qbit-printing/dev/native-auth/client/NativeAuthDiscoveryChecks.cs

/*
 * Copyright 2026 Kingsrook, LLC
 * SPDX-License-Identifier: Apache-2.0
 */
using System.Net;
using System.Text.Json;
using Qqq.PrintAgent.Core.Authentication;
namespace Printing.NativeAuth;



/// <summary>Exercises the real native probe gate against bounded, credential-free HTTP responses.</summary>
internal static class NativeAuthDiscoveryChecks
{
   /// <summary>Accepts compatible printing releases while preserving the exact upstream grant requirement.</summary>
   private static readonly string[] s_channels = ["api"];



   /// <summary>Check the native grant and compatible extension using fake discovery responses.</summary>
   internal static async Task RunAsync()
   {
      (string PrintingVersion, string ApiVersion, bool NativeGrant, bool Accepted)[] cases =
      [
         ("2.0.0", "1.9.0", true, true),
         ("2.1.0", "1.9.0", true, true),
         ("2.9.17", "1.9.0", true, true),
         ("1.9.0", "1.9.0", true, false),
         ("3.0.0", "1.9.0", true, false),
         ("2.1", "1.9.0", true, false),
         ("2.01.0", "1.9.0", true, false),
         ("2.1.0-rc.1", "1.9.0", true, false),
         ("not-a-version", "1.9.0", true, false),
         ("2.1.0", "1.8.0", true, false),
         ("2.1.0", "1.10.0", true, false),
         ("2.1.0", "1.9.0", false, false),
      ];
      foreach((string printingVersion, string apiVersion, bool nativeGrant, bool expected) in cases)
      {
         using var handler = new DiscoveryHandler(printingVersion, apiVersion, nativeGrant);
         using var client = new QqqSessionClient(new Uri("https://printing.example.invalid"), handler);
         bool accepted = false;
         try
         {
            await NativeAuthDiscovery.DiscoverAsync(client, CancellationToken.None);
            accepted = true;
         }
         catch(QqqSessionException error) when(error.Failure == QqqSessionException.FailureKind.ConfigurationRequired)
         {
            // Expected for incompatible discovery: the case stays rejected and the comparison below judges it.
         }
         catch(InvalidDataException)
         {
            // Expected for malformed discovery values: the case stays rejected and the comparison below judges it.
         }
         catch(InvalidOperationException)
         {
            // Expected when native-session discovery is absent: the case stays rejected and judged below.
         }
         if(accepted != expected || handler.Requests != 1)
         {
            throw new InvalidDataException($"Native discovery compatibility case {printingVersion}/{apiVersion}/grant={nativeGrant} failed.");
         }
      }
      Console.WriteLine($"Native discovery compatibility checks passed: {cases.Length}.");
   }



   /// <summary>Supplies discovery only and fails if the probe attempts authenticated traffic.</summary>
   private sealed class DiscoveryHandler(string printingVersion, string apiVersion, bool nativeGrant) : HttpMessageHandler
   {
      /// <summary>Ensures rejected metadata still traversed the public HTTP discovery boundary.</summary>
      internal int Requests
      {
         get;



         private set;
      }



      /// <summary>Refuses any credential or request outside the public discovery boundary.</summary>
      protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
      {
         if(request.Method != HttpMethod.Get
            || !string.Equals(request.RequestUri?.AbsoluteUri, "https://printing.example.invalid/qqq/v1/version", StringComparison.Ordinal)
            || request.Headers.Contains("Cookie")
            || request.Headers.Contains("Authorization")
            || request.Headers.Contains("X-QQQ-Device-Id") || request.Headers.Contains("X-QQQ-Device-Token"))
         {
            throw new InvalidOperationException("Native discovery must precede authentication and device proof.");
         }
         Requests++;
         string[] features = nativeGrant
            ? ["version", "metaData", "processes", "processCancel", "extensions", "widgets", "nativeSessionLogin"]
            : ["version", "metaData", "processes", "processCancel", "extensions", "widgets"];
         string json = JsonSerializer.Serialize(new
         {
            apiVersion,
            features,
            clientChannels = s_channels,
            extensions = new[] { new { name = "printing", version = printingVersion, pathPrefix = "/qbit/printing" } }
         });
         return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK) { Content = new StringContent(json) });
      }
   }
}