Premiere commit - Omika

2026-10-23 18:46:50 +02:00
commit 8ea76c1b24
2155 changed files with 984301 additions and 0 deletions
@@ -0,0 +1,624 @@
+using System.Net;
+using System.Net.Http.Json;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using Omika.Api.Services;
+using Omika.Core.Abstractions;
+using Omika.Core.Compatibility;
+using Omika.Core.Constants;
+using Omika.Core.Contracts.Mobile.License;
+using Omika.Core.Contracts.Security;
+using Omika.Core.Domain.Entities.Mobile;
+using Omika.Core.Domain.Entities.Security;
+using Omika.Core.Interfaces;
+using Omika.Core.Interfaces.Mobile;
+using Omika.Core.Runtime;
+using Omika.Data.Configuration;
+using Omika.Data.Connection;
+using Omika.Data.Runtime;
+
+namespace Omika.Tests.Api;
+
+/// <summary>
+/// Tests HTTP de l'endpoint d'authentification Back-Office WinDev
+/// (POST /api/backoffice/auth/token).
+///
+/// Vérifie le contrat complet : codes HTTP, émission du Bearer token via le
+/// mécanisme normal (ITokenService / MobileAuthMiddleware), contrôle d'accès
+/// Back-Office (CO_AccesBO / UT_AccesBO), code client, et séparation avec le
+/// droit A.LIC.MOB (qui n'est pas une condition d'émission du token).
+///
+/// Le hash utilisé est un placeholder volontairement faux : aucun vrai hash ni
+/// vrai token n'apparaît dans ces tests.
+/// </summary>
+[Collection("ApplicationRuntimeContext")]
+public class BackOfficeAuthEndpointsTests : IDisposable
+{
+    private const string SigningKey = "test-signing-key-for-integration-tests-only";
+    private const string CodeClient = "BATIK.01";
+    private const string ValidLogin = "DFO";
+    private const string ValidHash = "FAKE-HASH-0123456789ABCDEF0123456789ABCDEF";
+    private const long ValidUserId = 42;
+    private const long ValidCollaborateurId = 7;
+
+    private readonly FakeBackOfficeAuthRepository _authRepository = new();
+    private readonly FakeLicenceRepository _licenceRepository = new();
+    private readonly FakeLicenseService _licenseService = new();
+    private readonly FakePermissionService _permissionService = new();
+    private readonly WebApplicationFactory<Program> _factory;
+
+    public BackOfficeAuthEndpointsTests()
+    {
+        ApplicationRuntimeContext.Reset();
+
+        _factory = new WebApplicationFactory<Program>()
+            .WithWebHostBuilder(builder =>
+            {
+                builder.ConfigureServices(services =>
+                {
+                    var config = new ConfigurationBuilder()
+                        .AddInMemoryCollection(new Dictionary<string, string?>
+                        {
+                            ["Hfsql:Server"] = "test-server",
+                            ["Hfsql:DatabaseName"] = "test-db",
+                            ["MobileAuth:SigningKey"] = SigningKey
+                        })
+                        .Build();
+                    services.AddSingleton<IConfiguration>(config);
+
+                    services.RemoveAll<IDatabaseRuntimeInitializer>();
+                    services.AddScoped<IDatabaseRuntimeInitializer, FakeRuntimeInitializer>();
+
+                    services.RemoveAll<IHfsqlConnection>();
+                    services.AddScoped<IHfsqlConnection, FakeHfsqlConnection>();
+
+                    services.RemoveAll<IBackOfficeAuthRepository>();
+                    services.AddScoped<IBackOfficeAuthRepository>(_ => _authRepository);
+
+                    services.RemoveAll<ILicenceRepository>();
+                    services.AddScoped<ILicenceRepository>(_ => _licenceRepository);
+
+                    services.RemoveAll<ILicenseService>();
+                    services.AddScoped<ILicenseService>(_ => _licenseService);
+
+                    services.RemoveAll<IMobilePermissionService>();
+                    services.AddScoped<IMobilePermissionService>(_ => _permissionService);
+                });
+            });
+    }
+
+    public void Dispose()
+    {
+        _factory.Dispose();
+        ApplicationRuntimeContext.Reset();
+    }
+
+    // ===== 1. Authentification réussie =====
+
+    [Fact]
+    public async Task Post_ValidCredentials_WithBoAccess_Returns200_AndValidToken()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(200, (int)response.StatusCode);
+        var body = await response.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
+        Assert.NotNull(body);
+        Assert.False(string.IsNullOrWhiteSpace(body.AccessToken));
+        Assert.True(body.AccessTokenExpiresAtUtc > DateTimeOffset.UtcNow);
+        Assert.Equal(ValidUserId.ToString(), body.UserId);
+        Assert.Equal(ValidCollaborateurId.ToString(), body.CollaborateurId);
+
+        // Le token est valide et porte l'identité attendue (même mécanisme que le mobile).
