Extract OpenIdConnectEvent logic into own handler

Author: andycunningham-airelogic

src/SchoolAccount.Web.Mvc/Authentication/Extensions/ServiceCollectionExtensions.cs

@@ -1,7 +1,9 @@
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using SchoolAccount.SharedKernel;
+using SchoolAccount.Web.Mvc.Authentication.Handlers;
 using SchoolAccount.Web.Mvc.Authentication.Models;
 using static SchoolAccount.Web.Mvc.Authentication.ClaimConstants;
 
@@ -54,16 +56,7 @@ IConfigurationManager configuration
                         await Task.CompletedTask;
                     },
 
-                    OnTicketReceived = context =>
-                    {
-                        var org = context.Principal?.GetOrganisation();
-                        if (org is null)
-                        {
-                            context.Response.Redirect("/error/403");
-                            context.HandleResponse();
-                        }
-                        return Task.CompletedTask;
-                    },
+                    OnTicketReceived = OpenIdConnectEventHandlers.OnTicketReceived,
 
                     // within ACA a container runs on http, though available as https publicly
                     // this causes the OIDC redirect_url to have the http protocol, rather than https

src/SchoolAccount.Web.Mvc/Authentication/Handlers/OpenIdConnectEventHandlers.cs

@@ -0,0 +1,19 @@
+using Microsoft.AspNetCore.Authentication;
+using SchoolAccount.Web.Mvc.Authentication.Extensions;
+
+namespace SchoolAccount.Web.Mvc.Authentication.Handlers;
+
+public static class OpenIdConnectEventHandlers
+{
+    public static Task OnTicketReceived(TicketReceivedContext context)
+    {
+        var org = context.Principal?.GetOrganisation();
+        if (org is null)
+        {
+            context.Response.Redirect("/error/403");
+            context.HandleResponse();
+        }
+
+        return Task.CompletedTask;
+    }
+}

src/SchoolAccount.Web.Mvc/Authentication/UserContext.cs

@@ -1,4 +1,5 @@
-using System.Security.Principal;
+using System.Globalization;
+using System.Security.Principal;
 using SchoolAccount.SharedKernel;
 using SchoolAccount.Web.Mvc.Authentication.Extensions;
 
@@ -15,7 +16,10 @@ public UserContext(IHttpContextAccessor contextAccessor)
         GivenName = user?.FindFirst(ClaimConstants.GivenName)?.Value;
         Surname = user?.FindFirst(ClaimConstants.FamilyName)?.Value;
         EmailAddress = user?.FindFirst(ClaimConstants.Email)?.Value;
-        OrganisationName = user?.GetOrganisation()?.Name;
+        OrganisationName = OrganisationName =
+            Thread.CurrentThread.CurrentCulture.TextInfo.ToTitleCase(
+                (user?.GetOrganisation()?.Name ?? string.Empty).ToLower(CultureInfo.CurrentCulture)
+            );
     }
 
     public string? GivenName { get; }

tests/SchoolAccount.IntegrationTests/Authentication/Handlers/OpenIdConnectEventHandlersTests.cs

@@ -0,0 +1,49 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
+using SchoolAccount.Web.Mvc.Authentication.Handlers;
+
+namespace SchoolAccount.IntegrationTests.Authentication.Handlers;
+
+public class OpenIdConnectEventHandlersTests
+{
+    [Fact]
+    public async Task OnTicketReceived_NoOrganisation_Redirects403()
+    {
+        var ticket = new AuthenticationTicket(new ClaimsPrincipal(new ClaimsIdentity()), "oidc");
+
+        var context = new TicketReceivedContext(
+            new DefaultHttpContext(),
+            new AuthenticationScheme("oidc", null, typeof(IAuthenticationHandler)),
+            new OpenIdConnectOptions(),
+            ticket
+        );
+
+        await OpenIdConnectEventHandlers.OnTicketReceived(context);
+
+        Assert.Equal(302, context.HttpContext.Response.StatusCode);
+        Assert.Equal("/error/403", context.HttpContext.Response.Headers.Location);
+        Assert.True(context.Result?.Handled);
+    }
+
+    [Fact]
+    public async Task OnTicketReceived_WithOrganisation_DoesNotRedirect()
+    {
+        var identity = new ClaimsIdentity();
+        identity.AddClaim(new Claim("organisation", """{"NAME":"Test School"}"""));
+
+        var ticket = new AuthenticationTicket(new ClaimsPrincipal(identity), "oidc");
+
+        var context = new TicketReceivedContext(
+            new DefaultHttpContext(),
+            new AuthenticationScheme("oidc", null, typeof(IAuthenticationHandler)),
+            new OpenIdConnectOptions(),
+            ticket
+        );
+
+        await OpenIdConnectEventHandlers.OnTicketReceived(context);
+
+        Assert.NotEqual(302, context.HttpContext.Response.StatusCode);
+        Assert.Null(context.Result);
+    }
+}