| 1 | using AgentForge.Abstractions; |
| 2 | using AgentForge.Data; |
| 3 | using AgentForge.Data.Entities; |
| 4 | using AgentForge.Models; |
| 5 | using AgentForge.Options; |
| 6 | using AgentForge.Services; |
| 7 | using Microsoft.Extensions.DependencyInjection; |
| 8 | using Microsoft.Extensions.Options; |
| 9 | |
| 10 | namespace AgentForge.Tests; |
| 11 | |
| 12 | public sealed class ForgeOAuthSignInGateTests |
| 13 | { |
| 14 | [Fact] |
| 15 | public async Task Invite_only_denies_unknown_github_user() |
| 16 | { |
| 17 | await using var factory = CreateFactory(); |
| 18 | using var scope = factory.Services.CreateScope(); |
| 19 | var repository = scope.ServiceProvider.GetRequiredService<ForgeRepository>(); |
| 20 | var gate = scope.ServiceProvider.GetRequiredService<IForgeOAuthSignInGate>(); |
| 21 | |
| 22 | _ = repository.GetOrgBySlug("team") |
| 23 | ?? throw new InvalidOperationException("Default org 'team' was not seeded."); |
| 24 | |
| 25 | var decision = await gate.EvaluateAsync( |
| 26 | new ForgeOAuthSignInContext("github", "1", "stranger", "Stranger", "gho_test"), |
| 27 | CancellationToken.None); |
| 28 | |
| 29 | Assert.False(decision.Allowed); |
| 30 | } |
| 31 | |
| 32 | [Fact] |
| 33 | public async Task Invite_only_allows_pre_seeded_member() |
| 34 | { |
| 35 | await using var factory = CreateFactory(); |
| 36 | using var scope = factory.Services.CreateScope(); |
| 37 | var repository = scope.ServiceProvider.GetRequiredService<ForgeRepository>(); |
| 38 | var gate = scope.ServiceProvider.GetRequiredService<IForgeOAuthSignInGate>(); |
| 39 | |
| 40 | var org = repository.GetOrgBySlug("team") |
| 41 | ?? throw new InvalidOperationException("Default org 'team' was not seeded."); |
| 42 | var identity = repository.UpsertIdentity("github", "42", "alice", "Alice"); |
| 43 | repository.InsertOrgMember(org.Id, identity.Id, ForgeOrgRole.Member); |
| 44 | |
| 45 | var decision = await gate.EvaluateAsync( |
| 46 | new ForgeOAuthSignInContext("github", "42", "alice", "Alice", "gho_test"), |
| 47 | CancellationToken.None); |
| 48 | |
| 49 | Assert.True(decision.Allowed); |
| 50 | } |
| 51 | |
| 52 | [Fact] |
| 53 | public async Task Ams_showcase_bundle_loads_instance_user_management_gate() |
| 54 | { |
| 55 | await using var factory = new ForgeWebApplicationFactory { PluginBundle = "ams-showcase" }; |
| 56 | using var scope = factory.Services.CreateScope(); |
| 57 | var gates = scope.ServiceProvider.GetServices<IForgeOAuthSignInGate>().ToList(); |
| 58 | Assert.Contains(gates, gate => gate.GetType().FullName?.Contains("InstanceOAuthSignInGate") == true); |
| 59 | } |
| 60 | |
| 61 | private static ForgeWebApplicationFactory CreateFactory() |
| 62 | { |
| 63 | Environment.SetEnvironmentVariable("FORGE_OAUTH_SIGNIN_POLICY", "invite_only"); |
| 64 | Environment.SetEnvironmentVariable("FORGE_DEFAULT_ORG_SLUG", "team"); |
| 65 | Environment.SetEnvironmentVariable("FORGE_REQUIRE_AUTH", "true"); |
| 66 | return new ForgeWebApplicationFactory { PluginBundle = "ams-showcase" }; |
| 67 | } |
| 68 | } |
| 69 | |