From 52b7a56c695936e8fd3414a196c5ff8f805f58d5 Mon Sep 17 00:00:00 2001 From: edelomeza Date: Wed, 15 Jul 2026 14:30:20 -0600 Subject: [PATCH] feat: add Venta CRUD module with tests and security validation --- WebDevSecOps/Controllers/VentaController.cs | 131 +++++++++++ .../Models/CliClienteAutocompleteDto.cs | 12 + .../Models/SegUsuarioAutocompleteDto.cs | 12 + WebDevSecOps/Models/VenCatEstado.cs | 15 ++ WebDevSecOps/Models/Venta.cs | 36 +++ WebDevSecOps/Models/VentaCreateViewModel.cs | 23 ++ WebDevSecOps/Pages/Shared/_Layout.cshtml | 3 + WebDevSecOps/Program.cs | 16 ++ WebDevSecOps/Services/ClienteService.cs | 38 +++ WebDevSecOps/Services/EstadoVentaService.cs | 109 +++++++++ WebDevSecOps/Services/IClienteService.cs | 2 + WebDevSecOps/Services/IEstadoVentaService.cs | 10 + WebDevSecOps/Services/IUsuarioService.cs | 2 + WebDevSecOps/Services/IVentaService.cs | 12 + WebDevSecOps/Services/UsuarioService.cs | 38 +++ WebDevSecOps/Services/VentaService.cs | 175 ++++++++++++++ WebDevSecOps/Views/Venta/Create.cshtml | 144 ++++++++++++ WebDevSecOps/Views/Venta/Index.cshtml | 112 +++++++++ WebDevSecOps/Views/Venta/Memoria.md | 159 +++++++++++++ WebDevSecOps/appsettings.json | 4 +- .../Services/VentaApiClientTests.cs | 182 +++++++++++++++ .../SAST/VentaSecurityTests.cs | 209 +++++++++++++++++ .../Common/ContractTestData.cs | 83 +++++++ .../Pages/Ventas/CreateTests.cs | 186 +++++++++++++++ .../Pages/Ventas/IndexTests.cs | 220 ++++++++++++++++++ 25 files changed, 1931 insertions(+), 2 deletions(-) create mode 100644 WebDevSecOps/Controllers/VentaController.cs create mode 100644 WebDevSecOps/Models/CliClienteAutocompleteDto.cs create mode 100644 WebDevSecOps/Models/SegUsuarioAutocompleteDto.cs create mode 100644 WebDevSecOps/Models/VenCatEstado.cs create mode 100644 WebDevSecOps/Models/Venta.cs create mode 100644 WebDevSecOps/Models/VentaCreateViewModel.cs create mode 100644 WebDevSecOps/Services/EstadoVentaService.cs create mode 100644 WebDevSecOps/Services/IEstadoVentaService.cs create mode 100644 WebDevSecOps/Services/IVentaService.cs create mode 100644 WebDevSecOps/Services/VentaService.cs create mode 100644 WebDevSecOps/Views/Venta/Create.cshtml create mode 100644 WebDevSecOps/Views/Venta/Index.cshtml create mode 100644 WebDevSecOps/Views/Venta/Memoria.md create mode 100644 tests/WebDevSecOps.IntegrationTests/Services/VentaApiClientTests.cs create mode 100644 tests/WebDevSecOps.SecurityTests/SAST/VentaSecurityTests.cs create mode 100644 tests/WebDevSecOps.UnitTests/Pages/Ventas/CreateTests.cs create mode 100644 tests/WebDevSecOps.UnitTests/Pages/Ventas/IndexTests.cs diff --git a/WebDevSecOps/Controllers/VentaController.cs b/WebDevSecOps/Controllers/VentaController.cs new file mode 100644 index 0000000..338f779 --- /dev/null +++ b/WebDevSecOps/Controllers/VentaController.cs @@ -0,0 +1,131 @@ +using Microsoft.AspNetCore.Authorization; +using Microsoft.AspNetCore.Mvc; +using WebDevSecOps.Models; +using WebDevSecOps.Services; + +namespace WebDevSecOps.Controllers; + +[Authorize] +public class VentaController : Controller +{ + private readonly IVentaService _service; + private readonly IEstadoVentaService _estadoVentaService; + private readonly IClienteService _clienteService; + private readonly IUsuarioService _usuarioService; + private readonly ILogger _logger; + + public VentaController(IVentaService service, IEstadoVentaService estadoVentaService, IClienteService clienteService, IUsuarioService usuarioService, ILogger logger) + { + _service = service; + _estadoVentaService = estadoVentaService; + _clienteService = clienteService; + _usuarioService = usuarioService; + _logger = logger; + } + + [HttpGet] + [ResponseCache(Duration = 60, Location = ResponseCacheLocation.Client, NoStore = false)] + public async Task Index(string? texto = null, DateTime? dteFechaInicio = null, DateTime? dteFechaFin = null, int pageNumber = 1, int pageSize = 10, CancellationToken ct = default) + { + if (!ModelState.IsValid) + return BadRequest(ModelState); + + await CargarEstadoVentasAsync(ct); + + var result = (!string.IsNullOrEmpty(texto) || dteFechaInicio.HasValue || dteFechaFin.HasValue) + ? await _service.SearchVentasAsync(texto, dteFechaInicio, dteFechaFin, pageNumber, pageSize, ct) + : await _service.GetVentasAsync(pageNumber, pageSize, ct); + + if (result is null) + { + _logger.LogWarning("Failed to load ventas — service returned null"); + TempData["Error"] = "No se pudieron cargar las ventas."; + } + + return View(result); + } + + [HttpGet] + public async Task Create(string? returnUrl = null, CancellationToken ct = default) + { + ViewData["ReturnUrl"] = returnUrl; + return View(); + } + + [HttpPost] + [ValidateAntiForgeryToken] + public async Task Create(VentaCreateViewModel model, CancellationToken ct, string? returnUrl = null) + { + if (!ModelState.IsValid) + { + ViewData["ReturnUrl"] = returnUrl; + return View(model); + } + + var result = await _service.CreateVentaAsync(model, ct); + + if (result.Success) + { + _logger.LogInformation("Venta created successfully"); + TempData["Success"] = "Venta creada exitosamente."; + if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl)) + return Redirect(returnUrl); + return RedirectToAction("Index"); + } + + if (result.FieldErrors is not null) + { + foreach (var kvp in result.FieldErrors) + { + foreach (var msg in kvp.Value) + { + var key = kvp.Key switch + { + "idCliCliente" => nameof(VentaCreateViewModel.IdCliCliente), + "idSegUsuario" => nameof(VentaCreateViewModel.IdSegUsuario), + _ => kvp.Key + }; + ModelState.AddModelError(key, msg); + } + } + } + + if (result.ErrorMessage is not null) + ModelState.AddModelError(string.Empty, result.ErrorMessage); + + ViewData["ReturnUrl"] = returnUrl; + return View(model); + } + + [HttpGet] + public async Task ClientesAutocomplete(string texto, int maxResultados = 10, CancellationToken ct = default) + { + if (!ModelState.IsValid) + return Json(new List()); + + if (string.IsNullOrWhiteSpace(texto) || texto.Length < 2) + return Json(new List()); + + var result = await _clienteService.AutocompleteClientesAsync(texto, maxResultados, ct); + return Json(result ?? []); + } + + [HttpGet] + public async Task UsuariosAutocomplete(string texto, int maxResultados = 10, CancellationToken ct = default) + { + if (!ModelState.IsValid) + return Json(new List()); + + if (string.IsNullOrWhiteSpace(texto) || texto.Length < 2) + return Json(new List()); + + var result = await _usuarioService.AutocompleteUsuariosAsync(texto, maxResultados, ct); + return Json(result ?? []); + } + + private async Task CargarEstadoVentasAsync(CancellationToken ct = default) + { + var estados = await _estadoVentaService.GetAllAsync(ct: ct); + ViewBag.EstadoVentaDict = estados?.Items?.ToDictionary(t => t.Id, t => t.StrValor) ?? []; + } +} diff --git a/WebDevSecOps/Models/CliClienteAutocompleteDto.cs b/WebDevSecOps/Models/CliClienteAutocompleteDto.cs new file mode 100644 index 0000000..ef1b41e --- /dev/null +++ b/WebDevSecOps/Models/CliClienteAutocompleteDto.cs @@ -0,0 +1,12 @@ +using System.Text.Json.Serialization; + +namespace WebDevSecOps.Models; + +public class CliClienteAutocompleteDto +{ + [JsonPropertyName("id")] + public int Id { get; set; } + + [JsonPropertyName("strNombreCliente")] + public string StrNombreCliente { get; set; } = string.Empty; +} diff --git a/WebDevSecOps/Models/SegUsuarioAutocompleteDto.cs b/WebDevSecOps/Models/SegUsuarioAutocompleteDto.cs new file mode 100644 index 0000000..a6c0423 --- /dev/null +++ b/WebDevSecOps/Models/SegUsuarioAutocompleteDto.cs @@ -0,0 +1,12 @@ +using System.Text.Json.Serialization; + +namespace WebDevSecOps.Models; + +public class SegUsuarioAutocompleteDto +{ + [JsonPropertyName("id")] + public int Id { get; set; } + + [JsonPropertyName("strNombre")] + public string StrNombre { get; set; } = string.Empty; +} diff --git a/WebDevSecOps/Models/VenCatEstado.cs