chore: update integration tests to remove consent and HTML parsing

Author: jeastham1993

user-management/src/Stickerlandia.UserManagement.Api/Areas/Identity/Pages/Account/Register.cshtml.cs

@@ -18,7 +18,7 @@ namespace Stickerlandia.UserManagement.Api.Areas.Identity.Pages.Account;
 
 public class RegisterModel : PageModel
 {
-    private readonly RegisterCommandHandler registerCommandHandler;
+    private readonly RegisterCommandHandler _registerCommandHandler;
     private readonly SignInManager<PostgresUserAccount> _signInManager;
     private readonly UserManager<PostgresUserAccount> _userManager;
     private readonly IUserStore<PostgresUserAccount> _userStore;
@@ -39,7 +39,7 @@ public RegisterModel(
         _signInManager = signInManager;
         _logger = logger;
         _emailSender = emailSender;
-        this.registerCommandHandler = registerCommandHandler;
+        this._registerCommandHandler = registerCommandHandler;
     }
 
     /// <summary>
@@ -126,7 +126,7 @@ public async Task<IActionResult> OnPostAsync(string returnUrl = null)
         ExternalLogins = (await _signInManager.GetExternalAuthenticationSchemesAsync()).ToList();
         if (ModelState.IsValid)
         {
-            var registerResult = await registerCommandHandler.Handle(new RegisterUserCommand
+            var registerResult = await _registerCommandHandler.Handle(new RegisterUserCommand
             {
                 EmailAddress = Input.Email,
                 FirstName = Input.FirstName,

user-management/src/Stickerlandia.UserManagement.Lambda/MigrationFunction.cs

@@ -40,6 +40,8 @@ await manager.CreateAsync(new OpenIddictApplicationDescriptor
             {
                 ClientId = "web-ui",
                 ClientType = OpenIddictConstants.ClientTypes.Public,
+                // An implicit consent type is used for the web UI, meaning users will NOT be prompted to consent to requested scoipes.
+                ConsentType = OpenIddictConstants.ConsentTypes.Implicit,
                 PostLogoutRedirectUris =
                 {
                     new Uri("https://localhost:3000")

user-management/src/Stickerlandia.UserManagement.MigrationService/Worker.cs

@@ -63,6 +63,8 @@ await manager.CreateAsync(new OpenIddictApplicationDescriptor
             {
                 ClientId = "web-ui",
                 ClientType = OpenIddictConstants.ClientTypes.Public,
+                // An implicit consent type is used for the web UI, meaning users will NOT be prompted to consent to requested scoipes.
+                ConsentType = OpenIddictConstants.ConsentTypes.Implicit,
                 PostLogoutRedirectUris =
                 {
                     new Uri("https://localhost:3000")

user-management/tests/Stickerlandia.UserManagement.IntegrationTest/AccountTests.cs

@@ -88,12 +88,14 @@ public async Task WhenAUserRegistersThenCanRetrieveTheirAccountDetails()
 
         // Act
         var registerResult = await _driver.RegisterUser(emailAddress, password);
+        registerResult.Should().NotBeNull();
+        
         var loginResponse = await _driver.Login(emailAddress, password);
+        loginResponse.Should().NotBeNull();
+        
         var userAccount = await _driver.GetUserAccount(loginResponse!.AuthToken);
 
         // Assert
-        registerResult.Should().NotBeNull();
-        loginResponse.Should().NotBeNull();
         userAccount.Should().NotBeNull();
         userAccount!.EmailAddress.Should().Be(emailAddress);
     }

user-management/tests/Stickerlandia.UserManagement.IntegrationTest/Drivers/AccountDriver.cs

@@ -16,6 +16,7 @@ internal sealed class AccountDriver : IDisposable
     private readonly ITestOutputHelper _testOutputHelper;
     private readonly IMessaging _messaging;
     private readonly HttpClient _oauthClient;
+    private readonly HttpClient _httpClient;
 
     public AccountDriver(ITestOutputHelper testOutputHelper, HttpClient httpClient, IMessaging messaging, CookieContainer cookieContainer)
     {
@@ -31,10 +32,23 @@ public AccountDriver(ITestOutputHelper testOutputHelper, HttpClient httpClient,
             AllowAutoRedirect = false
         };
 
