sync full source from private myoffice

MyOffice.Tests/Auth/OpenIddictRedirectUriTests.cs

@@ -0,0 +1,22 @@
+using MyOffice.Web.Auth;
+
+namespace MyOffice.Tests.Auth;
+
+public class OpenIddictRedirectUriTests
+{
+	[Fact]
+	public void BuildRedirectUri_uses_localhost_when_host_empty()
+	{
+		var uri = OpenIddictSeeder.BuildRedirectUri(null);
+
+		Assert.Equal("http://localhost:4300/silent-refresh.html", uri.ToString());
+	}
+
+	[Fact]
+	public void BuildRedirectUri_appends_silent_refresh_and_trims_slash()
+	{
+		var uri = OpenIddictSeeder.BuildRedirectUri("https://app.example.com/");
+
+		Assert.Equal("https://app.example.com/silent-refresh.html", uri.ToString());
+	}
+}

MyOffice.Tests/Auth/PasswordHasherTests.cs

@@ -0,0 +1,56 @@
+using Microsoft.AspNetCore.Identity;
+using MyOffice.Web.Identity.Domain;
+using MyOffice.Web.Identity.Repositories;
+
+namespace MyOffice.Tests.Auth;
+
+public class PasswordHasherTests
+{
+	private readonly PasswordHasher _hasher = new();
+	private readonly ApplicationUser<Guid> _user = new() { Id = Guid.NewGuid(), UserName = "test@example.com" };
+
+	[Fact]
+	public void HashPassword_then_verify_succeeds_with_identity_format()
+	{
+		var hash = _hasher.HashPassword(_user, "P@ssw0rd!");
+
+		Assert.Equal(PasswordVerificationResult.Success, _hasher.VerifyHashedPassword(_user, hash, "P@ssw0rd!"));
+	}
+
+	[Fact]
+	public void VerifyHashedPassword_fails_for_wrong_password()
+	{
+		var hash = _hasher.HashPassword(_user, "P@ssw0rd!");
+
+		Assert.Equal(PasswordVerificationResult.Failed, _hasher.VerifyHashedPassword(_user, hash, "wrong"));
+	}
+
+	[Fact]
+	public void HashPassword_produces_distinct_hashes_due_to_salt()
+	{
+		var a = _hasher.HashPassword(_user, "same");
+		var b = _hasher.HashPassword(_user, "same");
+
+		Assert.NotEqual(a, b);
+	}
+
+	[Fact]
+	public void VerifyHashedPassword_legacy_hash_returns_rehash_needed()
+	{
+		var legacy = PasswordHasher.HashLegacyForTests("legacy-secret");
+
+		Assert.Equal(
+			PasswordVerificationResult.SuccessRehashNeeded,
+			_hasher.VerifyHashedPassword(_user, legacy, "legacy-secret"));
+	}
+
+	[Fact]
+	public void VerifyHashedPassword_legacy_wrong_password_fails()
+	{
+		var legacy = PasswordHasher.HashLegacyForTests("legacy-secret");
+
+		Assert.Equal(
+			PasswordVerificationResult.Failed,
+			_hasher.VerifyHashedPassword(_user, legacy, "nope"));
+	}
+}