seerr-autoapprove/tests/SeerrAutoApprove.Tests/EndpointTests.cs

using System.Net;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.DependencyInjection.Extensions;
using SeerrAutoApprove.Seerr;

namespace SeerrAutoApprove.Tests;

public sealed class EndpointTests : IDisposable
{
    private readonly TempDatabase _db = new();

    public void Dispose() => _db.Dispose();

    private WebApplicationFactory<Program> CreateFactory(string? webhookSecret) =>
        new WebApplicationFactory<Program>().WithWebHostBuilder(builder =>
        {
            builder.ConfigureAppConfiguration((_, config) => config.AddInMemoryCollection(new Dictionary<string, string?>
            {
                ["Seerr:BaseUrl"] = "http://seerr.invalid",
                ["Seerr:ApiKey"] = "test-key",
                ["AutoApprove:DatabasePath"] = _db.Path,
                ["AutoApprove:WebhookSecret"] = webhookSecret,
            }));
            builder.ConfigureServices(services => services.Replace(ServiceDescriptor.Singleton<ISeerrClient, FakeSeerrClient>()));
        });

    [Fact]
    public async Task Health_returns_ok()
    {
        await using var factory = CreateFactory(null);

        var response = await factory.CreateClient().GetAsync("/health");

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
    }

    [Fact]
    public async Task Webhook_without_secret_is_accepted()
    {
        await using var factory = CreateFactory(null);

        var response = await factory.CreateClient().PostAsync("/webhook", new StringContent("{}"));

        Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
    }

    [Fact]
    public async Task Webhook_with_secret_rejects_missing_or_wrong_header()
    {
        await using var factory = CreateFactory("s3cret");
        var client = factory.CreateClient();

        var missing = await client.PostAsync("/webhook", new StringContent("{}"));

        using var wrong = new HttpRequestMessage(HttpMethod.Post, "/webhook") { Content = new StringContent("{}") };
        wrong.Headers.TryAddWithoutValidation("Authorization", "nope");
        var wrongResponse = await client.SendAsync(wrong);

        Assert.Equal(HttpStatusCode.Unauthorized, missing.StatusCode);
        Assert.Equal(HttpStatusCode.Unauthorized, wrongResponse.StatusCode);
    }

    [Fact]
    public async Task Webhook_with_correct_secret_is_accepted()
    {
        await using var factory = CreateFactory("s3cret");
        using var request = new HttpRequestMessage(HttpMethod.Post, "/webhook") { Content = new StringContent("{}") };
        request.Headers.TryAddWithoutValidation("Authorization", "s3cret");

        var response = await factory.CreateClient().SendAsync(request);

        Assert.Equal(HttpStatusCode.Accepted, response.StatusCode);
    }
}