b/WebDevSecOps/Models/VenCatEstado.cs new file mode 100644 index 0000000..f96cbf9 --- /dev/null +++ b/WebDevSecOps/Models/VenCatEstado.cs @@ -0,0 +1,15 @@ +using System.Text.Json.Serialization; + +namespace WebDevSecOps.Models; + +public class VenCatEstado +{ + [JsonPropertyName("id")] + public int Id { get; set; } + + [JsonPropertyName("strValor")] + public string StrValor { get; set; } = string.Empty; + + [JsonPropertyName("strDescripcion")] + public string? StrDescripcion { get; set; } +} diff --git a/WebDevSecOps/Models/Venta.cs b/WebDevSecOps/Models/Venta.cs new file mode 100644 index 0000000..c10fe66 --- /dev/null +++ b/WebDevSecOps/Models/Venta.cs @@ -0,0 +1,36 @@ +using System.Text.Json.Serialization; + +namespace WebDevSecOps.Models; + +public class Venta +{ + [JsonPropertyName("id")] + public int Id { get; set; } + + [JsonPropertyName("idCliCliente")] + public int IdCliCliente { get; set; } + + [JsonPropertyName("strNombreCliente")] + public string? StrNombreCliente { get; set; } + + [JsonPropertyName("idSegUsuario")] + public int IdSegUsuario { get; set; } + + [JsonPropertyName("strNombreUsuario")] + public string? StrNombreUsuario { get; set; } + + [JsonPropertyName("idVenCatEstado")] + public int IdVenCatEstado { get; set; } + + [JsonPropertyName("strEstado")] + public string? StrEstado { get; set; } + + [JsonPropertyName("dteFechaHoraCompra")] + public DateTime? DteFechaHoraCompra { get; set; } + + [JsonPropertyName("strClaveVenta")] + public string StrClaveVenta { get; set; } = string.Empty; + + [JsonPropertyName("rowVersion")] + public byte[]? RowVersion { get; set; } +} diff --git a/WebDevSecOps/Models/VentaCreateViewModel.cs b/WebDevSecOps/Models/VentaCreateViewModel.cs new file mode 100644 index 0000000..613e777 --- /dev/null +++ b/WebDevSecOps/Models/VentaCreateViewModel.cs @@ -0,0 +1,23 @@ +using System.ComponentModel.DataAnnotations; +using System.Text.Json.Serialization; + +namespace WebDevSecOps.Models; + +public class VentaCreateViewModel +{ + [Required(ErrorMessage = "El cliente es obligatorio.")] + [JsonRequired] + [JsonPropertyName("idCliCliente")] + [Display(Name = "Cliente")] + public int IdCliCliente { get; set; } + + [Required(ErrorMessage = "El usuario es obligatorio.")] + [JsonRequired] + [JsonPropertyName("idSegUsuario")] + [Display(Name = "Usuario")] + public int IdSegUsuario { get; set; } + + public string? StrNombreCliente { get; set; } + + public string? StrNombreUsuario { get; set; } +} diff --git a/WebDevSecOps/Pages/Shared/_Layout.cshtml b/WebDevSecOps/Pages/Shared/_Layout.cshtml index 610f1ff..5ac028d 100644 --- a/WebDevSecOps/Pages/Shared/_Layout.cshtml +++ b/WebDevSecOps/Pages/Shared/_Layout.cshtml @@ -38,6 +38,9 @@
  • Productos
    • +
  • + Ventas +
    • }
  • Privacy diff --git a/WebDevSecOps/Program.cs b/WebDevSecOps/Program.cs index 3855133..74afd82 100644 --- a/WebDevSecOps/Program.cs +++ b/WebDevSecOps/Program.cs @@ -109,6 +109,22 @@ }) .AddStandardResilienceHandler(); +builder.Services.AddHttpClient(client => +{ + client.BaseAddress = new Uri(builder.Configuration["ApiSettings:BaseUrl"] + ?? throw new InvalidOperationException("ApiSettings:BaseUrl is not configured.")); + client.Timeout = TimeSpan.FromSeconds(30); +}) +.AddStandardResilienceHandler(); + +builder.Services.AddHttpClient(client => +{ + client.BaseAddress = new Uri(builder.Configuration["ApiSettings:BaseUrl"] + ?? throw new InvalidOperationException("ApiSettings:BaseUrl is not configured.")); + client.Timeout = TimeSpan.FromSeconds(30); +}) +.AddStandardResilienceHandler(); + var app = builder.Build(); if (!app.Environment.IsDevelopment()) diff --git a/WebDevSecOps/Services/ClienteService.cs b/WebDevSecOps/Services/ClienteService.cs index baec61b..0c14885 100644 --- a/WebDevSecOps/Services/ClienteService.cs +++ b/WebDevSecOps/Services/ClienteService.cs @@ -161,6 +161,44 @@ public ClienteService(HttpClient httpClient, IHttpContextAccessor httpContextAcc } } + public async Task> AutocompleteClientesAsync(string texto, int maxResultados = 10, CancellationToken ct = default) + { + var token = GetToken(); + + if (token is null) + { + _logger.LogWarning("No access token found"); + return []; + } + + try + { + var encodedTexto = Uri.EscapeDataString(texto); + using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/Cliente/autocomplete?texto={encodedTexto}&maxResultados={maxResultados}"); + request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token); + + var response = await _httpClient.SendAsync(request, ct); + response.EnsureSuccessStatusCode(); + + return await response.Content.ReadFromJsonAsync>(cancellationToken: ct) ?? []; + } + catch (OperationCanceledException ex) + { + _logger.LogWarning(ex, "Autocomplete clientes request was cancelled"); + throw new OperationCanceledException("The autocomplete clientes request was cancelled.", ex); + } + catch (HttpRequestException ex) + { + _logger.LogError(ex, "Connection error autocomplete clientes"); + return []; + } + catch (Exception ex) + { + _logger.LogError(ex, "Unexpected error autocomplete clientes"); + return []; + } + } + public async Task CreateClienteAsync(ClienteCreateViewModel model, CancellationToken ct = default) { var token = GetToken(); diff --git a/WebDevSecOps/Services/EstadoVentaService.cs b/WebDevSecOps/Services/EstadoVentaService.cs new file mode 100644 index 0000000..eec5c2c --- /dev/null +++ b/WebDevSecOps/Services/EstadoVentaService.cs @@ -0,0 +1,109 @@ +using System.Net.Http.Json; +using WebDevSecOps.Models; + +namespace WebDevSecOps.Services; + +public class EstadoVentaService : IEstadoVentaService +{ + private readonly HttpClient _httpClient; + private readonly IHttpContextAccessor _httpContextAccessor; + private readonly ITokenStore _tokenStore; + private readonly ILogger _logger; + + public EstadoVentaService(HttpClient httpClient, IHttpContextAccessor httpContextAccessor, ITokenStore tokenStore, ILogger logger) + { + _httpClient = httpClient; + _httpContextAccessor = httpContextAccessor; + _tokenStore = tokenStore; + _logger = logger; + } + + private string? GetToken() + { + var user = _httpContextAccessor.HttpContext?.User; + return user is not null ? _tokenStore.GetTokenFromPrincipal(user) : null; + } + + public async Task?> GetAllAsync(int pageNumber = 1, int pageSize = 100, CancellationToken ct = default) + { + var token = GetToken(); + + if (token is null) + { + _logger.LogWarning("No access token found"); + return null; + } + + try + { + using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/EstadoVenta?PageNumber={pageNumber}&PageSize={pageSize}"); + request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token); + + var response = await _httpClient.SendAsync(request, ct); + response.EnsureSuccessStatusCode(); + + return await response.Content.ReadFromJsonAsync>(cancellationToken: ct); + } + catch (OperationCanceledException ex) + { + _logger.LogWarning(ex, "Get estados venta request was cancelled"); + throw new OperationCanceledException("The get estados venta request was cancelled.", ex); + } + catch (HttpRequestException ex) + { + _logger.LogError(ex, "Connection error fetching estados venta"); + return null; + } + catch (Exception ex) + { + _logger.LogError(ex, "Unexpected error fetching estados venta"); + return null; + } + } + + public async Task GetByIdAsync(int id, CancellationToken ct = default) + { + var token = GetToken(); + + if (token is null) + { + _logger.LogWarning("No access token found"); + return null; + } + + try + { + using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/EstadoVenta/{id}"); + request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token); + + var response = await _httpClient.SendAsync(request, ct); + + if (response.IsSuccessStatusCode) + return await response.Content.ReadFromJsonAsync(cancellationToken: ct); + + if (response.StatusCode == System.Net.HttpStatusCode.NotFound) + { + _logger.LogWarning("EstadoVenta