ersatztv/ErsatzTV.Tests/Controllers/AuthControllerTests.cs

using System.Collections.Generic;
using ErsatzTV.Application.Auth;
using ErsatzTV.Controllers.Api;
using ErsatzTV.Controllers.Api.Requests;
using MediatR;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using NSubstitute;
using NUnit.Framework;
using Shouldly;

namespace ErsatzTV.Tests.Controllers;

[TestFixture]
public class AuthControllerTests
{
    private static IConfiguration Config(bool envSeed) =>
        new ConfigurationBuilder()
            .AddInMemoryCollection(
                envSeed
                    ? new Dictionary<string, string?> { ["Auth:LocalAdmin:Password"] = "seed-password" }
                    : new Dictionary<string, string?>())
            .Build();

    [Test]
    public async Task Config_Reports_Setup_Not_Required_When_Env_Seed_Configured()
    {
        var mediator = Substitute.For<IMediator>();
        mediator.Send(Arg.Any<IsLocalAdminConfigured>(), Arg.Any<CancellationToken>()).Returns(false);

        var controller = new AuthController(mediator, Config(envSeed: true));

        var result = await controller.Config(CancellationToken.None) as OkObjectResult;
        var body = result!.Value.ShouldBeOfType<AuthConfigResponse>();

        // Env seed owns the credential → the SPA must not offer the browser setup-claim.
        body.SetupRequired.ShouldBeFalse();
    }

    [Test]
    public async Task Config_Reports_Setup_Required_When_Unconfigured_And_No_Env_Seed()
    {
        var mediator = Substitute.For<IMediator>();
        mediator.Send(Arg.Any<IsLocalAdminConfigured>(), Arg.Any<CancellationToken>()).Returns(false);

        var controller = new AuthController(mediator, Config(envSeed: false));

        var result = await controller.Config(CancellationToken.None) as OkObjectResult;
        var body = result!.Value.ShouldBeOfType<AuthConfigResponse>();

        body.SetupRequired.ShouldBeTrue();
    }

    [Test]
    public async Task Setup_Is_Closed_With_409_When_Env_Seed_Configured()
    {
        var mediator = Substitute.For<IMediator>();
        var controller = new AuthController(mediator, Config(envSeed: true))
        {
            ControllerContext = new ControllerContext { HttpContext = new DefaultHttpContext() }
        };

        var result = await controller.Setup(new SetupRequest("admin", "hunter2pw"), CancellationToken.None);

        var problem = result.ShouldBeOfType<ConflictObjectResult>();
        problem.StatusCode.ShouldBe(StatusCodes.Status409Conflict);
        // The claim must never be attempted while the env seed owns the credential.
        await mediator.DidNotReceive().Send(Arg.Any<ClaimLocalAdmin>(), Arg.Any<CancellationToken>());
    }
}