.NET 6应用基于IConfiguration配置DataProtection的测试困境与咨询

我有一个可在AWS Lambda云环境和物理服务器运行的.NET 6 Web应用，希望根据当前环境差异化配置DataProtection。最初通过IConfiguration实现的方案如下：

// Program.cs
WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
// [省略：builder.Configuration的初始化]
// [省略：builder.Services的配置]
ConfigureDpApi(builder);

WebApplication app = builder.Build();
// [省略：应用管道配置]

app.Run();

static void ConfigureDpApi(WebApplicationBuilder builder)
{
    AppConfiguration appConfig = builder.Configuration.Get<AppConfiguration>();
    if (appConfig.EnvironmentType == "AWS")
    {
        builder.Services.AddDataProtection()
            .SetApplicationName(applicationName: "myapp")
            .PersistKeysToAWSSystemsManager(parameterNamePrefix: "/myapp/api/DataProtection");
    }
    else if (appConfig.EnvironmentType == "ON_PREMISE")
    {
        var directoryInfos = new DirectoryInfo(appConfig.KeysFolder);
        var certificate = new X509Certificate2(appConfig.CertificatePath, appConfig.CertificatePassword);
        builder.Services.AddDataProtection()
            .SetApplicationName(applicationName: "myapp")
            .PersistKeysToFileSystem(directoryInfos)
            .ProtectKeysWithCertificate(certificate);
    }
    else
    {
        // 本地开发、测试环境不配置DPAPI
    }
}

但该方案在集成测试中失败，因为测试项目对配置源的覆盖操作晚于ConfigureDpApi的执行：

// 测试API客户端初始化
var factory = new WebApplicationFactory<Program>();
var apiClient = factory
    .WithWebHostBuilder(builder =>
    {
        // 此代码块在Program.ConfigureDpApi()之前执行
        builder.ConfigureAppConfiguration((hostingContext, config) =>
        {
            // 此代码逻辑在Program.ConfigureDpApi()之后执行
            config.Sources.Clear();
            config.SetBasePath(Directory.GetCurrentDirectory());
            config.AddJsonFile("appsettings.tests.json", optional: false);
        });
    })
    .CreateClient();

我需要让测试配置覆盖在DataProtection配置前生效，但目前的执行顺序无法满足需求。请问能否在WebApplicationBuilder.Build()后配置DataProtection？或是改用环境变量等替代方案？

解决方案 #

方案1：调整配置时机为服务构建后执行 #

将DataProtection的配置逻辑改为延迟执行，利用IConfigureOptions接口确保在配置源加载完成后读取配置值：

// Program.cs
WebApplicationBuilder builder = WebApplication.CreateBuilder(args);

// 绑定配置到选项类
builder.Services.Configure<AppConfiguration>(builder.Configuration);

// 基础DataProtection配置 + 延迟加载的环境差异化配置
builder.Services.AddDataProtection()
    .SetApplicationName("myapp")
    .Services.ConfigureOptions<ConfigureDataProtectionOptions>();

WebApplication app = builder.Build();
// [省略：应用管道配置]
app.Run();

// 新增配置选项类
public class ConfigureDataProtectionOptions : IConfigureOptions<DataProtectionOptions>
{
    private readonly AppConfiguration _appConfig;
    private readonly IServiceProvider _serviceProvider;

    public ConfigureDataProtectionOptions(IOptions<AppConfiguration> appConfig, IServiceProvider serviceProvider)
    {
        _appConfig = appConfig.Value;
        _serviceProvider = serviceProvider;
    }

    public void Configure(DataProtectionOptions options)
    {
        switch (_appConfig.EnvironmentType)
        {
            case "AWS":
                var awsBuilder = _serviceProvider.GetRequiredService<IAwsSystemsManagerDataProtectionBuilder>();
                awsBuilder.PersistKeysToAWSSystemsManager("/myapp/api/DataProtection");
                break;
            case "ON_PREMISE":
                var directory = new DirectoryInfo(_appConfig.KeysFolder);
                var certificate = new X509Certificate2(_appConfig.CertificatePath, _appConfig.CertificatePassword);
                var fileBuilder = _serviceProvider.GetRequiredService<IFileSystemDataProtectionBuilder>();
                fileBuilder.PersistKeysToFileSystem(directory);
                fileBuilder.ProtectKeysWithCertificate(certificate);
                break;
            // 测试/本地环境无需额外配置
        }
    }
}

这种方式会让差异化配置逻辑在服务容器构建完成后执行，此时测试项目的配置覆盖已经生效。

方案2：改用环境变量传递环境标识 #

放弃通过IConfiguration读取环境类型，直接用环境变量判断，测试时提前设置环境变量即可确保生效：

// 修改Program.cs中的ConfigureDpApi方法
static void ConfigureDpApi(WebApplicationBuilder builder)
{
    var environmentType = Environment.GetEnvironmentVariable("APP_ENVIRONMENT_TYPE");
    
    if (environmentType == "AWS")
    {
        builder.Services.AddDataProtection()
            .SetApplicationName("myapp")
            .PersistKeysToAWSSystemsManager("/myapp/api/DataProtection");
    }
    else if (environmentType == "ON_PREMISE")
    {
        var appConfig = builder.Configuration.Get<AppConfiguration>();
        var directoryInfos = new DirectoryInfo(appConfig.KeysFolder);
        var certificate = new X509Certificate2(appConfig.CertificatePath, appConfig.CertificatePassword);
        builder.Services.AddDataProtection()
            .SetApplicationName("myapp")
            .PersistKeysToFileSystem(directoryInfos)
            .ProtectKeysWithCertificate(certificate);
    }
    else
    {
        // 本地开发、测试环境不配置DPAPI
    }
}

测试项目中提前设置环境变量：

// 测试初始化前设置环境变量
Environment.SetEnvironmentVariable("APP_ENVIRONMENT_TYPE", "TEST");

var factory = new WebApplicationFactory<Program>();
var apiClient = factory
    .WithWebHostBuilder(builder =>
    {
        builder.ConfigureAppConfiguration((hostingContext, config) =>
        {
            config.Sources.Clear();
            config.SetBasePath(Directory.GetCurrentDirectory());
            config.AddJsonFile("appsettings.tests.json", optional: false);
        });
    })
    .CreateClient();

方案3：调整测试项目的配置覆盖阶段 #

使用ConfigureHostConfiguration替代ConfigureAppConfiguration，在主机初始化的早期阶段替换配置源，这个阶段早于Program.cs中的逻辑执行：

var factory = new WebApplicationFactory<Program>();
var apiClient = factory
    .WithWebHostBuilder(builder =>
    {
        // 主机配置阶段替换配置源，确保早于Program中的逻辑执行
        builder.ConfigureHostConfiguration(config =>
        {
            config.Sources.Clear();
            config.SetBasePath(Directory.GetCurrentDirectory());
            config.AddJsonFile("appsettings.tests.json", optional: false);
        });
    })
    .CreateClient();

ConfigureHostConfiguration的配置会被WebApplicationBuilder.Configuration继承，确保ConfigureDpApi执行时能读取到测试配置。

内容的提问来源于stack exchange，提问作者Maxime Rossini