with id {Id} not found", id); + return null; + } + + _logger.LogWarning("Get estado venta by id failed with status {StatusCode}", response.StatusCode); + return null; + } + catch (OperationCanceledException ex) + { + _logger.LogWarning(ex, "Get estado venta by id request was cancelled"); + throw new OperationCanceledException("The get estado venta by id request was cancelled.", ex); + } + catch (HttpRequestException ex) + { + _logger.LogError(ex, "Connection error fetching estado venta {Id}", id); + return null; + } + catch (Exception ex) + { + _logger.LogError(ex, "Unexpected error fetching estado venta {Id}", id); + return null; + } + } +} diff --git a/WebDevSecOps/Services/IClienteService.cs b/WebDevSecOps/Services/IClienteService.cs index 4adbaa9..dcbc736 100644 --- a/WebDevSecOps/Services/IClienteService.cs +++ b/WebDevSecOps/Services/IClienteService.cs @@ -10,6 +10,8 @@ public interface IClienteService Task GetClienteByIdAsync(int id, CancellationToken ct = default); + Task> AutocompleteClientesAsync(string texto, int maxResultados = 10, CancellationToken ct = default); + Task CreateClienteAsync(ClienteCreateViewModel model, CancellationToken ct = default); Task UpdateClienteAsync(int id, ClienteUpdateViewModel model, CancellationToken ct = default); diff --git a/WebDevSecOps/Services/IEstadoVentaService.cs b/WebDevSecOps/Services/IEstadoVentaService.cs new file mode 100644 index 0000000..22a8f40 --- /dev/null +++ b/WebDevSecOps/Services/IEstadoVentaService.cs @@ -0,0 +1,10 @@ +using WebDevSecOps.Models; + +namespace WebDevSecOps.Services; + +public interface IEstadoVentaService +{ + Task?> GetAllAsync(int pageNumber = 1, int pageSize = 100, CancellationToken ct = default); + + Task GetByIdAsync(int id, CancellationToken ct = default); +} diff --git a/WebDevSecOps/Services/IUsuarioService.cs b/WebDevSecOps/Services/IUsuarioService.cs index 9152b9a..eaa5252 100644 --- a/WebDevSecOps/Services/IUsuarioService.cs +++ b/WebDevSecOps/Services/IUsuarioService.cs @@ -8,6 +8,8 @@ public interface IUsuarioService Task?> BuscarUsuariosAsync(string texto, int pageNumber = 1, int pageSize = 10, CancellationToken ct = default); + Task> AutocompleteUsuariosAsync(string texto, int maxResultados = 10, CancellationToken ct = default); + Task CreateUsuarioAsync(UsuarioCreateViewModel model, CancellationToken ct = default); Task GetUsuarioByIdAsync(int id, CancellationToken ct = default); diff --git a/WebDevSecOps/Services/IVentaService.cs b/WebDevSecOps/Services/IVentaService.cs new file mode 100644 index 0000000..f7f78fc --- /dev/null +++ b/WebDevSecOps/Services/IVentaService.cs @@ -0,0 +1,12 @@ +using WebDevSecOps.Models; + +namespace WebDevSecOps.Services; + +public interface IVentaService +{ + Task?> GetVentasAsync(int pageNumber = 1, int pageSize = 10, CancellationToken ct = default); + + Task?> SearchVentasAsync(string? texto, DateTime? dteFechaInicio, DateTime? dteFechaFin, int pageNumber = 1, int pageSize = 10, CancellationToken ct = default); + + Task CreateVentaAsync(VentaCreateViewModel model, CancellationToken ct = default); +} diff --git a/WebDevSecOps/Services/UsuarioService.cs b/WebDevSecOps/Services/UsuarioService.cs index 8176bce..cdc48f6 100644 --- a/WebDevSecOps/Services/UsuarioService.cs +++ b/WebDevSecOps/Services/UsuarioService.cs @@ -100,6 +100,44 @@ public UsuarioService(HttpClient httpClient, IHttpContextAccessor httpContextAcc } } + public async Task> AutocompleteUsuariosAsync(string texto, int maxResultados = 10, CancellationToken ct = default) + { + var token = GetToken(); + + if (token is null) + { + _logger.LogWarning("No access token found"); + return []; + } + + try + { + var encodedTexto = Uri.EscapeDataString(texto); + using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/Usuario/autocomplete?texto={encodedTexto}&maxResultados={maxResultados}"); + request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token); + + var response = await _httpClient.SendAsync(request, ct); + response.EnsureSuccessStatusCode(); + + return await response.Content.ReadFromJsonAsync>(cancellationToken: ct) ?? []; + } + catch (OperationCanceledException ex) + { + _logger.LogWarning(ex, "Autocomplete usuarios request was cancelled"); + throw new OperationCanceledException("The autocomplete usuarios request was cancelled.", ex); + } + catch (HttpRequestException ex) + { + _logger.LogError(ex, "Connection error autocomplete usuarios"); + return []; + } + catch (Exception ex) + { + _logger.LogError(ex, "Unexpected error autocomplete usuarios"); + return []; + } + } + public async Task CreateUsuarioAsync(UsuarioCreateViewModel model, CancellationToken ct = default) { var token = GetToken(); diff --git a/WebDevSecOps/Services/VentaService.cs b/WebDevSecOps/Services/VentaService.cs new file mode 100644 index 0000000..4271342 --- /dev/null +++ b/WebDevSecOps/Services/VentaService.cs @@ -0,0 +1,175 @@ +using System.Net.Http.Json; +using System.Text.Json; +using WebDevSecOps.Models; + +namespace WebDevSecOps.Services; + +public class VentaService : IVentaService +{ + private readonly HttpClient _httpClient; + private readonly IHttpContextAccessor _httpContextAccessor; + private readonly ITokenStore _tokenStore; + private readonly ILogger _logger; + + public VentaService(HttpClient httpClient, IHttpContextAccessor httpContextAccessor, ITokenStore tokenStore, ILogger logger) + { + _httpClient = httpClient; + _httpContextAccessor = httpContextAccessor; + _tokenStore = tokenStore; + _logger = logger; + } + + private string? GetToken() + { + var user = _httpContextAccessor.HttpContext?.User; + return user is not null ? _tokenStore.GetTokenFromPrincipal(user) : null; + } + + public async Task?> GetVentasAsync(int pageNumber = 1, int pageSize = 10, CancellationToken ct = default) + { + var token = GetToken(); + + if (token is null) + { + _logger.LogWarning("No access token found"); + return null; + } + + try + { + using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/Venta?PageNumber={pageNumber}&PageSize={pageSize}"); + request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token); + + var response = await _httpClient.SendAsync(request, ct); + response.EnsureSuccessStatusCode(); + + return await response.Content.ReadFromJsonAsync>(cancellationToken: ct); + } + catch (OperationCanceledException ex) + { + _logger.LogWarning(ex, "Get ventas request was cancelled"); + throw new OperationCanceledException("The get ventas request was cancelled.", ex); + } + catch (HttpRequestException ex) + { + _logger.LogError(ex, "Connection error fetching ventas"); + return null; + } + catch (Exception ex) + { + _logger.LogError(ex, "Unexpected error fetching ventas"); + return null; + } + } + + public async Task?> SearchVentasAsync(string? texto, DateTime? dteFechaInicio, DateTime? dteFechaFin, int pageNumber = 1, int pageSize = 10, CancellationToken ct = default) + { + var token = GetToken(); + + if (token is null) + { + _logger.LogWarning("No access token found"); + return null; + } + + try + { + var queryParams = new List + { + $"PageNumber={pageNumber}", + $"PageSize={pageSize}" + }; + + if (!string.IsNullOrEmpty(texto)) + { + queryParams.Add($"strClaveVenta={Uri.EscapeDataString(texto)}"); + queryParams.Add($"strNombreCliente={Uri.EscapeDataString(texto)}"); + } + + if (dteFechaInicio.HasValue) + queryParams.Add($"dteFechaInicio={dteFechaInicio.Value:yyyy-MM-dd}"); + + if (dteFechaFin.HasValue) + queryParams.Add($"dteFechaFin={dteFechaFin.Value:yyyy-MM-dd}"); + + var queryString = string.Join("&", queryParams); + + using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/Venta/buscar?