AaronPo/the-biergarten-app
1
0
Fork 0
mirror of https://github.com/aaronpo97/the-biergarten-app.git synced 2026-10-14 17:54:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enforce brewery ownership on update and delete (#267)

Browse Source
This commit is contained in:
Aaron Po
2026-08-31 13:37:17 -04:00
committed by GitHub
parent 49d7f860de
commit 8b429be857
31 changed files with 978 additions and 287 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
web/backend/API/API.Specs/API.Specs.csproj
View File

@@ -41,5 +41,7 @@
<ProjectReference Include="..\..\Infrastructure\Infrastructure.Configuration\Infrastructure.Configuration.csproj" />
<ProjectReference Include="..\..\Infrastructure\Infrastructure.Email\Infrastructure.Email.csproj" />
<ProjectReference Include="..\..\Features\Features.Emails\Features.Emails.csproj" />
<ProjectReference Include="..\..\Features\Features.Locations\Features.Locations.csproj" />
<ProjectReference Include="..\..\Database\Database.Connection\Database.Connection.csproj" />
</ItemGroup>
</Project>

95
web/backend/API/API.Specs/Features/Breweries.feature Normal file
View File

@@ -0,0 +1,95 @@
Feature: Brewery Management
As an authenticated user
I want to create, view, update and delete brewery posts
So that I can share information about breweries with the community
Background:
Given the API is running
Scenario: Successful brewery creation
Given I have an existing account
And I am logged in
And a city exists
When I create a brewery with values:
| BreweryName | Description | AddressLine1 | PostalCode |
| Roundhouse Brewery | A cozy local brewery | 123 Main St | 90210 |
Then the response has HTTP status 201
And the response JSON should have "breweryName" equal "Roundhouse Brewery"
Scenario: Brewery creation fails without authentication
Given a city exists
When I create a brewery with values:
| BreweryName | Description | AddressLine1 | PostalCode |
| No Auth Brew | A brewery | 1 Nowhere St | 00000 |
Then the response has HTTP status 401
Scenario: Brewery creation fails with a non-existent city
Given I have an existing account
And I am logged in
When I create a brewery with a non-existent city
Then the response has HTTP status 404
Scenario: Retrieve an existing brewery by ID
Given I have an existing account
And I am logged in
And a city exists
And I have created a brewery
When I retrieve the brewery by ID
Then the response has HTTP status 200
And the response JSON should have "breweryName" equal "Test Brewery"
Scenario: Retrieving a non-existent brewery returns not found
When I retrieve a brewery by a non-existent ID
Then the response has HTTP status 404
Scenario: Owner can update their brewery
Given I have an existing account
And I am logged in
And a city exists
And I have created a brewery
When I update the brewery with values:
| BreweryName | Description |
| Renamed Brewery | An updated description |
Then the response has HTTP status 200
And the response JSON should have "breweryName" equal "Renamed Brewery"
Scenario: A different user cannot update someone else's brewery
Given I have an existing account
And I am logged in
And a city exists
And I have created a brewery
And I am logged in as a different user
When I update the brewery with values:
| BreweryName | Description |
| Hijacked | Nope |
Then the response has HTTP status 403
Scenario: Updating a non-existent brewery returns not found
Given I have an existing account
And I am logged in
When I update a non-existent brewery
Then the response has HTTP status 404
Scenario: Owner can delete their brewery
Given I have an existing account
And I am logged in
And a city exists
And I have created a brewery
When I delete the brewery
Then the response has HTTP status 200
And retrieving the brewery by ID should now return HTTP status 404
Scenario: A different user cannot delete someone else's brewery
Given I have an existing account
And I am logged in
And a city exists
And I have created a brewery
And I am logged in as a different user
When I delete the brewery
Then the response has HTTP status 403
Scenario: Deleting a non-existent brewery returns not found
Given I have an existing account
And I am logged in
When I delete a non-existent brewery
Then the response has HTTP status 404

39
web/backend/API/API.Specs/Steps/ApiStepsBase.cs Normal file
View File

@@ -0,0 +1,39 @@
using Reqnroll;
namespace API.Specs.Steps;
/// <summary>
/// Shared <see cref="TestApiFactory" />/<see cref="HttpClient" /> plumbing and the <see cref="ScenarioContext" />
/// keys used to coordinate it, common to every step definition class that drives the test API.
/// </summary>
public abstract class ApiStepsBase(ScenarioContext scenario)
{
protected ScenarioContext Scenario { get; } = scenario;
protected const string ClientKey = "client";
protected const string FactoryKey = "factory";
protected const string ResponseKey = "response";
protected const string ResponseBodyKey = "responseBody";
protected TestApiFactory GetFactory()
{
TestApiFactory? factory = Scenario.TryGetValue<TestApiFactory>(
FactoryKey,
out TestApiFactory? f
)
? f
: new TestApiFactory();
Scenario[FactoryKey] = factory;
return factory;
}
protected HttpClient GetClient()
{
if (Scenario.TryGetValue<HttpClient>(ClientKey, out HttpClient? client))
return client;
client = GetFactory().CreateClient();
Scenario[ClientKey] = client;
return client;
}
}