+        using var scope = _factory.Services.CreateScope();
+        var tokenService = scope.ServiceProvider.GetRequiredService<ITokenService>();
+        MobileTokenIdentity identity = tokenService.ValidateToken(body.AccessToken)!;
+        Assert.NotNull(identity);
+        Assert.Equal(CodeClient, identity.CodeClient);
+        Assert.Equal(ValidUserId.ToString(), identity.UserId);
+        Assert.Equal(ValidCollaborateurId.ToString(), identity.CollaborateurId);
+    }
+
+    [Fact]
+    public async Task Post_LoginIsCaseInsensitive_Returns200()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = "dfo", // minuscules : reproduit le UPPER(UT_Login) = UPPER(login) WinDev
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(200, (int)response.StatusCode);
+    }
+
+    // ===== 2/3. Identifiants incorrects =====
+
+    [Fact]
+    public async Task Post_WrongLogin_Returns401_GenericMessage()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = "INCONNU",
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(401, (int)response.StatusCode);
+        Assert.Contains("Compte ou mot de passe incorrect.", await response.Content.ReadAsStringAsync());
+    }
+
+    [Fact]
+    public async Task Post_WrongPasswordHash_Returns401_GenericMessage()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = "AUTRE-HASH-FAUX"
+        });
+
+        Assert.Equal(401, (int)response.StatusCode);
+        Assert.Contains("Compte ou mot de passe incorrect.", await response.Content.ReadAsStringAsync());
+    }
+
+    // ===== 4. Hash vide =====
+
+    [Fact]
+    public async Task Post_EmptyPasswordHash_Returns400()
+    {
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = string.Empty
+        });
+
+        Assert.Equal(400, (int)response.StatusCode);
+    }
+
+    // ===== 5. Accès Back-Office refusé =====
+
+    [Fact]
+    public async Task Post_UserWithoutBoAccess_Returns403()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = new BackOfficeAuthUser(
+            ValidUserId, ValidLogin, ValidCollaborateurId, ValidCollaborateurId,
+            UtilisateurAccesBO: false, CollaborateurAccesBO: false, CollaborateurActif: true);
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(403, (int)response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Post_UserWithoutCollaborateur_ButUtAccesBoTrue_Returns200()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = new BackOfficeAuthUser(
+            ValidUserId, ValidLogin, CollaborateurId: 0, CollaborateurPkId: 0,
+            UtilisateurAccesBO: true, CollaborateurAccesBO: false, CollaborateurActif: false);
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(200, (int)response.StatusCode);
+    }
+
+    // ===== 6. Collaborateur lié =====
+
+    [Fact]
+    public async Task Post_LinkedCollaborateur_ReturnsCorrectUserIdAndCollaborateurId()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(200, (int)response.StatusCode);
+        var body = await response.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
+        Assert.NotNull(body);
+        Assert.Equal(ValidUserId.ToString(), body.UserId);
+        Assert.Equal(ValidCollaborateurId.ToString(), body.CollaborateurId);
+    }
+
+    // ===== 7. Utilisateur sans collaborateur =====
+
+    [Fact]
+    public async Task Post_UserWithoutCollaborateur_ReturnsNullCollaborateurId()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = new BackOfficeAuthUser(
+            ValidUserId, ValidLogin, CollaborateurId: 0, CollaborateurPkId: 0,
+            UtilisateurAccesBO: true, CollaborateurAccesBO: false, CollaborateurActif: false);
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(200, (int)response.StatusCode);
+        var body = await response.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
+        Assert.NotNull(body);
+        Assert.Equal(ValidUserId.ToString(), body.UserId);
+        Assert.Null(body.CollaborateurId);
+    }
