feat: add provider conformance fixtures and tests for identity resolution across providers by jgarverick · Pull Request #12 · aria-fx/aria

jgarverick · 2026-05-16T01:56:10Z

This pull request introduces a comprehensive, shared provider conformance test suite for identity normalization and access policy evaluation across multiple authentication providers (Entra, Okta, Auth0). It adds reusable test fixtures, standardized JSON fixture data, and shared logic to ensure that all supported providers produce consistent, normalized identity contracts used by access policy logic. The changes also refactor the EntraAuthService to support injectable token resolvers for improved testability.

Key changes include:

Shared Provider Conformance Test Infrastructure

Added ProviderConformanceFixtures.cs, which provides a reusable loader and builder for provider-specific JWT fixtures and expected normalized identity results, and exposes normalization logic for use in tests.
Added provider-conformance-fixtures.json and provider-conformance-notes.txt as standardized, documented test data and guidance for provider normalization expectations. [1] [2]

Test Coverage for Identity Normalization

Introduced AccessPolicyConformanceTests in Aria.Auth.Core.Tests, which verifies that access policy evaluation produces consistent results across providers using the shared fixtures.
Added ProviderAdapterConformanceTests in Aria.Cli.Tests, ensuring all provider adapters (Entra, Okta, Auth0) produce the expected normalized identity contract as defined in the shared fixtures.

Project and Build System Updates

Created a new test project Aria.Auth.Core.Tests with references to shared fixtures and content, and updated .csproj files in both core and CLI test projects to include or exclude test fixture files as appropriate. [1] [2] [3]

Refactoring for Testability

Refactored EntraAuthService to allow injection of a custom token resolver function, enabling deterministic testing with fixture JWTs. [1] [2]

…tion across providers

Copilot

Pull request overview

This PR adds a shared provider conformance testing setup to validate that identity normalization (and downstream access-policy evaluation) behaves consistently across Entra, Okta, and Auth0, using standardized JWT fixture data.

Changes:

Added shared provider conformance fixtures (loader + JSON fixtures + notes) and linked them into multiple test projects.
Introduced new conformance tests for provider adapters (CLI) and access-policy evaluation (auth core).
Refactored EntraAuthService to support an injectable token resolver for deterministic testing.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/aria-cli/Services/EntraAuthService.cs	Adds injectable token resolver path for deterministic identity parsing in tests.
src/aria-cli/Aria.Cli.Tests/ProviderAdapterConformanceTests.cs	New conformance test ensuring each provider adapter produces the expected normalized identity from shared fixtures.
src/aria-cli/Aria.Cli.Tests/Aria.Cli.Tests.csproj	Links shared fixture code/data into CLI test output for execution-time loading.
src/aria-auth-core/TestFixtures/ProviderConformanceFixtures.cs	Adds reusable fixture loader and JWT builder for cross-provider conformance tests.
src/aria-auth-core/TestFixtures/provider-conformance-notes.txt	Documents intended normalization expectations for the shared fixtures.
src/aria-auth-core/TestFixtures/provider-conformance-fixtures.json	Adds standardized JWT claim fixtures and expected normalized identity contracts.
src/aria-auth-core/Aria.Auth.Core.Tests/Aria.Auth.Core.Tests.csproj	New test project for auth-core access-policy conformance validation.
src/aria-auth-core/Aria.Auth.Core.Tests/AccessPolicyConformanceTests.cs	New test ensuring access-policy evaluation is consistent across provider-normalized identities.
src/aria-auth-core/Aria.Auth.Core.csproj	Excludes test/fixture sources from the core library compilation.

…s and normalization notes

jgarverick · 2026-05-16T02:03:18Z

@copilot apply changes based on the comments in this thread

…tra scopes Agent-Logs-Url: https://github.com/aria-fx/aria/sessions/01cc60b0-c135-4b44-8deb-fa34d4fed350 Co-authored-by: jgarverick <2940856+jgarverick@users.noreply.github.com>

Copilot · 2026-05-16T02:06:55Z

@copilot apply changes based on the comments in this thread

Applied the requested review-thread fixes in commit bceebc9: env-var based conformance tests now serialize access and restore previous token values, and Entra scp normalization now splits on both spaces and commas to match the documented rules. Targeted and baseline tests passed, and validation (Code Review + CodeQL) is clean.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Josh Garverick <jgarverick@github.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

+
+            Assert.NotNull(identity);
+            Assert.Equal(fixture.Expected.Provider, identity!.Provider);
+            Assert.Equal(fixture.Expected.ObjectId, identity.ObjectId);
+            Assert.Equal(fixture.Expected.TenantId, identity.TenantId);
+            Assert.Equal(fixture.Expected.UserPrincipalName, identity.UserPrincipalName);
+
+            foreach (var group in fixture.Expected.Groups)
+                Assert.Contains(group, identity.Groups);
+
+            foreach (var role in fixture.Expected.Roles)
+                Assert.Contains(role, identity.Roles);
+        }
+    }
+


+    private static async Task<ResolvedIdentity?> ResolveOktaAsync(string token)
+    {
+        await EnvironmentVariableLock.WaitAsync();
+        var previousToken = Environment.GetEnvironmentVariable("OKTA_ACCESS_TOKEN");
+        Environment.SetEnvironmentVariable("OKTA_ACCESS_TOKEN", token);
+
+        try
+        {
+            var config = new AriaConfig
+            {
+                Okta = new OktaConfig
+                {
+                    Enabled = true,
+                    Issuer = "https://example.okta.com"
+                }
+            };
+
+            var provider = new OktaIdentityProvider();
+            return await provider.GetIdentityAsync(config);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("OKTA_ACCESS_TOKEN", previousToken);
+            EnvironmentVariableLock.Release();
+        }


