feat(push): add service-owned firebase channels and delivery

Add push contracts, provider delivery and channel diagnostics. Link email channels to services and document migration and validation. Ref: IT-1074
2026-10-24 12:31:35 +03:00
parent b30dba93e8
commit 1631786ce2
105 changed files with 3838 additions and 147 deletions
@@ -0,0 +1,96 @@
+using System.Security.Cryptography;
+using System.Text.Json;
+using HrynCo.NotificationService.DAL.Abstract.Push;
+using HrynCo.NotificationService.DAL.Abstract.PushChannels;
+using HrynCo.NotificationService.Worker.Services.Push;
+using NSubstitute;
+
+namespace HrynCo.NotificationService.Services.Tests.Push;
+
+public sealed class PushChannelTestServiceTests
+{
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task UsesSavedCredentialsWithoutSavingTokenAndSeparatesAuthorizationFromSend(bool send)
+    {
+        var channels = Substitute.For<IPushChannelRepository>();
+        var firebase = Client();
+        var id = Guid.NewGuid();
+        channels.GetByIdAsync(id, Arg.Any<CancellationToken>()).Returns(new PushChannel
+        { Id = id, ServiceId = Guid.NewGuid(), FirebaseProjectId = "test-project", IsActive = false });
+        channels.GetCredentialsAsync(id, Arg.Any<CancellationToken>()).Returns(Credentials());
+        var outcome = await new PushChannelTestService(channels, firebase).TestAsync(new PushChannelTestSettings
+        { ChannelId = id, FirebaseProjectId = "test-project", RecipientToken = send ? "test-token" : null }, send, default);
+        Assert.Null(outcome.Error);
+        await firebase.Received(send ? 1 : 0).SendTestAsync("test-token", Arg.Any<FirebaseServiceAccountCredentials>(), Arg.Any<CancellationToken>());
+        await firebase.Received(send ? 0 : 1).CheckAuthorizationAsync(Arg.Any<FirebaseServiceAccountCredentials>(), Arg.Any<CancellationToken>());
+        await channels.DidNotReceiveWithAnyArgs().SaveAsync(default!, default!, default, default);
+    }
+
+    [Fact]
+    public async Task UnsavedCredentialsOverrideSavedConfiguration()
+    {
+        var channels = Substitute.For<IPushChannelRepository>();
+        var firebase = Client();
+        var outcome = await new PushChannelTestService(channels, firebase).TestAsync(new PushChannelTestSettings
+        { ChannelId = Guid.NewGuid(), FirebaseProjectId = "test-project", CredentialsJson = Credentials() }, false, default);
+        Assert.Null(outcome.Error);
+        await channels.DidNotReceiveWithAnyArgs().GetCredentialsAsync(default, default);
+        await firebase.Received(1).CheckAuthorizationAsync(Arg.Any<FirebaseServiceAccountCredentials>(), Arg.Any<CancellationToken>());
+    }
+
+    [Theory]
+    [InlineData("changed-project")]
+    [InlineData("invalid-json")]
+    [InlineData("missing-token")]
+    [InlineData("unknown-channel")]
+    public async Task InvalidInputNeverContactsFirebase(string scenario)
+    {
+        var channels = Substitute.For<IPushChannelRepository>();
+        var firebase = Client();
+        var id = Guid.NewGuid();
+        if (scenario != "unknown-channel") channels.GetByIdAsync(id, Arg.Any<CancellationToken>()).Returns(new PushChannel
+        { Id = id, ServiceId = Guid.NewGuid(), FirebaseProjectId = "test-project" });
+        channels.GetCredentialsAsync(id, Arg.Any<CancellationToken>()).Returns(Credentials());
+        var settings = new PushChannelTestSettings
+        {
+            ChannelId = id, FirebaseProjectId = scenario == "changed-project" ? "other-project" : "test-project",
+            CredentialsJson = scenario == "invalid-json" ? "private-secret-do-not-echo" : null
+        };
+        var outcome = await new PushChannelTestService(channels, firebase).TestAsync(settings, scenario == "missing-token", default);
+        Assert.NotNull(outcome.Error);
+        Assert.DoesNotContain("private-secret-do-not-echo", outcome.Error);
+        await firebase.DidNotReceiveWithAnyArgs().CheckAuthorizationAsync(default!, default);
+        await firebase.DidNotReceiveWithAnyArgs().SendTestAsync(default!, default!, default);
+    }
+
+    [Fact]
+    public async Task RetryableProviderFailureReturnsSafeUnconfirmedResult()
+    {
+        var channels = Substitute.For<IPushChannelRepository>();
+        var firebase = Client();
+        firebase.SendTestAsync(Arg.Any<string>(), Arg.Any<FirebaseServiceAccountCredentials>(), Arg.Any<CancellationToken>())
+            .Returns(Task.FromException<PushDeliveryOutcome>(new PushRetryException(TimeSpan.FromSeconds(30))));
+        var outcome = await new PushChannelTestService(channels, firebase).TestAsync(new PushChannelTestSettings
+        { FirebaseProjectId = "test-project", CredentialsJson = Credentials(), RecipientToken = "test-token" }, true, default);
+        Assert.Contains("acceptance was not confirmed", outcome.Error);
+    }
+
+    private static IFirebasePushClient Client()
+    {
+        var firebase = Substitute.For<IFirebasePushClient>();
+        firebase.CheckAuthorizationAsync(Arg.Any<FirebaseServiceAccountCredentials>(), Arg.Any<CancellationToken>())
+            .Returns(new PushDeliveryOutcome(null));
+        firebase.SendTestAsync(Arg.Any<string>(), Arg.Any<FirebaseServiceAccountCredentials>(), Arg.Any<CancellationToken>())
+            .Returns(new PushDeliveryOutcome(null));
+        return firebase;
+    }
+
+    private static string Credentials()
+    {
+        using var rsa = RSA.Create(2048);
+        return JsonSerializer.Serialize(new
+        { type = "service_account", project_id = "test-project", client_email = "test@example.invalid", private_key = rsa.ExportPkcs8PrivateKeyPem() });
+    }
+}