+
+    // ===== 8/9. Code client =====
+
+    [Fact]
+    public async Task Post_EmptyCodeClient_Returns400()
+    {
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = string.Empty,
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(400, (int)response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Post_UnknownCodeClient_Returns400()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = null; // client inconnu côté serveur
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = "INCONNU.99",
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(400, (int)response.StatusCode);
+    }
+
+    // ===== 10/11/12. Token accepté par MobileAuthMiddleware + A.LIC.MOB =====
+
+    [Fact]
+    public async Task Post_ReturnedToken_IsAcceptedByMobileAuthMiddleware_OnProtectedEndpoint()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        _permissionService.Permissions[MobilePermissionKeys.LicenceMobile] = true;
+        _licenseService.GetResult = new CollaborateurLicenceDto
+        {
+            Numero = "LIC-001",
+            CodeClient = CodeClient,
+            Active = true,
+            QrCode = "omika-enroll-v1:cGF5bG9hZA.sig"
+        };
+
+        var client = _factory.CreateClient();
+
+        // 1. Obtention du token Back-Office.
+        var authResponse = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+        Assert.Equal(200, (int)authResponse.StatusCode);
+        var session = await authResponse.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
+        Assert.NotNull(session);
+        Assert.False(string.IsNullOrWhiteSpace(session.AccessToken));
+
+        // 2. Le token est accepté par MobileAuthMiddleware sur un endpoint protégé.
+        var protectedClient = _factory.CreateClient();
+        protectedClient.DefaultRequestHeaders.Authorization =
+            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", session.AccessToken);
+
+        var protectedResponse = await protectedClient.GetAsync(
+            $"/collaborateurs/{ValidCollaborateurId}/licence-mobile");
+
+        Assert.Equal(200, (int)protectedResponse.StatusCode);
+    }
+
+    [Fact]
+    public async Task Post_UserWithLicenceMobilePermission_CanAccessLicenceMobileEndpoint()
+    {
+        _permissionService.Permissions[MobilePermissionKeys.LicenceMobile] = true;
+        _licenseService.GetResult = new CollaborateurLicenceDto
+        {
+            Numero = "LIC-002",
+            CodeClient = CodeClient,
+            Active = true,
+            QrCode = "omika-enroll-v1:cGF5bG9hZA.sig"
+        };
+
+        string token = await ObtainTokenAsync();
+
+        var client = _factory.CreateClient();
+        client.DefaultRequestHeaders.Authorization =
+            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+        var response = await client.GetAsync($"/collaborateurs/{ValidCollaborateurId}/licence-mobile");
+
+        Assert.Equal(200, (int)response.StatusCode);
+        Assert.Equal(CodeClient, _licenseService.LastCodeClient);
+    }
+
+    [Fact]
+    public async Task Post_UserWithoutLicenceMobilePermission_TokenCreated_ButLicenceMobileDenied()
+    {
+        _permissionService.Permissions[MobilePermissionKeys.LicenceMobile] = false;
+
+        string token = await ObtainTokenAsync();
+        Assert.False(string.IsNullOrWhiteSpace(token));
+
+        var client = _factory.CreateClient();
+        client.DefaultRequestHeaders.Authorization =
+            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+        var response = await client.GetAsync($"/collaborateurs/{ValidCollaborateurId}/licence-mobile");
+
+        Assert.Equal(401, (int)response.StatusCode);
+    }
+
+    // ===== 13. Sécurité : aucun hash/token exposé =====
+
+    [Fact]
+    public async Task ErrorResponses_DoNotContainPasswordHash()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = "INCONNU",
+            PasswordHash = ValidHash