+        // Create a separate HttpClient for OAuth2.0 operations that doesn't auto-follow redirects
+        var mainHttpHandler = new HttpClientHandler()
+        {
+            CookieContainer = cookieContainer,
+            UseCookies = true,
+            CheckCertificateRevocationList = true,
+            AllowAutoRedirect = true
+        };
+        
         _oauthClient = new HttpClient(oauthHandler, true)
         {
             BaseAddress = httpClient.BaseAddress
         };
+        _httpClient = new HttpClient(mainHttpHandler, true)
+        {
+            BaseAddress = httpClient.BaseAddress
+        };
     }
 
     public async Task<RegisterResponse?> RegisterUser(string emailAddress, string password)
@@ -71,8 +85,8 @@ public AccountDriver(ITestOutputHelper testOutputHelper, HttpClient httpClient,
             _testOutputHelper.WriteLine($"Got registration page content, length: {pageContent.Length}");
 
             // Step 2: Extract all form fields, including hidden ones
-            var formFields = HtmlFormParser.ExtractFormFields(pageContent);
-            var antiForgeryToken = HtmlFormParser.ExtractAntiForgeryToken(pageContent);
+            var formFields = new Dictionary<string, string>();
+            var antiForgeryToken = FormDataExtractor.ExtractAntiForgeryToken(pageContent);
 
             _testOutputHelper.WriteLine($"Extracted {formFields.Count} form fields");
 
@@ -82,7 +96,7 @@ public AccountDriver(ITestOutputHelper testOutputHelper, HttpClient httpClient,
                 _testOutputHelper.WriteLine("Added anti-forgery token");
             }
 
-            // Step 3: Set the user registration data  
+            // Step 3: Set the user registration data
             formFields["Input.Email"] = emailAddress;
             formFields["Input.Password"] = password;
             formFields["Input.ConfirmPassword"] = password;
@@ -187,7 +201,9 @@ public AccountDriver(ITestOutputHelper testOutputHelper, HttpClient httpClient,
             // Step 4: Follow authorization flow using OAuth client (no auto-redirect)
             var authorizationResponse = await _oauthClient.GetAsync(authorizationUrl);
 
-            if (!authorizationResponse.IsSuccessStatusCode)
+            // The authorization response should return HttpStatusCode.Found (302) if successful, with the redirect location containing the authorization code.
+            // In the 'Location' header
+            if (authorizationResponse.StatusCode != HttpStatusCode.Found)
             {
                 _testOutputHelper.WriteLine($"Authorization request failed: {authorizationResponse.StatusCode}");
                 var errorContent = await authorizationResponse.Content.ReadAsStringAsync();
@@ -277,8 +293,8 @@ private async Task AuthenticateUserViaIdentityUI(string emailAddress, string pas
         var loginPageContent = await loginPageResponse.Content.ReadAsStringAsync();
 
         // Step 2: Extract form fields and anti-forgery token
-        var formFields = HtmlFormParser.ExtractFormFields(loginPageContent);
-        var antiForgeryToken = HtmlFormParser.ExtractAntiForgeryToken(loginPageContent);
+        var formFields = new Dictionary<string, string>();
+        var antiForgeryToken = FormDataExtractor.ExtractAntiForgeryToken(loginPageContent);
 
         if (antiForgeryToken != null)
         {
@@ -341,12 +357,6 @@ private static string BuildAuthorizationUrl(string codeChallenge, string state)
         // If no direct redirect, check if we need to handle a consent form
         var responseContent = await response.Content.ReadAsStringAsync();
 
-        if (IsConsentForm(responseContent))
-        {
-            _testOutputHelper.WriteLine("Consent form detected, submitting consent");
-            return await HandleConsentForm(responseContent, state);
-        }
-        
         _testOutputHelper.WriteLine("No authorization code or consent form found in response");
         _testOutputHelper.WriteLine($"Response status: {response.StatusCode}");
         _testOutputHelper.WriteLine($"Response content: {responseContent}");
@@ -515,75 +525,10 @@ private static bool HasValidationErrors(string htmlContent)
         return false;
     }
 
