Bifrost as OIDC issuer for the Matrix chat (gamecult-chat cut bifrost-oidc-issuer, squash of 1ef289a..ec4acfa and abd12b3..)
One configured client (stale clients removed with their tokens and authorizations), Active membership re-checked at token and userinfo through IsStillActiveMemberAsync, PKCE required by the server option, OpenIddict.Server.AspNetCore + EntityFrameworkCore 7.7.1 with no vulnerable transitives. Soul s2, s3 and s4 hold; Low conformance gaps in gamecult-chat:follow_up:oidc-issuer-spec-conformance. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens
parent
78d38d92e6
commit
83daabe512
20 changed files with 4771 additions and 48 deletions
|
|
@ -21,6 +21,7 @@ public sealed class MigrationDiscoveryTests
|
|||
"20260622202000_AddBridgeActionTargetSurfaceName",
|
||||
"20260705190000_AddPatronSupportProjectAttribution",
|
||||
"20261010043937_AddConceptVotes",
|
||||
"20261022163159_AddOpenIddict",
|
||||
];
|
||||
|
||||
// Database.GetMigrations() reads assembly metadata only; no connection is opened.
|
||||
|
|
@ -50,7 +51,7 @@ public sealed class MigrationDiscoveryTests
|
|||
}
|
||||
|
||||
[Fact]
|
||||
public void All_thirteen_migrations_are_listed_in_order()
|
||||
public void All_fourteen_migrations_are_listed_in_order()
|
||||
{
|
||||
Assert.Equal(ExpectedMigrations, Discovered());
|
||||
}
|
||||
|
|
|
|||
737
tests/Bifrost.Web.Tests/OidcIssuerTests.cs
Normal file
737
tests/Bifrost.Web.Tests/OidcIssuerTests.cs
Normal file
|
|
@ -0,0 +1,737 @@
|
|||
using System.Net;
|
||||
using System.Net.Http.Headers;
|
||||
using System.Net.Http.Json;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
using Bifrost.Web.Domain;
|
||||
using Bifrost.Web.Features.Shared;
|
||||
using Bifrost.Web.Tests.Support;
|
||||
using Microsoft.AspNetCore.Mvc.Testing;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Microsoft.Extensions.Hosting;
|
||||
using Microsoft.IdentityModel.JsonWebTokens;
|
||||
using Microsoft.IdentityModel.Tokens;
|
||||
|
||||
namespace Bifrost.Web.Tests;
|
||||
|
||||
public sealed class OidcIssuerTests : IClassFixture<OidcWebApplicationFactory>
|
||||
{
|
||||
private static readonly Uri Origin = new("https://localhost");
|
||||
private readonly OidcWebApplicationFactory _factory;
|
||||
|
||||
public OidcIssuerTests(OidcWebApplicationFactory factory) => _factory = factory;
|
||||
|
||||
[Fact]
|
||||
public async Task Discovery_advertises_ES256_and_the_code_flow_only()
|
||||
{
|
||||
using var client = NewClient();
|
||||
var discovery = await client.GetFromJsonAsync<JsonElement>("/.well-known/openid-configuration");
|
||||
|
||||
Assert.Equal(Origin.AbsoluteUri, discovery.GetProperty("issuer").GetString());
|
||||
Assert.Equal("/.well-known/jwks", new Uri(discovery.GetProperty("jwks_uri").GetString()!).AbsolutePath);
|
||||
Assert.Equal(["ES256"], Strings(discovery, "id_token_signing_alg_values_supported"));
|
||||
Assert.Equal(["code"], Strings(discovery, "response_types_supported"));
|
||||
Assert.Equal(["authorization_code"], Strings(discovery, "grant_types_supported"));
|
||||
Assert.Contains("S256", Strings(discovery, "code_challenge_methods_supported"));
|
||||
Assert.Equal(["client_secret_basic"], Strings(discovery, "token_endpoint_auth_methods_supported"));
|
||||
Assert.Equal(["openid", "profile"], Strings(discovery, "scopes_supported").Order());
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Jwks_holds_exactly_the_configured_P256_key()
|
||||
{
|
||||
using var client = NewClient();
|
||||
var jwks = await GetJwksAsync(client);
|
||||
|
||||
var key = Assert.Single(jwks.GetProperty("keys").EnumerateArray());
|
||||
Assert.Equal("EC", key.GetProperty("kty").GetString());
|
||||
Assert.Equal("P-256", key.GetProperty("crv").GetString());
|
||||
Assert.Equal("ES256", key.GetProperty("alg").GetString());
|
||||
|
||||
using var ec = ECDsa.Create();
|
||||
ec.ImportFromPem(_factory.Kit.SigningPublicKeyPem);
|
||||
var expected = ec.ExportParameters(false);
|
||||
Assert.Equal(Base64UrlEncoder.Encode(expected.Q.X), key.GetProperty("x").GetString());
|
||||
Assert.Equal(Base64UrlEncoder.Encode(expected.Q.Y), key.GetProperty("y").GetString());
|
||||
Assert.False(key.TryGetProperty("d", out _));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task An_active_member_completes_code_and_pkce_and_gets_the_right_claims()
|
||||
{
|
||||
var (client, identity) = await SignedInAsync(MembershipStatus.Active, "Ada Lovelace");
|
||||
var accountId = _factory.AccountId(identity);
|
||||
await SetLinksAsync(identity, "heimdall-canary-7", "github-canary-7");
|
||||
|
||||
var tokens = await CompleteFlowAsync(client);
|
||||
|
||||
var verified = await ValidateIdTokenAsync(tokens.IdToken, tokens.Request.Nonce);
|
||||
Assert.Equal(accountId.ToString("D"), verified.Claim("sub"));
|
||||
Assert.Equal(identity, verified.Claim("preferred_username"));
|
||||
Assert.Equal("Ada Lovelace", verified.Claim("name"));
|
||||
Assert.Equal(["ES256"], [verified.Alg]);
|
||||
|
||||
// Nothing about the authenticator links, e-mail or membership leaves Bifrost.
|
||||
Assert.DoesNotContain("heimdall-canary-7", verified.PayloadJson);
|
||||
Assert.DoesNotContain("github-canary-7", verified.PayloadJson);
|
||||
Assert.DoesNotContain("email", verified.PayloadJson, StringComparison.OrdinalIgnoreCase);
|
||||
Assert.DoesNotContain("urn:bifrost", verified.PayloadJson);
|
||||
|
||||
using var userinfo = new HttpRequestMessage(HttpMethod.Get, "/connect/userinfo");
|
||||
userinfo.Headers.Authorization = new AuthenticationHeaderValue("Bearer", tokens.AccessToken);
|
||||
using var userinfoResponse = await NewClient().SendAsync(userinfo);
|
||||
Assert.Equal(HttpStatusCode.OK, userinfoResponse.StatusCode);
|
||||
var body = await userinfoResponse.Content.ReadAsStringAsync();
|
||||
var info = JsonDocument.Parse(body).RootElement;
|
||||
Assert.Equal(accountId.ToString("D"), info.GetProperty("sub").GetString());
|
||||
Assert.Equal(identity, info.GetProperty("preferred_username").GetString());
|
||||
Assert.Equal("Ada Lovelace", info.GetProperty("name").GetString());
|
||||
Assert.DoesNotContain("canary", body);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Sub_and_preferred_username_are_stable_across_display_name_changes()
|
||||
{
|
||||
var (client, identity) = await SignedInAsync(MembershipStatus.Active, "First Name");
|
||||
|
||||
var first = await ValidateIdTokenAsync((await CompleteFlowAsync(client)).IdToken, null);
|
||||
await _factory.SetDisplayNameAsync(identity, "Second Name");
|
||||
var second = await ValidateIdTokenAsync((await CompleteFlowAsync(client)).IdToken, null);
|
||||
|
||||
Assert.Equal(first.Claim("sub"), second.Claim("sub"));
|
||||
Assert.Equal(first.Claim("preferred_username"), second.Claim("preferred_username"));
|
||||
Assert.Equal("First Name", first.Claim("name"));
|
||||
Assert.Equal("Second Name", second.Claim("name"));
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(MembershipStatus.Authenticated)]
|
||||
[InlineData(MembershipStatus.PendingApproval)]
|
||||
[InlineData(MembershipStatus.Suspended)]
|
||||
public async Task A_member_who_is_not_active_is_refused_with_access_denied_and_no_code(MembershipStatus status)
|
||||
{
|
||||
var (client, _) = await SignedInAsync(status, "Not Active");
|
||||
var request = NewRequest();
|
||||
|
||||
var final = await DriveAsync(client, request);
|
||||
|
||||
var redirect = AssertRedirectToClient(final, request.State);
|
||||
Assert.Equal("access_denied", redirect["error"]);
|
||||
Assert.Equal(Bifrost.Web.Features.Oidc.OidcEndpoints.NotActiveDescription, redirect["error_description"]);
|
||||
Assert.False(redirect.ContainsKey("code"));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task An_active_account_with_no_bifrost_identity_is_refused_never_given_an_empty_username()
|
||||
{
|
||||
using var factory = new OidcNoIdentityFactory();
|
||||
using var client = factory.CreateClient(ClientOptions());
|
||||
await RegisterAsync(client, $"noid-{Guid.NewGuid():N}");
|
||||
var request = NewRequest();
|
||||
|
||||
var final = await DriveAsync(client, request);
|