+        });
+
+        Assert.Equal(401, (int)response.StatusCode);
+        string body = await response.Content.ReadAsStringAsync();
+        Assert.DoesNotContain(ValidHash, body);
+        Assert.DoesNotContain(ValidHash.ToLowerInvariant(), body);
+    }
+
+    // ===== Helpers =====
+
+    private async Task<string> ObtainTokenAsync()
+    {
+        _authRepository.ValidLogin = ValidLogin;
+        _authRepository.ValidHash = ValidHash;
+        _authRepository.UserToReturn = ValidUser();
+        _licenceRepository.ClientToReturn = ValidClient();
+
+        var client = _factory.CreateClient();
+        var response = await client.PostAsJsonAsync("/api/backoffice/auth/token", new BackOfficeAuthTokenRequest
+        {
+            CodeClient = CodeClient,
+            Login = ValidLogin,
+            PasswordHash = ValidHash
+        });
+        Assert.Equal(200, (int)response.StatusCode);
+        var session = await response.Content.ReadFromJsonAsync<BackOfficeAuthTokenResponse>();
+        Assert.NotNull(session);
+        return session.AccessToken;
+    }
+
+    private static BackOfficeAuthUser ValidUser() => new(
+        ValidUserId,
+        ValidLogin,
+        CollaborateurId: ValidCollaborateurId,
+        CollaborateurPkId: ValidCollaborateurId,
+        UtilisateurAccesBO: false,
+        CollaborateurAccesBO: true,
+        CollaborateurActif: true);
+
+    private static ClientBase ValidClient() => new()
+    {
+        Id = 1,
+        Code = CodeClient,
+        Nom = "Société Test"
+    };
+
+    // ===== Fakes =====
+
+    private sealed class FakeBackOfficeAuthRepository : IBackOfficeAuthRepository
+    {
+        public string ValidLogin { get; set; } = string.Empty;
+        public string ValidHash { get; set; } = string.Empty;
+        public BackOfficeAuthUser? UserToReturn { get; set; }
+
+        public Task<BackOfficeAuthUser?> GetByLoginAndPasswordHashAsync(
+            string login,
+            string passwordHash,
+            CancellationToken cancellationToken = default)
+        {
+            bool loginMatches = string.Equals(login, ValidLogin, StringComparison.OrdinalIgnoreCase);
+            bool hashMatches = string.Equals(passwordHash, ValidHash, StringComparison.Ordinal);
+
+            return Task.FromResult(loginMatches && hashMatches ? UserToReturn : null);
+        }
+    }
+
+    private sealed class FakeLicenceRepository : ILicenceRepository
+    {
+        public ClientBase? ClientToReturn { get; set; }
+
+        public Task<ClientBase?> GetClientByCodeAsync(string codeClient, CancellationToken cancellationToken = default)
+            => Task.FromResult(ClientToReturn);
+
+        public Task<Licence?> GetByNumeroAsync(string numero, CancellationToken cancellationToken = default)
+            => Task.FromResult<Licence?>(null);
+
+        public Task<Licence?> GetByNumeroAndClientAsync(string numero, string codeClient, CancellationToken cancellationToken = default)
+            => Task.FromResult<Licence?>(null);
+
+        public Task<string?> GetMobileApiUrlForClientAsync(string codeClient, CancellationToken cancellationToken = default)
+            => Task.FromResult<string?>(null);
+
+        public Task<Licence?> GetByCollaborateurAsync(long collaborateurId, CancellationToken cancellationToken = default)
+            => Task.FromResult<Licence?>(null);
+
+        public Task<Licence?> GetFreeMobileLicenceAsync(long clientId, CancellationToken cancellationToken = default)
+            => Task.FromResult<Licence?>(null);
+
+        public Task<bool> AssignMobileLicenceAsync(string numero, long userId, long collaborateurId, string? nom, string? prenom, CancellationToken cancellationToken = default)
+            => Task.FromResult(false);
+
+        public Task<bool> ReleaseMobileLicenceAsync(string numero, CancellationToken cancellationToken = default)