+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../Aria.Auth.Core.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Compile Include="../TestFixtures/ProviderConformanceFixtures.cs" Link="Shared/ProviderConformanceFixtures.cs" />
+    <Content Include="../TestFixtures/provider-conformance-fixtures.json" Link="provider-conformance-fixtures.json" CopyToOutputDirectory="PreserveNewest" />
+    <Content Include="../TestFixtures/provider-conformance-notes.txt" Link="provider-conformance-notes.txt" CopyToOutputDirectory="PreserveNewest" />
+  </ItemGroup>


…semaphore Agent-Logs-Url: https://github.com/aria-fx/aria/sessions/730ce815-f1e3-4c3b-862b-294e94adf60c Co-authored-by: jgarverick <2940856+jgarverick@users.noreply.github.com>

jgarverick · 2026-05-16T02:23:41Z

@copilot apply changes based on the comments in this thread

Agent-Logs-Url: https://github.com/aria-fx/aria/sessions/fe0258e6-597d-486d-ae21-ae2004f46f3f Co-authored-by: jgarverick <2940856+jgarverick@users.noreply.github.com>

Copilot · 2026-05-16T02:28:33Z

@copilot apply changes based on the comments in this thread

Applied all review feedback in commit 98fd083:

Changed group/role assertions from containment to set equality with case-insensitive comparison and detailed failure messages
Extended [Collection("EnvironmentVariableTests")] to Auth0IdentityProviderTests and OktaIdentityProviderTests for proper test isolation across all env-var-dependent tests
Updated CI workflow to include Aria.Auth.Core.Tests project in test execution

All tests pass and validation is clean.

feat: add provider conformance fixtures and tests for identity resolu…

224b24a

…tion across providers

jgarverick requested a review from Copilot May 16, 2026 01:57

Copilot started reviewing on behalf of jgarverick May 16, 2026 01:57 View session

Copilot AI reviewed May 16, 2026

View reviewed changes

Comment thread src/aria-cli/Aria.Cli.Tests/ProviderAdapterConformanceTests.cs

Comment thread src/aria-cli/Aria.Cli.Tests/ProviderAdapterConformanceTests.cs

Comment thread src/aria-auth-core/TestFixtures/provider-conformance-notes.txt Outdated

feat: enhance provider conformance fixtures with additional test case…

433466b

…s and normalization notes

Copilot started work on behalf of jgarverick May 16, 2026 02:03 View session

fix: serialize env-token fixture tests and support comma-delimited en…

bceebc9

…tra scopes Agent-Logs-Url: https://github.com/aria-fx/aria/sessions/01cc60b0-c135-4b44-8deb-fa34d4fed350 Co-authored-by: jgarverick <2940856+jgarverick@users.noreply.github.com>

Copilot finished work on behalf of jgarverick May 16, 2026 02:07

jgarverick requested a review from Copilot May 16, 2026 02:11

Copilot started reviewing on behalf of jgarverick May 16, 2026 02:11 View session

Potential fix for pull request finding

faacdb9

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Josh Garverick <jgarverick@github.com>

Copilot started work on behalf of jgarverick May 16, 2026 02:15 View session

Copilot AI reviewed May 16, 2026

View reviewed changes

refactor: use xUnit Collection for env-var test isolation instead of …

d32bbd3

…semaphore Agent-Logs-Url: https://github.com/aria-fx/aria/sessions/730ce815-f1e3-4c3b-862b-294e94adf60c Co-authored-by: jgarverick <2940856+jgarverick@users.noreply.github.com>

Copilot finished work on behalf of jgarverick May 16, 2026 02:20

Copilot started work on behalf of jgarverick May 16, 2026 02:23 View session

fix: improve conformance test assertions and isolation, add CI coverage

98fd083

Agent-Logs-Url: https://github.com/aria-fx/aria/sessions/fe0258e6-597d-486d-ae21-ae2004f46f3f Co-authored-by: jgarverick <2940856+jgarverick@users.noreply.github.com>

Copilot finished work on behalf of jgarverick May 16, 2026 02:29

jgarverick merged commit b4da326 into main May 16, 2026
2 checks passed

jgarverick deleted the feat/issue-7-provider-conformance-fixtures branch May 16, 2026 02:32

This was referenced May 16, 2026

[P1] Complete Okta/Auth0 identity adapters in aria-cli #6

Closed

[P1] Add shared provider conformance fixtures for auth-core and aria-cli #7

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add provider conformance fixtures and tests for identity resolution across providers#12

feat: add provider conformance fixtures and tests for identity resolution across providers#12
jgarverick merged 6 commits into
mainfrom
feat/issue-7-provider-conformance-fixtures

jgarverick commented May 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jgarverick commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jgarverick commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jgarverick commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Shared Provider Conformance Test Infrastructure

Test Coverage for Identity Normalization

Project and Build System Updates

Refactoring for Testability

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jgarverick commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

jgarverick commented May 16, 2026

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jgarverick commented May 16, 2026 •

edited

Loading