* Refactor OpenIddict for shared usage between APIs + implement member authentication and handling within the Delivery API * Make SwaggerRouteTemplatePipelineFilter UI config overridable * Enable token revocation + rename logout endpoint to signout * Add default implementation of SwaggerGenOptions configuration for enabling Delivery API member auth in Swagger * Correct notification handling when (un)protecting content * Fixing integration test framework * Cleanup test to not execute some composers twice * Update paths to match docs * Return Forbidden when a member is authorized but not allowed to access the requested resource * Cleanup * Rename RequestMemberService to RequestMemberAccessService * Rename badly named variable * Review comments * Hide the auth controller from Swagger * Remove semaphore * Add security requirements for content API operations in Swagger * Hide the back-office auth endpoints from Swagger * Fix merge * Update back-office API auth endpoint paths + add revoke and sign-out endpoints (as of now they do not exist, a separate task will fix that) * Swap endpoint order to maintain backwards compat with the current login screen for new back-office (will be swapped back again to ensure correct .well-known endpoints, see FIXME comment) * Make "items by IDs" endpoint support member auth * Add 401 and 403 to "items by IDs" endpoint responses --------- Co-authored-by: Bjarke Berg <mail@bergmania.dk> Co-authored-by: Elitsa <elm@umbraco.dk>
70 lines
2.6 KiB
C#
70 lines
2.6 KiB
C#
using Microsoft.Extensions.DependencyInjection;
|
|
using Microsoft.Extensions.Options;
|
|
using Newtonsoft.Json;
|
|
using Newtonsoft.Json.Linq;
|
|
using NUnit.Framework;
|
|
using Umbraco.Cms.Api.Management;
|
|
using Umbraco.Cms.Api.Management.Controllers.Install;
|
|
using Umbraco.Cms.Core.Configuration.Models;
|
|
using Umbraco.Cms.Core.Hosting;
|
|
using Umbraco.Cms.Persistence.EFCore.Composition;
|
|
using Umbraco.Cms.Tests.Integration.TestServerTest;
|
|
using Umbraco.Cms.Web.Common.ApplicationBuilder;
|
|
|
|
namespace Umbraco.Cms.Tests.Integration.NewBackoffice;
|
|
|
|
[TestFixture]
|
|
internal sealed class OpenAPIContractTest : UmbracoTestServerTestBase
|
|
{
|
|
private GlobalSettings GlobalSettings => GetRequiredService<IOptions<GlobalSettings>>().Value;
|
|
|
|
private IHostingEnvironment HostingEnvironment => GetRequiredService<IHostingEnvironment>();
|
|
|
|
protected override void CustomTestSetup(IUmbracoBuilder builder)
|
|
{
|
|
builder.AddMvcAndRazor(mvcBuilder =>
|
|
{
|
|
// Adds Umbraco.Cms.Api.Management
|
|
mvcBuilder.AddApplicationPart(typeof(InstallControllerBase).Assembly);
|
|
});
|
|
|
|
// Currently we cannot do this in tests, as EF Core is not initialized
|
|
builder.Services.PostConfigure<UmbracoPipelineOptions>(options =>
|
|
{
|
|
var backofficePipelineFilter = options.PipelineFilters.FirstOrDefault(x => x.Name.Equals("Backoffice"));
|
|
if (backofficePipelineFilter != null)
|
|
{
|
|
options.PipelineFilters.Remove(backofficePipelineFilter);
|
|
}
|
|
});
|
|
}
|
|
|
|
[Test]
|
|
public async Task Validate_OpenApi_Contract_is_implemented()
|
|
{
|
|
string[] keysToIgnore = { "servers", "x-generator" };
|
|
var officePath = GlobalSettings.GetBackOfficePath(HostingEnvironment);
|
|
|
|
var urlToContract = $"{officePath}/management/api/openapi.json";
|
|
var swaggerPath = $"{officePath}/swagger/management/swagger.json";
|
|
var apiContract = JObject.Parse(await Client.GetStringAsync(urlToContract));
|
|
|
|
var generatedJsonString = await Client.GetStringAsync(swaggerPath);
|
|
var mergedContract = JObject.Parse(generatedJsonString);
|
|
var originalGeneratedContract = JObject.Parse(generatedJsonString);
|
|
|
|
mergedContract.Merge(apiContract, new JsonMergeSettings
|
|
{
|
|
MergeArrayHandling = MergeArrayHandling.Merge
|
|
});
|
|
|
|
foreach (var key in keysToIgnore)
|
|
{
|
|
originalGeneratedContract.Remove(key);
|
|
mergedContract.Remove(key);
|
|
}
|
|
|
|
Assert.AreEqual(originalGeneratedContract.ToString(Formatting.Indented), mergedContract.ToString(Formatting.Indented), $"Generated API do not respect the contract.");
|
|
}
|
|
}
|