+            => Task.FromResult(false);
+
+        public Task<bool> AssignDeviceAsync(string numero, string deviceId, CancellationToken cancellationToken = default)
+            => Task.FromResult(false);
+
+        public Task AddHistoAsync(LicenceHistoEntry entry, CancellationToken cancellationToken = default)
+            => Task.CompletedTask;
+    }
+
+    private sealed class FakeLicenseService : ILicenseService
+    {
+        public CollaborateurLicenceDto? GetResult { get; set; }
+        public string? LastCodeClient { get; private set; }
+
+        public Task<LicenseResponse> ActivateAsync(LicenseActivateRequest request, CancellationToken cancellationToken = default)
+            => Task.FromResult(new LicenseResponse());
+
+        public Task<LicenseResponse> ValidateAsync(LicenseValidateRequest request, CancellationToken cancellationToken = default)
+            => Task.FromResult(new LicenseResponse());
+
+        public Task<CollaborateurLicenceDto?> GetMobileLicenceForCollaborateurAsync(string collaborateurId, string codeClient, CancellationToken cancellationToken = default)
+        {
+            LastCodeClient = codeClient;
+            return Task.FromResult(GetResult);
+        }
+
+        public Task<CollaborateurLicenceDto?> AssignMobileLicenceAsync(string collaborateurId, string codeClient, CancellationToken cancellationToken = default)
+        {
+            LastCodeClient = codeClient;
+            return Task.FromResult<CollaborateurLicenceDto?>(null);
+        }
+
+        public Task<bool> ReleaseMobileLicenceAsync(string collaborateurId, CancellationToken cancellationToken = default)
+            => Task.FromResult(true);
+    }
+
+    private sealed class FakePermissionService : IMobilePermissionService
+    {
+        public Dictionary<string, bool> Permissions { get; } = new();
+
+        public MobileTokenIdentity? Identity => null;
+
+        public Task<IReadOnlyDictionary<string, bool>> GetPermissionsAsync(CancellationToken cancellationToken = default)
+            => Task.FromResult<IReadOnlyDictionary<string, bool>>(Permissions);
+
+        public Task<bool> HasPermissionAsync(string key, CancellationToken cancellationToken = default)
+            => Task.FromResult(Permissions.TryGetValue(key, out bool allowed) && allowed);
+    }
+
+    private sealed class FakeRuntimeInitializer : IDatabaseRuntimeInitializer
+    {
+        public Task<Result> InitializeAsync(CancellationToken cancellationToken = default)
+        {
+            ApplicationRuntimeContext.SetDetectedVersion(DatabaseSchemaVersion.Batik);
+            return Task.FromResult(Result.Success());
+        }
+    }
+
+    private sealed class FakeHfsqlConnection : IHfsqlConnection, IDisposable
+    {
+        public HfsqlOptions Options => new();
+        public HfsqlConnectionState State => HfsqlConnectionState.Closed;
+        public void Dispose() { }
+        public Task OpenAsync(CancellationToken ct = default) => Task.CompletedTask;
+        public Task CloseAsync() => Task.CompletedTask;
+        public Task<object?> ExecuteScalarAsync(string sql, IReadOnlyList<object?>? parameters = null, CancellationToken ct = default)
+            => Task.FromResult<object?>(null);
+        public Task<int> ExecuteNonQueryAsync(string sql, IReadOnlyList<object?>? parameters = null, CancellationToken ct = default)
+            => Task.FromResult(0);
+        public Task<IReadOnlyList<IReadOnlyDictionary<string, object?>>> QueryAsync(string sql, IReadOnlyList<object?>? parameters = null, CancellationToken ct = default)
+            => Task.FromResult<IReadOnlyList<IReadOnlyDictionary<string, object?>>>([]);
+        public Task<IReadOnlyList<HfsqlColumnMetadata>> GetColumnsAsync(string tableName, CancellationToken ct = default)
+            => Task.FromResult<IReadOnlyList<HfsqlColumnMetadata>>([]);
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+}