test(#1695): cover identity-form vs username branching in ResolveHumanGuidAsync (#1711)

The PermissionService fix landed in PR #1691 as one of several changes; #1695
remained open because the test coverage that locks in the regression behaviour
hadn't followed. This adds the four facts the issue called for so the bug
cannot silently come back:

- ResolveHumanGuidAsync_IdentityFormGuid_ResolvesDirectly: 32-hex "N" form
  short-circuits, IHumanIdentityResolver is never invoked.
- ResolveHumanGuidAsync_IdentityFormGuid_DashedForm_ResolvesDirectly:
  GuidFormatter.TryParse accepts both "N" and "D" forms, so dashed callers
  also bypass the resolver.
- ResolveHumanGuidAsync_LegacyUsername_FallsThroughToResolver: legacy
  username-form callers (e.g. local-dev-user) still hit the resolver and
  the upsert-on-first-contact path is preserved.
- ResolveHumanGuidAsync_IdentityForm_DoesNotCreatePhantomRow: regression
  test against the spring.humans phantom-row symptom — asserts
  ResolveByUsernameAsync is never invoked across both identity-form
  shapes, which is what guarantees the resolver's upsert-on-miss can no
  longer create a phantom row keyed by GUID-hex.

Tests inject a real ServiceCollection-backed IServiceScopeFactory so the
service exercises the production scope-resolution path and the substituted
IHumanIdentityResolver records every call (matching the pattern used in
UnitCreationServiceTests).

Closes #1695.

Co-authored-by: savasp-agent[bot] <275188714+savasp-agent[bot]@users.noreply.github.com>

Author: savasp-agent[bot]

tests/Cvoya.Spring.Dapr.Tests/Auth/PermissionServiceTests.cs

@@ -6,13 +6,15 @@ namespace Cvoya.Spring.Dapr.Tests.Auth;
 using Cvoya.Spring.Core.Directory;
 using Cvoya.Spring.Core.Identifiers;
 using Cvoya.Spring.Core.Messaging;
+using Cvoya.Spring.Core.Security;
 using Cvoya.Spring.Core.Units;
 using Cvoya.Spring.Dapr.Actors;
 using Cvoya.Spring.Dapr.Auth;
 
 using global::Dapr.Actors;
 using global::Dapr.Actors.Client;
 
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 
 using NSubstitute;
@@ -330,4 +332,110 @@ public async Task ResolveEffectivePermissionAsync_DirectoryHasNoEntry_ReturnsNul
 