270
web/backend/API/API.Specs/Steps/AuthSteps.cs
View File

@@ -10,40 +10,14 @@ using Reqnroll;
namespace API.Specs.Steps;
[Binding]
public class AuthSteps(ScenarioContext scenario)
public class AuthSteps(ScenarioContext scenario) : ApiStepsBase(scenario)
{
private const string ClientKey = "client";
private const string FactoryKey = "factory";
private const string ResponseKey = "response";
private const string ResponseBodyKey = "responseBody";
private const string TestUserKey = "testUser";
private const string RegisteredUserIdKey = "registeredUserId";
private const string RegisteredUsernameKey = "registeredUsername";
private const string PreviousAccessTokenKey = "previousAccessToken";
private const string PreviousRefreshTokenKey = "previousRefreshToken";
private TestApiFactory GetFactory()
{
TestApiFactory? factory = scenario.TryGetValue<TestApiFactory>(
FactoryKey,
out TestApiFactory? f
)
? f
: new TestApiFactory();
scenario[FactoryKey] = factory;
return factory;
}
private HttpClient GetClient()
{
if (scenario.TryGetValue<HttpClient>(ClientKey, out HttpClient? client))
return client;
client = GetFactory().CreateClient();
scenario[ClientKey] = client;
return client;
}
/// <summary>
/// Reads a required configuration value from the running <see cref="TestApiFactory" />'s own
/// <see cref="IConfiguration" />, so forged tokens are always signed with the exact secret the
@@ -107,7 +81,7 @@ public class AuthSteps(ScenarioContext scenario)
[Given("I have an existing account")]
public async Task GivenIHaveAnExistingAccount()
{
scenario[TestUserKey] = (FixtureUsername, FixturePassword);
Scenario[TestUserKey] = (FixtureUsername, FixturePassword);
HttpClient client = GetClient();
var registrationData = new
@@ -153,14 +127,14 @@ public class AuthSteps(ScenarioContext scenario)
[Given("I do not have an existing account")]
public void GivenIDoNotHaveAnExistingAccount()
{
scenario[TestUserKey] = ("Failing", "User");
Scenario[TestUserKey] = ("Failing", "User");
}
[When("I submit a login request with a username and password")]
public async Task WhenISubmitALoginRequestWithAUsernameAndPassword()
{
HttpClient client = GetClient();
(string username, string password) = scenario.TryGetValue(TestUserKey, out (string username, string password) user)
(string username, string password) = Scenario.TryGetValue(TestUserKey, out (string username, string password) user)
? user
: ("test.user", "password");
@@ -174,8 +148,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a login request with a missing username")]
@@ -192,8 +166,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a login request with a missing password")]
@@ -210,8 +184,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a login request with both username and password missing")]
@@ -226,18 +200,18 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[Then("the response JSON should have an access token")]
public void ThenTheResponseJsonShouldHaveAnAccessToken()
{
scenario
Scenario
.TryGetValue<HttpResponseMessage>(ResponseKey, out HttpResponseMessage? response)
.Should()
.BeTrue();
scenario.TryGetValue<string>(ResponseBodyKey, out string? responseBody).Should().BeTrue();
Scenario.TryGetValue<string>(ResponseBodyKey, out string? responseBody).Should().BeTrue();
JsonDocument doc = JsonDocument.Parse(responseBody!);
JsonElement root = doc.RootElement;
@@ -270,8 +244,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a registration request with values:")]
@@ -321,8 +295,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a registration request using a GET request")]
@@ -337,8 +311,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[Given("I have registered a new account")]
@@ -364,13 +338,13 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
using JsonDocument doc = JsonDocument.Parse(responseBody);
JsonElement root = doc.RootElement;
scenario[RegisteredUserIdKey] = ParseRegisteredUserId(root);
scenario[RegisteredUsernameKey] = ParseRegisteredUsername(root);
Scenario[RegisteredUserIdKey] = ParseRegisteredUserId(root);
Scenario[RegisteredUsernameKey] = ParseRegisteredUsername(root);
}
[Given("I am logged in")]
@@ -396,12 +370,12 @@ public class AuthSteps(ScenarioContext scenario)
payloadElem.TryGetProperty("accessToken", out JsonElement tokenElem)
|| payloadElem.TryGetProperty("AccessToken", out tokenElem)
)
scenario["accessToken"] = tokenElem.GetString();
Scenario["accessToken"] = tokenElem.GetString();
if (
payloadElem.TryGetProperty("refreshToken", out JsonElement refreshElem)
|| payloadElem.TryGetProperty("RefreshToken", out refreshElem)
)
scenario["refreshToken"] = refreshElem.GetString();
Scenario["refreshToken"] = refreshElem.GetString();
}
}
@@ -421,15 +395,15 @@ public class AuthSteps(ScenarioContext scenario)
[Given("I have a valid access token for my account")]
public void GivenIHaveAValidAccessTokenForMyAccount()
{
Guid userId = scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
Guid userId = Scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
? id
: throw new InvalidOperationException("registered user ID not found in scenario");
string? username = scenario.TryGetValue<string>(RegisteredUsernameKey, out string? user)
string? username = Scenario.TryGetValue<string>(RegisteredUsernameKey, out string? user)
? user
: throw new InvalidOperationException("registered username not found in scenario");
string secret = GetRequiredConfigValue(ConfigurationKeys.AccessTokenSecret);
scenario["accessToken"] = GenerateJwtToken(
Scenario["accessToken"] = GenerateJwtToken(
userId,
username,
secret,
@@ -440,15 +414,15 @@ public class AuthSteps(ScenarioContext scenario)
[Given("I have a valid confirmation token for my account")]
public void GivenIHaveAValidConfirmationTokenForMyAccount()
{
Guid userId = scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
Guid userId = Scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
? id
: throw new InvalidOperationException("registered user ID not found in scenario");
string? username = scenario.TryGetValue<string>(RegisteredUsernameKey, out string? user)
string? username = Scenario.TryGetValue<string>(RegisteredUsernameKey, out string? user)
? user
: throw new InvalidOperationException("registered username not found in scenario");
string secret = GetRequiredConfigValue(ConfigurationKeys.ConfirmationTokenSecret);
scenario["confirmationToken"] = GenerateJwtToken(
Scenario["confirmationToken"] = GenerateJwtToken(
userId,
username,
secret,
@@ -459,15 +433,15 @@ public class AuthSteps(ScenarioContext scenario)
[Given("I have an expired confirmation token for my account")]
public void GivenIHaveAnExpiredConfirmationTokenForMyAccount()
{
Guid userId = scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
Guid userId = Scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
? id
: throw new InvalidOperationException("registered user ID not found in scenario");
string? username = scenario.TryGetValue<string>(RegisteredUsernameKey, out string? user)
string? username = Scenario.TryGetValue<string>(RegisteredUsernameKey, out string? user)
? user
: throw new InvalidOperationException("registered username not found in scenario");
string secret = GetRequiredConfigValue(ConfigurationKeys.ConfirmationTokenSecret);
scenario["confirmationToken"] = GenerateJwtToken(
Scenario["confirmationToken"] = GenerateJwtToken(
userId,
username,
secret,
@@ -478,15 +452,15 @@ public class AuthSteps(ScenarioContext scenario)
[Given("I have a confirmation token signed with the wrong secret")]
public void GivenIHaveAConfirmationTokenSignedWithTheWrongSecret()
{
Guid userId = scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
Guid userId = Scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
? id
: throw new InvalidOperationException("registered user ID not found in scenario");
string? username = scenario.TryGetValue<string>(RegisteredUsernameKey, out string? user)
string? username = Scenario.TryGetValue<string>(RegisteredUsernameKey, out string? user)
? user
: throw new InvalidOperationException("registered username not found in scenario");
const string wrongSecret = "wrong-confirmation-secret-that-is-very-long-1234567890";
scenario["confirmationToken"] = GenerateJwtToken(
Scenario["confirmationToken"] = GenerateJwtToken(
userId,
username,
wrongSecret,
@@ -498,7 +472,7 @@ public class AuthSteps(ScenarioContext scenario)
public async Task WhenISubmitARequestToAProtectedEndpointWithAValidAccessToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("accessToken", out string? t)
string? token = Scenario.TryGetValue<string>("accessToken", out string? t)
? t
: "invalid-token";
@@ -509,8 +483,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a request to a protected endpoint with an invalid access token")]
@@ -524,18 +498,18 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a confirmation request with the valid token")]
public async Task WhenISubmitAConfirmationRequestWithTheValidToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("confirmationToken", out string? t)
string? token = Scenario.TryGetValue<string>("confirmationToken", out string? t)
? t
: "valid-token";
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -548,18 +522,18 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit the same confirmation request again")]
public async Task WhenISubmitTheSameConfirmationRequestAgain()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("confirmationToken", out string? t)
string? token = Scenario.TryGetValue<string>("confirmationToken", out string? t)
? t
: "valid-token";
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -572,8 +546,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a confirmation request with a malformed token")]
@@ -581,7 +555,7 @@ public class AuthSteps(ScenarioContext scenario)
{
HttpClient client = GetClient();
const string token = "malformed-token-not-jwt";
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -594,20 +568,20 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a refresh token request with a valid refresh token")]
public async Task WhenISubmitARefreshTokenRequestWithTheValidRefreshToken()
{
HttpClient client = GetClient();
if (scenario.TryGetValue<string>("accessToken", out string? oldAccessToken))
scenario[PreviousAccessTokenKey] = oldAccessToken;
if (scenario.TryGetValue<string>("refreshToken", out string? oldRefreshToken))
scenario[PreviousRefreshTokenKey] = oldRefreshToken;
if (Scenario.TryGetValue<string>("accessToken", out string? oldAccessToken))
Scenario[PreviousAccessTokenKey] = oldAccessToken;
if (Scenario.TryGetValue<string>("refreshToken", out string? oldRefreshToken))
Scenario[PreviousRefreshTokenKey] = oldRefreshToken;
string? token = scenario.TryGetValue<string>("refreshToken", out string? t)
string? token = Scenario.TryGetValue<string>("refreshToken", out string? t)
? t
: "valid-refresh-token";
@@ -616,8 +590,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a refresh token request with an invalid refresh token")]
@@ -630,8 +604,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a refresh token request with the expired refresh token")]
@@ -644,8 +618,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a refresh token request with a missing refresh token")]
@@ -657,8 +631,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a refresh token request using a GET request")]
@@ -672,8 +646,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
// Protected Endpoint Steps
@@ -685,22 +659,22 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[Given("I am logged in with an immediately-expiring access token")]
public Task GivenIAmLoggedInWithAnImmediatelyExpiringAccessToken()
{
// Simulate an expired access token for auth rejection behavior.
scenario["accessToken"] = "expired-access-token";
Scenario["accessToken"] = "expired-access-token";
return Task.CompletedTask;
}
[Given("I have an access token signed with the wrong secret")]
public void GivenIHaveAnAccessTokenSignedWithTheWrongSecret()
{
scenario["accessToken"] =
Scenario["accessToken"] =
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
}
@@ -708,7 +682,7 @@ public class AuthSteps(ScenarioContext scenario)
public async Task WhenISubmitARequestToAProtectedEndpointWithTheExpiredToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("accessToken", out string? t)
string? token = Scenario.TryGetValue<string>("accessToken", out string? t)
? t
: "expired-token";
@@ -719,15 +693,15 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a request to a protected endpoint with the tampered token")]
public async Task WhenISubmitARequestToAProtectedEndpointWithTheTamperedToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("accessToken", out string? t)
string? token = Scenario.TryGetValue<string>("accessToken", out string? t)
? t
: "tampered-token";
@@ -738,8 +712,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When(
@@ -748,7 +722,7 @@ public class AuthSteps(ScenarioContext scenario)
public async Task WhenISubmitARequestToAProtectedEndpointWithMyRefreshTokenInsteadOfAccessToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("refreshToken", out string? t)
string? token = Scenario.TryGetValue<string>("refreshToken", out string? t)
? t
: "refresh-token";
@@ -759,24 +733,24 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[Given("I have a valid confirmation token")]
public void GivenIHaveAValidConfirmationToken()
{
scenario["confirmationToken"] = "valid-confirmation-token";
Scenario["confirmationToken"] = "valid-confirmation-token";
}
[When("I submit a confirmation request with the expired token")]
public async Task WhenISubmitAConfirmationRequestWithTheExpiredToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("confirmationToken", out string? t)
string? token = Scenario.TryGetValue<string>("confirmationToken", out string? t)
? t
: "expired-confirmation-token";
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -789,18 +763,18 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a confirmation request with the tampered token")]
public async Task WhenISubmitAConfirmationRequestWithTheTamperedToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("confirmationToken", out string? t)
string? token = Scenario.TryGetValue<string>("confirmationToken", out string? t)
? t
: "tampered-confirmation-token";
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -813,15 +787,15 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a confirmation request with a missing token")]
public async Task WhenISubmitAConfirmationRequestWithAMissingToken()
{
HttpClient client = GetClient();
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -831,15 +805,15 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a confirmation request using an invalid HTTP method")]
public async Task WhenISubmitAConfirmationRequestUsingAnInvalidHttpMethod()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("confirmationToken", out string? t)
string? token = Scenario.TryGetValue<string>("confirmationToken", out string? t)
? t
: "valid-confirmation-token";
@@ -850,8 +824,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When(
@@ -860,7 +834,7 @@ public class AuthSteps(ScenarioContext scenario)
public async Task WhenISubmitARequestToAProtectedEndpointWithMyConfirmationTokenInsteadOfAccessToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("confirmationToken", out string? t)
string? token = Scenario.TryGetValue<string>("confirmationToken", out string? t)
? t
: "confirmation-token";
@@ -871,8 +845,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a confirmation request with an invalid token")]
@@ -880,7 +854,7 @@ public class AuthSteps(ScenarioContext scenario)
{
HttpClient client = GetClient();
const string token = "invalid-confirmation-token";
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -893,15 +867,15 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a confirmation request with the valid token without an access token")]
public async Task WhenISubmitAConfirmationRequestWithTheValidTokenWithoutAnAccessToken()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("confirmationToken", out string? t)
string? token = Scenario.TryGetValue<string>("confirmationToken", out string? t)
? t
: "valid-token";
@@ -912,14 +886,14 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[Then("the response JSON should have a new access token")]
public void ThenTheResponseJsonShouldHaveANewAccessToken()
{
scenario.TryGetValue<string>(ResponseBodyKey, out string? responseBody).Should().BeTrue();
Scenario.TryGetValue<string>(ResponseBodyKey, out string? responseBody).Should().BeTrue();
using JsonDocument doc = JsonDocument.Parse(responseBody!);
JsonElement payload = doc.RootElement.GetProperty("payload");
@@ -927,14 +901,14 @@ public class AuthSteps(ScenarioContext scenario)
accessToken.Should().NotBeNullOrWhiteSpace();
if (scenario.TryGetValue<string>(PreviousAccessTokenKey, out string? previousAccessToken))
if (Scenario.TryGetValue<string>(PreviousAccessTokenKey, out string? previousAccessToken))
accessToken.Should().NotBe(previousAccessToken);
}
[Then("the response JSON should have a new refresh token")]
public void ThenTheResponseJsonShouldHaveANewRefreshToken()
{
scenario.TryGetValue<string>(ResponseBodyKey, out string? responseBody).Should().BeTrue();
Scenario.TryGetValue<string>(ResponseBodyKey, out string? responseBody).Should().BeTrue();
using JsonDocument doc = JsonDocument.Parse(responseBody!);
JsonElement payload = doc.RootElement.GetProperty("payload");
@@ -942,7 +916,7 @@ public class AuthSteps(ScenarioContext scenario)
refreshToken.Should().NotBeNullOrWhiteSpace();
if (scenario.TryGetValue<string>(PreviousRefreshTokenKey, out string? previousRefreshToken))
if (Scenario.TryGetValue<string>(PreviousRefreshTokenKey, out string? previousRefreshToken))
refreshToken.Should().NotBe(previousRefreshToken);
}
@@ -950,10 +924,10 @@ public class AuthSteps(ScenarioContext scenario)
public async Task GivenIHaveConfirmedMyAccount()
{
HttpClient client = GetClient();
string? token = scenario.TryGetValue<string>("confirmationToken", out string? t)
string? token = Scenario.TryGetValue<string>("confirmationToken", out string? t)
? t
: throw new InvalidOperationException("confirmation token not found");
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -972,10 +946,10 @@ public class AuthSteps(ScenarioContext scenario)
public async Task WhenISubmitAResendConfirmationRequestForMyAccount()
{
HttpClient client = GetClient();
Guid userId = scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
Guid userId = Scenario.TryGetValue(RegisteredUserIdKey, out Guid id)
? id
: throw new InvalidOperationException("registered user ID not found");
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -988,8 +962,8 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a resend confirmation request for a non-existent user")]
@@ -997,7 +971,7 @@ public class AuthSteps(ScenarioContext scenario)
{
HttpClient client = GetClient();
Guid fakeUserId = Guid.NewGuid();
string? accessToken = scenario.TryGetValue<string>("accessToken", out string? at)
string? accessToken = Scenario.TryGetValue<string>("accessToken", out string? at)
? at
: string.Empty;
@@ -1010,15 +984,15 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[When("I submit a resend confirmation request without an access token")]
public async Task WhenISubmitAResendConfirmationRequestWithoutAnAccessToken()
{
HttpClient client = GetClient();
Guid userId = scenario.TryGetValue(RegisteredUserIdKey, out Guid id) ? id : Guid.NewGuid();
Guid userId = Scenario.TryGetValue(RegisteredUserIdKey, out Guid id) ? id : Guid.NewGuid();
HttpRequestMessage requestMessage = new(
HttpMethod.Post,
@@ -1027,7 +1001,7 @@ public class AuthSteps(ScenarioContext scenario)
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
scenario[ResponseKey] = response;
scenario[ResponseBodyKey] = responseBody;
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
}

