How can I unit test an AuthorizeWhereIn attribute with Ninject - asp.net-mvc-3

Question

I'm using a custom authorisation attribute (blatantly plagiarised from another SO answer) but have hit a hurdle where I can't find a way to unit test it. Unfortunately I do need to unit test is at the same time as I invoke my controller action so I'm trying to find a way to do the Ninject dependency injection in the unit test.
The AuthorizeWhereIn attribute is:
public class AuthorizeWhereIn : AuthorizeAttribute
{
/// <summary>
/// Add the allowed roles to this property.
/// </summary>
public new HCIRoles Roles;
/// <summary>
/// Checks to see if the user is authenticated and has the
/// correct role to access a particular view.
/// </summary>
/// <param name="httpContext"></param>
/// <returns></returns>
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
if (httpContext == null)
throw new ArgumentNullException("httpContext");
// Make sure the user is authenticated.
if (!httpContext.User.Identity.IsAuthenticated)
return false;
// Get user's current roles
var roles = System.Web.Security.Roles.GetRolesForUser();
HCIRoles currentRoles = (HCIRoles)Enum.Parse(typeof(HCIRoles), string.Join(",", roles));
// Perform a bitwise operation to see if the user's role
// is in the passed in role values.
if (Roles != 0 && ((Roles & currentRoles) == 0))
return false;
return true;
}
}
The problem is the System.Web.Security.Roles.GetRolesForUser() call which isn't available in my unit test and which I want to mock any way. I can abstract that call into a separate interface and use Ninject to inject it for the web application but I can't find a way to do the same in a unit test.
So if I change the attribute to something like the below
public class AuthorizeWhereIn : AuthorizeAttribute
{
[Inject]
IRoleService RoleService { get; set; }
...
}
and my unit test code is along the lines of:
[TestMethod()]
public void IndexTest()
{
var builder = new TestControllerBuilder();
var controller = builder.CreateController<UserController>(dataLayer.Object);
var invoker = new ActionInvoker<UserController>();
var mockMembershipService = new Mock<IMembershipService>();
mockMembershipService.Setup(x => x.GetAllUsers(It.IsAny<int>(), It.IsAny<int>(), out total)).Returns(new MembershipUserCollection());
controller.MembershipService = mockMembershipService.Object;
builder.InitializeController(controller);
invoker.InvokeAction(controller.ControllerContext, x => x.Index());
}
And the controller being tested is:
[AuthorizeWhereIn(Roles = HCIRoles.Admin)]
public class UserController : BaseController
{
public ActionResult Index()
{
return View();
}
}
My question is how can I inject the RolseService depdency in the unit test given that I can't directly access the AuthroizeWhereIn attribute?
I've read and re-read the Ninject Filter extension for MVC3 http://www.planetgeek.ch/2010/11/13/official-ninject-mvc-extension-gets-support-for-mvc3/ but can't seem to apply it to this case.

Answer 1

given that I can't directly access the AuthroizeWhereIn attribute
Why not accessing it directly? That's what you are trying to test after all.
private class TestController : Controller { }
[TestMethod]
public void Test()
{
// arrange
var builder = new TestControllerBuilder();
var controller = new TestController();
builder.InitializeController(controller);
controller.ControllerContext = new ControllerContext(builder.HttpContext, new RouteData(), controller);
var httpContext = builder.HttpContext;
httpContext.Stub(x => x.Items).Return(new Hashtable());
var identity = new GenericIdentity("foo");
var roles = new string[0];
httpContext.User = new GenericPrincipal(identity, roles);
var ad = MockRepository.GeneratePartialMock<ActionDescriptor>();
var context = new AuthorizationContext(controller.ControllerContext, ad);
var sut = new AuthorizeWhereIn();
var service = MockRepository.GenerayeStub<IRoleService>();
sut.RoleService = service;
// TODO: set expectations on the service
// act
sut.OnAuthorization(context);
// assert
// TODO: assert on the type of context.Result
// If it is HttpUnauthorizedResult the authorization has failed
// (i.e. your custom AuthorizeCore method returned false)
}

Answer 2

A colleague ended up finding a clever solution using an extension method on IPrincipal. That way there's no need for dependency injection in the attribute since the HttpContext can be mocked with the Mvccontrib library.
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
if (httpContext == null)
throw new ArgumentNullException("httpContext");
// Make sure the user is authenticated.
if (!httpContext.User.Identity.IsAuthenticated)
return false;
// Get user's current roles
//var roles = System.Web.Security.Roles.GetRolesForUser();
HCIRoles currentRoles = httpContext.User.GetRoles();
// Perform a bitwise operation to see if the user's role
// is in the passed in role values.
if (Roles != 0 && ((Roles & currentRoles) == 0))
return false;
return true;
}
public static HCIRoles GetRoles(this IPrincipal user)
{
HCIRoles roles = 0;
foreach (HCIRoles r in Enum.GetValues(typeof(HCIRoles)))
{
if (user.IsInRole(r.ToString()))
roles |= r;
}
return roles;
}