Niek Otten
751ca006a7
Failing tests for the BFF walking-skeleton endpoints: - POST /self-service/registrations rejects missing/malformed/wrong-key/expired tokens (401) and, with a valid digid token, forwards the bsn to the domain and returns 202 (WebApplicationFactory + a local test signing key, ADR-0010). - GET /openbaar/register serves public-safe rows anonymously (never the bsn) and filters by q. - OpenbaarProjection.PublicView (pure) filters by id and maps to id+status only. Endpoints and PublicView are stubs so the tests compile and fail on their assertions; the green commit implements them. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
31 lines
1.2 KiB
C#
31 lines
1.2 KiB
C#
using System.Text;
|
|
using Microsoft.IdentityModel.JsonWebTokens;
|
|
using Microsoft.IdentityModel.Tokens;
|
|
|
|
namespace Bff.Tests;
|
|
|
|
/// <summary>Mints JWTs for the BFF tests — signed with the factory's test key (valid) or otherwise
|
|
/// (a wrong key / expired) to exercise the bearer validation the BFF configures.</summary>
|
|
internal static class TestTokens
|
|
{
|
|
public static string Valid(string bsn) => Create(bsn, BffFactory.TestSigningKey, expired: false);
|
|
|
|
public static string Expired(string bsn) => Create(bsn, BffFactory.TestSigningKey, expired: true);
|
|
|
|
public static string WrongKey(string bsn) => Create(
|
|
bsn,
|
|
new SymmetricSecurityKey(Encoding.UTF8.GetBytes("a-different-signing-key-256-bits-long-indeed-yes!")),
|
|
expired: false);
|
|
|
|
private static string Create(string bsn, SymmetricSecurityKey key, bool expired)
|
|
{
|
|
var handler = new JsonWebTokenHandler();
|
|
return handler.CreateToken(new SecurityTokenDescriptor
|
|
{
|
|
Claims = new Dictionary<string, object> { ["bsn"] = bsn },
|
|
Expires = DateTime.UtcNow.AddMinutes(expired ? -5 : 30),
|
|
SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256),
|
|
});
|
|
}
|
|
}
|