329
web/backend/API/API.Specs/Steps/BrewerySteps.cs Normal file
View File

@@ -0,0 +1,329 @@
using System.Text;
using System.Text.Json;
using Database.Connection;
using Features.Locations.Dtos;
using Features.Locations.Repository;
using FluentAssertions;
using Microsoft.Extensions.DependencyInjection;
using Reqnroll;
namespace API.Specs.Steps;
[Binding]
public class BrewerySteps(ScenarioContext scenario) : ApiStepsBase(scenario)
{
private const string AccessTokenKey = "accessToken";
private const string CityIdKey = "cityId";
private const string BreweryPostIdKey = "breweryPostId";
private const string BreweryRowVersionKey = "breweryRowVersion";
private const string FixtureCountryName = "Fixture Country";
private const string FixtureCountryIsoCode = "FX";
private const string FixtureStateProvinceName = "Fixture State";
private const string FixtureStateProvinceIsoCode = "FX-TS";
private const string FixtureCityName = "Fixture City";
// GetOrCreateCityIdAsync is not fully race-safe under concurrent callers creating the same
// city (see its remarks); scenarios run in parallel across feature classes, so provisioning
// the shared fixture city is serialized the same way AuthSteps serializes its fixture account.
private static readonly SemaphoreSlim CityProvisioningLock = new(1, 1);
private HttpRequestMessage NewAuthenticatedRequest(HttpMethod method, string url)
{
HttpRequestMessage requestMessage = new(method, url);
if (Scenario.TryGetValue<string>(AccessTokenKey, out string? accessToken))
requestMessage.Headers.Add("Authorization", $"Bearer {accessToken}");
return requestMessage;
}
private async Task SendAsync(HttpRequestMessage requestMessage)
{
HttpClient client = GetClient();
HttpResponseMessage response = await client.SendAsync(requestMessage);
string responseBody = await response.Content.ReadAsStringAsync();
Scenario[ResponseKey] = response;
Scenario[ResponseBodyKey] = responseBody;
}
[Given("a city exists")]
public async Task GivenACityExists()
{
ISqlConnectionFactory connectionFactory = GetFactory()
.Services.GetRequiredService<ISqlConnectionFactory>();
LocationRepository repository = new(connectionFactory);
CityLocation fixtureCity = new(
FixtureCityName,
FixtureStateProvinceName,
FixtureStateProvinceIsoCode,
FixtureCountryName,
FixtureCountryIsoCode
);
await CityProvisioningLock.WaitAsync();
Guid cityId;
try
{
cityId = await repository.GetOrCreateCityIdAsync(fixtureCity);
}
finally
{
CityProvisioningLock.Release();
}
Scenario[CityIdKey] = cityId;
}
private async Task CreateBreweryAsync(
string breweryName,
string description,
string addressLine1,
string postalCode,
Guid cityId
)
{
var createData = new
{
breweryName,
description,
location = new
{
cityId,
addressLine1,
addressLine2 = (string?)null,
postalCode,
coordinates = (object?)null,
},
};
HttpRequestMessage requestMessage = NewAuthenticatedRequest(
HttpMethod.Post,
"/api/brewery"
);
requestMessage.Content = new StringContent(
JsonSerializer.Serialize(createData),
Encoding.UTF8,
"application/json"
);
await SendAsync(requestMessage);
}
[When("I create a brewery with values:")]
public async Task WhenICreateABreweryWithValues(Table table)
{
DataTableRow row = table.Rows[0];
Guid cityId = Scenario.TryGetValue(CityIdKey, out Guid id) ? id : Guid.NewGuid();
await CreateBreweryAsync(
row["BreweryName"] ?? "",
row["Description"] ?? "",
row["AddressLine1"] ?? "",
row["PostalCode"] ?? "",
cityId
);
}
[When("I create a brewery with a non-existent city")]
public async Task WhenICreateABreweryWithANonExistentCity()
{
await CreateBreweryAsync(
"Ghost City Brewery",
"A brewery in a city that does not exist",
"1 Nowhere St",
"00000",
Guid.NewGuid()
);
}
[Given("I have created a brewery")]
public async Task GivenIHaveCreatedABrewery()
{
Guid cityId = Scenario.TryGetValue(CityIdKey, out Guid id)
? id
: throw new InvalidOperationException("city ID not found in scenario");
await CreateBreweryAsync(
"Test Brewery",
"A test brewery",
"123 Test St",
"00000",
cityId
);
Scenario
.TryGetValue<HttpResponseMessage>(ResponseKey, out HttpResponseMessage? response)
.Should()
.BeTrue();
((int)response!.StatusCode).Should().Be(201, "fixture brewery creation must succeed");
Scenario.TryGetValue<string>(ResponseBodyKey, out string? responseBody).Should().BeTrue();
using JsonDocument doc = JsonDocument.Parse(responseBody!);
JsonElement payload = doc.RootElement.GetProperty("payload");
Scenario[BreweryPostIdKey] = payload.GetProperty("breweryPostId").GetGuid();
Scenario[BreweryRowVersionKey] = payload.GetProperty("rowVersion").GetString()
?? throw new InvalidOperationException("rowVersion missing from created brewery");
}
private Guid GetCreatedBreweryPostId()
{
return Scenario.TryGetValue(BreweryPostIdKey, out Guid id)
? id
: throw new InvalidOperationException("brewery post ID not found in scenario");
}
[When("I retrieve the brewery by ID")]
public async Task WhenIRetrieveTheBreweryById()
{
HttpRequestMessage requestMessage = NewAuthenticatedRequest(
HttpMethod.Get,
$"/api/brewery/{GetCreatedBreweryPostId()}"
);
await SendAsync(requestMessage);
}
[When("I retrieve a brewery by a non-existent ID")]
public async Task WhenIRetrieveABreweryByANonExistentId()
{
HttpRequestMessage requestMessage = NewAuthenticatedRequest(
HttpMethod.Get,
$"/api/brewery/{Guid.NewGuid()}"
);
await SendAsync(requestMessage);
}
[When("I update the brewery with values:")]
public async Task WhenIUpdateTheBreweryWithValues(Table table)
{
DataTableRow row = table.Rows[0];
Guid breweryPostId = GetCreatedBreweryPostId();
string rowVersion = Scenario.TryGetValue<string>(BreweryRowVersionKey, out string? rv)
? rv
: throw new InvalidOperationException("row version not found in scenario");
var updateData = new
{
breweryPostId,
rowVersion,
breweryName = row["BreweryName"] ?? "",
description = row["Description"] ?? "",
location = (object?)null,
};
HttpRequestMessage requestMessage = NewAuthenticatedRequest(
HttpMethod.Put,
$"/api/brewery/{breweryPostId}"
);
requestMessage.Content = new StringContent(
JsonSerializer.Serialize(updateData),
Encoding.UTF8,
"application/json"
);
await SendAsync(requestMessage);
}
[When("I update a non-existent brewery")]
public async Task WhenIUpdateANonExistentBrewery()
{
Guid breweryPostId = Guid.NewGuid();
var updateData = new
{
breweryPostId,
rowVersion = Convert.ToBase64String([0x00, 0x00, 0x00, 0x00]),
breweryName = "Nonexistent",
description = "Nonexistent",
location = (object?)null,
};
HttpRequestMessage requestMessage = NewAuthenticatedRequest(
HttpMethod.Put,
$"/api/brewery/{breweryPostId}"
);
requestMessage.Content = new StringContent(
JsonSerializer.Serialize(updateData),
Encoding.UTF8,
"application/json"
);
await SendAsync(requestMessage);
}
[When("I delete the brewery")]
public async Task WhenIDeleteTheBrewery()
{
HttpRequestMessage requestMessage = NewAuthenticatedRequest(
HttpMethod.Delete,
$"/api/brewery/{GetCreatedBreweryPostId()}"
);
await SendAsync(requestMessage);
}
[When("I delete a non-existent brewery")]
public async Task WhenIDeleteANonExistentBrewery()
{
HttpRequestMessage requestMessage = NewAuthenticatedRequest(
HttpMethod.Delete,
$"/api/brewery/{Guid.NewGuid()}"
);
await SendAsync(requestMessage);
}
[Given("I am logged in as a different user")]
public async Task GivenIAmLoggedInAsADifferentUser()
{
HttpClient client = GetClient();
string suffix = Guid.NewGuid().ToString("N")[..8];
var registrationData = new
{
username = $"otheruser-{suffix}",
firstName = "Other",
lastName = "User",
email = $"otheruser-{suffix}@example.com",
dateOfBirth = "1990-01-01",
password = "Password1!",
};
HttpRequestMessage requestMessage = new(HttpMethod.Post, "/api/auth/register")
{
Content = new StringContent(
JsonSerializer.Serialize(registrationData),
Encoding.UTF8,
"application/json"
),
};
HttpResponseMessage response = await client.SendAsync(requestMessage);
response.EnsureSuccessStatusCode();
string responseBody = await response.Content.ReadAsStringAsync();
using JsonDocument doc = JsonDocument.Parse(responseBody);
JsonElement payload = doc.RootElement.GetProperty("payload");
string accessToken =
(
payload.TryGetProperty("accessToken", out JsonElement tokenElem)
? tokenElem.GetString()
: null
) ?? throw new InvalidOperationException("accessToken missing from registration payload");
Scenario[AccessTokenKey] = accessToken;
}
[Then("retrieving the brewery by ID should now return HTTP status {int}")]
public async Task ThenRetrievingTheBreweryByIdShouldNowReturnHttpStatus(int expectedCode)
{
HttpRequestMessage requestMessage = NewAuthenticatedRequest(
HttpMethod.Get,
$"/api/brewery/{GetCreatedBreweryPostId()}"
);
await SendAsync(requestMessage);
Scenario
.TryGetValue<HttpResponseMessage>(ResponseKey, out HttpResponseMessage? response)
.Should()
.BeTrue();
((int)response!.StatusCode).Should().Be(expectedCode);
}
}