{queryString}"); + request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token); + + var response = await _httpClient.SendAsync(request, ct); + response.EnsureSuccessStatusCode(); + + return await response.Content.ReadFromJsonAsync>(cancellationToken: ct); + } + catch (OperationCanceledException ex) + { + _logger.LogWarning(ex, "Search ventas request was cancelled"); + throw new OperationCanceledException("The search ventas request was cancelled.", ex); + } + catch (HttpRequestException ex) + { + _logger.LogError(ex, "Connection error searching ventas"); + return null; + } + catch (Exception ex) + { + _logger.LogError(ex, "Unexpected error searching ventas"); + return null; + } + } + + public async Task CreateVentaAsync(VentaCreateViewModel model, CancellationToken ct = default) + { + var token = GetToken(); + + if (token is null) + { + _logger.LogWarning("No access token found"); + return OperationResult.Fail("Error de autenticación. Inicie sesión nuevamente."); + } + + try + { + using var request = new HttpRequestMessage(HttpMethod.Post, "api/v1/Venta") + { + Content = JsonContent.Create(model) + }; + request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token); + + var response = await _httpClient.SendAsync(request, ct); + + if (response.IsSuccessStatusCode) + { + _logger.LogInformation("Venta created successfully"); + return OperationResult.Ok(); + } + + await SafeResponseLogger.LogResponseFailure(_logger, response, "CreateVenta", ct: ct); + + var rawBody = await response.Content.ReadAsStringAsync(ct); + var errorResponse = JsonSerializer.Deserialize(rawBody); + + if (errorResponse?.Errors is not null && errorResponse.Errors.Count > 0) + return OperationResult.Fail(errorResponse.Errors, errorResponse.Title); + + var message = errorResponse?.Detail ?? errorResponse?.Title ?? "Error al crear la venta."; + return OperationResult.Fail(message); + } + catch (OperationCanceledException ex) + { + _logger.LogWarning(ex, "Create venta request was cancelled"); + throw new OperationCanceledException("The create venta request was cancelled.", ex); + } + catch (HttpRequestException ex) + { + _logger.LogError(ex, "Connection error while creating venta"); + return OperationResult.Fail("Error de conexion con el servidor. Verifique su conexion e intente nuevamente."); + } + catch (Exception ex) + { + _logger.LogError(ex, "Unexpected error creating venta"); + return OperationResult.Fail("Error inesperado. Intente nuevamente."); + } + } +} diff --git a/WebDevSecOps/Views/Venta/Create.cshtml b/WebDevSecOps/Views/Venta/Create.cshtml new file mode 100644 index 0000000..f5a9b5f --- /dev/null +++ b/WebDevSecOps/Views/Venta/Create.cshtml @@ -0,0 +1,144 @@ +@model VentaCreateViewModel +@{ + ViewData["Title"] = "Agregar Venta"; +} + +
    +
    +
    +

    Agregar Venta

    + + @{ + var generalErrors = ViewData.ModelState[string.Empty]?.Errors; + } + @if (generalErrors is { Count: > 0 }) + { + + } + +
    + @Html.AntiForgeryToken() + + +
    + + + + + + +
    + +
    + + + + + + +
    + +
    + + Cancelar +
    +
    +
    +
    +
    + +@section Scripts { + + +} diff --git a/WebDevSecOps/Views/Venta/Index.cshtml b/WebDevSecOps/Views/Venta/Index.cshtml new file mode 100644 index 0000000..3a6b6c3 --- /dev/null +++ b/WebDevSecOps/Views/Venta/Index.cshtml @@ -0,0 +1,112 @@ +@model PaginatedResponse +@{ + ViewData["Title"] = "Ventas"; + var currentQuery = Context.Request.Query; + var texto = currentQuery["texto"].FirstOrDefault(); + var dteFechaInicio = currentQuery["dteFechaInicio"].FirstOrDefault(); + var dteFechaFin = currentQuery["dteFechaFin"].FirstOrDefault(); +} + +
    +
    +

    Ventas

    + + Agregar Venta +
    + +
    +
    + +
    +
    + + +
    +
    + + +
    +
    + + Limpiar +
    +
    + + @if (Model?.Items is null || Model.Items.Count == 0) + { +
    No se encontraron ventas.
    + } + else + { +
    + + + + + + + + + + + @foreach (var venta in Model.Items) + { + + + + + @{ + var estadoValor = "-"; + if (ViewBag.EstadoVentaDict is not null && ViewBag.EstadoVentaDict.ContainsKey(venta.IdVenCatEstado)) + { + estadoValor = ViewBag.EstadoVentaDict[venta.IdVenCatEstado]; + } + } + + + } + +
    Fecha y HoraClave VentaNombre ClienteEstado Venta
    @venta.DteFechaHoraCompra?.ToString("dd/MM/yyyy HH:mm")@venta.StrClaveVenta@venta.StrNombreCliente@estadoValor
    +
    + + + +

    + Mostrando pagina @Model.PageNumber de @Model.TotalPages (@Model.TotalCount registros) +

    + } +
    diff --git a/WebDevSecOps/Views/Venta/Memoria.md b/WebDevSecOps/Views/Venta/Memoria.md new file mode 100644 index 0000000..a21ef33 --- /dev/null +++ b/WebDevSecOps/Views/Venta/Memoria.md @@ -0,0 +1,159 @@ +# M�dulo Venta � Memoria del proyecto + +## Rama: Venta + +--- + +## Resumen del m�dulo + +M�dulo CRUD parcial para la gesti�n de ventas. Consume los endpoints de la API WebAPIDevSecOps (/api/v1/Venta, /api/v1/Venta/buscar, /api/v1/EstadoVenta, /api/v1/Cliente/autocomplete, /api/v1/Usuario/autocomplete). + +### Acciones implementadas + +| Acci�n | M�todo | Ruta | Prop�sito | +|--------|--------|------|-----------| +| Index | GET | /Venta/Index | Listado paginado con filtros (texto + fechas) | +| Create | GET | /Venta/Create | Formulario de nueva venta | +| Create | POST | /Venta/Create | Procesa y guarda la venta | +| ClientesAutocomplete | GET | /Venta/ClientesAutocomplete?texto=&maxResultados=10 | JSON para autocomplete de clientes | +| UsuariosAutocomplete | GET | /Venta/UsuariosAutocomplete?texto=&maxResultados=10 | JSON para autocomplete de usuarios | + +--- + +## Endpoints API consumidos + +| M�todo | Endpoint | Uso | +|--------|----------|-----| +| GET | /api/v1/Venta?PageNumber=&PageSize= | Listado paginado | +| GET | /api/v1/Venta/buscar?strClaveVenta=&strNombreCliente=&dteFechaInicio=&dteFechaFin=&PageNumber=&PageSize= | B�squeda con filtros | +| POST | /api/v1/Venta | Crear venta (body: { idCliCliente, idSegUsuario }) | +| GET | /api/v1/EstadoVenta?PageNumber=&PageSize= | Cat�logo de estados (read-only) | +| GET | /api/v1/Cliente/autocomplete?texto=&maxResultados= | Autocomplete de clientes | +| GET | /api/v1/Usuario/autocomplete?texto=&maxResultados= | Autocomplete de usuarios | + +--- + +## Pantalla principal (Index) + +### Filtros +- **Texto �nico**: Busca simult�neamente por strClaveVenta y strNombreCliente (se env�a el mismo valor a ambos par�metros) +- **Rango de fechas**: dteFechaInicio (Desde) y dteFechaFin (Hasta) � controles input type="date" +- La paginaci�n preserva todos los filtros en los enlaces + +### Columnas de la tabla +| Cabecera | Propiedad | Origen | +|----------|-----------|--------| +| Fecha y Hora | DteFechaHoraCompra | VenVentaDto | +| Clave Venta | StrClaveVenta | VenVentaDto | +| Nombre Cliente | StrNombreCliente | VenVentaDto (resuelto desde CliCliente) | +| Estado Venta | StrEstado | VenCatEstado resuelto v�a ViewBag.EstadoVentaDict | + +### Paginaci�n +- pageSize fijo en 10 registros por p�gina (default) +- Controles Anterior/Siguiente + numeraci�n de p�ginas +- Texto informativo: "Mostrando p�gina X de Y (Z registros)" + +--- + +## Pantalla Create + +### Campos del formulario +- **Cliente**: Campo de b�squeda con autocomplete (m�n. 2 caracteres). El usuario escribe, JS consulta /Venta/ClientesAutocomplete?texto=..., despliega resultados en dropdown, al seleccionar se llena IdCliCliente (hidden) +- **Usuario**: Mismo comportamiento con /Venta/UsuariosAutocomplete?texto=..., llena IdSegUsuario (hidden) + +### Datos enviados a la API +`json +{ + "idCliCliente": 1, + "idSegUsuario": 1 +} +` +- idVenCatEstado: Asignado por la API +- dteFechaHoraCompra: Asignado por la API +- strClaveVenta: Calculado por la API + +### Manejo de errores (POST) +- �xito ? TempData["Success"] + redirect a Index +- Error de campo ? ModelState.AddModelError con mapeo (idCliCliente ? IdCliCliente, idSegUsuario ? IdSegUsuario) +- Error general ? ModelState.AddModelError(string.Empty, mensaje) +- Recarga la vista con el modelo para reintentar + +--- + +## Archivos del m�dulo + +### Modelos +| Archivo | Prop�sito | +|---------|-----------| +| Models/Venta.cs | Entidad de dominio (VenVentaDto) | +| Models/VenCatEstado.cs | Entidad de cat�logo (VenCatEstadoDto) | +| Models/VentaCreateViewModel.cs | ViewModel para crear venta | +| Models/CliClienteAutocompleteDto.cs | DTO para autocomplete de cliente | +| Models/SegUsuarioAutocompleteDto.cs | DTO para autocomplete de usuario | + +### Servicios +| Archivo | Prop�sito | +|---------|-----------| +| Services/IVentaService.cs | Interfaz: GetVentasAsync, SearchVentasAsync, CreateVentaAsync | +| Services/VentaService.cs | Implementaci�n HttpClient | +| Services/IEstadoVentaService.cs | Interfaz cat�logo (read-only) | +| Services/EstadoVentaService.cs | Implementaci�n HttpClient | +| IClienteService.cs / ClienteService.cs | + AutocompleteClientesAsync | +| IUsuarioService.cs / UsuarioService.cs | + AutocompleteUsuariosAsync | + +### Controlador +| Archivo | Acciones | +|---------|----------| +| Controllers/VentaController.cs | Index, Create (GET/POST), ClientesAutocomplete, UsuariosAutocomplete | + +### Vistas +| Archivo | Prop�sito | +|---------|-----------| +| Views/Venta/Index.cshtml | Listado con filtros + tabla paginada | +| Views/Venta/Create.cshtml | Formulario con autocomplete JS | + +### Modificaciones a otros archivos +| Archivo | Cambio | +|---------|--------| +| Program.cs | DI: IVentaService + IEstadoVentaService | +| Pages/Shared/_Layout.cshtml | Men� "Ventas" despu�s de Productos | + +--- + +## Pruebas + +### Unitarias (WebDevSecOps.UnitTests) +| Archivo | Tests | +|---------|-------| +| Pages/Ventas/IndexTests.cs | 8 tests: paginaci�n, filtros, servicio nulo, carga de estado, etc. | +| Pages/Ventas/CreateTests.cs | 8 tests: create get/post, validaci�n, errores, autocomplete >2 chars, field errors | + +### Integraci�n (WebDevSecOps.IntegrationTests) +| Archivo | Tests | +|---------|-------| +| Services/VentaApiClientTests.cs | 9 tests: URLs correctas (list/search/create), serializaci�n, bearer token, errores HTTP, missing token | + +### Seguridad (WebDevSecOps.SecurityTests) +| Archivo | Tests | +|---------|-------| +| SAST/VentaSecurityTests.cs | 12 tests: autenticaci�n requerida (Index, Create, autocomplete), validaci�n campos obligatorios, tipo inv�lido | + +### Datos de prueba +| Archivo | Datos agregados | +|---------|----------------| +| Common/ContractTestData.cs | ValidVenCatEstado, ValidVenta, ValidVentaPaginatedResponse, ValidVentaCreateViewModel, ValidClienteAutocompleteList, ValidUsuarioAutocompleteList, VentaValidationApiError | + +--- + +## Convenciones aplicadas (heredadas de Empleado) + +- [Authorize] en el controlador +- TempData["Success"] / TempData["Error"] para notificaciones Toastr +- OperationResult para resultados de operaciones +- ViewBag.EstadoVentaDict (Dictionary) para resolver cat�logos en tabla (evita N+1) +- returnUrl opcional para redirect condicional +- Manejo de ModelState.AddModelError con mapeo de nombres de campo (snake ? Pascal) +- SafeResponseLogger.LogResponseFailure para errores de API +- Paginaci�n con preservaci�n de query params +- Autocomplete con m�nimo 2 caracteres +- JS con nonce para seguridad CSP diff --git a/WebDevSecOps/appsettings.json b/WebDevSecOps/appsettings.json index cb9f14b..a7fb3b8 100644 --- a/WebDevSecOps/appsettings.json +++ b/WebDevSecOps/appsettings.json @@ -7,8 +7,8 @@ }, "AllowedHosts": "localhost; https://localhost:7227/", "ApiSettings": { - "BaseUrl": "https://localhost:7227/" - } + "BaseUrl": "https://localhost:7227/" + } } diff --git a/tests/WebDevSecOps.IntegrationTests/Services/VentaApiClientTests.cs b/tests/WebDevSecOps.IntegrationTests/Services/VentaApiClientTests.cs new file mode 100644 index 0000000..4d2912f --- /dev/null +++ b/tests/WebDevSecOps.IntegrationTests/Services/VentaApiClientTests.cs @@ -0,0 +1,182 @@ +using System.Net; +using System.Security.Claims; +using System.Text.Json; +using Microsoft.AspNetCore.Http; +using Microsoft.Extensions.Logging; +using Moq; +using WebDevSecOps.Models; +using WebDevSecOps.Services; +using WebDevSecOps.UnitTests.Common; + +namespace WebDevSecOps.IntegrationTests.Services; + +public class VentaApiClientTests +{ + private (VentaService Service, MockHttpMessageHandler Handler) CreateServiceWithToken( + object? responseContent = null, HttpStatusCode? statusCode = null) + { + var mockHandler = new MockHttpMessageHandler(responseContent, statusCode ?? HttpStatusCode.OK); + var httpClient = new HttpClient(mockHandler) { BaseAddress = new Uri(TestConstants.ApiBaseUrl) }; + + var httpContextAccessorMock = new Mock(); + var principal = new ClaimsPrincipal(new ClaimsIdentity([ + new Claim("token_key", "test-key"), + new Claim(ClaimTypes.Name, "test-user") + ], "test")); + var httpContextMock = new Mock(); + httpContextMock.Setup(x => x.User).Returns(principal); + httpContextAccessorMock.Setup(x => x.HttpContext).Returns(httpContextMock.Object); + + var tokenStoreMock = new Mock(); + tokenStoreMock.Setup(x => x.GetTokenFromPrincipal(It.IsAny())) + .Returns(ContractTestData.TestToken); + + var loggerMock = new Mock>(); + var service = new VentaService(httpClient, httpContextAccessorMock.Object, tokenStoreMock.Object, loggerMock.Object); + + return (service, mockHandler); + } + + private (VentaService Service, MockHttpMessageHandler Handler) CreateServiceWithoutToken() + { + var mockHandler = new MockHttpMessageHandler(null, HttpStatusCode.OK); + var httpClient = new HttpClient(mockHandler) { BaseAddress = new Uri(TestConstants.ApiBaseUrl) }; + + var httpContextAccessorMock = new Mock(); + httpContextAccessorMock.Setup(x => x.HttpContext).Returns((HttpContext?)null); + + var tokenStoreMock = new Mock(); + + var loggerMock = new Mock>(); + var service = new VentaService(httpClient, httpContextAccessorMock.Object, tokenStoreMock.Object, loggerMock.Object); + + return (service, mockHandler); + } + + [Fact] + public async Task GetVentas_ShouldGetCorrectUrl() + { + var (service, handler) = CreateServiceWithToken(); + + await service.GetVentasAsync(pageNumber: 2, pageSize: 25); + + Assert.Equal(HttpMethod.Get, handler.LastRequest?.Method); + Assert.Equal("api/v1/Venta?PageNumber=2&PageSize=25", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/')); + } + + [Fact] + public async Task SearchVentas_ShouldBuildCorrectUrl_WithTexto() + { + var (service, handler) = CreateServiceWithToken(); + + await service.SearchVentasAsync("V-000001", null, null, 1, 10); + + var url = handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'); + Assert.Contains("api/v1/Venta/buscar", url); + Assert.Contains("strClaveVenta=V-000001", url); + Assert.Contains("strNombreCliente=V-000001", url); + } + + [Fact] + public async Task SearchVentas_ShouldBuildCorrectUrl_WithFechas() + { + var (service, handler) = CreateServiceWithToken(); + var desde = new DateTime(2026, 7, 1, 0, 0, 0, DateTimeKind.Utc); + var hasta = new DateTime(2026, 7, 31, 0, 0, 0, DateTimeKind.Utc); + + await service.SearchVentasAsync(null, desde, hasta, 1, 10); + + var url = handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'); + Assert.Contains("dteFechaInicio=2026-07-01", url); + Assert.Contains("dteFechaFin=2026-07-31", url); + } + + [Fact] + public async Task CreateVenta_ShouldPostCorrectUrl() + { + var (service, handler) = CreateServiceWithToken(null, HttpStatusCode.Created); + + await service.CreateVentaAsync(ContractTestData.ValidVentaCreateViewModel); + + Assert.Equal(HttpMethod.Post, handler.LastRequest?.Method); + Assert.Equal("api/v1/Venta", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/')); + } + + [Fact] + public async Task CreateVenta_ShouldSerializeRequestBody() + { + var (service, handler) = CreateServiceWithToken(null, HttpStatusCode.Created); + + await service.CreateVentaAsync(ContractTestData.ValidVentaCreateViewModel); + + Assert.NotNull(handler.LastRequestBody); + var json = JsonDocument.Parse(handler.LastRequestBody); + Assert.Equal(1, json.RootElement.GetProperty("idCliCliente").GetInt32()); + Assert.Equal(1, json.RootElement.GetProperty("idSegUsuario").GetInt32()); + } + + [Fact] + public async Task CreateVenta_ShouldReturnOk_WhenApiSucceeds() + { + var (service, _) = CreateServiceWithToken(null, HttpStatusCode.Created); + + var result = await service.CreateVentaAsync(ContractTestData.ValidVentaCreateViewModel); + + Assert.True(result.Success); + } + + [Fact] + public async Task CreateVenta_ShouldReturnFail_WhenApiReturnsError() + { + var (service, _) = CreateServiceWithToken(ContractTestData.VentaValidationApiError, HttpStatusCode.BadRequest); + + var result = await service.CreateVentaAsync(ContractTestData.ValidVentaCreateViewModel); + + Assert.False(result.Success); + Assert.NotNull(result.FieldErrors); + Assert.Contains("idCliCliente", result.FieldErrors.Keys); + } + + [Fact] + public async Task CreateVenta_ShouldReturnFail_WhenMissingToken() + { + var (service, _) = CreateServiceWithoutToken(); + + var result = await service.CreateVentaAsync(ContractTestData.ValidVentaCreateViewModel); + + Assert.False(result.Success); + Assert.Equal(ContractTestData.MissingTokenMessage, result.ErrorMessage); + } + + [Fact] + public async Task GetVentas_ShouldReturnData_WhenApiSucceeds() + { + var (service, _) = CreateServiceWithToken(ContractTestData.ValidVentaPaginatedResponse, HttpStatusCode.OK); + + var result = await service.GetVentasAsync(); + + Assert.NotNull(result); + Assert.Single(result.Items); + Assert.Equal("V-000001", result.Items[0].StrClaveVenta); + } + + [Fact] + public async Task GetVentas_ShouldReturnNull_WhenApiReturnsServerError() + { + var (service, _) = CreateServiceWithToken("", HttpStatusCode.InternalServerError); + + var result = await service.GetVentasAsync(); + + Assert.Null(result); + } + + [Fact] + public async Task GetVentas_ShouldReturnNull_WhenMissingToken() + { + var (service, _) = CreateServiceWithoutToken(); + + var result = await service.GetVentasAsync(); + + Assert.Null(result); + } +} diff --git a/tests/WebDevSecOps.SecurityTests/SAST/VentaSecurityTests.cs b/tests/WebDevSecOps.SecurityTests/SAST/VentaSecurityTests.cs new file mode 100644 index 0000000..8af8e65 --- /dev/null +++ b/tests/WebDevSecOps.SecurityTests/SAST/VentaSecurityTests.cs @@ -0,0 +1,209 @@ +using System.Net; +using Microsoft.AspNetCore.Authentication.Cookies; +using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Mvc.Testing; +using Microsoft.Extensions.DependencyInjection; +using Microsoft.Extensions.DependencyInjection.Extensions; +using WebDevSecOps.SecurityTests.Common; +using WebDevSecOps.Services; + +namespace WebDevSecOps.SecurityTests.SAST; + +public class VentaSecurityTests +{ + private static WebApplicationFactory CreateFactory() + { + return new WebApplicationFactory() + .WithWebHostBuilder(builder => + { + builder.ConfigureServices(services => + { + services.RemoveAll(); + services.AddSingleton(new FakeAuthService()); + + services.PostConfigure( + CookieAuthenticationDefaults.AuthenticationScheme, + options => options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest); + }); + }); + } + + private static (WebApplicationFactory Factory, HttpClient Client) CreateUnauthenticatedClient() + { + var factory = new WebApplicationFactory(); + var client = factory.CreateClient(new WebApplicationFactoryClientOptions + { + AllowAutoRedirect = false, + HandleCookies = true, + }); + return (factory, client); + } + + private static async Task AuthenticateAsync(HttpClient client) + { + var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/Login"); + + var form = SecurityTestHelpers.ToFormPayload(new Dictionary + { + { "__RequestVerificationToken", token }, + { "Input.Username", "admin" }, + { "Input.Password", "Admin@123!" }, + }); + + await client.PostAsync("/Login", form); + } + + [Fact] + public async Task VentaIndex_RequiresAuthentication() + { + var (factory, client) = CreateUnauthenticatedClient(); + using (factory) + using (client) + { + var (status, _) = await SecurityTestHelpers.GetAsync(client, "/Venta/Index"); + Assert.Equal((int)HttpStatusCode.Redirect, status); + } + } + + [Fact] + public async Task VentaCreate_RequiresAuthentication() + { + var (factory, client) = CreateUnauthenticatedClient(); + using (factory) + using (client) + { + var (status, _) = await SecurityTestHelpers.GetAsync(client, "/Venta/Create"); + Assert.Equal((int)HttpStatusCode.Redirect, status); + } + } + + [Theory] + [InlineData("")] + [InlineData(" ")] + [InlineData(null)] + public async Task VentaCreate_RejectsEmptyIdCliCliente(string? id) + { + using var factory = CreateFactory(); + using var client = factory.CreateClient(new WebApplicationFactoryClientOptions + { + AllowAutoRedirect = false, + HandleCookies = true, + }); + + await AuthenticateAsync(client); + var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/Venta/Create"); + + var form = SecurityTestHelpers.ToFormPayload(new Dictionary + { + { "__RequestVerificationToken", token }, + { "IdCliCliente", id ?? "" }, + { "IdSegUsuario", "1" }, + }); + + var (status, body) = await SecurityTestHelpers.PostAsync(client, "/Venta/Create", form); + Assert.Equal((int)HttpStatusCode.OK, status); + Assert.Contains("obligatorio", body); + } + + [Theory] + [InlineData("")] + [InlineData(" ")] + [InlineData(null)] + public async Task VentaCreate_RejectsEmptyIdSegUsuario(string? id) + { + using var factory = CreateFactory(); + using var client = factory.CreateClient(new WebApplicationFactoryClientOptions + { + AllowAutoRedirect = false, + HandleCookies = true, + }); + + await AuthenticateAsync(client); + var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/Venta/Create"); + + var form = SecurityTestHelpers.ToFormPayload(new Dictionary + { + { "__RequestVerificationToken", token }, + { "IdCliCliente", "1" }, + { "IdSegUsuario", id ?? "" }, + }); + + var (status, body) = await SecurityTestHelpers.PostAsync(client, "/Venta/Create", form); + Assert.Equal((int)HttpStatusCode.OK, status); + Assert.Contains("obligatorio", body); + } + + [Fact] + public async Task VentaCreate_RejectsInvalidIdCliCliente() + { + using var factory = CreateFactory(); + using var client = factory.CreateClient(new WebApplicationFactoryClientOptions + { + AllowAutoRedirect = false, + HandleCookies = true, + }); + + await AuthenticateAsync(client); + var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/Venta/Create"); + + var form = SecurityTestHelpers.ToFormPayload(new Dictionary + { + { "__RequestVerificationToken", token }, + { "IdCliCliente", "not-a-number" }, + { "IdSegUsuario", "1" }, + }); + + var (status, body) = await SecurityTestHelpers.PostAsync(client, "/Venta/Create", form); + Assert.Equal((int)HttpStatusCode.OK, status); + Assert.Contains("not valid", body.ToLowerInvariant()); + } + + [Fact] + public async Task VentaCreate_RejectsInvalidIdSegUsuario() + { + using var factory = CreateFactory(); + using var client = factory.CreateClient(new WebApplicationFactoryClientOptions + { + AllowAutoRedirect = false, + HandleCookies = true, + }); + + await AuthenticateAsync(client); + var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/Venta/Create"); + + var form = SecurityTestHelpers.ToFormPayload(new Dictionary + { + { "__RequestVerificationToken", token }, + { "IdCliCliente", "1" }, + { "IdSegUsuario", "not-a-number" }, + }); + + var (status, body) = await SecurityTestHelpers.PostAsync(client, "/Venta/Create", form); + Assert.Equal((int)HttpStatusCode.OK, status); + Assert.Contains("not valid", body.ToLowerInvariant()); + } + + [Fact] + public async Task ClientesAutocomplete_RequiresAuthentication() + { + var (factory, client) = CreateUnauthenticatedClient(); + using (factory) + using (client) + { + var (status, _) = await SecurityTestHelpers.GetAsync(client, "/Venta/ClientesAutocomplete?texto=Maria"); + Assert.Equal((int)HttpStatusCode.Redirect, status); + } + } + + [Fact] + public