||||
|
||||
var redirect = AssertRedirectToClient(final, request.State);
|
||||
Assert.Equal("access_denied", redirect["error"]);
|
||||
Assert.Equal(Bifrost.Web.Features.Oidc.OidcEndpoints.NoIdentityDescription, redirect["error_description"]);
|
||||
Assert.False(redirect.ContainsKey("code"));
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("unknown-client", OidcTestKit.RedirectUri, true)]
|
||||
[InlineData(OidcTestKit.ClientId, "https://evil.example.test/callback", true)]
|
||||
[InlineData(OidcTestKit.ClientId, OidcTestKit.RedirectUri, false)]
|
||||
public async Task Unknown_client_wrong_redirect_uri_and_missing_pkce_are_refused_before_any_sign_in_redirect(
|
||||
string clientId, string redirectUri, bool pkce)
|
||||
{
|
||||
using var client = NewClient();
|
||||
var request = NewRequest(clientId, redirectUri, pkce);
|
||||
|
||||
using var response = await client.GetAsync(request.Path);
|
||||
|
||||
var location = response.Headers.Location?.OriginalString ?? string.Empty;
|
||||
Assert.DoesNotContain("/auth/sign-in", location);
|
||||
Assert.DoesNotContain("request_uri=", location);
|
||||
Assert.DoesNotContain("code=", location);
|
||||
Assert.NotEqual(HttpStatusCode.OK, response.StatusCode);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task A_mas_sized_authorize_request_survives_sign_in_and_its_handle_is_single_use()
|
||||
{
|
||||
var request = NewRequest(extra: "&ui_locales=en&prompt=login&claims_locales=en&max_age=3600");
|
||||
Assert.True(request.Path.Length > LocalReturnPath.MaxLength, "the request must be longer than a sign-in return path");
|
||||
|
||||
using var client = NewClient();
|
||||
var signIn = await DriveAsync(client, request);
|
||||
Assert.Equal(HttpStatusCode.Redirect, signIn.StatusCode);
|
||||
Assert.Equal("/auth/sign-in", signIn.Headers.Location!.IsAbsoluteUri
|
||||
? signIn.Headers.Location.AbsolutePath
|
||||
: signIn.Headers.Location.OriginalString.Split('?')[0]);
|
||||
var resume = ReturnUrl(signIn);
|
||||
Assert.True(resume.Length <= LocalReturnPath.MaxLength, "the resume path must fit the sign-in return path");
|
||||
Assert.Equal(resume, LocalReturnPath.Parse(resume).Value);
|
||||
|
||||
var identity = await RegisterAsync(client, $"resume-{Guid.NewGuid():N}");
|
||||
await _factory.SetMembershipAsync(identity, MembershipStatus.Active);
|
||||
|
||||
using var resumed = await client.GetAsync(resume);
|
||||
var redirect = AssertRedirectToClient(resumed, request.State);
|
||||
Assert.True(redirect.ContainsKey("code"), "the resumed request issues a code");
|
||||
|
||||
var tokens = await ExchangeAsync(client, request, redirect["code"]!);
|
||||
var verified = await ValidateIdTokenAsync(tokens.IdToken, request.Nonce);
|
||||
Assert.Equal(request.Nonce, verified.Claim("nonce"));
|
||||
|
||||
// The handle was spent by the first resume.
|
||||
using var replay = await client.GetAsync(resume);
|
||||
var replayRedirect = replay.Headers.Location?.OriginalString ?? string.Empty;
|
||||
Assert.DoesNotContain("code=", replayRedirect);
|
||||
Assert.NotEqual(HttpStatusCode.OK, replay.StatusCode);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task A_parked_authorize_request_expires()
|
||||
{
|
||||
// Own host: moving the clock must not skew the id_token checks of the other tests.
|
||||
using var own = new OidcWebApplicationFactory();
|
||||
await new OidcIssuerTests(own).ParkedRequestIsRefusedAfterItsLifetimeAsync();
|
||||
}
|
||||
|
||||
private async Task ParkedRequestIsRefusedAfterItsLifetimeAsync()
|
||||
{
|
||||
// Fixed probe times, not the constant: a lifetime of a day, or of a minute, must show.
|
||||
var early = NewRequest();
|
||||
var late = NewRequest();
|
||||
using var client = NewClient();
|
||||
var earlyResume = ReturnUrl(await DriveAsync(client, early));
|
||||
var lateResume = ReturnUrl(await DriveAsync(client, late));
|
||||
var identity = await RegisterAsync(client, $"late-{Guid.NewGuid():N}");
|
||||
await _factory.SetMembershipAsync(identity, MembershipStatus.Active);
|
||||
|
||||
_factory.Clock.Advance(TimeSpan.FromMinutes(5));
|
||||
using var withinLifetime = await client.GetAsync(earlyResume);
|
||||
Assert.True(AssertRedirectToClient(withinLifetime, early.State).ContainsKey("code"), "five minutes is within the lifetime");
|
||||
|
||||
_factory.Clock.Advance(TimeSpan.FromMinutes(25));
|
||||
using var expired = await client.GetAsync(lateResume);
|
||||
var location = expired.Headers.Location?.OriginalString ?? string.Empty;
|
||||
Assert.DoesNotContain("code=", location);
|
||||
Assert.NotEqual(HttpStatusCode.OK, expired.StatusCode);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task The_token_endpoint_accepts_client_secret_basic_only()
|
||||
{
|
||||
var (client, _) = await SignedInAsync(MembershipStatus.Active, "Basic Only");
|
||||
var request = NewRequest();
|
||||
var code = await CodeAsync(client, request);
|
||||
|
||||
var wrongSecret = await TokenAsync(client, request, code, secret: "wrong-secret");
|
||||
Assert.NotEqual(HttpStatusCode.OK, wrongSecret.StatusCode);
|
||||
|
||||
var asPost = await TokenAsync(client, request, code, secretInBody: true);
|
||||
Assert.NotEqual(HttpStatusCode.OK, asPost.StatusCode);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Identity_is_minted_once()
|
||||
{
|
||||
using var scope = _factory.Services.CreateScope();
|
||||
var service = scope.ServiceProvider.GetRequiredService<Bifrost.Web.Features.Membership.BifrostIdentityService>();
|
||||
var account = new UserAccount { BifrostIdentity = "Original", NormalizedBifrostIdentity = "original" };
|
||||
|
||||
await service.EnsureIdentityAsync(account, "someone-else", CancellationToken.None);
|
||||
|
||||
Assert.Equal("original", account.NormalizedBifrostIdentity);
|
||||
Assert.Equal("Original", account.BifrostIdentity);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task The_openid_scope_alone_releases_the_subject_and_nothing_else()
|
||||
{
|
||||
var (client, identity) = await SignedInAsync(MembershipStatus.Active, "Scoped Down");
|
||||
var request = NewRequest(scope: "openid");
|
||||
var code = await CodeAsync(client, request);
|
||||
|
||||
var tokens = await ExchangeAsync(client, request, code);
|
||||
|
||||
var verified = await ValidateIdTokenAsync(tokens.IdToken, request.Nonce);
|
||||
Assert.Equal(_factory.AccountId(identity).ToString("D"), verified.Claim("sub"));
|
||||
Assert.Null(verified.Claim("preferred_username"));
|
||||
Assert.Null(verified.Claim("name"));
|
||||
|
||||
using var userinfo = new HttpRequestMessage(HttpMethod.Get, "/connect/userinfo");
|
||||
userinfo.Headers.Authorization = new AuthenticationHeaderValue("Bearer", tokens.AccessToken);
|
||||
using var response = await NewClient().SendAsync(userinfo);
|
||||
var info = (await response.Content.ReadFromJsonAsync<JsonElement>()).EnumerateObject().Select(x => x.Name).ToArray();
|
||||
Assert.Equal(["sub"], info);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task A_blank_display_name_falls_back_to_the_bifrost_identity()
|
||||
{
|
||||
var (client, identity) = await SignedInAsync(MembershipStatus.Active, " ");
|
||||
|
||||
var verified = await ValidateIdTokenAsync((await CompleteFlowAsync(client)).IdToken, null);
|
||||
|
||||
Assert.Equal(identity, verified.Claim("name"));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Userinfo_without_a_valid_token_is_refused()
|
||||
{
|
||||
using var client = NewClient();
|
||||
using var none = await client.GetAsync("/connect/userinfo");
|
||||
Assert.Equal(HttpStatusCode.Unauthorized, none.StatusCode);
|
||||
|
||||
using var forged = new HttpRequestMessage(HttpMethod.Get, "/connect/userinfo");
|
||||
forged.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "not-a-token");
|
||||
using var forgedResponse = await client.SendAsync(forged);
|
||||
Assert.Equal(HttpStatusCode.Unauthorized, forgedResponse.StatusCode);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Startup_makes_the_one_client_match_configuration_again()
|
||||
{
|
||||
// Own host: the drift below leaves the application manager's cache stale for every other test.