3
web/backend/Domain/Domain.Entities/Entities/BreweryPost.cs
View File

@@ -6,8 +6,8 @@ public sealed class BreweryPost
public Guid BreweryPostId { get; set; }
// FK References
// Note: An empty GUID signifies that this object is incomplete
public Guid PostedById { get; set; }
public string PostedBy { get; set; } = string.Empty;
// Attributes
public string BreweryName { get; set; } = string.Empty;
@@ -21,6 +21,7 @@ public sealed class BreweryPost
// Navigation Properties
public BreweryPostLocation? Location { get; set; }
public List<BeerPost> BeerPosts { get; set; } = [];
public string PostedBy { get; set; } = string.Empty;
// Query-computed
public DistanceInformation? Distance { get; set; }

22
web/backend/Features/Features.Breweries.Tests/Commands/CreateBreweryHandlerTests.cs
View File

@@ -32,6 +32,9 @@ public class CreateBreweryHandlerTests
.Setup(r => r.CreateAsync(It.IsAny<BreweryPost>()))
.Callback<BreweryPost>(b => persisted = b)
.Returns(Task.CompletedTask);
_repoMock
.Setup(r => r.GetByIdAsync(It.IsAny<Guid>(), It.IsAny<CancellationToken>()))
.ReturnsAsync(() => persisted);
DateTime before = DateTime.UtcNow;
BreweryDto result = await _handler.Handle(command, CancellationToken.None);
@@ -53,8 +56,27 @@ public class CreateBreweryHandlerTests
persisted.Location.PostalCode.Should().Be(command.Location.PostalCode);
_repoMock.Verify(r => r.CreateAsync(It.IsAny<BreweryPost>()), Times.Once);
_repoMock.Verify(
r => r.GetByIdAsync(persisted.BreweryPostId, It.IsAny<CancellationToken>()),
Times.Once
);
result.BreweryName.Should().Be("MyBrew");
result.Location.Should().NotBeNull();
}
[Fact]
public async Task Handle_ThrowsInvalidOperationException_WhenBreweryNotFoundAfterCreation()
{
CreateBreweryCommand command = new(Guid.NewGuid(), "MyBrew", "Desc", ValidLocation());
_repoMock.Setup(r => r.CreateAsync(It.IsAny<BreweryPost>())).Returns(Task.CompletedTask);
_repoMock
.Setup(r => r.GetByIdAsync(It.IsAny<Guid>(), It.IsAny<CancellationToken>()))
.ReturnsAsync((BreweryPost?)null);
Func<Task> act = () => _handler.Handle(command, CancellationToken.None);
await act.Should().ThrowAsync<InvalidOperationException>();
}
}

61
web/backend/Features/Features.Breweries.Tests/Commands/DeleteBreweryHandlerTests.cs
View File

@@ -1,21 +1,66 @@
using Domain.Exceptions;
using Features.Breweries.Commands.DeleteBrewery;
using Features.Breweries.Repository;
using FluentAssertions;
using Moq;
namespace Features.Breweries.Tests.Commands;
public class DeleteBreweryHandlerTests
{
[Fact]
public async Task Handle_DelegatesToRepository()
private readonly DeleteBreweryHandler _handler;
private readonly Mock<IBreweryRepository> _repoMock = new();
public DeleteBreweryHandlerTests()
{
Mock<IBreweryRepository> repoMock = new();
DeleteBreweryHandler handler = new(repoMock.Object);
Guid id = Guid.NewGuid();
repoMock.Setup(r => r.DeleteAsync(id)).Returns(Task.CompletedTask);
_handler = new DeleteBreweryHandler(_repoMock.Object);
}
await handler.Handle(new DeleteBreweryCommand(id), CancellationToken.None);
private void SetUpExistingBrewery(Guid breweryPostId, Guid postedById)
{
_repoMock
.Setup(r => r.GetPostedByIdAsync(breweryPostId, It.IsAny<CancellationToken>()))
.ReturnsAsync(postedById);
}
repoMock.Verify(r => r.DeleteAsync(id), Times.Once);
[Fact]
public async Task Handle_DelegatesToRepository_WhenRequestingUserIsThePoster()
{
Guid breweryPostId = Guid.NewGuid();
Guid requestingUserId = Guid.NewGuid();
SetUpExistingBrewery(breweryPostId, requestingUserId);
_repoMock.Setup(r => r.DeleteAsync(breweryPostId)).Returns(Task.CompletedTask);
await _handler.Handle(
new DeleteBreweryCommand(breweryPostId, requestingUserId),
CancellationToken.None
);
_repoMock.Verify(r => r.DeleteAsync(breweryPostId), Times.Once);
}
[Fact]
public async Task Handle_ThrowsNotFoundException_WhenBreweryDoesNotExist()
{
DeleteBreweryCommand command = new(Guid.NewGuid(), Guid.NewGuid());
Func<Task> act = () => _handler.Handle(command, CancellationToken.None);
await act.Should().ThrowAsync<NotFoundException>();
_repoMock.Verify(r => r.DeleteAsync(It.IsAny<Guid>()), Times.Never);
}
[Fact]
public async Task Handle_ThrowsForbiddenException_WhenRequestingUserIsNotThePoster()
{
Guid breweryPostId = Guid.NewGuid();
SetUpExistingBrewery(breweryPostId, Guid.NewGuid());
DeleteBreweryCommand command = new(breweryPostId, Guid.NewGuid());
Func<Task> act = () => _handler.Handle(command, CancellationToken.None);
await act.Should().ThrowAsync<ForbiddenException>();
_repoMock.Verify(r => r.DeleteAsync(It.IsAny<Guid>()), Times.Never);
}
}

