How to test component page with @attribute [Authorize...] will not render for unauthorized user?

[kwilkins]

Hello! I am relatively new to Blazor and very new to using bUnit, so apologies if this isn't the proper way to test such a thing.

I have a relatively simple component that shouldn't render itself for a user not with the admin role.

@page "/admin"
@attribute [Authorize(Roles = "admin")]

@using MSKRStudio.StandAloneWebApp.Data

<h1>Admin</h1>

<p>This component shows admin actions, but only for authorized team members!</p>

<p><em>Coming soon!</em></p>

I have written a test like so, expecting the <h1> tag to not be present. However, the entire Admin component does render for the test.

        [Fact]
        public void Test1()
        {
            using var ctx = new TestContext();
            var authContext = ctx.AddTestAuthorization();
            authContext.SetAuthorized("TEST USER", AuthorizationState.Unauthorized);
            
            var cut = ctx.RenderComponent<Admin>();

            Assert.Throws<ElementNotFoundException>(() => cut.Find("h1"));
        }

How can I go about this?

[egil]

Hi there,

bUnit doesn't look at the authorize attribute of a component. It simply renders it if you tell it to.

Testing that Blazor respects the authorize attribute would be you testing the blazor runtime, which is probably not what you want.

If you want to test that the Admin component has the authorize attribute set correctly. I would look for the attribute on the component and assert it is there with the correct/expected values, e.g.:

var actual = Attribute.GetCustomAttribute(typeof(Admin), typeof(AuthorizeAttribute)) as AuthorizeAttribute;

Assert.NotNull(actual);
Assert.Equal("admin", actual.Roles);

(completely untested code, but that should get you started).

More here: https://docs.microsoft.com/en-us/dotnet/standard/attributes/retrieving-information-stored-in-attributes

[kwilkins]

Thanks for answering! So just to understand this more, the authorize attribute here is more just metadata on this component which the blazor runtime would handle when rendering. Whereas, bUnit is just rendering the actual component code?

[egil]

Thanks for answering! So just to understand this more, the authorize attribute here is more just metadata on this component which the blazor runtime would handle when rendering. Whereas, bUnit is just rendering the actual component code?

Correct. bUnit does not inspect the attributes of a component. If you ask bUnit to render a component, it does that. I am not sure how the Blazor runtime actually decides how to not add a component to the render tree or not based on the attributes.

[kingua]

You could conceivably wrap any markup in <AuthorizeView></AuthorizeView> as well and then verify that it's not found.