|
||||
using var own = new OidcWebApplicationFactory();
|
||||
await new OidcIssuerTests(own).SeederRestoresTheClientAsync();
|
||||
}
|
||||
|
||||
private async Task SeederRestoresTheClientAsync()
|
||||
{
|
||||
using var warm = NewClient();
|
||||
await warm.GetAsync("/healthz");
|
||||
using var scope = _factory.Services.CreateScope();
|
||||
var manager = scope.ServiceProvider.GetRequiredService<OpenIddict.Abstractions.IOpenIddictApplicationManager>();
|
||||
var application = await manager.FindByClientIdAsync(OidcTestKit.ClientId);
|
||||
Assert.NotNull(application);
|
||||
|
||||
// Someone widened the client in the database; the next start puts configuration back.
|
||||
var drifted = new OpenIddict.Abstractions.OpenIddictApplicationDescriptor
|
||||
{
|
||||
ClientId = OidcTestKit.ClientId,
|
||||
ClientType = OpenIddict.Abstractions.OpenIddictConstants.ClientTypes.Confidential,
|
||||
ClientSecret = "drifted-secret",
|
||||
RedirectUris = { new Uri("https://evil.example.test/callback") }
|
||||
};
|
||||
await manager.UpdateAsync(application, drifted);
|
||||
var seeders = _factory.Services.GetServices<IHostedService>().OfType<Bifrost.Web.Features.Oidc.OidcClientSeeder>().ToList();
|
||||
var seeder = Assert.Single(seeders);
|
||||
await seeder.StartAsync(CancellationToken.None);
|
||||
|
||||
// Read the stored row, not through the manager: the manager's cache still holds the drifted instance.
|
||||
using var fresh = _factory.Services.CreateScope();
|
||||
var rows = fresh.ServiceProvider.GetRequiredService<Bifrost.Web.Data.BifrostDbContext>()
|
||||
.Set<OpenIddict.EntityFrameworkCore.Models.OpenIddictEntityFrameworkCoreApplication>()
|
||||
.AsNoTracking().ToList();
|
||||
var stored = Assert.Single(rows);
|
||||
Assert.Equal([OidcTestKit.RedirectUri], (await manager.GetRedirectUrisAsync(stored)).ToArray());
|
||||
Assert.True(await manager.ValidateClientSecretAsync(stored, _factory.Kit.ClientSecret));
|
||||
Assert.False(await manager.ValidateClientSecretAsync(stored, "drifted-secret"));
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(MembershipStatus.Authenticated)]
|
||||
[InlineData(MembershipStatus.PendingApproval)]
|
||||
[InlineData(MembershipStatus.Suspended)]
|
||||
[InlineData(null)]
|
||||
public async Task A_member_no_longer_active_after_authorize_gets_no_tokens(MembershipStatus? status)
|
||||
{
|
||||
var (client, identity) = await SignedInAsync(MembershipStatus.Active, "Soon Gone");
|
||||
var request = NewRequest();
|
||||
var code = await CodeAsync(client, request);
|
||||
|
||||
await LeaveActiveAsync(identity, status);
|
||||
|
||||
using var response = await TokenAsync(client, request, code);
|
||||
var body = await response.Content.ReadAsStringAsync();
|
||||
Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
|
||||
Assert.Contains("invalid_grant", body);
|
||||
Assert.DoesNotContain("id_token", body);
|
||||
Assert.DoesNotContain("access_token", body);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData(MembershipStatus.Authenticated)]
|
||||
[InlineData(MembershipStatus.PendingApproval)]
|
||||
[InlineData(MembershipStatus.Suspended)]
|
||||
[InlineData(null)]
|
||||
public async Task Userinfo_refuses_an_access_token_whose_member_is_no_longer_active(MembershipStatus? status)
|
||||
{
|
||||
var (client, identity) = await SignedInAsync(MembershipStatus.Active, "Soon Gone");
|
||||
var tokens = await CompleteFlowAsync(client);
|
||||
|
||||
using (var before = await UserInfoAsync(tokens.AccessToken))
|
||||
{
|
||||
Assert.Equal(HttpStatusCode.OK, before.StatusCode);
|
||||
}
|
||||
|
||||
await LeaveActiveAsync(identity, status);
|
||||
|
||||
using var after = await UserInfoAsync(tokens.AccessToken);
|
||||
Assert.Equal(HttpStatusCode.Forbidden, after.StatusCode);
|
||||
Assert.DoesNotContain(identity, await after.Content.ReadAsStringAsync());
|
||||
}
|
||||
|
||||
private Task<HttpResponseMessage> UserInfoAsync(string accessToken)
|
||||
{
|
||||
var request = new HttpRequestMessage(HttpMethod.Get, "/connect/userinfo");
|
||||
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
|
||||
return NewClient().SendAsync(request);
|
||||
}
|
||||
|
||||
/// <summary>A null status deletes the account instead.</summary>
|
||||
private Task LeaveActiveAsync(string identity, MembershipStatus? status) =>
|
||||
status is { } value ? _factory.SetMembershipAsync(identity, value) : _factory.DeleteAccountAsync(identity);
|
||||
|
||||
[Fact]
|
||||
public async Task Startup_removes_every_client_but_the_configured_one_with_its_tokens_and_authorizations()
|
||||
{
|
||||
// Own host: the stale clients are rows the other tests must not see.
|
||||
using var own = new OidcCascadeFactory();
|
||||
await new OidcIssuerTests(own).StaleClientsAreRemovedAsync();
|
||||
}
|
||||
|
||||
private async Task StaleClientsAreRemovedAsync()
|
||||
{
|
||||
// Two stale clients, one of them differing from the configured id only in case.
|
||||
var stale = new[]
|
||||
{
|
||||
(Id: "old-mas", Redirect: "https://old.example.test/callback"),
|
||||
(Id: OidcTestKit.ClientId.ToUpperInvariant(), Redirect: "https://shouting.example.test/callback")
|
||||
};
|
||||
var (client, _) = await SignedInAsync(MembershipStatus.Active, "Member");
|
||||
using (var scope = _factory.Services.CreateScope())
|
||||
{
|
||||
var manager = scope.ServiceProvider.GetRequiredService<OpenIddict.Abstractions.IOpenIddictApplicationManager>();
|
||||
foreach (var (id, redirect) in stale)
|
||||
{
|
||||
await manager.CreateAsync(new OpenIddict.Abstractions.OpenIddictApplicationDescriptor
|
||||
{
|
||||
ClientId = id,
|
||||
ClientSecret = "stale-secret",
|
||||
ClientType = OpenIddict.Abstractions.OpenIddictConstants.ClientTypes.Confidential,
|
||||
RedirectUris = { new Uri(redirect) },
|
||||
Permissions =
|
||||
{
|
||||
OpenIddict.Abstractions.OpenIddictConstants.Permissions.Endpoints.Authorization,
|
||||
OpenIddict.Abstractions.OpenIddictConstants.Permissions.Endpoints.Token,
|
||||
OpenIddict.Abstractions.OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode,
|
||||
OpenIddict.Abstractions.OpenIddictConstants.Permissions.ResponseTypes.Code,
|
||||
OpenIddict.Abstractions.OpenIddictConstants.Permissions.Scopes.Profile,
|
||||
OpenIddict.Abstractions.OpenIddictConstants.Permissions.Prefixes.Scope + OpenIddict.Abstractions.OpenIddictConstants.Scopes.OpenId
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// The control: before seeding every client, stale or configured, really can obtain a code and so holds
|
||||
// an authorization and a token.
|
||||
foreach (var (id, redirect) in stale)
|
||||
{
|
||||
using var issued = await DriveAsync(client, NewRequest(id, redirect));
|
||||
Assert.Contains("code=", issued.Headers.Location?.OriginalString ?? string.Empty);
|
||||
}
|
||||
|
||||
_ = await CodeAsync(client, NewRequest());
|
||||
var staleCounts = Counts(stale.Select(x => x.Id));
|
||||
Assert.Equal(stale.Length, staleCounts.Count);
|
||||
Assert.All(staleCounts, x => Assert.True(x.Tokens > 0 && x.Authorizations > 0, "the control must leave grants to remove"));
|
||||
var configuredBefore = Counts([OidcTestKit.ClientId]).Single();
|
||||
Assert.True(configuredBefore.Tokens > 0 && configuredBefore.Authorizations > 0);
|
||||
|
||||
var seeder = Assert.Single(_factory.Services.GetServices<IHostedService>().OfType<Bifrost.Web.Features.Oidc.OidcClientSeeder>());
|
||||
await seeder.StartAsync(CancellationToken.None);
|
||||
|
||||
foreach (var (id, redirect) in stale)
|
||||
{
|
||||
using var refused = await DriveAsync(client, NewRequest(id, redirect));
|
||||
Assert.DoesNotContain("code=", refused.Headers.Location?.OriginalString ?? string.Empty);
|
||||
Assert.NotEqual(HttpStatusCode.OK, refused.StatusCode);
|
||||
}
|
||||
|
||||
using var fresh = _factory.Services.CreateScope();
|
||||
var db = fresh.ServiceProvider.GetRequiredService<Bifrost.Web.Data.BifrostDbContext>();
|
||||
var rows = db.Set<OpenIddict.EntityFrameworkCore.Models.OpenIddictEntityFrameworkCoreApplication>().AsNoTracking().ToList();
|
||||
Assert.Equal([OidcTestKit.ClientId], rows.Select(x => x.ClientId).ToArray());
|
||||
|
||||
// Nothing issued to a removed client survives, and the configured client's grants are untouched.