82
web/backend/Features/Features.Breweries.Tests/Commands/UpdateBreweryHandlerTests.cs
View File

@@ -1,4 +1,5 @@
using Domain.Entities;
using Domain.Exceptions;
using Features.Breweries.Commands.UpdateBrewery;
using Features.Breweries.Repository;
using FluentAssertions;
@@ -16,13 +17,24 @@ public class UpdateBreweryHandlerTests
_handler = new UpdateBreweryHandler(_repoMock.Object);
}
private void SetUpExistingBrewery(Guid breweryPostId, Guid postedById)
{
_repoMock
.Setup(r => r.GetPostedByIdAsync(breweryPostId, It.IsAny<CancellationToken>()))
.ReturnsAsync(postedById);
}
[Fact]
public async Task Handle_UpdatesNameDescription_AndSetsUpdatedAt()
{
Guid breweryPostId = Guid.NewGuid();
Guid requestingUserId = Guid.NewGuid();
SetUpExistingBrewery(breweryPostId, requestingUserId);
UpdateBreweryCommand command = new(
Guid.NewGuid(),
breweryPostId,
requestingUserId,
[0x01, 0x02],
Guid.NewGuid(),
"Renamed",
"New description",
null
@@ -30,8 +42,8 @@ public class UpdateBreweryHandlerTests
BreweryPost? persisted = null;
_repoMock
.Setup(r => r.UpdateAsync(It.IsAny<BreweryPost>()))
.Callback<BreweryPost>(b => persisted = b)
.Setup(r => r.UpdateAsync(It.IsAny<BreweryPost>(), It.IsAny<CancellationToken>()))
.Callback<BreweryPost, CancellationToken>((b, _) => persisted = b)
.ReturnsAsync(() => persisted!);
DateTime before = DateTime.UtcNow;
@@ -40,7 +52,6 @@ public class UpdateBreweryHandlerTests
persisted.Should().NotBeNull();
persisted!.BreweryPostId.Should().Be(command.BreweryPostId);
persisted.PostedById.Should().Be(command.PostedById);
persisted.BreweryName.Should().Be("Renamed");
persisted.Description.Should().Be("New description");
persisted.RowVersion.Should().Equal(command.RowVersion);
@@ -51,10 +62,14 @@ public class UpdateBreweryHandlerTests
[Fact]
public async Task Handle_ClearsLocation_WhenCommandLocationIsNull()
{
Guid breweryPostId = Guid.NewGuid();
Guid requestingUserId = Guid.NewGuid();
SetUpExistingBrewery(breweryPostId, requestingUserId);
UpdateBreweryCommand command = new(
Guid.NewGuid(),
breweryPostId,
requestingUserId,
[0x01, 0x02],
Guid.NewGuid(),
"Name",
"Description",
null
@@ -62,8 +77,8 @@ public class UpdateBreweryHandlerTests
BreweryPost? persisted = null;
_repoMock
.Setup(r => r.UpdateAsync(It.IsAny<BreweryPost>()))
.Callback<BreweryPost>(b => persisted = b)
.Setup(r => r.UpdateAsync(It.IsAny<BreweryPost>(), It.IsAny<CancellationToken>()))
.Callback<BreweryPost, CancellationToken>((b, _) => persisted = b)
.ReturnsAsync(() => persisted!);
await _handler.Handle(command, CancellationToken.None);
@@ -74,6 +89,10 @@ public class UpdateBreweryHandlerTests
[Fact]
public async Task Handle_SetsLocation_WhenCommandLocationProvided()
{
Guid breweryPostId = Guid.NewGuid();
Guid requestingUserId = Guid.NewGuid();
SetUpExistingBrewery(breweryPostId, requestingUserId);
UpdateBreweryLocation locationCommand = new(
Guid.NewGuid(),
Guid.NewGuid(),
@@ -83,9 +102,9 @@ public class UpdateBreweryHandlerTests
null
);
UpdateBreweryCommand command = new(
Guid.NewGuid(),
breweryPostId,
requestingUserId,
[0x01, 0x02],
Guid.NewGuid(),
"Name",
"Description",
locationCommand
@@ -93,8 +112,8 @@ public class UpdateBreweryHandlerTests
BreweryPost? persisted = null;
_repoMock
.Setup(r => r.UpdateAsync(It.IsAny<BreweryPost>()))
.Callback<BreweryPost>(b => persisted = b)
.Setup(r => r.UpdateAsync(It.IsAny<BreweryPost>(), It.IsAny<CancellationToken>()))
.Callback<BreweryPost, CancellationToken>((b, _) => persisted = b)
.ReturnsAsync(() => persisted!);
await _handler.Handle(command, CancellationToken.None);
@@ -109,4 +128,41 @@ public class UpdateBreweryHandlerTests
persisted.Location.AddressLine2.Should().Be(locationCommand.AddressLine2);
persisted.Location.PostalCode.Should().Be(locationCommand.PostalCode);
}
[Fact]
public async Task Handle_ThrowsNotFoundException_WhenBreweryDoesNotExist()
{
UpdateBreweryCommand command = new(
Guid.NewGuid(),
Guid.NewGuid(),
[0x01, 0x02],
"Name",
"Description",
null
);
Func<Task> act = () => _handler.Handle(command, CancellationToken.None);
await act.Should().ThrowAsync<NotFoundException>();
}
[Fact]
public async Task Handle_ThrowsForbiddenException_WhenRequestingUserIsNotThePoster()
{
Guid breweryPostId = Guid.NewGuid();
SetUpExistingBrewery(breweryPostId, Guid.NewGuid());
UpdateBreweryCommand command = new(
breweryPostId,
Guid.NewGuid(),
[0x01, 0x02],
"Name",
"Description",
null
);
Func<Task> act = () => _handler.Handle(command, CancellationToken.None);
await act.Should().ThrowAsync<ForbiddenException>();
}
}

4
web/backend/Features/Features.Breweries.Tests/Queries/GetAllBreweryLocationsHandlerTests.cs
View File

@@ -22,7 +22,7 @@ public class GetAllBreweryLocationsHandlerTests
{
_repoMock.Setup(r => r.GetAllLocations()).ReturnsAsync(Array.Empty<BreweryPost>());
IEnumerable<SimplifiedBreweryDto> result = await _handler.Handle(
IEnumerable<BreweryWithLocationDto> result = await _handler.Handle(
new GetAllBreweryLocationsQuery(),
CancellationToken.None
);
@@ -41,7 +41,7 @@ public class GetAllBreweryLocationsHandlerTests
];
_repoMock.Setup(r => r.GetAllLocations()).ReturnsAsync(breweries);
IEnumerable<SimplifiedBreweryDto> result = await _handler.Handle(
IEnumerable<BreweryWithLocationDto> result = await _handler.Handle(
new GetAllBreweryLocationsQuery(),
CancellationToken.None
);

4
web/backend/Features/Features.Breweries.Tests/Queries/GetBreweryLocationsWithinRangeHandlerTests.cs
View File

@@ -29,7 +29,7 @@ public class GetBreweryLocationsWithinRangeHandlerTests
)
.ReturnsAsync(Array.Empty<BreweryPost>());
IEnumerable<SimplifiedBreweryDto> result = await _handler.Handle(
IEnumerable<BreweryWithLocationDto> result = await _handler.Handle(
new GetBreweryLocationsWithinRangeQuery(43.6532, -79.3832, 1000),
CancellationToken.None
);
@@ -57,7 +57,7 @@ public class GetBreweryLocationsWithinRangeHandlerTests
.Setup(r => r.GetAllLocationsWithinRange(It.IsAny<CoordinateData>(), It.IsAny<double>()))
.ReturnsAsync(breweries);
IEnumerable<SimplifiedBreweryDto> result = await _handler.Handle(
IEnumerable<BreweryWithLocationDto> result = await _handler.Handle(
new GetBreweryLocationsWithinRangeQuery(43.6532, -79.3832, 1000),
CancellationToken.None
);

7
web/backend/Features/Features.Breweries/Commands/CreateBrewery/CreateBreweryCommand.cs
View File

@@ -23,3 +23,10 @@ public record CreateBreweryCommand(
string Description,
CreateBreweryLocation Location
) : IRequest<BreweryDto>;
/// <summary>Request body for <c>POST /api/brewery</c>. <c>PostedById</c> comes from the caller's JWT.</summary>
public record CreateBreweryRequest(
string BreweryName,
string Description,
CreateBreweryLocation Location
);

13
web/backend/Features/Features.Breweries/Commands/CreateBrewery/CreateBreweryHandler.cs
View File

@@ -37,6 +37,17 @@ public class CreateBreweryHandler(IBreweryRepository repository)
};
await repository.CreateAsync(entity);
return entity.ToDto();
// RowVersion is a DB-computed column, unset on the in-memory entity; re-fetch so callers
// get back the value needed for a subsequent optimistic-concurrency update. Uses
// CancellationToken.None since the write already committed: cancelling the caller's request
// at this point must not turn a successful creation into a thrown exception.
BreweryPost created =
await repository.GetByIdAsync(entity.BreweryPostId, CancellationToken.None)
?? throw new InvalidOperationException(
$"Brewery '{entity.BreweryPostId}' was not found after a successful creation."
);
return created.ToDto();
}
}

4
web/backend/Features/Features.Breweries/Commands/DeleteBrewery/DeleteBreweryCommand.cs
View File