         result.ShouldBeNull();
     }
+
+    // -- #1695 ----------------------------------------------------------
+    // Identity-form callers (human:id:<guid>) hand the GUID-hex through
+    // PermissionService directly. The pre-fix code blindly passed every
+    // humanId string to IHumanIdentityResolver.ResolveByUsernameAsync,
+    // which on miss upserted a phantom row keyed by the GUID-hex with
+    // its own brand-new UUID — the unit's permission map then 403'd the
+    // legitimate caller and the spring.humans table grew a leaking row
+    // per send. The guard short-circuits the resolver when humanId
+    // already parses as a Guid, so neither symptom can recur.
+
+    [Fact]
+    public async Task ResolveHumanGuidAsync_IdentityFormGuid_ResolvesDirectly()
+    {
+        // Identity-form: 32-hex-char "N" form (the wire shape produced by
+        // GuidFormatter.Format and emitted on the From address path
+        // component). Must round-trip through the service to the unit
+        // permission map without ever calling the resolver.
+        var ct = TestContext.Current.CancellationToken;
+        var resolver = Substitute.For<IHumanIdentityResolver>();
+        var service = BuildServiceWithResolver(resolver);
+
+        var identityFormHex = HumanGuid.ToString("N");
+        Unit(UnitOneId).GetHumanPermissionAsync(HumanGuid, ct).Returns(PermissionLevel.Owner);
+
+        var result = await service.ResolvePermissionAsync(identityFormHex, Id(UnitOneId), ct);
+
+        result.ShouldBe(PermissionLevel.Owner);
+        await resolver.DidNotReceive().ResolveByUsernameAsync(
+            Arg.Any<string>(), Arg.Any<string?>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task ResolveHumanGuidAsync_IdentityFormGuid_DashedForm_ResolvesDirectly()
+    {
+        // GuidFormatter.TryParse accepts both "N" and "D" forms — assert
+        // the dashed shape also short-circuits (callers in either form
+        // must land on the same row, per the issue's prescription).
+        var ct = TestContext.Current.CancellationToken;
+        var resolver = Substitute.For<IHumanIdentityResolver>();
+        var service = BuildServiceWithResolver(resolver);
+
+        Unit(UnitOneId).GetHumanPermissionAsync(HumanGuid, ct).Returns(PermissionLevel.Owner);
+
+        var result = await service.ResolvePermissionAsync(HumanIdString, Id(UnitOneId), ct);
+
+        result.ShouldBe(PermissionLevel.Owner);
+        await resolver.DidNotReceive().ResolveByUsernameAsync(
+            Arg.Any<string>(), Arg.Any<string?>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task ResolveHumanGuidAsync_LegacyUsername_FallsThroughToResolver()
+    {
+        // Username-form callers (e.g. "local-dev-user", cloud OAuth
+        // usernames) must still flow through the resolver so the
+        // upsert-on-first-contact behaviour is preserved.
+        var ct = TestContext.Current.CancellationToken;
+        var resolver = Substitute.For<IHumanIdentityResolver>();
+        resolver.ResolveByUsernameAsync("local-dev-user", null, Arg.Any<CancellationToken>())
+            .Returns(HumanGuid);
+        var service = BuildServiceWithResolver(resolver);
+
+        Unit(UnitOneId).GetHumanPermissionAsync(HumanGuid, ct).Returns(PermissionLevel.Owner);
+
+        var result = await service.ResolvePermissionAsync("local-dev-user", Id(UnitOneId), ct);
+
+        result.ShouldBe(PermissionLevel.Owner);
+        await resolver.Received(1).ResolveByUsernameAsync(
+            "local-dev-user", null, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task ResolveHumanGuidAsync_IdentityForm_DoesNotCreatePhantomRow()
+    {
+        // Regression test for the phantom-humans-row symptom in #1695.
+        // Sending a message with an identity-form From address used to
+        // call ResolveByUsernameAsync(<guid-hex>) → resolver upsert
+        // created a row whose username was the GUID-hex. We assert
+        // ResolveByUsernameAsync is never invoked for any of the input
+        // shapes the AuthenticatedCallerAccessor produces (#1485 / #1491
+        // shape: bare "N" form, plus the dashed "D" form for resilience).
+        var ct = TestContext.Current.CancellationToken;
+        var resolver = Substitute.For<IHumanIdentityResolver>();
+        var service = BuildServiceWithResolver(resolver);
+
+        await service.ResolvePermissionAsync(HumanGuid.ToString("N"), Id(UnitOneId), ct);
+        await service.ResolvePermissionAsync(HumanGuid.ToString("D"), Id(UnitOneId), ct);
+
+        await resolver.DidNotReceive().ResolveByUsernameAsync(
+            Arg.Any<string>(), Arg.Any<string?>(), Arg.Any<CancellationToken>());
+    }
+
+    private PermissionService BuildServiceWithResolver(IHumanIdentityResolver resolver)
+    {
+        var services = new ServiceCollection();
+        services.AddScoped(_ => resolver);
+        var scopeFactory = services.BuildServiceProvider().GetRequiredService<IServiceScopeFactory>();
+
+        return new PermissionService(
+            _actorProxyFactory,
+            _hierarchyResolver,
+            _directoryService,
+            _loggerFactory,
+            scopeFactory);
+    }
 }