|
||||
var keptId = rows.Single().Id;
|
||||
Assert.Empty(db.Set<OpenIddict.EntityFrameworkCore.Models.OpenIddictEntityFrameworkCoreToken>().AsNoTracking().Where(x => x.Application!.Id != keptId));
|
||||
Assert.Empty(db.Set<OpenIddict.EntityFrameworkCore.Models.OpenIddictEntityFrameworkCoreAuthorization>().AsNoTracking().Where(x => x.Application!.Id != keptId));
|
||||
Assert.Equal(configuredBefore, Counts([OidcTestKit.ClientId]).Single());
|
||||
}
|
||||
|
||||
private sealed record GrantCount(int Tokens, int Authorizations);
|
||||
|
||||
private List<GrantCount> Counts(IEnumerable<string> clientIds)
|
||||
{
|
||||
using var scope = _factory.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<Bifrost.Web.Data.BifrostDbContext>();
|
||||
var applications = db.Set<OpenIddict.EntityFrameworkCore.Models.OpenIddictEntityFrameworkCoreApplication>().AsNoTracking().ToList();
|
||||
return clientIds
|
||||
.Select(id => applications.Single(x => x.ClientId == id).Id)
|
||||
.Select(applicationId => new GrantCount(
|
||||
db.Set<OpenIddict.EntityFrameworkCore.Models.OpenIddictEntityFrameworkCoreToken>().Count(x => x.Application!.Id == applicationId),
|
||||
db.Set<OpenIddict.EntityFrameworkCore.Models.OpenIddictEntityFrameworkCoreAuthorization>().Count(x => x.Application!.Id == applicationId)))
|
||||
.ToList();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task The_issuer_is_the_configured_public_base_url_not_the_request_origin()
|
||||
{
|
||||
using var factory = new OidcForeignIssuerFactory();
|
||||
using var client = factory.CreateClient(ClientOptions());
|
||||
var discovery = await client.GetFromJsonAsync<JsonElement>("/.well-known/openid-configuration");
|
||||
|
||||
Assert.Equal(OidcForeignIssuerFactory.PublicBaseUrl, discovery.GetProperty("issuer").GetString());
|
||||
}
|
||||
|
||||
// ---- helpers ----
|
||||
|
||||
private static WebApplicationFactoryClientOptions ClientOptions() => new()
|
||||
{
|
||||
AllowAutoRedirect = false,
|
||||
HandleCookies = true,
|
||||
BaseAddress = Origin
|
||||
};
|
||||
|
||||
private HttpClient NewClient() => _factory.CreateClient(ClientOptions());
|
||||
|
||||
private static async Task<string> RegisterAsync(HttpClient client, string identity)
|
||||
{
|
||||
using var response = await client.PostAsJsonAsync("/auth/bifrost/register", new { identity, displayName = identity });
|
||||
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
|
||||
return identity.ToLowerInvariant();
|
||||
}
|
||||
|
||||
private async Task<(HttpClient Client, string Identity)> SignedInAsync(MembershipStatus status, string displayName)
|
||||
{
|
||||
var client = NewClient();
|
||||
var identity = await RegisterAsync(client, $"member-{Guid.NewGuid():N}");
|
||||
await _factory.SetMembershipAsync(identity, status);
|
||||
await _factory.SetDisplayNameAsync(identity, displayName);
|
||||
return (client, identity);
|
||||
}
|
||||
|
||||
private async Task SetLinksAsync(string identity, string heimdallAccountId, string gitHubLogin)
|
||||
{
|
||||
using var scope = _factory.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<Bifrost.Web.Data.BifrostDbContext>();
|
||||
var account = db.UserAccounts.Single(x => x.NormalizedBifrostIdentity == identity);
|
||||
account.HeimdallAccountId = heimdallAccountId;
|
||||
account.GitHubLogin = gitHubLogin;
|
||||
await db.SaveChangesAsync();
|
||||
}
|
||||
|
||||
private sealed record AuthRequest(string Verifier, string State, string Nonce, string Path)
|
||||
{
|
||||
public string Challenge => Base64UrlEncoder.Encode(SHA256.HashData(Encoding.ASCII.GetBytes(Verifier)));
|
||||
}
|
||||
|
||||
private static AuthRequest NewRequest(
|
||||
string clientId = OidcTestKit.ClientId,
|
||||
string redirectUri = OidcTestKit.RedirectUri,
|
||||
bool pkce = true,
|
||||
string extra = "",
|
||||
string scope = "openid%20profile")
|
||||
{
|
||||
var verifier = Base64UrlEncoder.Encode(RandomNumberGenerator.GetBytes(48));
|
||||
var state = Base64UrlEncoder.Encode(RandomNumberGenerator.GetBytes(24));
|
||||
var nonce = Base64UrlEncoder.Encode(RandomNumberGenerator.GetBytes(24));
|
||||
var challenge = Base64UrlEncoder.Encode(SHA256.HashData(Encoding.ASCII.GetBytes(verifier)));
|
||||
var path = "/connect/authorize?response_type=code" +
|
||||
$"&client_id={Uri.EscapeDataString(clientId)}" +
|
||||
$"&redirect_uri={Uri.EscapeDataString(redirectUri)}" +
|
||||
$"&scope={scope}" +
|
||||
$"&state={state}&nonce={nonce}" +
|
||||
(pkce ? $"&code_challenge={challenge}&code_challenge_method=S256" : string.Empty) +
|
||||
extra;
|
||||
return new AuthRequest(verifier, state, nonce, path);
|
||||
}
|
||||
|
||||
/// <summary>Starts an authorize request and follows the provider's own redirects until the first response that is not one of them.</summary>
|
||||
private static async Task<HttpResponseMessage> DriveAsync(HttpClient client, AuthRequest request)
|
||||
{
|
||||
var response = await client.GetAsync(request.Path);
|
||||
for (var hops = 0; hops < 4 && IsAuthorizeRedirect(response); hops++)
|
||||
{
|
||||
var next = response.Headers.Location!;
|
||||
response.Dispose();
|
||||
response = await client.GetAsync(next.IsAbsoluteUri ? next.PathAndQuery : next.OriginalString);
|
||||
}
|
||||
|
||||
return response;
|
||||
}
|
||||
|
||||
private static bool IsAuthorizeRedirect(HttpResponseMessage response) =>
|
||||
response.StatusCode is HttpStatusCode.Redirect or HttpStatusCode.Found &&
|
||||
response.Headers.Location is { } location &&
|
||||
(location.IsAbsoluteUri ? location.AbsolutePath : location.OriginalString).StartsWith("/connect/authorize", StringComparison.Ordinal);
|
||||
|
||||
private static string ReturnUrl(HttpResponseMessage signInRedirect)
|
||||
{
|
||||
var location = signInRedirect.Headers.Location!;
|
||||
var query = location.IsAbsoluteUri ? location.Query : location.OriginalString[location.OriginalString.IndexOf('?')..];
|
||||
return Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(query)
|
||||
.Single(x => string.Equals(x.Key, "returnUrl", StringComparison.OrdinalIgnoreCase)).Value.ToString();
|
||||
}
|
||||
|
||||
private static Dictionary<string, string?> AssertRedirectToClient(HttpResponseMessage response, string state)
|
||||
{
|
||||
Assert.True(response.StatusCode is HttpStatusCode.Redirect or HttpStatusCode.Found, $"expected a redirect, got {(int)response.StatusCode}");
|
||||
var location = response.Headers.Location!;
|
||||
Assert.Equal(new Uri(OidcTestKit.RedirectUri).GetLeftPart(UriPartial.Path), location.GetLeftPart(UriPartial.Path));
|
||||
var query = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(location.Query);
|
||||
Assert.Equal(state, query["state"].ToString());
|
||||
return query.ToDictionary(x => x.Key, x => (string?)x.Value.ToString());
|
||||
}
|
||||
|
||||
private async Task<string> CodeAsync(HttpClient signedIn, AuthRequest request)
|
||||
{
|
||||
var final = await DriveAsync(signedIn, request);
|
||||
return AssertRedirectToClient(final, request.State)["code"]!;
|
||||
}
|
||||
|
||||
private sealed record Tokens(AuthRequest Request, string IdToken, string AccessToken);
|
||||
|
||||
private async Task<Tokens> CompleteFlowAsync(HttpClient signedIn)
|
||||
{
|
||||
var request = NewRequest();
|
||||
var code = await CodeAsync(signedIn, request);
|
||||
return await ExchangeAsync(signedIn, request, code);
|
||||
}
|
||||
|
||||
private async Task<Tokens> ExchangeAsync(HttpClient client, AuthRequest request, string code)
|
||||
{
|
||||
using var response = await TokenAsync(client, request, code);
|
||||
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
|
||||
var body = await response.Content.ReadFromJsonAsync<JsonElement>();
|
||||
Assert.DoesNotContain("refresh_token", body.EnumerateObject().Select(x => x.Name));
|
||||
return new Tokens(request, body.GetProperty("id_token").GetString()!, body.GetProperty("access_token").GetString()!);
|
||||
}
|
||||
|
||||
private async Task<HttpResponseMessage> TokenAsync(
|
||||
HttpClient client, AuthRequest request, string code, string? secret = null, bool secretInBody = false)
|
||||
{
|
||||
var form = new Dictionary<string, string>
|
||||
{
|
||||
["grant_type"] = "authorization_code",
|
||||
["code"] = code,
|
||||
["redirect_uri"] = OidcTestKit.RedirectUri,
|
||||
["code_verifier"] = request.Verifier
|
||||
};
|
||||
var message = new HttpRequestMessage(HttpMethod.Post, "/connect/token");
|
||||
var effectiveSecret = secret ?? _factory.Kit.ClientSecret;
|
||||
if (secretInBody)
|
||||
{
|
||||
form["client_id"] = OidcTestKit.ClientId;
|
||||
form["client_secret"] = effectiveSecret;
|
||||
}
|
||||
else
|
||||
{
|
||||
message.Headers.Authorization = new AuthenticationHeaderValue(
|
||||
"Basic",
|
||||
Convert.ToBase64String(Encoding.ASCII.GetBytes($"{OidcTestKit.ClientId}:{effectiveSecret}")));
|
||||
}
|
||||
|
||||
message.Content = new FormUrlEncodedContent(form);
|
||||
// The code is bound to the client; use a cookieless client so a session cannot influence the exchange.