@@ -2,5 +2,5 @@ using MediatR;
namespace Features.Breweries.Commands.DeleteBrewery;
/// <summary>Deletes a brewery post. Bound directly from the route of <c>DELETE /api/brewery/{id}</c>.</summary>
public record DeleteBreweryCommand(Guid BreweryPostId) : IRequest;
/// <summary>Deletes a brewery post. <see cref="BreweryPostId" /> is bound from the route of <c>DELETE /api/brewery/{id}</c>.</summary>
public record DeleteBreweryCommand(Guid BreweryPostId, Guid RequestingUserId) : IRequest;

13
web/backend/Features/Features.Breweries/Commands/DeleteBrewery/DeleteBreweryHandler.cs
View File

@@ -10,8 +10,17 @@ public class DeleteBreweryHandler(IBreweryRepository repository)
/// <exception cref="Domain.Exceptions.NotFoundException">
/// Thrown when no brewery exists with <paramref name="request" />'s <c>BreweryPostId</c>.
/// </exception>
public Task Handle(DeleteBreweryCommand request, CancellationToken cancellationToken)
/// <exception cref="Domain.Exceptions.ForbiddenException">
/// Thrown when <paramref name="request" />'s <c>RequestingUserId</c> did not post the brewery.
/// </exception>
public async Task Handle(DeleteBreweryCommand request, CancellationToken cancellationToken)
{
return repository.DeleteAsync(request.BreweryPostId);
await repository.EnsureCallerOwnsBreweryAsync(
request.BreweryPostId,
request.RequestingUserId,
cancellationToken
);
await repository.DeleteAsync(request.BreweryPostId);
}
}

19
web/backend/Features/Features.Breweries/Commands/UpdateBrewery/UpdateBreweryCommand.cs
View File

@@ -19,16 +19,25 @@ public record UpdateBreweryLocation(
);
/// <summary>
/// Updates an existing brewery post. Bound directly from the request body of <c>PUT /api/brewery/{id}</c>.
/// A <c>null</c> <see cref="Location" /> clears the brewery's location. <see cref="RowVersion" /> must be the
/// row-version last read for this brewery (e.g. from a prior <c>GET</c>); the update is rejected with a
/// <c>409 Conflict</c> if the brewery was modified since then.
/// Updates an existing brewery post. A <c>null</c> <see cref="Location" /> clears the brewery's location.
/// <see cref="RowVersion" /> must be the row-version last read for this brewery (e.g. from a prior
/// <c>GET</c>); the update is rejected with a <c>409 Conflict</c> if the brewery was modified since then.
/// </summary>
public record UpdateBreweryCommand(
Guid BreweryPostId,
Guid RequestingUserId,
byte[] RowVersion,
Guid PostedById,
string BreweryName,
string Description,
UpdateBreweryLocation? Location
) : IRequest<BreweryDto>;
/// <summary>Request body for <c>PUT /api/brewery/{id}</c>.</summary>
public record UpdateBreweryRequest(
Guid BreweryPostId,
byte[] RowVersion,
string BreweryName,
string Description,
UpdateBreweryLocation? Location
);

11
web/backend/Features/Features.Breweries/Commands/UpdateBrewery/UpdateBreweryHandler.cs
View File

@@ -26,13 +26,18 @@ public class UpdateBreweryHandler(IBreweryRepository repository)
CancellationToken cancellationToken
)
{
await repository.EnsureCallerOwnsBreweryAsync(
request.BreweryPostId,
request.RequestingUserId,
cancellationToken
);
BreweryPost entity = new()
{
BreweryPostId = request.BreweryPostId,
PostedById = request.PostedById,
RowVersion = request.RowVersion,
BreweryName = request.BreweryName,
Description = request.Description,
RowVersion = request.RowVersion,
UpdatedAt = DateTime.UtcNow,
Location = request.Location is null
? null
@@ -48,7 +53,7 @@ public class UpdateBreweryHandler(IBreweryRepository repository)
},
};
BreweryPost updated = await repository.UpdateAsync(entity);
BreweryPost updated = await repository.UpdateAsync(entity, cancellationToken);
return updated.ToDto();
}
}

49
web/backend/Features/Features.Breweries/Controllers/BreweryController.cs
View File

@@ -70,13 +70,13 @@ public class BreweryController(IMediator mediator) : ControllerBase
/// <remarks>Allows anonymous access.</remarks>
[AllowAnonymous]
[HttpGet("locations")]
public async Task<ActionResult<ResponseBody<IEnumerable<SimplifiedBreweryDto>>>> GetAllLocations()
public async Task<ActionResult<ResponseBody<IEnumerable<BreweryWithLocationDto>>>> GetAllLocations()
{
IEnumerable<SimplifiedBreweryDto> breweries = await mediator.Send(
IEnumerable<BreweryWithLocationDto> breweries = await mediator.Send(
new GetAllBreweryLocationsQuery()
);
return Ok(
new ResponseBody<IEnumerable<SimplifiedBreweryDto>>
new ResponseBody<IEnumerable<BreweryWithLocationDto>>
{
Message = "Brewery locations retrieved successfully.",
Payload = breweries,
@@ -91,17 +91,17 @@ public class BreweryController(IMediator mediator) : ControllerBase
/// <remarks>Allows anonymous access.</remarks>
[AllowAnonymous]
[HttpGet("locations/nearby")]
public async Task<ActionResult<ResponseBody<IEnumerable<SimplifiedBreweryDto>>>> GetLocationsWithinRange(
public async Task<ActionResult<ResponseBody<IEnumerable<BreweryWithLocationDto>>>> GetLocationsWithinRange(
[FromQuery] double latitude,
[FromQuery] double longitude,
[FromQuery] double rangeInMetres
)
{
IEnumerable<SimplifiedBreweryDto> breweries = await mediator.Send(
IEnumerable<BreweryWithLocationDto> breweries = await mediator.Send(
new GetBreweryLocationsWithinRangeQuery(latitude, longitude, rangeInMetres)
);
return Ok(
new ResponseBody<IEnumerable<SimplifiedBreweryDto>>
new ResponseBody<IEnumerable<BreweryWithLocationDto>>
{
Message = "Brewery locations retrieved successfully.",
Payload = breweries,
@@ -113,10 +113,17 @@ public class BreweryController(IMediator mediator) : ControllerBase
/// <returns><c>201 Created</c> with the newly created brewery.</returns>
[HttpPost]
public async Task<ActionResult<ResponseBody<BreweryDto>>> Create(
[FromBody] CreateBreweryCommand command
[FromBody] CreateBreweryRequest request
)
{
BreweryDto brewery = await mediator.Send(command);
BreweryDto brewery = await mediator.Send(
new CreateBreweryCommand(
User.GetAuthenticatedUserId(),
request.BreweryName,
request.Description,
request.Location
)
);
return Created(
$"/api/brewery/{brewery.BreweryPostId}",
new ResponseBody<BreweryDto>
@@ -128,27 +135,37 @@ public class BreweryController(IMediator mediator) : ControllerBase
}
/// <summary>Updates an existing brewery post.</summary>
/// <param name="id">Must match <paramref name="command" />'s <c>BreweryPostId</c>.</param>
/// <param name="id">Must match <paramref name="request" />'s <c>BreweryPostId</c>.</param>
/// <returns>
/// <c>200 OK</c> with the updated brewery; <c>400 Bad Request</c> if the route ID does not match the
/// payload ID; <c>404 Not Found</c> if the brewery or its <c>CityId</c> does not exist; or
/// <c>409 Conflict</c> if the brewery was modified since <c>command.RowVersion</c> was read.
/// <c>409 Conflict</c> if the brewery was modified since <c>request.RowVersion</c> was read.
/// </returns>
[HttpPut("{id:guid}")]
public async Task<ActionResult<ResponseBody<BreweryDto>>> Update(
Guid id,
[FromBody] UpdateBreweryCommand command
[FromBody] UpdateBreweryRequest request
)
{
if (command.BreweryPostId != id)
if (request.BreweryPostId != id)
return BadRequest(new ResponseBody { Message = "Route ID does not match payload ID." });
BreweryDto brewery = await mediator.Send(command);
BreweryDto breweryUpdated = await mediator.Send(
new UpdateBreweryCommand(
request.BreweryPostId,
User.GetAuthenticatedUserId(),
request.RowVersion,
request.BreweryName,
request.Description,
request.Location
)
);
return Ok(
new ResponseBody<BreweryDto>
{
Message = "Brewery updated successfully.",
Payload = brewery,
Payload = breweryUpdated,
}
);
}
@@ -158,7 +175,7 @@ public class BreweryController(IMediator mediator) : ControllerBase
[HttpDelete("{id:guid}")]
public async Task<ActionResult<ResponseBody>> Delete(Guid id)
{
await mediator.Send(new DeleteBreweryCommand(id));
await mediator.Send(new DeleteBreweryCommand(id, User.GetAuthenticatedUserId()));
return Ok(new ResponseBody { Message = "Brewery deleted successfully." });
}
}
}

2
web/backend/Features/Features.Breweries/Dtos/BreweryDto.cs
View File

@@ -36,7 +36,7 @@ public record BreweryDto(
/// The distance, in metres, from a query's origin point, or <see langword="null"/> for queries with no
/// origin point (e.g. <c>GET /api/brewery/locations</c>).
/// </param>
public record SimplifiedBreweryDto(
public record BreweryWithLocationDto(
Guid BreweryPostId,
string BreweryName,
BreweryLocationDto? Location,

