[mckaragoz]

Adds an independent Identity Lab xUnit project at tests/CodeBeam.UltimateAuth.IdentityLab.Tests to verify sandbox isolation, role boundaries, provisioning integrity, and lifecycle behavior through actual services and policies.

The suite uses PostgreSQL 17 with Testcontainers 4.16.0, a separate database per test, and production migrations. Integration tests compose both Lab and framework persistence; focused tests replace selected framework stores/clients and authenticated-context sources. The project is included in the solution and a dedicated .NET 10 CI job uploads TRX results, including on failure.

Production source is unchanged. The failing regression remains enabled and is included in normal local and CI runs.

Test execution

Executed locally in Release with .NET SDK 10.0.403:

Suite / area	Passed	Failed	Skipped
Identity Lab — Security	15	0	0
Identity Lab — Authorization	10	0	0
Identity Lab — Services	20	0	0
Identity Lab — Provisioning	7	0	0
Identity Lab — Integration	14	0	0
Identity Lab — Regression	0	1	0
Identity Lab total	66	1	0
Existing unit tests	2,754	0	0
Existing integration tests	375	0	0
Existing EF integration tests	3	0	0

All 67 Identity Lab cases executed; the final run took 33 seconds after build. All 3,132 existing tests passed. git diff --check passed. Initial SDK/network/Docker access issues were resolved. The external PostgreSQL connection-string alternative was not separately exercised; remote CI results are not claimed.

Coverage matrix

Priority	Security boundary	Implemented coverage and limits
P0	Owner/User cannot acquire or delegate Ladmin	Public role-mutation policy and actual role-service denials; persisted assignments unchanged; legitimate registration/member provisioning controls
P0	System roles protected from demo operations	Hostile names, fixed demo-role IDs, ownership/status/target checks; actual Manager assignment succeeds and Ladmin delegation fails
P0	Forged authorization attributes and actor identity	Persisted admin guard; actual context factory replaces forged typed Ladmin attributes with stored Owner identity; provisioning actor mismatch denied
P0	Two-sandbox isolation	Foreign/missing read, update, delete, role and session targets denied; batch target validation and positive controls; session policy decisions do not exercise real session rows
P0	Ownership and sandbox status	Member management denied; owner deletion restrictions; active/passive/suspended policy behavior
P0	Provisioning and rollback	Token impostors denied; exact actor/target scope, unrelated target denial, one-shot consumption and revocation; real partial account hard-deleted after injected role-store failure
P0	Relational invariants and capacity	PostgreSQL migrations, duplicate-owner rollback, concurrent ownership uniqueness, cross-sandbox membership rejection, concurrent additions competing for one slot
P0	Deletion and repair	Membership cleanup ordering, owner protection, cross-sandbox preservation and scoped stale-member repair; complete framework deletion cleanup remains partial
P0	System-role identity integrity	Enabled failing regression for an Owner-named role carrying the Ladmin ID
P1	Functional authorization	Manager/Customer demo-store permissions, wildcard/admin permission filtering, duplicate registration, account-deletion ordering; standalone identifier availability and diagnostics transport remain gaps
P2	Trusted seeding	Real PostgreSQL seed repeatability, fixed administrator assignment count and exact Manager permissions
P2	Hosted transport and recovery	Full HTTP/cookie/CSRF authenticity, registration fault recovery, cancellation and restart scenarios remain untested

Detailed matrix: security-coverage.md

Execution report and reproduction: execution-report.md

Known failing regression

Regression/SystemRoleIdentityTests.Owner_name_with_admin_id_must_be_rejected_before_assignment reproduces a system-role ID validation gap:

1. Resolve normalized OWNER to a role with LabRoleIds.Admin.
2. Return no assignments for the regular target user.
3. Call LabRoleService.AssignAsync(singleTenant, target, "Owner").
4. The implementation assigns the returned Admin ID; the regression requires rejection before assignment and fails because no exception is thrown.

This requires malformed role data or a compromised store. Admin seed validation normally rejects mismatched IDs, and the helper is not a public role-mutation endpoint. It is a reproduced defense-in-depth integrity defect, not a demonstrated ordinary-user escalation. No production fix, test disabling, known-defect exclusion, or continue-on-error was added.

Remaining gaps and CI readiness

Full hosted HTTP/cookie identity authenticity, diagnostics transport, standalone identifier availability, complete deletion cleanup, owner/admin repair, registration failure recovery, and cancellation/restart boundaries remain partial or untested. Some services trust actor-key arguments supplied by callers; direct service tests do not establish transport-level authenticity.

This draft is not ready to become a required green CI gate: the preserved regression fails and needs separate triage and explicitly approved production work. Passing the other tests does not establish complete security coverage.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 70.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.96%. Comparing base (64d1dc5) to head (e7ac527).

Files with missing lines	Patch %	Lines
...ltimateAuth.IdentityLab/Services/LabRoleService.cs	70.00%	2 Missing and 1 partial ⚠️

❗ There is a different number of reports uploaded between BASE (64d1dc5) and HEAD (e7ac527). Click for more details.

HEAD has 3 uploads less than BASE

Flag	BASE (64d1dc5)	HEAD (e7ac527)
	3	0

Additional details and impacted files

@@             Coverage Diff             @@
##              dev     #124       +/-   ##
===========================================
- Coverage   86.75%   72.96%   -13.79%     
===========================================
  Files         681      775       +94     
  Lines       18902    23766     +4864     
  Branches     2291     3045      +754     
===========================================
+ Hits        16398    17341      +943     
- Misses       1760     5619     +3859     
- Partials      744      806       +62     

Flag	Coverage Δ
framework	86.74% <ø> (?)
identitylab	19.40% <70.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.