|
||||
using var bare = NewClient();
|
||||
return await bare.SendAsync(message);
|
||||
}
|
||||
|
||||
private sealed record Verified(string Alg, string PayloadJson, JsonElement Payload)
|
||||
{
|
||||
public string? Claim(string name) => Payload.TryGetProperty(name, out var value) ? value.GetString() : null;
|
||||
}
|
||||
|
||||
private async Task<Verified> ValidateIdTokenAsync(string idToken, string? nonce)
|
||||
{
|
||||
using var client = NewClient();
|
||||
var jwks = new JsonWebKeySet((await GetJwksAsync(client)).GetRawText());
|
||||
var result = await new JsonWebTokenHandler().ValidateTokenAsync(idToken, new TokenValidationParameters
|
||||
{
|
||||
ValidIssuer = Origin.AbsoluteUri,
|
||||
ValidAudience = OidcTestKit.ClientId,
|
||||
IssuerSigningKeys = jwks.GetSigningKeys(),
|
||||
ValidAlgorithms = ["ES256"]
|
||||
});
|
||||
Assert.True(result.IsValid, result.Exception?.Message);
|
||||
var jwt = (JsonWebToken)result.SecurityToken;
|
||||
var payload = Encoding.UTF8.GetString(Base64UrlEncoder.DecodeBytes(jwt.EncodedPayload));
|
||||
if (nonce is not null)
|
||||
{
|
||||
Assert.Equal(nonce, JsonDocument.Parse(payload).RootElement.GetProperty("nonce").GetString());
|
||||
}
|
||||
|
||||
return new Verified(jwt.Alg, payload, JsonDocument.Parse(payload).RootElement.Clone());
|
||||
}
|
||||
|
||||
private static async Task<JsonElement> GetJwksAsync(HttpClient client)
|
||||
{
|
||||
var discovery = await client.GetFromJsonAsync<JsonElement>("/.well-known/openid-configuration");
|
||||
var jwksUri = new Uri(discovery.GetProperty("jwks_uri").GetString()!);
|
||||
return await client.GetFromJsonAsync<JsonElement>(jwksUri.PathAndQuery);
|
||||
}
|
||||
|
||||
private static string[] Strings(JsonElement document, string property) =>
|
||||
document.GetProperty(property).EnumerateArray().Select(x => x.GetString()!).ToArray();
|
||||
}
|
||||
|
||||
public sealed class OidcSurfaceAbsentTests : IClassFixture<TestWebApplicationFactory>
|
||||
{
|
||||
private readonly TestWebApplicationFactory _factory;
|
||||
|
||||
public OidcSurfaceAbsentTests(TestWebApplicationFactory factory) => _factory = factory;
|
||||
|
||||
[Theory]
|
||||
[InlineData("/.well-known/openid-configuration")]
|
||||
[InlineData("/.well-known/jwks")]
|
||||
[InlineData("/connect/authorize")]
|
||||
[InlineData("/connect/token")]
|
||||
[InlineData("/connect/userinfo")]
|
||||
public async Task Without_the_configuration_section_no_provider_surface_exists(string path)
|
||||
{
|
||||
using var client = _factory.CreateClient();
|
||||
using var response = await client.GetAsync(path);
|
||||
|
||||
Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
|
||||
}
|
||||
}
|
||||
|
||||
public sealed class OidcStartupFailureTests
|
||||
{
|
||||
[Theory]
|
||||
[InlineData(OidcKeyFault.MissingFile)]
|
||||
[InlineData(OidcKeyFault.RsaKey)]
|
||||
[InlineData(OidcKeyFault.PublicKeyOnly)]
|
||||
[InlineData(OidcKeyFault.NotPem)]
|
||||
public void A_configured_provider_with_an_unusable_signing_key_stops_startup_naming_the_setting_not_the_path(OidcKeyFault fault)
|
||||
{
|
||||
using var factory = new OidcKeyFaultFactory(fault);
|
||||
|
||||
var failure = Assert.ThrowsAny<Exception>(() => factory.CreateClient());
|
||||
|
||||
var messages = Flatten(failure).ToList();
|
||||
Assert.Contains(messages, m => m.Contains("Bifrost:Oidc:SigningKeyPath", StringComparison.Ordinal));
|
||||
Assert.DoesNotContain(messages, m => m.Contains("canary-", StringComparison.Ordinal));
|
||||
Assert.DoesNotContain(messages, m => m.Contains("BEGIN", StringComparison.Ordinal));
|
||||
}
|
||||
|
||||
private static IEnumerable<string> Flatten(Exception error)
|
||||
{
|
||||
for (var current = error; current is not null; current = current.InnerException!)
|
||||
{
|
||||
yield return current.Message;
|
||||
if (current.InnerException is null)
|
||||
{
|
||||
yield break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
104
tests/Bifrost.Web.Tests/OidcKeyMaterialTests.cs
Normal file
104
tests/Bifrost.Web.Tests/OidcKeyMaterialTests.cs
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
using System.Security.Cryptography;
|
||||
using Bifrost.Web.Configuration;
|
||||
using Bifrost.Web.Features.Oidc;
|
||||
using Bifrost.Web.Tests.Support;
|
||||
using Microsoft.IdentityModel.Tokens;
|
||||
|
||||
namespace Bifrost.Web.Tests;
|
||||
|
||||
public sealed class OidcKeyMaterialTests : IDisposable
|
||||
{
|
||||
private readonly OidcTestKit _kit = new();
|
||||
|
||||
public void Dispose() => _kit.Dispose();
|
||||
|
||||
[Fact]
|
||||
public void A_complete_configuration_loads_the_signing_key_the_secret_and_the_encryption_key()
|
||||
{
|
||||
using var material = OidcKeyMaterial.Load(Options());
|
||||
|
||||
var signing = Assert.IsType<ECDsaSecurityKey>(material.SigningKey);
|
||||
Assert.False(string.IsNullOrEmpty(signing.KeyId));
|
||||
Assert.Equal(_kit.ClientSecret, material.ClientSecret);
|
||||
Assert.Equal(32, Assert.IsType<SymmetricSecurityKey>(material.EncryptionKey).Key.Length);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("SigningKeyPath", "Bifrost:Oidc:SigningKeyPath")]
|
||||
[InlineData("EncryptionKeyPath", "Bifrost:Oidc:EncryptionKeyPath")]
|
||||
[InlineData("ClientId", "Bifrost:Oidc:Clients:Mas:ClientId")]
|
||||
[InlineData("ClientSecretPath", "Bifrost:Oidc:Clients:Mas:ClientSecretPath")]
|
||||
[InlineData("RedirectUri", "Bifrost:Oidc:Clients:Mas:RedirectUri")]
|
||||
public void A_missing_setting_stops_startup_naming_that_setting(string blank, string expectedField)
|
||||
{
|
||||
var failure = Assert.Throws<OidcConfigurationException>(() => OidcKeyMaterial.Load(Options(blank: blank)));
|
||||
|
||||
Assert.Contains(expectedField, failure.Message, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_redirect_uri_that_is_not_absolute_stops_startup()
|
||||
{
|
||||
var failure = Assert.Throws<OidcConfigurationException>(() => OidcKeyMaterial.Load(Options(redirectUri: "/callback")));
|
||||
|
||||
Assert.Contains("Bifrost:Oidc:Clients:Mas:RedirectUri", failure.Message, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("missing")]
|
||||
[InlineData("not base64 !!")]