-    private static bool IsConsentForm(string htmlContent)
-    {
-        // Check for consent form indicators
-        return htmlContent.Contains("Allow this application to access", StringComparison.OrdinalIgnoreCase) ||
-               htmlContent.Contains("consent", StringComparison.OrdinalIgnoreCase) ||
-               htmlContent.Contains("Grant access", StringComparison.OrdinalIgnoreCase) ||
-               htmlContent.Contains("Authorize", StringComparison.OrdinalIgnoreCase) ||
-               htmlContent.Contains("name=\"submit.Allow\"", StringComparison.OrdinalIgnoreCase);
-    }
-    
-    private async Task<string?> HandleConsentForm(string consentFormHtml, string state)
-    {
-        try
-        {
-            // Extract form fields from the consent form
-            var formFields = HtmlFormParser.ExtractFormFields(consentFormHtml);
-            var formAction = HtmlFormParser.ExtractFormAction(consentFormHtml);
-            var antiForgeryToken = HtmlFormParser.ExtractAntiForgeryToken(consentFormHtml);
-            
-            if (antiForgeryToken != null)
-            {
-                formFields["__RequestVerificationToken"] = antiForgeryToken;
-            }
-            
-            // Add consent approval
-            formFields["submit.Accept"] = "Accept";
-            formFields.Remove("submit.Deny"); // Remove deny if present
-            
-            // Determine the form action URL
-            var actionUrl = string.IsNullOrEmpty(formAction) ? TestConstants.AuthorizeEndpoint : formAction;
-            
-            _testOutputHelper.WriteLine($"Submitting consent form to: {actionUrl}");
-            
-            // Submit the consent form using OAuth client (no auto-redirect)
-            using var consentContent = new FormUrlEncodedContent(formFields);
-            var consentResponse = await _oauthClient.PostAsync(actionUrl, consentContent);
-            
-            if (consentResponse.StatusCode == HttpStatusCode.Redirect)
-            {
-                _testOutputHelper.WriteLine("Consent approved - got redirect response");
-                return await ExtractAuthorizationCode(consentResponse);
-            }
-            
-            var consentResponseContent = await consentResponse.Content.ReadAsStringAsync();
-            _testOutputHelper.WriteLine($"Unexpected consent response: {consentResponse.StatusCode}");
-            _testOutputHelper.WriteLine($"Content: {consentResponseContent}");
-            
-            return null;
-        }
-        catch (HttpRequestException ex)
-        {
-            _testOutputHelper.WriteLine($"HTTP error handling consent form: {ex.Message}");
-            return null;
-        }
-        catch (InvalidOperationException ex)
-        {
-            _testOutputHelper.WriteLine($"Invalid operation error handling consent form: {ex.Message}");
-            return null;
-        }
-        catch (JsonException ex)
-        {
-            _testOutputHelper.WriteLine($"JSON parsing error handling consent form: {ex.Message}");
-            return null;
-        }
-    }
-    
     public void Dispose()
     {
         _oauthClient?.Dispose();
+        _httpClient?.Dispose();
         GC.SuppressFinalize(this);
     }
 }

user-management/tests/Stickerlandia.UserManagement.IntegrationTest/Drivers/FormDataExtractor.cs

@@ -0,0 +1,17 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2025 Datadog, Inc.
+
+using System.Text.RegularExpressions;
+
+namespace Stickerlandia.UserManagement.IntegrationTest.Drivers;
+
+internal static class FormDataExtractor
+{
+    public static string? ExtractAntiForgeryToken(string html)
+    {
+        var tokenPattern = @"<input[^>]*name=""__RequestVerificationToken""[^>]*value=""([^""]+)""[^>]*>";
+        var match = Regex.Match(html, tokenPattern, RegexOptions.IgnoreCase);
+        return match.Success ? match.Groups[1].Value : null;
+    }
+}