Comprehensive test suite for SharpCoreDB.Identity - a lightweight native identity provider for SharpCoreDB.

Core functionality tests for user management and authentication:

• ✅ User creation with validation
• ✅ Duplicate username/email prevention
• ✅ Password strength validation
• ✅ User lookup (by ID, username, email)
• ✅ Case-insensitive username/email search
• ✅ Password verification
• ✅ Password change operations
• ✅ Role assignment and removal
• ✅ Multi-role management
• ✅ Sign-in with credentials
• ✅ Email confirmation tokens
• ✅ Password reset tokens

Total Tests: 24

Account lockout and security features:

• ✅ Lockout after max failed attempts
• ✅ Lockout disabled scenarios
• ✅ Failed count reset after successful login
• ✅ Lockout configuration options

Total Tests: 4

Cryptographic security tests:

• ✅ Unique salt generation
• ✅ Password verification
• ✅ Incorrect password rejection
• ✅ Empty/null password handling
• ✅ Malformed hash handling
• ✅ Variable-length password support
• ✅ Unicode character support
• ✅ Timing attack resistance

Total Tests: 8

Thread-safety and concurrent operation tests:

• ✅ Concurrent user creation (uniqueness enforcement)
• ✅ Concurrent login attempts (lockout consistency)
• ✅ Concurrent role assignments (deduplication)
• ✅ Concurrent password changes
• ✅ Concurrent searches during creates

Total Tests: 5

Database restart and durability tests:

• ✅ User data persistence after restart
• ✅ Password hash persistence
• ✅ Role assignments persistence
• ✅ Email confirmation state persistence
• ✅ Lockout state persistence
• ✅ Batch user persistence (100 users)
• ✅ Security stamp persistence
• ✅ Password change persistence

Total Tests: 8

Token generation and validation tests:

• ✅ Email confirmation token generation
• ✅ Password reset token generation
• ✅ Valid token validation
• ✅ Expired token rejection
• ✅ Cross-user token rejection
• ✅ Security stamp change invalidation
• ✅ Purpose mismatch rejection
• ✅ Malformed token handling
• ✅ Time-based token uniqueness

Total Tests: 9

1. Open Test Explorer (Test → Test Explorer)
2. Click Run All to execute all tests
3. View results in real-time

# Run all tests
dotnet test tests/SharpCoreDB.Identity.Tests/SharpCoreDB.Identity.Tests.csproj

# Run with detailed output
dotnet test tests/SharpCoreDB.Identity.Tests/SharpCoreDB.Identity.Tests.csproj --logger "console;verbosity=detailed"

# Run with code coverage
dotnet test tests/SharpCoreDB.Identity.Tests/SharpCoreDB.Identity.Tests.csproj --collect:"XPlat Code Coverage"

# Run only concurrency tests
dotnet test --filter "FullyQualifiedName~ConcurrencyTests"

# Run only persistence tests
dotnet test --filter "FullyQualifiedName~PersistenceTests"

• Framework: xUnit v3 (3.2.2) - Latest stable for .NET 10
• Test Runner: Microsoft.NET.Test.Sdk 18.6.0
• Code Coverage: coverlet.collector 10.0.1
• Target: .NET 10 / C# 14

All tests follow AAA pattern (Arrange-Act-Assert):

[Fact]
public async Task MethodName_Scenario_ExpectedBehavior()
{
    // Arrange - Set up test data and dependencies
    var user = new SharpCoreUser { UserName = "test" };

    // Act - Execute the operation
    var result = await _identityService.CreateUserAsync(user, "Password123!");

    // Assert - Verify expected outcomes
    Assert.NotNull(result);
}

1. No ASP.NET Core Identity Integration

   • Does not implement IUserStore<T>, IRoleStore<T>, etc.
   • Custom identity service instead of UserManager<T> / SignInManager<T>
   • Impact: Cannot use with AddIdentityCore() or existing Identity UI
   • Workaround: Use SharpCoreDbIdentityService directly (as shown in Examples/Web/SharpCoreDB.CrudApp)

2. No Claims Support

   • User claims not yet implemented
   • Role claims table exists but not fully utilized
   • Impact: Custom claims must be managed separately
   • Future: Planned for v2.0

3. Basic Two-Factor Authentication

   • TwoFactorEnabled flag exists but no TOTP/SMS implementation
   • Impact: 2FA must be implemented separately
   • Future: Planned for v2.0

See Examples/Web/SharpCoreDB.CrudApp for a complete Razor Pages integration:

// Startup configuration
builder.Services.AddScoped<SharpCoreDbIdentityService>();
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options => { /* ... */ });

// Controller usage
public class AccountController(SharpCoreDbIdentityService identityService) : Controller
{
    public async Task<IActionResult> Login(LoginViewModel model)
    {
        var result = await identityService.PasswordSignInAsync(
            model.UserName, 
            model.Password, 
            lockoutOnFailure: true);

        if (result.Succeeded)
        {
            // Sign in user with cookie authentication
        }
    }
}

(Run dotnet test --filter "FullyQualifiedName~PasswordHasherTests" --logger "console;verbosity=detailed" to measure)

• Password Hashing: ~50-100ms (PBKDF2 with 10,000 iterations)
• User Creation: <10ms (including hash generation)
• User Lookup: <5ms
• Role Assignment: <5ms
• Concurrent Operations: Linear scaling up to 50 threads

When adding new tests:

1. Follow xUnit v3 conventions (never use v2)
2. Use AAA pattern for clarity
3. Use IDisposable for cleanup
4. Name tests: MethodName_Scenario_ExpectedBehavior
5. Add copyright header
6. Update this README with new test counts

MIT License - See root LICENSE file for details.

Last Updated: 2026-03-09
Test Framework: xUnit v3.2.2
Target Framework: .NET 10.0
Language: C# 14