Added configurable assertions (#12)

* Added two assertion delegates to assert (un)authorized results

* Version bump

Author: wcabus

src/JWTGuard.Template.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <PackageType>Template</PackageType>
-    <PackageVersion>1.0.1</PackageVersion>
+    <PackageVersion>1.1.0</PackageVersion>
     <PackageId>JWTGuard.Template</PackageId>
     <Title>JWT Guard Test Suite</Title>
     <Authors>Wesley Cabus</Authors>

src/JWTGuard/TestSettings.cs

@@ -1,5 +1,6 @@
 using Duende.IdentityServer.Test;
 using Microsoft.IdentityModel.Tokens;
+using Xunit;
 
 namespace JWTGuard;
 
@@ -18,7 +19,8 @@ static TestSettings()
         // {
         //     TargetUrl = "/your-api-target-endpoint",
         //     DefaultAudience = "my-api",
-        //     AllowedAudiences = ["my-api"]
+        //     AllowedAudiences = ["my-api"],
+        //     AssertAuthorizedResponse = response => Assert.Equal(StatusCodes.Status204NoContent, (int)response.StatusCode)
         // };
     }
 
@@ -83,6 +85,22 @@ public TestSettings()
     /// The default target API endpoint to test. Defaults to "/weatherforecast".
     /// </summary>
     public string TargetUrl { get; init; } = "/weatherforecast";
+
+    /// <summary>
+    /// The default assertion to verify an authorized HTTP response was returned by the API.<br/>
+    /// <br/>
+    /// Defaults to verifying the API returned a <c>200 OK</c> status code. 
+    /// </summary>
+    public Action<HttpResponseMessage> AssertAuthorizedResponse { get; init; } = 
+        response => Assert.Equal(StatusCodes.Status200OK, (int)response.StatusCode);
+    
+    /// <summary>
+    /// The default assertion to verify an unauthorized HTTP response was returned by the API.<br/>
+    /// <br/>
+    /// Defaults to verifying the API returned a <c>401 Unauthorized</c> status code. 
+    /// </summary>
+    public Action<HttpResponseMessage> AssertUnauthorizedResponse { get; init; } =
+        response => Assert.Equal(StatusCodes.Status401Unauthorized, (int)response.StatusCode);
 
     /// <summary>
     /// The default test user. Defaults to a user with subject ID "1", username "alice", and password "password".

src/JWTGuard/Tests/AudienceTests.cs

@@ -30,7 +30,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Authorized_For_Allowed_Audiences(
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.NotEqual(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertAuthorizedResponse(response);
     }
 
     [Theory(DisplayName = "When a token uses disallowed values for the audience claim, the API should return a 401 Unauthorized response.")]
@@ -51,7 +51,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Unauthorized_For_Disallowed_Audie
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertUnauthorizedResponse(response);
     }
 
     private Task<string> GetJwtAsync(string audience)

src/JWTGuard/Tests/ExternalSignatureTests.cs

@@ -26,7 +26,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Unauthorized_For_External_WebKey_
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertUnauthorizedResponse(response);
     }
 
     [Fact(DisplayName = "When using an external JSON Web Key by specifying the 'jwk' claim in the token, the API should return a 401 Unauthorized response.")]
@@ -40,7 +40,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Unauthorized_For_External_WebKey_
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertUnauthorizedResponse(response);
     }
 
     [Fact(DisplayName = "When using an external certificate by specifying the 'x5u' claim in the token, the API should return a 401 Unauthorized response.")]
@@ -54,7 +54,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Unauthorized_For_External_Certifi
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertUnauthorizedResponse(response);
     }
 
     [Fact(DisplayName = "When using an external certificate by specifying the 'x5c' claim in the token, the API should return a 401 Unauthorized response.")]
@@ -68,7 +68,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Unauthorized_For_External_Certifi
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertUnauthorizedResponse(response);
     }
 
     private string GetJwt(ExternalSignatureTestCase testCase)

src/JWTGuard/Tests/IssuerTests.cs

@@ -30,7 +30,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Authorized_For_Allowed_Issuer(str
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.NotEqual(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertAuthorizedResponse(response);
     }
 
     [Theory(DisplayName = "When a token uses disallowed values for the issuer claim, the API should return a 401 Unauthorized response.")]
@@ -51,7 +51,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Unauthorized_For_Disallowed_Issue
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertUnauthorizedResponse(response);
     }
 
     private Task<string> GetJwtAsync(string issuer)

src/JWTGuard/Tests/JwtTypeTests.cs

@@ -30,7 +30,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Authorized_For_Valid_JWT_Types(st
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.NotEqual(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertAuthorizedResponse(response);
     }
 
     [Theory(DisplayName = "When a token uses an unexpected token type, the API should return a 401 Unauthorized response.")]
@@ -51,7 +51,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Unauthorized_For_Invalid_JWT_Type
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertUnauthorizedResponse(response);
     }
 
     private Task<string> GetJwtAsync(string tokenType)

src/JWTGuard/Tests/SignatureAlgorithmTests.cs

@@ -30,7 +30,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Authorized_For_Supported_Signatur
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.NotEqual(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertAuthorizedResponse(response);
     }
 
     [Theory(DisplayName = "When a token uses an unsupported signature algorithm, the API should return a 401 Unauthorized response.")]
@@ -51,7 +51,7 @@ internal async Task Accessing_AuthorizedUrl_Is_Unauthorized_For_Unsupported_Sign
         var response = await Client.GetAsync(TestSettings.CurrentTestSettings.TargetUrl);
 
         // Assert
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        TestSettings.CurrentTestSettings.AssertUnauthorizedResponse(response);
     }
 
     private Task<string> GetJwtAsync(string signatureAlgorithm)