Premiere commit - Omika

2026-10-23 18:46:50 +02:00
commit 8ea76c1b24
2155 changed files with 984301 additions and 0 deletions
@@ -0,0 +1,140 @@
+using Omika.Core.Observability.Identity;
+
+namespace Omika.Diagnostics.Tests;
+
+/// <summary>
+/// Tests unitaires de l'ActorKey (§19) : HMAC-SHA256 serveur, stable par
+/// (tenant, collaborateur), non réversible, fail-open. Aucune clé de production
+/// utilisée ici (clés de test déterministes uniquement).
+/// </summary>
+public class DiagnosticActorKeyTests
+{
+    private static string KeyA() => Convert.ToBase64String(new byte[32]); // 32 octets 0x00
+
+    private static string KeyB() => Convert.ToBase64String(Enumerable.Repeat((byte)7, 32).ToArray());
+
+    [Fact]
+    public void SameTenant_SameCollaborateur_ProducesSameKey()
+    {
+        var provider = new DiagnosticActorKeyProvider(KeyA());
+
+        DiagnosticActorKey a = provider.Compute("BATIK.01", "42");
+        DiagnosticActorKey b = provider.Compute("BATIK.01", "42");
+
+        Assert.True(a.HasValue);
+        Assert.Equal(a.Value, b.Value);
+        Assert.Equal(a.Version, b.Version);
+    }
+
+    [Fact]
+    public void DifferentTenant_SameCollaborateur_ProducesDifferentKey()
+    {
+        var provider = new DiagnosticActorKeyProvider(KeyA());
+
+        DiagnosticActorKey a = provider.Compute("BATIK.01", "42");
+        DiagnosticActorKey b = provider.Compute("BATIK.02", "42");
+
+        Assert.NotEqual(a.Value, b.Value);
+    }
+
+    [Fact]
+    public void SameTenant_DifferentCollaborateur_ProducesDifferentKey()
+    {
+        var provider = new DiagnosticActorKeyProvider(KeyA());
+
+        DiagnosticActorKey a = provider.Compute("BATIK.01", "42");
+        DiagnosticActorKey b = provider.Compute("BATIK.01", "43");
+
+        Assert.NotEqual(a.Value, b.Value);
+    }
+
+    [Fact]
+    public void DifferentKey_ProducesDifferentActorKey()
+    {
+        DiagnosticActorKey a = new DiagnosticActorKeyProvider(KeyA()).Compute("BATIK.01", "42");
+        DiagnosticActorKey b = new DiagnosticActorKeyProvider(KeyB()).Compute("BATIK.01", "42");
+
+        Assert.True(a.HasValue);
+        Assert.True(b.HasValue);
+        Assert.NotEqual(a.Value, b.Value);
+    }
+
+    [Fact]
+    public void ActorKey_IsHexOnly_AndContainsNoNominativeData()
+    {
+        DiagnosticActorKey key = new DiagnosticActorKeyProvider(KeyA()).Compute("BATIK.01", "42");
+
+        Assert.NotNull(key.Value);
+        Assert.Equal(64, key.Value!.Length);
+        Assert.Matches("^[0-9a-f]{64}$", key.Value);
+        Assert.DoesNotContain("42", key.Value, StringComparison.Ordinal);
+        Assert.DoesNotContain("BATIK", key.Value, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("collaborateur", key.Value, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void ActorKey_HasStableFormat_Versioned()
+    {
+        DiagnosticActorKey key = new DiagnosticActorKeyProvider(KeyA()).Compute("BATIK.01", "7");
+
+        Assert.Equal(1, key.Version);
+        Assert.NotNull(key.Value);
+        Assert.Equal(64, key.Value!.Length);
+        Assert.Equal(key.Value.ToLowerInvariant(), key.Value); // hex minuscule
+    }
+
+    [Fact]
+    public void MissingKey_IsFailOpen_ReturnsEmpty()
+    {
+        var cases = new[]
+        {
+            new DiagnosticActorKeyProvider(null),
+            new DiagnosticActorKeyProvider(string.Empty),
+            new DiagnosticActorKeyProvider("   "),
+            new DiagnosticActorKeyProvider("not-base64!!!"),
+            new DiagnosticActorKeyProvider(Convert.ToBase64String(new byte[16])) // 128 bits < 256
+        };
+
+        foreach (DiagnosticActorKeyProvider provider in cases)
+        {
+            DiagnosticActorKey key = provider.Compute("BATIK.01", "42");
+            Assert.False(key.HasValue);
+            Assert.Null(key.Value);
+            Assert.Null(key.Version);
+        }
+    }
+
+    [Fact]
+    public void MissingIdentity_IsFailOpen_ReturnsEmpty()
+    {
+        var provider = new DiagnosticActorKeyProvider(KeyA());
+
+        Assert.False(provider.Compute("", "42").HasValue);
+        Assert.False(provider.Compute("   ", "42").HasValue);
+        Assert.False(provider.Compute("BATIK.01", null).HasValue);
+        Assert.False(provider.Compute("BATIK.01", "").HasValue);
+        Assert.False(provider.Compute("BATIK.01", "   ").HasValue);
+    }
+
+    [Fact]
+    public void CanonicalString_IsVersionedAndDeterministic()
+    {
+        string a = DiagnosticActorKeyProvider.BuildCanonicalString(1, "BATIK.01", "42");
+        string b = DiagnosticActorKeyProvider.BuildCanonicalString(1, "BATIK.01", "42");
+
+        Assert.Equal(a, b);
+        Assert.Equal("v1|tenant:BATIK.01|collaborateur:42", a);
+    }
+
+    [Fact]
+    public void ActorKey_DoesNotRevealIdentity_WhenComparedAcrossTenants()
+    {
+        // Deux collaborateurs différents ne peuvent pas être confondus, et la clé
+        // seule ne permet pas de retrouver le CollaborateurId (§2 : non réversible).
+        var provider = new DiagnosticActorKeyProvider(KeyA());
+        DiagnosticActorKey key = provider.Compute("BATIK.01", "12345678");
+
+        Assert.NotNull(key.Value);
+        Assert.DoesNotContain("12345678", key.Value, StringComparison.Ordinal);
+    }
+}