ClickOnce Device Testing Security Model

Question

I am trying to install an application through ClickOnce - with certain minimum permissions. I would like the unit test to claim that my application does not use any additional features that are prohibited by the required security policy.

Can I indicate in my unit test that I want to use the specified manifest to regulate permissions, make calls to my library, and then claim that security exceptions are possible?

If so, how?

Thanks!

Answer 1

If you want unit test (test in isolation), you should

• test permissionLogic and you should
• verify that your management system (i.e. MVVM) uses permission logic.

SecurityManager test for allowLogic

you can extract allowLogic to your class using methods

public class SecurityManager { bool IsAllowedToPrint(User user); bool IsAllowedToAdminister(User user); } 

then you write unit tests

  User user = CreateAdimistrator(); Assert.AreEqual(true, securityManager.IsAllowedToAdminister(user)); 

Contrologic (i.e. MVVM) uses permission logic

create a mock-SecurityManager that always enables / disables functionality. and record unit tests for the controller if it responds as expected.

 var allowEverythingMock = CreateSecurityManagerMockThatAllowsEverything(); var mvvm = CreateMvvm(allowEverythingMock ); Assert.IsNotNull(mvvm.GetAdminGui()); 

I'm not sure if there is an easy way to create an integration test where the Click-Once-App actually uses the real SecurityManager and the result will be checked.

Update after receiving more information about what purpose

write unit tests for the controller if it responds as expected.

 var controller = CreateCreate(Permission.Low); try { // File io is not allowed with low permissions controller.SaveTextAsFile("HellowWorld", @"c:\temp\UnittestResult.txt"); Assert.Fail("The Controller should have forbidden this"); } catch(PermissionException pex) { // everything is ok. This specific exception was expected. }