Authio.Testing 0.7.0

Authio.Testing

Test a .NET application that uses Authio without an Authio server. FakeAuthio is an in-memory Authio reached through an HttpMessageHandler: point the SDK's named clients at it and every request (discovery, keys, grants, introspection, userinfo, end session, Admin API) is answered in memory, recorded, and shaped like Authio's own answers. It is the fake the SDK's own test suites run on.

dotnet add package Authio.Testing

An API test

using var fake = new FakeAuthio();                       // https://authio.test, realm acme, client app
var builder = WebApplication.CreateSlimBuilder();

builder.WebHost.UseTestServer();
builder.Services.AddAuthioClient(o => { o.Authority = fake.BaseUrl; o.Realm = fake.Realm; o.ClientId = "app"; o.ClientSecret = "s3cret"; });
builder.Services.AddFakeAuthioBackchannel(fake);         // the Authio and Authio.Admin clients reach the fake
builder.Services.AddAuthentication().AddAuthioJwtBearer(o => o.Audiences = ["https://api.test"]);

// …

var token = fake.Tokens.CreateAccessToken("user-1")
    .WithAudience("https://api.test")
    .WithScope("orders:read")
    .WithAuthTime(DateTimeOffset.UtcNow)                 // a person; recency requirements read it
    .WithAcr("2").WithAmr("pwd", "otp", "mfa")
    .Build();

FakeTokenBuilder writes any claim (WithActor for a delegation chain, WithImpersonator, WithOrganization, WithResourceAccess, Expired, SignedWithUnknownKey, WithHeaderType, …). Tokens are real RS256 JWTs signed with fake.Tokens, whose public key the fake serves at jwks_uri; JwksOverride serves another key set instead.

A login test

The authorization endpoint redirects straight back with code, state and iss (PKCE S256 enforced, plain with AllowPlainPkce), or answers response_mode=web_message with the page that posts the result. ID tokens carry nonce, sid, acr, amr and at_hash.

var redirect = await login.CreateAuthorizationAsync(new AuthioAuthorizationRequest { RedirectUri = "https://app.test/cb" });
var callback = await fake.AuthorizeAsync(redirect.Url);   // follows the authorization endpoint
var result = await login.HandleCallbackAsync(callback, redirect.State);

NextLoginUser signs in another user, NextAuthorizeError answers with an error (login_required, access_denied).

Encrypted tokens

Give a client the public half of its encryption key and its ID and access tokens become nested JWEs, as Authio issues them for a client whose key source is its own:

using var rsa = RSA.Create(2048);
fake.DefaultClient.EncryptionKey = RSA.Create(rsa.ExportParameters(false));
fake.DefaultClient.EncryptionAlgorithm = "RSA-OAEP-256";   // RSA-OAEP (default), RSA-OAEP-256 or RSA1_5
// the SDK: options.ClientEncryptionKey = rsa.ExportPkcs8PrivateKeyPem();

fake.Encrypt(token, recipient, algorithm, encryption) encrypts any token the same way (the fake still recognises it at introspection and userinfo), and FakeJweFactory.Encrypt builds a JWE straight from RFC 7516, independent of IdentityModel. UserInfoSigned and UserInfoEncryptionKey answer UserInfo as a signed or encrypted JWT.

Logout

The end-session endpoint ends the session of the id_token_hint (EndedSessions) and redirects to a registered post_logout_redirect_uri. Back-channel logout is delivered on demand:

using var app = testServer.CreateClient();
var answer = await fake.DeliverBackChannelLogoutAsync(app, subject, sessionId, logoutUri: "/bff/backchannel-logout");

CreateLogoutToken(sub, sid, clientId) builds the logout token alone; BackChannelDeliveries records every delivery.

Everything else

Every grant (client credentials, authorization code, refresh with rotation and reuse detection, password, device with scripted outcomes in DeviceOutcomes, token exchange and connected accounts), forced token errors (TokenErrors), introspection, revocation (RevokeToken), suspended subjects, discovery failures, and Admin API stubs over fake.Admin (users, roles, groups, sessions, account credentials). ManualTimeProvider is a clock whose timers fire at once and record the delays asked for, so polling and Retry-After waits are instant and checkable.

License

MIT