);
|
||||||
|
await _db.SaveChangesAsync();
|
||||||
|
|
||||||
|
return (BuildResponse(accessToken, user, roles), rawRefresh);
|
||||||
|
}
|
||||||
|
|
||||||
|
// -------------------------------------------------------------------------
|
||||||
|
// Refresh
|
||||||
|
// -------------------------------------------------------------------------
|
||||||
|
|
||||||
|
public async Task<(LoginResponse Response, string RawRefreshToken)> RefreshAsync(
|
||||||
|
string rawRefreshToken, string? ipAddress = null)
|
||||||
|
{
|
||||||
|
var hash = _tokenService.HashToken(rawRefreshToken);
|
||||||
|
var token = await _db.RefreshTokens
|
||||||
|
.FirstOrDefaultAsync(rt => rt.TokenHash == hash);
|
||||||
|
|
||||||
|
if (token is null || !token.IsActive)
|
||||||
|
throw new UnauthorizedAccessException("Invalid or expired refresh token.");
|
||||||
|
|
||||||
|
var user = await _userManager.FindByIdAsync(token.UserId);
|
||||||
|
if (user is null)
|
||||||
|
throw new UnauthorizedAccessException("User not found.");
|
||||||
|
|
||||||
|
var roles = await _userManager.GetRolesAsync(user);
|
||||||
|
var newAccess = _tokenService.GenerateAccessToken(user, roles);
|
||||||
|
var newRaw = _tokenService.GenerateRefreshToken();
|
||||||
|
var newHash = _tokenService.HashToken(newRaw);
|
||||||
|
|
||||||
|
// Rotate: mark old token replaced+revoked, create new token
|
||||||
|
token.RevokedAt = DateTime.UtcNow;
|
||||||
|
token.ReplacedByHash = newHash;
|
||||||
|
|
||||||
|
_db.RefreshTokens.Add(new RefreshToken
|
||||||
|
{
|
||||||
|
UserId = user.Id,
|
||||||
|
TokenHash = newHash,
|
||||||
|
ExpiresAt = DateTime.UtcNow.AddDays(_refreshTokenExpiryDays),
|
||||||
|
CreatedAt = DateTime.UtcNow,
|
||||||
|
IpAddress = ipAddress,
|
||||||
|
DeviceInfo = token.DeviceInfo,
|
||||||
|
});
|
||||||
|
|
||||||
|
await _db.SaveChangesAsync();
|
||||||
|
|
||||||
|
return (BuildResponse(newAccess, user, roles), newRaw);
|
||||||
|
}
|
||||||
|
|
||||||
|
// -------------------------------------------------------------------------
|
||||||
|
// Logout
|
||||||
|
// -------------------------------------------------------------------------
|
||||||
|
|
||||||
|
public async Task LogoutAsync(string rawRefreshToken)
|
||||||
|
{
|
||||||
|
var hash = _tokenService.HashToken(rawRefreshToken);
|
||||||
|
var token = await _db.RefreshTokens
|
||||||
|
.FirstOrDefaultAsync(rt => rt.TokenHash == hash);
|
||||||
|
|
||||||
|
if (token is not null && token.IsActive)
|
||||||
|
{
|
||||||
|
token.RevokedAt = DateTime.UtcNow;
|
||||||
|
await _db.SaveChangesAsync();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// -------------------------------------------------------------------------
|
||||||
|
// Private helpers
|
||||||
|
// -------------------------------------------------------------------------
|
||||||
|
|
||||||
|
private static LoginResponse BuildResponse(
|
||||||
|
string accessToken, AppUser user, IList<string> roles)
|
||||||
|
=> new()
|
||||||
|
{
|
||||||
|
AccessToken = accessToken,
|
||||||
|
ExpiresIn = 15 * 60,
|
||||||
|
User = new UserInfo
|
||||||
|
{
|
||||||
|
Id = user.Id,
|
||||||
|
Email = user.Email!,
|
||||||
|
Roles = roles,
|
||||||
|
LanguagePreference = user.LanguagePreference,
|
||||||
|
},
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
using ROLAC.API.DTOs.Auth;
|
||||||
|
|
||||||
|
namespace ROLAC.API.Services;
|
||||||
|
|
||||||
|
public interface IAuthService
|
||||||
|
{
|
||||||
|
/// <summary>
|
||||||
|
/// Validates credentials and returns a new access token plus the raw refresh token
|
||||||
|
/// that must be stored in an HttpOnly cookie by the caller.
|
||||||
|
/// Throws <see cref="UnauthorizedAccessException"/> on any auth failure.
|
||||||
|
/// </summary>
|
||||||
|
Task<(LoginResponse Response, string RawRefreshToken)> LoginAsync(
|
||||||
|
LoginRequest request,
|
||||||
|
string? ipAddress = null,
|
||||||
|
string? deviceInfo = null);
|
||||||
|
|
||||||
|
/// <summary>
|
||||||
|
/// Validates a raw refresh token, revokes it, and issues a new token pair (rotation).
|
||||||
|
/// Throws <see cref="UnauthorizedAccessException"/> if the token is not found,
|
||||||
|
/// expired, or already revoked.
|
||||||
|
/// </summary>
|
||||||
|
Task<(LoginResponse Response, string RawRefreshToken)> RefreshAsync(
|
||||||
|
string rawRefreshToken,
|
||||||
|
string? ipAddress = null);
|
||||||
|
|
||||||
|
/// <summary>
|
||||||
|
/// Revokes the refresh token identified by its raw value.
|
||||||
|
/// Silently succeeds if the token is not found.
|
||||||
|
/// </summary>
|
||||||
|
Task LogoutAsync(string rawRefreshToken);
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user