4
web/backend/Features/Features.Breweries/Dtos/BreweryDtoMapper.cs
View File

@@ -45,9 +45,9 @@ public static class BreweryDtoMapper
/// Converts a <see cref="BreweryPost" /> to its simplified DTO representation, used for
/// location-based queries that only need identifying and location details.
/// </summary>
public static SimplifiedBreweryDto ToSimplifiedDto(this BreweryPost brewery)
public static BreweryWithLocationDto ToSimplifiedDto(this BreweryPost brewery)
{
return new SimplifiedBreweryDto(
return new BreweryWithLocationDto(
BreweryPostId: brewery.BreweryPostId,
BreweryName: brewery.BreweryName,
Location: brewery.Location is null

4
web/backend/Features/Features.Breweries/Queries/GetAllBreweryLocations/GetAllBreweryLocationsHandler.cs
View File

@@ -7,10 +7,10 @@ namespace Features.Breweries.Queries.GetAllBreweryLocations;
/// <summary>Handles <see cref="GetAllBreweryLocationsQuery" /> by retrieving all located brewery posts.</summary>
public class GetAllBreweryLocationsHandler(IBreweryRepository repository)
: IRequestHandler<GetAllBreweryLocationsQuery, IEnumerable<SimplifiedBreweryDto>>
: IRequestHandler<GetAllBreweryLocationsQuery, IEnumerable<BreweryWithLocationDto>>
{
/// <summary>Retrieves every brewery post that has a set location.</summary>
public async Task<IEnumerable<SimplifiedBreweryDto>> Handle(
public async Task<IEnumerable<BreweryWithLocationDto>> Handle(
GetAllBreweryLocationsQuery request,
CancellationToken cancellationToken
)

2
web/backend/Features/Features.Breweries/Queries/GetAllBreweryLocations/GetAllBreweryLocationsQuery.cs
View File

@@ -7,4 +7,4 @@ namespace Features.Breweries.Queries.GetAllBreweryLocations;
/// Retrieves all brewery posts that have a set location. Bound directly from
/// <c>GET /api/brewery/locations</c>.
/// </summary>
public record GetAllBreweryLocationsQuery : IRequest<IEnumerable<SimplifiedBreweryDto>>;
public record GetAllBreweryLocationsQuery : IRequest<IEnumerable<BreweryWithLocationDto>>;

2
web/backend/Features/Features.Breweries/Queries/GetBreweryById/GetBreweryByIdHandler.cs
View File

@@ -15,7 +15,7 @@ public class GetBreweryByIdHandler(IBreweryRepository repository)
CancellationToken cancellationToken
)
{
BreweryPost? brewery = await repository.GetByIdAsync(request.BreweryPostId);
BreweryPost? brewery = await repository.GetByIdAsync(request.BreweryPostId, cancellationToken);
return brewery?.ToDto();
}
}

4
web/backend/Features/Features.Breweries/Queries/GetBreweryLocationsWithinRange/GetBreweryLocationsWithinRangeHandler.cs
View File

@@ -9,10 +9,10 @@ namespace Features.Breweries.Queries.GetBreweryLocationsWithinRange;
/// Handles <see cref="GetBreweryLocationsWithinRangeQuery" /> by retrieving nearby located brewery posts.
/// </summary>
public class GetBreweryLocationsWithinRangeHandler(IBreweryRepository repository)
: IRequestHandler<GetBreweryLocationsWithinRangeQuery, IEnumerable<SimplifiedBreweryDto>>
: IRequestHandler<GetBreweryLocationsWithinRangeQuery, IEnumerable<BreweryWithLocationDto>>
{
/// <summary>Retrieves brewery posts within range of the requested coordinates, nearest first.</summary>
public async Task<IEnumerable<SimplifiedBreweryDto>> Handle(
public async Task<IEnumerable<BreweryWithLocationDto>> Handle(
GetBreweryLocationsWithinRangeQuery request,
CancellationToken cancellationToken
)

2
web/backend/Features/Features.Breweries/Queries/GetBreweryLocationsWithinRange/GetBreweryLocationsWithinRangeQuery.cs
View File

@@ -12,4 +12,4 @@ namespace Features.Breweries.Queries.GetBreweryLocationsWithinRange;
/// <param name="Longitude">The origin longitude, in decimal degrees.</param>
/// <param name="RangeInMetres">The maximum distance, in metres, from the origin coordinates.</param>
public record GetBreweryLocationsWithinRangeQuery(double Latitude, double Longitude, double RangeInMetres)
: IRequest<IEnumerable<SimplifiedBreweryDto>>;
: IRequest<IEnumerable<BreweryWithLocationDto>>;

24
web/backend/Features/Features.Breweries/Repository/BreweryOwnershipExtensions.cs Normal file
View File

@@ -0,0 +1,24 @@
using Domain.Exceptions;
namespace Features.Breweries.Repository;
/// <summary>Shared ownership check for commands that mutate a specific brewery post.</summary>
public static class BreweryOwnershipExtensions
{
/// <exception cref="Domain.Exceptions.NotFoundException">Thrown when no brewery exists with the given ID.</exception>
/// <exception cref="Domain.Exceptions.ForbiddenException">Thrown when <paramref name="requestingUserId" /> did not post the brewery.</exception>
public static async Task EnsureCallerOwnsBreweryAsync(
this IBreweryRepository repository,
Guid breweryPostId,
Guid requestingUserId,
CancellationToken cancellationToken
)
{
Guid postedById =
await repository.GetPostedByIdAsync(breweryPostId, cancellationToken)
?? throw new NotFoundException($"Brewery with ID {breweryPostId} not found.");
if (postedById != requestingUserId)
throw new ForbiddenException("You are not authorized to modify this brewery.");
}
}

131
web/backend/Features/Features.Breweries/Repository/BreweryRepository.cs
View File

@@ -28,7 +28,7 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
}
/// <inheritdoc/>
public async Task<BreweryPost?> GetByIdAsync(Guid id)
public async Task<BreweryPost?> GetByIdAsync(Guid id, CancellationToken cancellationToken = default)
{
await using DbConnection connection = await CreateConnection();
IEnumerable<BreweryPost> results = await connection.QueryAsync<
@@ -39,43 +39,59 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
Country,
BreweryPost
>(
"""
SELECT
bp.BreweryPostID,
bp.PostedByID,
bp.BreweryName,
bp.Description,
bp.CreatedAt,
bp.UpdatedAt,
bp.RowVersion,
bpl.BreweryPostLocationID,
bpl.AddressLine1,
bpl.AddressLine2,
bpl.PostalCode,
CONVERT(varbinary(max), bpl.Coordinates) AS Coordinates,
c.CityID,
c.CityName,
sp.StateProvinceID,
sp.StateProvinceName,
sp.ISO3166_2 AS Iso31662,
co.CountryID,
co.CountryName,
co.ISO3166_1 AS Iso31661
FROM dbo.BreweryPost bp
LEFT JOIN dbo.BreweryPostLocation bpl ON bp.BreweryPostID = bpl.BreweryPostID
LEFT JOIN dbo.City c ON bpl.CityID = c.CityID
LEFT JOIN dbo.StateProvince sp ON c.StateProvinceID = sp.StateProvinceID
LEFT JOIN dbo.Country co ON sp.CountryID = co.CountryID
WHERE bp.BreweryPostID = @BreweryPostId
""",
new CommandDefinition(
"""
SELECT
bp.BreweryPostID,
bp.PostedByID,
bp.BreweryName,
bp.Description,
bp.CreatedAt,
bp.UpdatedAt,
bp.RowVersion,
bpl.BreweryPostLocationID,
bpl.AddressLine1,
bpl.AddressLine2,
bpl.PostalCode,
CONVERT(varbinary(max), bpl.Coordinates) AS Coordinates,
c.CityID,
c.CityName,
sp.StateProvinceID,
sp.StateProvinceName,
sp.ISO3166_2 AS Iso31662,
co.CountryID,
co.CountryName,
co.ISO3166_1 AS Iso31661
FROM dbo.BreweryPost bp
LEFT JOIN dbo.BreweryPostLocation bpl ON bp.BreweryPostID = bpl.BreweryPostID
LEFT JOIN dbo.City c ON bpl.CityID = c.CityID
LEFT JOIN dbo.StateProvince sp ON c.StateProvinceID = sp.StateProvinceID
LEFT JOIN dbo.Country co ON sp.CountryID = co.CountryID
WHERE bp.BreweryPostID = @BreweryPostId
""",
new { BreweryPostId = id },
cancellationToken: cancellationToken
),
MapBreweryRow,
new { BreweryPostId = id },
splitOn: "BreweryPostLocationID,CityID,StateProvinceID,CountryID"
);
return results.SingleOrDefault();
}
/// <inheritdoc/>
public async Task<Guid?> GetPostedByIdAsync(Guid id, CancellationToken cancellationToken = default)
{
await using DbConnection connection = await CreateConnection();
return await connection.ExecuteScalarAsync<Guid?>(
new CommandDefinition(
"SELECT PostedByID FROM dbo.BreweryPost WHERE BreweryPostID = @BreweryPostId",
new { BreweryPostId = id },
cancellationToken: cancellationToken
)
);
}
/// <inheritdoc/>
public async Task<IEnumerable<BreweryPost>> GetAllAsync(int? limit, int? offset)
{
@@ -221,10 +237,10 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
}
/// <inheritdoc/>
public async Task<BreweryPost> UpdateAsync(BreweryPost brewery)
public async Task<BreweryPost> UpdateAsync(BreweryPost brewery, CancellationToken cancellationToken = default)
{
await using DbConnection connection = await CreateConnection();
await using DbTransaction transaction = await connection.BeginTransactionAsync();
await using DbTransaction transaction = await connection.BeginTransactionAsync(cancellationToken);
try
{
@@ -238,7 +254,8 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
BreweryPostID = @BreweryPostId
""",
new { brewery.BreweryPostId },
transaction
transaction,
cancellationToken: cancellationToken
)
)
is not null;
@@ -253,7 +270,8 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
new CommandDefinition(
"SELECT 1 FROM dbo.City WHERE CityID = @CityId",
new { brewery.Location.CityId },
transaction
transaction,
cancellationToken: cancellationToken
)
)
is not null;
@@ -280,7 +298,8 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
brewery.Description,
brewery.RowVersion,
},
transaction
transaction,
cancellationToken: cancellationToken
)
);
@@ -300,7 +319,8 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
WHERE BreweryPostID = @BreweryPostId
""",
new { brewery.BreweryPostId },
transaction
transaction,
cancellationToken: cancellationToken
)
);
}
@@ -315,7 +335,8 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
WHERE BreweryPostID = @BreweryPostId
""",
new { brewery.BreweryPostId },
transaction
transaction,
cancellationToken: cancellationToken
)
)
is not null;
@@ -346,7 +367,8 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
Longitude = brewery.Location.Coordinates?.Longitude,
Srid = GeographySrid,
},
transaction
transaction,
cancellationToken: cancellationToken
)
);
else
@@ -385,12 +407,13 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
Longitude = brewery.Location.Coordinates?.Longitude,
Srid = GeographySrid,
},
transaction
transaction,
cancellationToken: cancellationToken
)
);
}
await transaction.CommitAsync();
await transaction.CommitAsync(cancellationToken);
}
catch
{
@@ -398,7 +421,7 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
throw;
}
return await GetByIdAsync(brewery.BreweryPostId)
return await GetByIdAsync(brewery.BreweryPostId, cancellationToken)
?? throw new InvalidOperationException(
$"Brewery '{brewery.BreweryPostId}' was not found after a successful update."
);
@@ -542,25 +565,27 @@ public class BreweryRepository(ISqlConnectionFactory connectionFactory)
/// Composes a joined row's <see cref="BreweryPost" />, <see cref="BreweryPostLocation" />,
/// <see cref="City" />, <see cref="StateProvince" /> and <see cref="Country" /> fragments into a
/// single populated <see cref="BreweryPost" />. When the row has no location (a left-joined
/// brewery with no address on file), <paramref name="location" /> is a blank instance produced
/// from all-<c>NULL</c> columns; the schema guarantees that whenever a location row was joined
/// in, its City/StateProvince/Country chain was too.
/// brewery with no address on file), Dapper passes <see langword="null" /> for
/// <paramref name="location" /> rather than a blank instance, since its identity column
/// (<c>BreweryPostLocationID</c>) is <c>NULL</c>; the schema guarantees that whenever a location
/// row was joined in, its City/StateProvince/Country chain was too.
/// </summary>
private static BreweryPost MapBreweryRow(
BreweryPost post,
BreweryPostLocation location,
City city,
StateProvince stateProvince,
Country country
BreweryPostLocation? location,
City? city,
StateProvince? stateProvince,
Country? country
)
{
if (location.BreweryPostLocationId == Guid.Empty)
if (location is null)
return post;
stateProvince.CountryId = country.CountryId;
// The schema guarantees that whenever a location row was joined in, its City/StateProvince/
// Country chain was too, so these are never null alongside a non-null location.
city!.StateProvinceId = stateProvince!.StateProvinceId;
stateProvince.CountryId = country!.CountryId;
stateProvince.Country = country;
city.StateProvinceId = stateProvince.StateProvinceId;
city.StateProvince = stateProvince;
location.BreweryPostId = post.BreweryPostId;