|
||||
[InlineData("AAAAAAAAAAAAAAAAAAAAAA==")]
|
||||
public void An_unusable_encryption_key_stops_startup_naming_the_setting_not_the_path(string content)
|
||||
{
|
||||
if (content == "missing")
|
||||
{
|
||||
File.Delete(_kit.EncryptionKeyPath);
|
||||
}
|
||||
else
|
||||
{
|
||||
File.WriteAllText(_kit.EncryptionKeyPath, content);
|
||||
}
|
||||
|
||||
var failure = Assert.Throws<OidcConfigurationException>(() => OidcKeyMaterial.Load(Options()));
|
||||
|
||||
Assert.Contains("Bifrost:Oidc:EncryptionKeyPath", failure.Message, StringComparison.Ordinal);
|
||||
Assert.DoesNotContain("canary-", failure.Message, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_missing_client_secret_file_stops_startup_naming_the_setting_not_the_path()
|
||||
{
|
||||
File.Delete(_kit.ClientSecretPath);
|
||||
|
||||
var failure = Assert.Throws<OidcConfigurationException>(() => OidcKeyMaterial.Load(Options()));
|
||||
|
||||
Assert.Contains("Bifrost:Oidc:Clients:Mas:ClientSecretPath", failure.Message, StringComparison.Ordinal);
|
||||
Assert.DoesNotContain("canary-", failure.Message, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void A_P384_key_is_not_a_P256_key()
|
||||
{
|
||||
using var p384 = ECDsa.Create(ECCurve.NamedCurves.nistP384);
|
||||
File.WriteAllText(_kit.SigningKeyPath, p384.ExportPkcs8PrivateKeyPem());
|
||||
|
||||
var failure = Assert.Throws<OidcConfigurationException>(() => OidcKeyMaterial.Load(Options()));
|
||||
|
||||
Assert.Contains("Bifrost:Oidc:SigningKeyPath", failure.Message, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
private OidcIssuerOptions Options(string? blank = null, string? redirectUri = null) => new()
|
||||
{
|
||||
SigningKeyPath = blank == "SigningKeyPath" ? "" : _kit.SigningKeyPath,
|
||||
EncryptionKeyPath = blank == "EncryptionKeyPath" ? "" : _kit.EncryptionKeyPath,
|
||||
Clients = new OidcClientsOptions
|
||||
{
|
||||
Mas = new OidcClientOptions
|
||||
{
|
||||
ClientId = blank == "ClientId" ? "" : OidcTestKit.ClientId,
|
||||
ClientSecretPath = blank == "ClientSecretPath" ? "" : _kit.ClientSecretPath,
|
||||
RedirectUri = blank == "RedirectUri" ? "" : redirectUri ?? OidcTestKit.RedirectUri
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
260
tests/Bifrost.Web.Tests/Support/OidcTestKit.cs
Normal file
260
tests/Bifrost.Web.Tests/Support/OidcTestKit.cs
Normal file
|
|
@ -0,0 +1,260 @@
|
|||
using System.Security.Cryptography;
|
||||
using Bifrost.Web.Data;
|
||||
using Bifrost.Web.Domain;
|
||||
using Bifrost.Web.Features.Shared;
|
||||
using Microsoft.AspNetCore.Authentication;
|
||||
using Microsoft.AspNetCore.Authentication.Cookies;
|
||||
using Microsoft.AspNetCore.Hosting;
|
||||
using Microsoft.Extensions.Caching.Memory;
|
||||
using Microsoft.Extensions.Configuration;
|
||||
using Microsoft.Extensions.Options;
|
||||
using OpenIddict.EntityFrameworkCore;
|
||||
using OpenIddict.EntityFrameworkCore.Models;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Microsoft.Extensions.DependencyInjection.Extensions;
|
||||
|
||||
namespace Bifrost.Web.Tests.Support;
|
||||
|
||||
/// <summary>What is wrong with the signing key file a test host is started with.</summary>
|
||||
public enum OidcKeyFault
|
||||
{
|
||||
None,
|
||||
MissingFile,
|
||||
RsaKey,
|
||||
PublicKeyOnly,
|
||||
NotPem
|
||||
}
|
||||
|
||||
/// <summary>Key files and client settings for an OIDC test host. Everything is generated per kit; nothing is shared or committed.</summary>
|
||||
public sealed class OidcTestKit : IDisposable
|
||||
{
|
||||
public const string ClientId = "mas-test";
|
||||
public const string RedirectUri = "https://chat.example.test/_synapse/client/oidc/callback";
|
||||
|
||||
public OidcTestKit(OidcKeyFault fault = OidcKeyFault.None)
|
||||
{
|
||||
// The directory name is a canary: no error may echo any part of a configured path.
|
||||
Directory = Path.Combine(Path.GetTempPath(), "canary-" + Guid.NewGuid().ToString("N"));
|
||||
System.IO.Directory.CreateDirectory(Directory);
|
||||
|
||||
using var ec = ECDsa.Create(ECCurve.NamedCurves.nistP256);
|
||||
SigningKeyPem = ec.ExportPkcs8PrivateKeyPem();
|
||||
SigningPublicKeyPem = ec.ExportSubjectPublicKeyInfoPem();
|
||||
ClientSecret = Convert.ToHexString(RandomNumberGenerator.GetBytes(24));
|
||||
|
||||
SigningKeyPath = Path.Combine(Directory, "signing.pem");
|
||||
EncryptionKeyPath = Path.Combine(Directory, "encryption.key");
|
||||
ClientSecretPath = Path.Combine(Directory, "mas.secret");
|
||||
|
||||
switch (fault)
|
||||
{
|
||||
case OidcKeyFault.None:
|
||||
File.WriteAllText(SigningKeyPath, SigningKeyPem);
|
||||
break;
|
||||
case OidcKeyFault.RsaKey:
|
||||
using (var rsa = RSA.Create(2048))
|
||||
{
|
||||
File.WriteAllText(SigningKeyPath, rsa.ExportPkcs8PrivateKeyPem());
|
||||
}
|
||||
|
||||
break;
|
||||
case OidcKeyFault.PublicKeyOnly:
|
||||
File.WriteAllText(SigningKeyPath, SigningPublicKeyPem);
|
||||
break;
|
||||
case OidcKeyFault.NotPem:
|
||||
File.WriteAllText(SigningKeyPath, "not a key");
|
||||
break;
|
||||
case OidcKeyFault.MissingFile:
|
||||
break;
|
||||
}
|
||||
|
||||
File.WriteAllText(EncryptionKeyPath, Convert.ToBase64String(RandomNumberGenerator.GetBytes(32)) + "\n");
|
||||
File.WriteAllText(ClientSecretPath, ClientSecret + "\n");
|
||||
}
|
||||
|
||||
public string Directory { get; }
|
||||
|
||||
public string SigningKeyPath { get; }
|
||||
|
||||
public string EncryptionKeyPath { get; }
|
||||
|
||||
public string ClientSecretPath { get; }
|
||||
|
||||
public string ClientSecret { get; }
|
||||
|
||||
public string SigningKeyPem { get; }
|
||||
|
||||
public string SigningPublicKeyPem { get; }
|
||||
|
||||
public IReadOnlyDictionary<string, string?> Configuration => new Dictionary<string, string?>
|
||||
{
|
||||
["Bifrost:Oidc:SigningKeyPath"] = SigningKeyPath,
|
||||
["Bifrost:Oidc:EncryptionKeyPath"] = EncryptionKeyPath,
|
||||
["Bifrost:Oidc:Clients:Mas:ClientId"] = ClientId,
|
||||
["Bifrost:Oidc:Clients:Mas:ClientSecretPath"] = ClientSecretPath,
|
||||
["Bifrost:Oidc:Clients:Mas:RedirectUri"] = RedirectUri
|
||||
};
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
try
|
||||
{
|
||||
System.IO.Directory.Delete(Directory, recursive: true);
|
||||
}
|
||||
catch (IOException)
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>A clock the test moves, so a parked authorize request can be aged past its lifetime.</summary>
|
||||
public sealed class OidcTestClock : TimeProvider
|
||||
{
|
||||
private DateTimeOffset _now = DateTimeOffset.UtcNow;
|
||||
|
||||
public override DateTimeOffset GetUtcNow() => _now;
|
||||
|
||||
public void Advance(TimeSpan by) => _now += by;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// A test host with the OIDC provider configured from generated key files and cookie authentication as the real
|
||||
/// sign-in state (the shared test host signs everyone in as an admin through a header-driven handler instead).
|
||||
/// </summary>
|
||||
public class OidcWebApplicationFactory : TestWebApplicationFactory
|
||||
{
|
||||
public OidcWebApplicationFactory() : this(OidcKeyFault.None)
|
||||
{
|
||||
}
|
||||
|
||||
protected OidcWebApplicationFactory(OidcKeyFault fault) => Kit = new(fault);
|
||||
|
||||
public OidcTestKit Kit { get; }
|
||||
|
||||
public OidcTestClock Clock { get; } = new();
|
||||
|
||||
protected override void ConfigureWebHost(IWebHostBuilder builder)
|
||||
{
|
||||
base.ConfigureWebHost(builder);
|
||||
|
||||
// Program decides at registration time whether the provider exists, so these must be host settings:
|
||||
// configuration added with ConfigureAppConfiguration reaches the app only at Build().