async Task UsuariosAutocomplete_RequiresAuthentication() + { + var (factory, client) = CreateUnauthenticatedClient(); + using (factory) + using (client) + { + var (status, _) = await SecurityTestHelpers.GetAsync(client, "/Venta/UsuariosAutocomplete?texto=admin"); + Assert.Equal((int)HttpStatusCode.Redirect, status); + } + } +} diff --git a/tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs b/tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs index 3e599e2..bdbfdd4 100644 --- a/tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs +++ b/tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs @@ -441,6 +441,89 @@ public static class ContractTestData Status = 409 }; + // ======================================================================== + // Venta domain model + // ======================================================================== + + public static VenCatEstado ValidVenCatEstado => new() + { + Id = 1, + StrValor = "Activa", + StrDescripcion = "Venta activa" + }; + + public static PaginatedResponse ValidVenCatEstadoPaginatedResponse => new() + { + Items = [ValidVenCatEstado], + TotalCount = 1, + PageNumber = 1, + PageSize = 100, + TotalPages = 1 + }; + + public static Venta ValidVenta => new() + { + Id = 1, + IdCliCliente = 1, + StrNombreCliente = "Maria Garcia", + IdSegUsuario = 1, + StrNombreUsuario = "admin", + IdVenCatEstado = 1, + StrEstado = "Activa", + DteFechaHoraCompra = new DateTime(2026, 7, 14, 10, 30, 0, DateTimeKind.Utc), + StrClaveVenta = "V-000001", + RowVersion = _rowVersion + }; + + public static PaginatedResponse ValidVentaPaginatedResponse => new() + { + Items = [ValidVenta], + TotalCount = 1, + PageNumber = 1, + PageSize = 10, + TotalPages = 1 + }; + + public static PaginatedResponse EmptyVentaPaginatedResponse => new() + { + Items = [], + TotalCount = 0, + PageNumber = 1, + PageSize = 10, + TotalPages = 0 + }; + + public static VentaCreateViewModel ValidVentaCreateViewModel => new() + { + IdCliCliente = 1, + IdSegUsuario = 1, + StrNombreCliente = "Maria Garcia", + StrNombreUsuario = "admin" + }; + + public static List ValidClienteAutocompleteList => new() + { + new CliClienteAutocompleteDto { Id = 1, StrNombreCliente = "Maria Garcia" }, + new CliClienteAutocompleteDto { Id = 2, StrNombreCliente = "Juan Perez" } + }; + + public static List ValidUsuarioAutocompleteList => new() + { + new SegUsuarioAutocompleteDto { Id = 1, StrNombre = "admin" }, + new SegUsuarioAutocompleteDto { Id = 2, StrNombre = "vendedor1" } + }; + + public static ApiErrorResponse VentaValidationApiError => new() + { + Title = "Validation Error", + Detail = "One or more validation errors occurred.", + Status = 400, + Errors = new Dictionary + { + ["idCliCliente"] = ["El cliente es obligatorio."] + } + }; + public const string TestToken = "eyJhbGciOiJIUzI1NiJ9.dGVzdC1kYXRhLW5vdC1hLXJlYWwtc2VjcmV0"; public const string ConflictMessage = "El registro fue modificado por otro usuario. Recargue la p\u00e1gina e intente nuevamente."; public const string MissingTokenMessage = "Error de autenticaci\u00f3n. Inicie sesi\u00f3n nuevamente."; diff --git a/tests/WebDevSecOps.UnitTests/Pages/Ventas/CreateTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Ventas/CreateTests.cs new file mode 100644 index 0000000..862bb78 --- /dev/null +++ b/tests/WebDevSecOps.UnitTests/Pages/Ventas/CreateTests.cs @@ -0,0 +1,186 @@ +using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.ViewFeatures; +using Microsoft.Extensions.Logging; +using Moq; +using WebDevSecOps.Controllers; +using WebDevSecOps.Models; +using WebDevSecOps.Services; +using WebDevSecOps.UnitTests.Common; + +namespace WebDevSecOps.UnitTests; + +public class VentaCreateTests +{ + private static (VentaController Controller, Mock ServiceMock, Mock EstadoMock, Mock ClienteMock, Mock UsuarioMock, Mock> LoggerMock) CreateController() + { + var serviceMock = new Mock(); + var estadoMock = new Mock(); + var clienteMock = new Mock(); + var usuarioMock = new Mock(); + var loggerMock = new Mock>(); + var controller = new VentaController(serviceMock.Object, estadoMock.Object, clienteMock.Object, usuarioMock.Object, loggerMock.Object); + + controller.ControllerContext = new ControllerContext + { + HttpContext = new DefaultHttpContext() + }; + controller.TempData = new TempDataDictionary( + new DefaultHttpContext(), + Mock.Of()); + + return (controller, serviceMock, estadoMock, clienteMock, usuarioMock, loggerMock); + } + + [Fact] + public async Task Create_Get_ReturnsView() + { + var (controller, _, _, _, _, _) = CreateController(); + + var result = await controller.Create(); + + var viewResult = Assert.IsType(result); + Assert.Null(viewResult.Model); + } + + [Fact] + public async Task Create_Post_ReturnsRedirectToIndex_WhenSuccess() + { + var (controller, serviceMock, _, _, _, _) = CreateController(); + + serviceMock + .Setup(x => x.CreateVentaAsync(It.IsAny(), It.IsAny())) + .ReturnsAsync(OperationResult.Ok()); + + var result = await controller.Create(ContractTestData.ValidVentaCreateViewModel, CancellationToken.None); + + var redirectResult = Assert.IsType(result); + Assert.Equal("Index", redirectResult.ActionName); + Assert.Equal("Venta creada exitosamente.", controller.TempData["Success"]); + } + + [Fact] + public async Task Create_Post_ReturnsViewWithModel_WhenModelInvalid() + { + var (controller, _, _, _, _, _) = CreateController(); + + controller.ModelState.AddModelError("IdCliCliente", "Required"); + + var result = await controller.Create(ContractTestData.ValidVentaCreateViewModel, CancellationToken.None); + + var viewResult = Assert.IsType(result); + Assert.IsType(viewResult.Model); + } + + [Fact] + public async Task Create_Post_ReturnsViewWithModel_WhenServiceFails() + { + var (controller, serviceMock, _, _, _, _) = CreateController(); + + serviceMock + .Setup(x => x.CreateVentaAsync(It.IsAny(), It.IsAny())) + .ReturnsAsync(OperationResult.Fail("Error al crear la venta.")); + + var result = await controller.Create(ContractTestData.ValidVentaCreateViewModel, CancellationToken.None); + + var viewResult = Assert.IsType(result); + Assert.IsType(viewResult.Model); + } + + [Fact] + public async Task Create_Post_MapsFieldErrors_WhenServiceReturnsFieldErrors() + { + var (controller, serviceMock, _, _, _, _) = CreateController(); + + var fieldErrors = new Dictionary + { + ["idCliCliente"] = ["El cliente no existe."] + }; + + serviceMock + .Setup(x => x.CreateVentaAsync(It.IsAny(), It.IsAny())) + .ReturnsAsync(OperationResult.Fail(fieldErrors, "Validation Error")); + + var result = await controller.Create(ContractTestData.ValidVentaCreateViewModel, CancellationToken.None); + + var viewResult = Assert.IsType(result); + Assert.IsType(viewResult.Model); + Assert.False(controller.ViewData.ModelState.IsValid); + Assert.True(controller.ViewData.ModelState.ContainsKey(nameof(VentaCreateViewModel.IdCliCliente))); + } + + [Fact] + public async Task ClientesAutocomplete_ReturnsEmpty_WhenTextoLessThan2() + { + var (controller, _, _, _, _, _) = CreateController(); + + var result = await controller.ClientesAutocomplete("a"); + + var jsonResult = Assert.IsType(result); + var list = Assert.IsType>(jsonResult.Value); + Assert.Empty(list); + } + + [Fact] + public async Task ClientesAutocomplete_ReturnsData_WhenTextoIsValid() + { + var (controller, _, _, clienteMock, _, _) = CreateController(); + + clienteMock + .Setup(x => x.AutocompleteClientesAsync("Maria", 10, It.IsAny())) + .ReturnsAsync(ContractTestData.ValidClienteAutocompleteList); + + var result = await controller.ClientesAutocomplete("Maria"); + + var jsonResult = Assert.IsType(result); + var list = Assert.IsType>(jsonResult.Value); + Assert.Equal(2, list.Count); + Assert.Equal("Maria Garcia", list[0].StrNombreCliente); + } + + [Fact] + public async Task UsuariosAutocomplete_ReturnsEmpty_WhenTextoLessThan2() + { + var (controller, _, _, _, _, _) = CreateController(); + + var result = await controller.UsuariosAutocomplete("b"); + + var jsonResult = Assert.IsType(result); + var list = Assert.IsType>(jsonResult.Value); + Assert.Empty(list); + } + + [Fact] + public async Task UsuariosAutocomplete_ReturnsData_WhenTextoIsValid() + { + var (controller, _, _, _, usuarioMock, _) = CreateController(); + + usuarioMock + .Setup(x => x.AutocompleteUsuariosAsync("admin", 10, It.IsAny())) + .ReturnsAsync(ContractTestData.ValidUsuarioAutocompleteList); + + var result = await controller.UsuariosAutocomplete("admin"); + + var jsonResult = Assert.IsType(result); + var list = Assert.IsType>(jsonResult.Value); + Assert.Equal(2, list.Count); + Assert.Equal("admin", list[0].StrNombre); + } + + [Fact] + public async Task Create_Post_ReturnsViewWithGeneralError_WhenServiceErrorMessage() + { + var (controller, serviceMock, _, _, _, _) = CreateController(); + + serviceMock + .Setup(x => x.CreateVentaAsync(It.IsAny(), It.IsAny())) + .ReturnsAsync(OperationResult.Fail("Error de conexión.")); + + var result = await controller.Create(ContractTestData.ValidVentaCreateViewModel, CancellationToken.None); + + var viewResult = Assert.IsType(result); + Assert.IsType(viewResult.Model); + Assert.False(controller.ViewData.ModelState.IsValid); + Assert.True(controller.ViewData.ModelState.ContainsKey(string.Empty)); + } +} diff --git a/tests/WebDevSecOps.UnitTests/Pages/Ventas/IndexTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Ventas/IndexTests.cs new file mode 100644 index 0000000..9e6650d --- /dev/null +++ b/tests/WebDevSecOps.UnitTests/Pages/Ventas/IndexTests.cs @@ -0,0 +1,220 @@ +using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Mvc.ViewFeatures; +using Microsoft.Extensions.Logging; +using Moq; +using WebDevSecOps.Controllers; +using WebDevSecOps.Models; +using WebDevSecOps.Services; +using WebDevSecOps.UnitTests.Common; + +namespace WebDevSecOps.UnitTests; + +public class VentaIndexTests +{ + private static (VentaController Controller, Mock ServiceMock, Mock EstadoMock, Mock> LoggerMock) CreateController() + { + var serviceMock = new Mock(); + var estadoMock = new Mock(); + var clienteMock = new Mock(); + var usuarioMock = new Mock(); + var loggerMock = new Mock>(); + var controller = new VentaController(serviceMock.Object, estadoMock.Object, clienteMock.Object, usuarioMock.Object, loggerMock.Object); + + controller.ControllerContext = new ControllerContext + { + HttpContext = new DefaultHttpContext() + }; + controller.TempData = new TempDataDictionary( + new DefaultHttpContext(), + Mock.Of()); + + return (controller, serviceMock, estadoMock, loggerMock); + } + + [Fact] + public async Task Index_ReturnsViewWithPaginatedResponse_WhenServiceReturnsData() + { + var (controller, serviceMock, estadoMock, _) = CreateController(); + + estadoMock + .Setup(x => x.GetAllAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVenCatEstadoPaginatedResponse); + + serviceMock + .Setup(x => x.GetVentasAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVentaPaginatedResponse); + + var result = await controller.Index(); + + var viewResult = Assert.IsType(result); + var model = Assert.IsType>(viewResult.Model); + Assert.Single(model.Items); + Assert.Equal("V-000001", model.Items[0].StrClaveVenta); + Assert.Null(controller.TempData["Error"]); + } + + [Fact] + public async Task Index_ReturnsViewWithNullModel_WhenServiceReturnsNull() + { + var (controller, serviceMock, estadoMock, _) = CreateController(); + + estadoMock + .Setup(x => x.GetAllAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVenCatEstadoPaginatedResponse); + + serviceMock + .Setup(x => x.GetVentasAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync((PaginatedResponse?)null); + + var result = await controller.Index(); + + var viewResult = Assert.IsType(result); + Assert.Null(viewResult.Model); + Assert.Equal("No se pudieron cargar las ventas.", controller.TempData["Error"]); + } + + [Fact] + public async Task Index_UsesDefaultPagination_WhenNoParametersProvided() + { + var (controller, serviceMock, estadoMock, _) = CreateController(); + + estadoMock + .Setup(x => x.GetAllAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVenCatEstadoPaginatedResponse); + + var capturedPageNumber = 0; + var capturedPageSize = 0; + + serviceMock + .Setup(x => x.GetVentasAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .Callback((pn, ps, _) => + { + capturedPageNumber = pn; + capturedPageSize = ps; + }) + .ReturnsAsync(new PaginatedResponse()); + + await controller.Index(); + + Assert.Equal(1, capturedPageNumber); + Assert.Equal(10, capturedPageSize); + } + + [Fact] + public async Task Index_CallsSearch_WhenTextoProvided() + { + var (controller, serviceMock, estadoMock, _) = CreateController(); + + estadoMock + .Setup(x => x.GetAllAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVenCatEstadoPaginatedResponse); + + serviceMock + .Setup(x => x.SearchVentasAsync(It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVentaPaginatedResponse); + + await controller.Index(texto: "V-000001"); + + serviceMock.Verify( + x => x.SearchVentasAsync("V-000001", null, null, 1, 10, It.IsAny()), + Times.Once); + + serviceMock.Verify( + x => x.GetVentasAsync(It.IsAny(), It.IsAny(), It.IsAny()), + Times.Never); + } + + [Fact] + public async Task Index_CallsSearch_WhenFechasProvided() + { + var (controller, serviceMock, estadoMock, _) = CreateController(); + + estadoMock + .Setup(x => x.GetAllAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVenCatEstadoPaginatedResponse); + + serviceMock + .Setup(x => x.SearchVentasAsync(It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVentaPaginatedResponse); + + var desde = new DateTime(2026, 7, 1, 0, 0, 0, DateTimeKind.Utc); + var hasta = new DateTime(2026, 7, 31, 0, 0, 0, DateTimeKind.Utc); + + await controller.Index(dteFechaInicio: desde, dteFechaFin: hasta); + + serviceMock.Verify( + x => x.SearchVentasAsync(null, desde, hasta, 1, 10, It.IsAny()), + Times.Once); + } + + [Fact] + public async Task Index_CallsGetAll_WhenNoFiltersProvided() + { + var (controller, serviceMock, estadoMock, _) = CreateController(); + + estadoMock + .Setup(x => x.GetAllAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVenCatEstadoPaginatedResponse); + + serviceMock + .Setup(x => x.GetVentasAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVentaPaginatedResponse); + + await controller.Index(); + + serviceMock.Verify( + x => x.GetVentasAsync(1, 10, It.IsAny()), + Times.Once); + + serviceMock.Verify( + x => x.SearchVentasAsync(It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny()), + Times.Never); + } + + [Fact] + public async Task Index_LogsWarning_WhenServiceReturnsNull() + { + var (controller, serviceMock, estadoMock, loggerMock) = CreateController(); + + estadoMock + .Setup(x => x.GetAllAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVenCatEstadoPaginatedResponse); + + serviceMock + .Setup(x => x.GetVentasAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync((PaginatedResponse?)null); + + await controller.Index(); + + loggerMock.Verify( + x => x.Log( + LogLevel.Warning, + It.IsAny(), + It.Is((v, t) => v!.ToString()!.Contains("Failed to load ventas")), + It.IsAny(), + It.Is>((v, t) => true)), + Times.Once); + } + + [Fact] + public async Task Index_LoadsEstadoVentaDict() + { + var (controller, serviceMock, estadoMock, _) = CreateController(); + + estadoMock + .Setup(x => x.GetAllAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVenCatEstadoPaginatedResponse); + + serviceMock + .Setup(x => x.GetVentasAsync(It.IsAny(), It.IsAny(), It.IsAny())) + .ReturnsAsync(ContractTestData.ValidVentaPaginatedResponse); + + await controller.Index(); + + var dict = controller.ViewBag.EstadoVentaDict as Dictionary; + Assert.NotNull(dict); + Assert.Single(dict); + Assert.Equal("Activa", dict[1]); + } +}