mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-26 05:29:43 +00:00
Oliver Kieselbach
d377f1840c
GetAllBlockedDevices never parsed the query string and always called the cross-tenant GetAllBlockedDevicesAsync(), so a supplied tenantId was silently ignored (cross-tenant widening) and a malformed tenantId was not rejected. Parse tenantId, scope to GetBlockedDevicesAsync() when a valid GUID is given, and return 400 for a non-GUID value. Classification extracted to a testable ParseTenantFilter helper with unit coverage. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
55 lines
2.0 KiB
C#
55 lines
2.0 KiB
C#
using AutopilotMonitor.Functions.Functions.Admin;
|
|
using Xunit;
|
|
|
|
namespace AutopilotMonitor.Functions.Tests;
|
|
|
|
/// <summary>
|
|
/// Covers the tenantId-filter classification in <see cref="GetAllBlockedDevicesFunction"/>.
|
|
/// <para>
|
|
/// The HTTP entry point is intentionally not tested here (mocking <c>HttpRequestData</c> +
|
|
/// the middleware chain is more setup than the test is worth — same rationale as
|
|
/// <see cref="DeviceBlockFunctionTests"/>). The regression this guards against: a supplied
|
|
/// <c>?tenantId=</c> used to be ignored entirely, silently widening the result to a
|
|
/// cross-tenant view, and an invalid GUID was never rejected.
|
|
/// </para>
|
|
/// </summary>
|
|
public class GetAllBlockedDevicesFunctionTests
|
|
{
|
|
[Theory]
|
|
[InlineData(null)]
|
|
[InlineData("")]
|
|
[InlineData(" ")]
|
|
[InlineData("\t\n")]
|
|
public void ParseTenantFilter_MissingOrBlank_YieldsAll(string? raw)
|
|
{
|
|
var (kind, tenantId) = GetAllBlockedDevicesFunction.ParseTenantFilter(raw);
|
|
|
|
Assert.Equal(GetAllBlockedDevicesFunction.TenantFilterKind.All, kind);
|
|
Assert.Null(tenantId);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("806f61c3-1978-4e5c-8fd7-a571cb0fe6bc", "806f61c3-1978-4e5c-8fd7-a571cb0fe6bc")]
|
|
[InlineData(" 806f61c3-1978-4e5c-8fd7-a571cb0fe6bc ", "806f61c3-1978-4e5c-8fd7-a571cb0fe6bc")]
|
|
public void ParseTenantFilter_ValidGuid_YieldsScopedTrimmed(string raw, string expected)
|
|
{
|
|
var (kind, tenantId) = GetAllBlockedDevicesFunction.ParseTenantFilter(raw);
|
|
|
|
Assert.Equal(GetAllBlockedDevicesFunction.TenantFilterKind.Scoped, kind);
|
|
Assert.Equal(expected, tenantId);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("not-a-guid")]
|
|
[InlineData("099")]
|
|
[InlineData("806f61c3-1978-4e5c-8fd7")]
|
|
[InlineData("' OR 1=1 --")]
|
|
public void ParseTenantFilter_NonGuid_YieldsInvalid(string raw)
|
|
{
|
|
var (kind, tenantId) = GetAllBlockedDevicesFunction.ParseTenantFilter(raw);
|
|
|
|
Assert.Equal(GetAllBlockedDevicesFunction.TenantFilterKind.Invalid, kind);
|
|
Assert.Null(tenantId);
|
|
}
|
|
}
|