|
||||
foreach (var (key, value) in Kit.Configuration)
|
||||
{
|
||||
builder.UseSetting(key, value);
|
||||
}
|
||||
|
||||
builder.ConfigureServices(services =>
|
||||
{
|
||||
services.Configure<AuthenticationOptions>(options =>
|
||||
{
|
||||
options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
|
||||
options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
|
||||
});
|
||||
services.RemoveAll<TimeProvider>();
|
||||
services.AddSingleton<TimeProvider>(Clock);
|
||||
ConfigureActors(services);
|
||||
});
|
||||
}
|
||||
|
||||
/// <summary>A hook for tests that replace the seam Bifrost reads the signed-in account through.</summary>
|
||||
protected virtual void ConfigureActors(IServiceCollection services)
|
||||
{
|
||||
}
|
||||
|
||||
protected override void Dispose(bool disposing)
|
||||
{
|
||||
base.Dispose(disposing);
|
||||
if (disposing)
|
||||
{
|
||||
Kit.Dispose();
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Sets the membership of the account registered under <paramref name="identity"/>.</summary>
|
||||
public async Task SetMembershipAsync(string identity, MembershipStatus status)
|
||||
{
|
||||
using var scope = Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<BifrostDbContext>();
|
||||
var account = db.UserAccounts.Single(x => x.NormalizedBifrostIdentity == identity);
|
||||
db.Memberships.Single(x => x.UserAccountId == account.Id).Status = status;
|
||||
await db.SaveChangesAsync();
|
||||
}
|
||||
|
||||
/// <summary>Renames the account's display name, as the owner would between two sign-ins.</summary>
|
||||
public async Task SetDisplayNameAsync(string identity, string displayName)
|
||||
{
|
||||
using var scope = Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<BifrostDbContext>();
|
||||
db.UserAccounts.Single(x => x.NormalizedBifrostIdentity == identity).DisplayName = displayName;
|
||||
await db.SaveChangesAsync();
|
||||
}
|
||||
|
||||
/// <summary>Removes the account (and with it its membership), as an owner deleting themselves would.</summary>
|
||||
public async Task DeleteAccountAsync(string identity)
|
||||
{
|
||||
using var scope = Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<BifrostDbContext>();
|
||||
db.UserAccounts.Remove(db.UserAccounts.Single(x => x.NormalizedBifrostIdentity == identity));
|
||||
await db.SaveChangesAsync();
|
||||
}
|
||||
|
||||
public Guid AccountId(string identity)
|
||||
{
|
||||
using var scope = Services.CreateScope();
|
||||
return scope.ServiceProvider.GetRequiredService<BifrostDbContext>()
|
||||
.UserAccounts.Single(x => x.NormalizedBifrostIdentity == identity).Id;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>An OIDC host whose signing key file is unusable, so startup must refuse it.</summary>
|
||||
public sealed class OidcKeyFaultFactory(OidcKeyFault fault) : OidcWebApplicationFactory(fault);
|
||||
|
||||
/// <summary>An OIDC host whose actor accessor reports an Active account that has no Bifrost identity, which sign-in itself never produces.</summary>
|
||||
public sealed class OidcNoIdentityFactory : OidcWebApplicationFactory
|
||||
{
|
||||
protected override void ConfigureActors(IServiceCollection services)
|
||||
{
|
||||
services.RemoveAll<ICurrentBifrostActorAccessor>();
|
||||
services.AddScoped<ICurrentBifrostActorAccessor, ActiveWithoutIdentity>();
|
||||
}
|
||||
|
||||
private sealed class ActiveWithoutIdentity : ICurrentBifrostActorAccessor
|
||||
{
|
||||
public Task<CurrentBifrostActor> GetAsync(CancellationToken cancellationToken) =>
|
||||
Task.FromResult(new CurrentBifrostActor(true, new UserAccount
|
||||
{
|
||||
NormalizedBifrostIdentity = string.Empty,
|
||||
DisplayName = "No Identity",
|
||||
Membership = new Bifrost.Web.Domain.Membership { Status = MembershipStatus.Active }
|
||||
}));
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>An OIDC host whose public base URL differs from the origin its requests arrive on, so the issuer cannot be request-derived.</summary>
|
||||
public sealed class OidcForeignIssuerFactory : OidcWebApplicationFactory
|
||||
{
|
||||
public const string PublicBaseUrl = "https://id.example.test/";
|
||||
|
||||
protected override void ConfigureWebHost(IWebHostBuilder builder)
|
||||
{
|
||||
base.ConfigureWebHost(builder);
|
||||
builder.ConfigureAppConfiguration((_, configuration) =>
|
||||
configuration.AddInMemoryCollection(new Dictionary<string, string?> { ["Host:PublicBaseUrl"] = PublicBaseUrl }));
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// An OIDC host on OpenIddict's own non-bulk deletion path. The in-memory test database cannot run the bulk
|
||||
/// ExecuteDelete the library otherwise uses to remove an application's tokens and authorizations, so this switches
|
||||
/// that option and the library's cascade runs unchanged.
|
||||
/// </summary>
|
||||
public sealed class OidcCascadeFactory : OidcWebApplicationFactory
|
||||
{
|
||||
protected override void ConfigureWebHost(IWebHostBuilder builder)
|
||||
{
|
||||
base.ConfigureWebHost(builder);
|
||||
builder.ConfigureServices(services =>
|
||||
services.Configure<OpenIddictEntityFrameworkCoreOptions>(options => options.DisableBulkOperations = true));
|
||||
}
|
||||
}
|
||||
|
|
@ -68,6 +68,14 @@
|
|||
"System.IO.Pipelines": "8.0.0"
|
||||
}
|
||||
},
|
||||
"Microsoft.Bcl.Cryptography": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.2",
|
||||
"contentHash": "LG9Yll3B5aNpxv0+D47g6LiOiKBIlodhcHdQwcYzo8VeexFLGqx5ymetmA2aBRyo9cCcWsQWrFsdbsr8LvmWDw==",
|
||||
"dependencies": {
|
||||
"System.Formats.Asn1": "10.0.2"
|
||||
}
|
||||
},
|
||||
"Microsoft.CodeCoverage": {
|
||||
"type": "Transitive",
|
||||
"resolved": "17.14.1",
|
||||
|
|
@ -75,31 +83,31 @@
|
|||
},
|
||||
"Microsoft.EntityFrameworkCore": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.0.0",
|
||||
"contentHash": "SoODat83pGQUpWB9xULdMX6tuKpq/RTXDuJ2WeC1ldUKcKzLkaFJD1n+I0nOLY58odez/e7z8b6zdp235G/kyg==",
|
||||
"resolved": "8.0.30",
|
||||
"contentHash": "Y6GP16iuqAUkcXSgMqjgao9w0UHSz8x04LRDadsi++sn7yBI9C/sy61xNLzPKM+6DZEbyPRHGq3M58f6DhB25g==",
|
||||
"dependencies": {
|
||||
"Microsoft.EntityFrameworkCore.Abstractions": "8.0.0",
|
||||
"Microsoft.EntityFrameworkCore.Analyzers": "8.0.0",
|
||||
"Microsoft.Extensions.Caching.Memory": "8.0.0",
|
||||
"Microsoft.Extensions.Logging": "8.0.0"
|
||||
"Microsoft.EntityFrameworkCore.Abstractions": "8.0.30",
|
||||
"Microsoft.EntityFrameworkCore.Analyzers": "8.0.30",
|
||||
"Microsoft.Extensions.Caching.Memory": "8.0.1",
|
||||
"Microsoft.Extensions.Logging": "8.0.1"
|
||||
}
|
||||
},
|
||||
"Microsoft.EntityFrameworkCore.Abstractions": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.0.0",
|
||||
"contentHash": "VR22s3+zoqlVI7xauFKn1znSIFHO8xuILT+noSwS8bZCKcHz0ydkTDQMuaxSa5WBaQrZmwtTz9rmRvJ7X8mSPQ=="
|
||||
"resolved": "8.0.30",
|
||||
"contentHash": "JoVu3708PrMcA3BUeo1+gTcD4nRI8o3g3kwNXwgTPUDhe0dqN2CQmHmEPDD0uZlI1v2oq3F7tR46VycUHzP9ng=="
|
||||
},
|
||||
"Microsoft.EntityFrameworkCore.Analyzers": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.0.0",