10
web/backend/Features/Features.Breweries/Repository/IBreweryRepository.cs
View File

@@ -11,7 +11,13 @@ public interface IBreweryRepository
/// Retrieves a brewery post by ID, joined to its location. Returns <c>null</c> if no brewery post
/// exists with the given ID, or if it has no associated location.
/// </summary>
Task<BreweryPost?> GetByIdAsync(Guid id);
Task<BreweryPost?> GetByIdAsync(Guid id, CancellationToken cancellationToken = default);
/// <summary>
/// Retrieves the <c>PostedById</c> of the brewery post with the given ID, without joining its
/// location. Returns <c>null</c> if no brewery post exists with the given ID.
/// </summary>
Task<Guid?> GetPostedByIdAsync(Guid id, CancellationToken cancellationToken = default);
/// <summary>
/// Retrieves all brewery posts, optionally paginated, ordered by creation date descending. Posts
@@ -50,7 +56,7 @@ public interface IBreweryRepository
/// Thrown when <paramref name="brewery" />'s <c>RowVersion</c> no longer matches the stored row (it was
/// modified by another request since it was last read).
/// </exception>
Task<BreweryPost> UpdateAsync(BreweryPost brewery);
Task<BreweryPost> UpdateAsync(BreweryPost brewery, CancellationToken cancellationToken = default);
/// <summary>Deletes a brewery post by ID. Its location and photos are removed via cascading foreign keys.</summary>
/// <exception cref="Domain.Exceptions.NotFoundException">Thrown when no brewery exists with the given <paramref name="id" />.</exception>

24
web/backend/Features/Features.Users/Controllers/AuthController.cs
View File

@@ -1,5 +1,3 @@
using System.IdentityModel.Tokens.Jwt;
using Domain.Exceptions;
using Features.Auth.Commands.Account.DeleteAccount;
using Features.Auth.Commands.Account.UpdateEmail;
using Features.Auth.Commands.Account.UpdatePassword;
@@ -31,18 +29,6 @@ namespace Features.Auth.Controllers;
[Authorize(AuthenticationSchemes = "JWT")]
public class AuthController(IMediator mediator) : ControllerBase
{
/// <summary>
/// Extracts the authenticated caller's user ID from the validated access token's <c>sub</c> claim.
/// </summary>
/// <exception cref="UnauthorizedException">Thrown when the claim is missing or malformed.</exception>
private Guid GetAuthenticatedUserId()
{
string? userIdClaim = User.FindFirst(JwtRegisteredClaimNames.Sub)?.Value;
if (!Guid.TryParse(userIdClaim, out Guid userId))
throw new UnauthorizedException("Access token is missing a valid user ID claim");
return userId;
}
/// <summary>Registers a new user account.</summary>
/// <remarks>
/// Anonymous access. Returns 201 Created with the new account's ID, username, and issued tokens.
@@ -150,7 +136,7 @@ public class AuthController(IMediator mediator) : ControllerBase
)
{
UpdateUsernamePayload payload = await mediator.Send(
new UpdateUsernameCommand(GetAuthenticatedUserId(), request.NewUsername)
new UpdateUsernameCommand(User.GetAuthenticatedUserId(), request.NewUsername)
);
return Ok(
new ResponseBody<UpdateUsernamePayload>
@@ -172,7 +158,7 @@ public class AuthController(IMediator mediator) : ControllerBase
)
{
UpdateEmailPayload payload = await mediator.Send(
new UpdateEmailCommand(GetAuthenticatedUserId(), request.NewEmail)
new UpdateEmailCommand(User.GetAuthenticatedUserId(), request.NewEmail)
);
return Ok(
new ResponseBody<UpdateEmailPayload>
@@ -195,7 +181,7 @@ public class AuthController(IMediator mediator) : ControllerBase
{
UpdatePasswordPayload payload = await mediator.Send(
new UpdatePasswordCommand(
GetAuthenticatedUserId(),
User.GetAuthenticatedUserId(),
request.CurrentPassword,
request.NewPassword
)
@@ -218,7 +204,7 @@ public class AuthController(IMediator mediator) : ControllerBase
{
UpdateProfilePayload payload = await mediator.Send(
new UpdateProfileCommand(
GetAuthenticatedUserId(),
User.GetAuthenticatedUserId(),
request.FirstName,
request.LastName,
request.DateOfBirth
@@ -241,7 +227,7 @@ public class AuthController(IMediator mediator) : ControllerBase
[HttpDelete("account")]
public async Task<ActionResult<ResponseBody>> DeleteAccount()
{
await mediator.Send(new DeleteAccountCommand(GetAuthenticatedUserId()));
await mediator.Send(new DeleteAccountCommand(User.GetAuthenticatedUserId()));
return Ok(new ResponseBody { Message = "Account deleted successfully." });
}
}

21
web/backend/Shared/Shared.Contracts/ClaimsPrincipalExtensions.cs Normal file
View File

@@ -0,0 +1,21 @@
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Domain.Exceptions;
namespace Shared.Contracts;
/// <summary>Extension methods for reading well-known claims off an authenticated <see cref="ClaimsPrincipal" />.</summary>
public static class ClaimsPrincipalExtensions
{
/// <summary>
/// Extracts the authenticated caller's user ID from the validated access token's <c>sub</c> claim.
/// </summary>
/// <exception cref="UnauthorizedException">Thrown when the claim is missing or malformed.</exception>
public static Guid GetAuthenticatedUserId(this ClaimsPrincipal user)
{
string? userIdClaim = user.FindFirst(JwtRegisteredClaimNames.Sub)?.Value;
if (!Guid.TryParse(userIdClaim, out Guid userId))
throw new UnauthorizedException("Access token is missing a valid user ID claim");
return userId;
}
}

8
web/backend/Shared/Shared.Contracts/Shared.Contracts.csproj
View File

@@ -5,4 +5,12 @@
<Nullable>enable</Nullable>
<RootNamespace>Shared.Contracts</RootNamespace>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.2.1" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\..\Domain\Domain.Exceptions\Domain.Exceptions.csproj" />
</ItemGroup>
</Project>