46 lines
1.8 KiB
C#
46 lines
1.8 KiB
C#
using Elsa.Common;
|
|
using Elsa.Common.Multitenancy;
|
|
using Elsa.Identity.Contracts;
|
|
using Elsa.Identity.Entities;
|
|
using Elsa.Identity.Models;
|
|
using Elsa.Identity.Options;
|
|
using Elsa.Identity.Services;
|
|
using NSubstitute;
|
|
|
|
namespace Elsa.Identity.UnitTests.Services;
|
|
|
|
public class DefaultIdentityRefreshTokenServiceTests
|
|
{
|
|
[Fact]
|
|
public async Task RefreshAsyncRejectsAccessAndTamperedTokens()
|
|
{
|
|
var options = Microsoft.Extensions.Options.Options.Create(new IdentityTokenOptions
|
|
{
|
|
SigningKey = IdentityTokenTestConstants.SigningKey,
|
|
Issuer = "https://elsa.test",
|
|
Audience = "elsa-api"
|
|
});
|
|
var tokenService = new DefaultElsaTokenService(new CurrentClock(), options);
|
|
var user = new User { Id = "user-a", Name = "admin" };
|
|
var context = new TokenIssuanceContext(user, [], [], []);
|
|
var accessToken = await tokenService.IssueAccessTokenAsync(context);
|
|
var refreshToken = await tokenService.IssueRefreshTokenAsync(context);
|
|
var tamperedRefreshToken = refreshToken.Token[..^1] + (refreshToken.Token[^1] == 'a' ? 'b' : 'a');
|
|
var accessTokenIssuer = Substitute.For<IAccessTokenIssuer>();
|
|
var service = new DefaultIdentityRefreshTokenService(
|
|
Substitute.For<IUserProvider>(),
|
|
accessTokenIssuer,
|
|
new DefaultTenantAccessor(),
|
|
options);
|
|
|
|
Assert.Null(await service.RefreshAsync(accessToken.Token));
|
|
Assert.Null(await service.RefreshAsync(tamperedRefreshToken));
|
|
await accessTokenIssuer.DidNotReceive().IssueTokensAsync(Arg.Any<User>(), Arg.Any<CancellationToken>());
|
|
}
|
|
|
|
private sealed class CurrentClock : ISystemClock
|
|
{
|
|
public DateTimeOffset UtcNow => DateTimeOffset.UtcNow;
|
|
}
|
|
}
|