Question

I’m implementing an oauth provider using DotNetOpenAuth CTP library. So I have created an mvc3 application, which has an OAuth Controller with 3 methods in it with the purpose of authorizing third party applications. The controller has an IOAuthService which encapsulates all the logic that the library must do to complete certain tasks, however, the service methods return DotNetOpenOAuth objects that have their constructors protected.

I would like to test the behavior of the methods within my OAuthController, for this, I’m trying to mock my service methods but I havent’t been able to do this. I have to tell moq library what type of object I’m expecting the service method to return, and since I cannot access constructors of these objects, I’m not able to perform a test over my controller method.

The controller:

public class OAuthController : Controller
{
    private readonly IOAuthService _oAuthService;

    public OAuthController(IOAuthService oAuthService)
    {
        _oAuthService = oAuthService;
    }

    [Authorize, AcceptVerbs(HttpVerbs.Get | HttpVerbs.Post)]
    public ActionResult Authorize()
    {
        ClientApplication requestingClient;
        var request = _oAuthService.ReadAuthorizationRequest();
        if (request == null)
        {
            throw new HttpException((int)HttpStatusCode.BadRequest, "Missing authorization request.");
        }

        var response = _oAuthService.RequestClientAuthorization(GetIdentity().Name, out requestingClient, request);
        if (response != null)
        {
            return response.AsActionResult();
        }

        var model = new AuthorizeClientApplicationViewModel
        {
            ClientApplication = requestingClient.Name,
            Scope = request.Scope,
            AuthorizationRequest = request,
        };

        return View(model);
    }

    public virtual IIdentity GetIdentity()
    {
        return User.Identity;
    }
}

I want to test that whenever a third party app has no authorization, a view will pop up to the user asking for his permission to authorize the app. Fot this i need to mock:

• _oAuthService.RequestClientAuthorization

The setup of my test method will then look like :

var oAuthService = new Mock<IOAuthService>();
oAuthService.Setup(a => a.RequestClientAuthorization(userName, out client, pendingRequest)).Returns(new OutgoingWebResponse()); // DotNetOpenAuth doesn't allow me to do the **new OutgoingWebResponse**

PD: For this question I only wrote one of the controller methods, but there are 3, and they have similar scenarios.

Answer 1

One possibility is to write a wrapper (the same way ASP.NET MVC abstracts all the HTTP Context specific stuff):

public abstract class OutgoingWebResponseWrapperBase
{
    protected OutgoingWebResponseWrapperBase() { }

    public abstract ActionResult AsActionResult();
}

and then have a naïve implementation:

public class OutgoingWebResponseWrapper: OutgoingWebResponseWrapperBase
{
    private readonly OutgoingWebResponse _response;
    public OutgoingWebResponseWrapper(OutgoingWebResponse response)
    {
        _response = response;
    }

    public override ActionResult AsActionResult()
    {
        return _response.AsActionResult();
    }
}

Now modify the IOAuthService.RequestClientAuthorization method to return a OutgoingWebResponseWrapperBase instead of OutgoingWebResponse.

Just like that:

public interface IOAuthService
{
    ...
    OutgoingWebResponseWrapperBase RequestClientAuthorization(...);
}

Obviously your controller code will stay absolutely the same. It’s just that now you can mock the return type of the RequestClientAuthorization in your unit test because it is an abstract class. You can also mock the AsActionResult abstract method call to return some expected mocked instance and you will assert in your unit test that the controller action that you are testing returned this expected action result.