|
||||
"contentHash": "ZXxEeLs2zoZ1TA+QoMMcw4f3Tirf8PzgdDax8RoWo0dxI2KmqiEGWYjhm2B/XyWfglc6+mNRyB8rZiQSmxCpeg=="
|
||||
"resolved": "8.0.30",
|
||||
"contentHash": "+ZVRBR3CzGu0AGWTbewOWTzV+UG//yDrA0gdvb9i1dTidSvwG9qRRggEI9fie0MPC0LAcS9Z8X5HRYWWxefutg=="
|
||||
},
|
||||
"Microsoft.EntityFrameworkCore.Relational": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.0.0",
|
||||
"contentHash": "fFKkr24cYc7Zw5T6DC4tEyOEPgPbq23BBmym1r9kn4ET9F3HKaetpOeQtV2RryYyUxEeNkJuxgfiZHTisqZc+A==",
|
||||
"resolved": "8.0.30",
|
||||
"contentHash": "uGWv6fvDUvJDKAYXfVwPVLmit2i6WCmfdzwrHHuw4OJ30s9GDVLsvV62Gi8TIgFSUlTVgSVW/c+hAvDwmY1TDw==",
|
||||
"dependencies": {
|
||||
"Microsoft.EntityFrameworkCore": "8.0.0",
|
||||
"Microsoft.EntityFrameworkCore": "8.0.30",
|
||||
"Microsoft.Extensions.Configuration.Abstractions": "8.0.0"
|
||||
}
|
||||
},
|
||||
|
|
@ -203,10 +211,10 @@
|
|||
},
|
||||
"Microsoft.Extensions.DependencyInjection": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.0.0",
|
||||
"contentHash": "V8S3bsm50ig6JSyrbcJJ8bW2b9QLGouz+G1miK3UTaOWmMtFwNNNzUf4AleyDWUmTrWMLNnFSLEQtxmxgNQnNQ==",
|
||||
"resolved": "8.0.1",
|
||||
"contentHash": "BmANAnR5Xd4Oqw7yQ75xOAYODybZQRzdeNucg7kS5wWKd2PNnMdYtJ2Vciy0QLylRmv42DGl5+AFL9izA6F1Rw==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": "8.0.0"
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": "8.0.2"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": {
|
||||
|
|
@ -309,12 +317,12 @@
|
|||
},
|
||||
"Microsoft.Extensions.Logging": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.0.0",
|
||||
"contentHash": "tvRkov9tAJ3xP51LCv3FJ2zINmv1P8Hi8lhhtcKGqM+ImiTCC84uOPEI4z8Cdq2C3o9e+Aa0Gw0rmrsJD77W+w==",
|
||||
"resolved": "8.0.1",
|
||||
"contentHash": "4x+pzsQEbqxhNf1QYRr5TDkLP9UsLT3A6MdRKDDEgrW7h1ljiEPgTNhKYUhNCCAaVpQECVQ+onA91PTPnIp6Lw==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.DependencyInjection": "8.0.0",
|
||||
"Microsoft.Extensions.Logging.Abstractions": "8.0.0",
|
||||
"Microsoft.Extensions.Options": "8.0.0"
|
||||
"Microsoft.Extensions.DependencyInjection": "8.0.1",
|
||||
"Microsoft.Extensions.Logging.Abstractions": "8.0.2",
|
||||
"Microsoft.Extensions.Options": "8.0.2"
|
||||
}
|
||||
},
|
||||
"Microsoft.Extensions.Logging.Abstractions": {
|
||||
|
|
@ -414,6 +422,37 @@
|
|||
"resolved": "8.0.0",
|
||||
"contentHash": "bXJEZrW9ny8vjMF1JV253WeLhpEVzFo1lyaZu1vQ4ZxWUlVvknZ/+ftFgVheLubb4eZPSwwxBeqS1JkCOjxd8g=="
|
||||
},
|
||||
"Microsoft.IdentityModel.Abstractions": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.19.2",
|
||||
"contentHash": "HJbo/lnSfNHUfphPRT910poQc4T2/9+8svFLvzuaYHGAOJ2Tu+oEDqpX0BVP3BJ4OuUM1kylEKyaiX2fCAK3Cw=="
|
||||
},
|
||||
"Microsoft.IdentityModel.JsonWebTokens": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.19.2",
|
||||
"contentHash": "ui3fuBT4fs8kdKfBthI4NzLYIBIneEVS8UrL1JVBzAn80UiKmngBBi0BEByE7n/9c+EElcfFlCMFFTqpkBSLNA==",
|
||||
"dependencies": {
|
||||
"Microsoft.IdentityModel.Tokens": "8.19.2"
|
||||
}
|
||||
},
|
||||
"Microsoft.IdentityModel.Logging": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.19.2",
|
||||
"contentHash": "r5YLDIxGOnkVJHrqXv/iD1FM1CgGrQOdriXuvuWvTPmKbnGANhEysq9XKmN6IHjf2a+9bAGEpnoRBsAQlvJU5w==",
|
||||
"dependencies": {
|
||||
"Microsoft.IdentityModel.Abstractions": "8.19.2"
|
||||
}
|
||||
},
|
||||
"Microsoft.IdentityModel.Tokens": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.19.2",
|
||||
"contentHash": "GtPC1S02uH1gOO4fQ+zRysIicKmEXaYFP8PIkdJYXqMyruYhopre4ozVHp0XiDSA0+GJvOZH9prxCPvgBMg4Ww==",
|
||||
"dependencies": {
|
||||
"Microsoft.Bcl.Cryptography": "10.0.2",
|
||||
"Microsoft.Extensions.Logging.Abstractions": "8.0.0",
|
||||
"Microsoft.IdentityModel.Logging": "8.19.2"
|
||||
}
|
||||
},
|
||||
"Microsoft.TestPlatform.ObjectModel": {
|
||||
"type": "Transitive",
|
||||
"resolved": "17.14.1",
|
||||
|
|
@ -455,6 +494,60 @@
|
|||
"Npgsql": "8.0.0"
|
||||
}
|
||||
},
|
||||
"OpenIddict.Abstractions": {
|
||||
"type": "Transitive",
|
||||
"resolved": "7.7.1",
|
||||
"contentHash": "dgb+2dGHzwjVUs7Jc8Dt3PQurVCEllX8XW8+WPmdB1eV5IKRoAZyiJyp3mgFOR1sk/jvilPqnMzQYGkVNVf66Q==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.DependencyInjection.Abstractions": "8.0.2",
|
||||
"Microsoft.Extensions.Primitives": "8.0.0",
|
||||
"Microsoft.IdentityModel.Tokens": "8.19.2"
|
||||
}
|
||||
},
|
||||
"OpenIddict.Core": {
|
||||
"type": "Transitive",
|
||||
"resolved": "7.7.1",
|
||||
"contentHash": "TLk8u4zZ9IvTpTYV+a6nX1eBpnPR5E3seMPGcArXhfBK0VTImWWzPbcdx+GxiPxyq7+8iOg05uIJt7FsRwDpZg==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.Caching.Memory": "8.0.1",
|
||||
"Microsoft.Extensions.Logging": "8.0.1",
|
||||
"Microsoft.Extensions.Options": "8.0.2",
|
||||
"OpenIddict.Abstractions": "7.7.1"
|
||||
}
|
||||
},
|
||||
"OpenIddict.EntityFrameworkCore": {
|
||||
"type": "Transitive",
|
||||
"resolved": "7.7.1",
|
||||
"contentHash": "U+Lq0DuEm9bolWOVur0Qy3LgwzCSjRQKs2Q8tUfFfpuAJsnhgK7j401eDm5PdHV1wnoaBYhXEMkkW+UKeADyaw==",
|
||||
"dependencies": {
|
||||
"Microsoft.EntityFrameworkCore.Relational": "8.0.30",
|
||||
"OpenIddict.Core": "7.7.1",
|
||||
"OpenIddict.EntityFrameworkCore.Models": "7.7.1"
|
||||
}
|
||||
},
|
||||
"OpenIddict.EntityFrameworkCore.Models": {
|
||||
"type": "Transitive",
|
||||
"resolved": "7.7.1",
|
||||
"contentHash": "DjJ5/7TBV7q7zB43v7em73nQBIacid5hxtlZzLnuWBg7kzvlBlUvvmgEhW/asoMBT3sR2nEyufB0wKOnn1niXQ=="
|
||||
},
|
||||
"OpenIddict.Server": {
|
||||
"type": "Transitive",
|
||||
"resolved": "7.7.1",
|
||||
"contentHash": "Se5+zNefCR9VpRPudmXOVJ6z79rSdEx+PvlPn1fGvKhLW6cqT5w8q8lPdRKe+zdiyAEXpSg+K5m6lTSpVqYOWA==",
|
||||
"dependencies": {
|
||||
"Microsoft.Extensions.Logging": "8.0.1",
|
||||
"Microsoft.IdentityModel.JsonWebTokens": "8.19.2",
|
||||
"OpenIddict.Abstractions": "7.7.1"
|
||||
}
|
||||
},
|
||||
"OpenIddict.Server.AspNetCore": {
|
||||
"type": "Transitive",
|
||||
"resolved": "7.7.1",
|
||||
"contentHash": "YQW64MJBVXsJ+H5kb+HFAQaSXsavOCEG+kDgD+DaYK7apLFtbOrgN233RhHOuztChWcY8SfjpjeN0ZXPwTFsbA==",
|
||||
"dependencies": {
|
||||
"OpenIddict.Server": "7.7.1"
|
||||
}
|
||||
},
|
||||
"System.Collections.Immutable": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.0.0",
|
||||
|
|
@ -470,6 +563,11 @@
|
|||
"resolved": "8.0.0",
|
||||
"contentHash": "fdYxcRjQqTTacKId/2IECojlDSFvp7LP5N78+0z/xH7v/Tuw5ZAxu23Y6PTCRinqyu2ePx+Gn1098NC6jM6d+A=="
|
||||
},
|
||||
"System.Formats.Asn1": {
|
||||
"type": "Transitive",
|
||||
"resolved": "10.0.2",
|
||||
"contentHash": "9Hee6iQ74pDgdRNIL6lO8Vlx2onVWd5aDnqwk4Pvo0h5FklBd7QwcQDKgxeLuhiy0o3ibzUVO0KFQe0/hPXU+Q=="
|
||||
},
|
||||
"System.IO.Pipelines": {
|
||||
"type": "Transitive",
|
||||
"resolved": "8.0.0",
|
||||
|
|
@ -540,6 +638,8 @@
|
|||
"Microsoft.Extensions.Caching.Memory": "[8.0.1, )",
|
||||
"Npgsql": "[8.0.3, )",
|
||||
"Npgsql.EntityFrameworkCore.PostgreSQL": "[8.0.0, )",
|
||||
"OpenIddict.EntityFrameworkCore": "[7.7.1, )",
|
||||
"OpenIddict.Server.AspNetCore": "[7.7.1, )",
|
||||
"System.Text.Json": "[8.0.5, )"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue