authorization/src/GraphQL.Authorization.Tests/AuthorizationSkipTests.cs at 8d491c03a7890263da62122810180608eacd7616 · graphql-dotnet/authorization · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
using GraphQL.Types;
using Xunit;

namespace GraphQL.Authorization.Tests
{
    /// <summary>
    /// Tests for <see cref="IntrospectionSkipCondition"/>.
    /// https://github.com/graphql-dotnet/authorization/issues/28
    /// </summary>
    public class AuthorizationSkipTests : ValidationTestBase
    {
        [Fact]
        public void passes_with_skip_condition()
        {
            Rule = new AuthorizationValidationRule(new AuthorizationEvaluator(Settings), new[] { new IntrospectionSkipCondition() });
            Settings.AddPolicy("AdminPolicy", _ => _.RequireClaim("admin"));

            ShouldPassRule(config =>
            {
                config.Query = QUERY;
                config.Schema = CreateSchema();
            });
        }

        [Fact]
        public void fails_without_skip_condition()
        {
            Settings.AddPolicy("AdminPolicy", _ => _.RequireClaim("admin"));

            ShouldFailRule(config =>
            {
                config.Query = QUERY;
                config.Schema = CreateSchema();
            });
        }

        [Fact]
        public void fails_with_skip_condition_and_extra_fields()
        {
            Rule = new AuthorizationValidationRule(new AuthorizationEvaluator(Settings), new[] { new IntrospectionSkipCondition() });
            Settings.AddPolicy("AdminPolicy", _ => _.RequireClaim("admin"));

            ShouldFailRule(config =>
            {
                config.Query = QUERY.Replace("...frag1", "...frag1 info");
                config.Schema = CreateSchema();
            });
        }

        private static ISchema CreateSchema() =>
            Schema.For("type Query { info: String! }", builder => builder.Types.Include<Query>());

        [GraphQLAuthorize("AdminPolicy")]
        public class Query
        {
            public string Info() => "OK";
        }

        private const string QUERY = @"
query
{
  __typename
  __type(name: ""__Schema"")
  {
    name
    description
  }
  x: __schema
  {
    queryType
    {
      name
    }
  }
  ...frag1
  ... on Query
  {
    inline: __typename
  }
}

fragment frag1 on Query
{
  s: __typename
}";
    }
}