By the end of this session, you will be able to:

• Write unit tests for a service class using xUnit and Moq
• Spin up the real HTTP pipeline in a test with WebApplicationFactory
• Swap the production database for an in-memory one inside the test host
• Test authenticated endpoints by generating real JWTs in tests
• Decide what deserves a test — and what is a waste of your time

• A regression net. You change the pagination code in Session 12 and instantly learn that filtering broke
• Executable documentation. A test named Delete_WhenCallerIsNotOwner_ThrowsForbidden states a business rule better than a comment
• Design pressure. Code that is hard to test is usually code with too many responsibilities
• Speed. Re-running 200 assertions takes less time than clicking through Postman once
• Confidence to refactor. Without tests, working code is code nobody dares to touch

dotnet new xunit -n TaskManagerApi.Tests

dotnet sln add TaskManagerApi.Tests/TaskManagerApi.Tests.csproj

dotnet add TaskManagerApi.Tests reference TaskManagerApi.Api
dotnet add TaskManagerApi.Tests package Moq
dotnet add TaskManagerApi.Tests package FluentAssertions
dotnet add TaskManagerApi.Tests package Microsoft.AspNetCore.Mvc.Testing
dotnet add TaskManagerApi.Tests package Microsoft.EntityFrameworkCore.InMemory

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <Nullable>enable</Nullable>
    <IsPackable>false</IsPackable>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
    <PackageReference Include="xunit" Version="2.9.2" />
    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
    <PackageReference Include="Moq" Version="4.20.72" />
    <PackageReference Include="FluentAssertions" Version="6.12.1" />
    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.8" />
  </ItemGroup>

  <ItemGroup>
    <ProjectReference Include="..\TaskManagerApi.Api\TaskManagerApi.Api.csproj" />
  </ItemGroup>

</Project>

using FluentAssertions;
using TaskManagerApi.Api.Validation;
using Xunit;

namespace TaskManagerApi.Tests.Validation;

public class TaskValidatorTests
{
    [Fact]
    public void IsValidTitle_WhenTitleIsWhitespaceOnly_ReturnsFalse()
    {
        // Arrange
        var title = "   ";

        // Act
        var result = TaskValidator.IsValidTitle(title);

        // Assert
        result.Should().BeFalse();
    }
}

The convention used throughout this course: MethodUnderTest_Scenario_ExpectedResult

dotnet test

# Only tests whose full name contains TaskServiceTests
dotnet test --filter "FullyQualifiedName~TaskServiceTests"

# Only tests tagged with a trait
dotnet test --filter "Category=Integration"

# Full per-test output instead of a summary
dotnet test --logger "console;verbosity=detailed"

var repoMock = new Mock<ITaskRepository>();

// 1. Return a value for a specific argument
repoMock.Setup(r => r.GetByIdAsync(1))
        .ReturnsAsync(new TaskItem { Id = 1, Title = "Test task" });

// 2. Return null for anything else
repoMock.Setup(r => r.GetByIdAsync(It.IsAny<int>()))
        .ReturnsAsync((TaskItem?)null);

// 3. Make a call blow up
repoMock.Setup(r => r.SaveChangesAsync())
        .ThrowsAsync(new DbUpdateException("constraint violated"));

// .Object is the thing that actually implements ITaskRepository
ITaskRepository repository = repoMock.Object;

public class TaskServiceTests
{
    private readonly Mock<ITaskRepository> _repoMock = new();
    private readonly TaskService _sut;

    public TaskServiceTests()
    {
        _sut = new TaskService(_repoMock.Object);
    }

    [Fact]
    public async Task GetByIdAsync_WhenTaskExists_ReturnsTask()
    {
        var task = new TaskItem { Id = 1, Title = "Test task" };
        _repoMock.Setup(r => r.GetByIdAsync(1)).ReturnsAsync(task);

        var result = await _sut.GetByIdAsync(1);

        result.Should().NotBeNull();
        result!.Title.Should().Be("Test task");
    }
}

[Fact]
public async Task CreateAsync_WithValidDto_PersistsTaskOnce()
{
    var dto = new CreateTaskDto("Write report", DateTime.UtcNow.AddDays(3));

    await _sut.CreateAsync(dto, ownerId: 7);

    _repoMock.Verify(r => r.AddAsync(
        It.Is<TaskItem>(t => t.Title == "Write report" && t.OwnerId == 7)),
        Times.Once);

    _repoMock.Verify(r => r.SaveChangesAsync(), Times.Once);

    _repoMock.VerifyNoOtherCalls();
}

public class HealthEndpointTests : IClassFixture<WebApplicationFactory<Program>>
{
    private readonly HttpClient _client;

    public HealthEndpointTests(WebApplicationFactory<Program> factory)
    {
        _client = factory.CreateClient();
    }

    [Fact]
    public async Task GetHealth_ReturnsOkAndHealthyBody()
    {
        var response = await _client.GetAsync("/health");

        response.StatusCode.Should().Be(HttpStatusCode.OK);
        (await response.Content.ReadAsStringAsync()).Should().Be("Healthy");
    }
}

public class TasksEndpointTests : IClassFixture<WebApplicationFactory<Program>>
{
    private readonly HttpClient _client;

    public TasksEndpointTests(WebApplicationFactory<Program> factory)
    {
        _client = factory.WithWebHostBuilder(builder =>
        {
            builder.ConfigureServices(services =>
            {
                var descriptor = services.SingleOrDefault(
                    d => d.ServiceType == typeof(DbContextOptions<AppDbContext>));
                if (descriptor is not null) services.Remove(descriptor);

                services.AddDbContext<AppDbContext>(options =>
                    options.UseInMemoryDatabase("TestDb"));
            });
        }).CreateClient();
    }

    [Fact]
    public async Task GetTasks_ReturnsOk()
    {
        var response = await _client.GetAsync("/api/v1/tasks");

        response.StatusCode.Should().Be(HttpStatusCode.OK);
    }
}

public class TestApiFactory : WebApplicationFactory<Program>
{
    protected override void ConfigureWebHost(IWebHostBuilder builder)
    {
        builder.UseEnvironment("Testing");

        builder.ConfigureServices(services =>
        {
            var descriptor = services.SingleOrDefault(
                d => d.ServiceType == typeof(DbContextOptions<AppDbContext>));
            if (descriptor is not null) services.Remove(descriptor);

            services.AddDbContext<AppDbContext>(options =>
                options.UseInMemoryDatabase($"TestDb-{Guid.NewGuid()}"));

            using var provider = services.BuildServiceProvider();
            using var scope = provider.CreateScope();
            var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
            db.Database.EnsureCreated();
            Seed(db);
        });
    }

    private static void Seed(AppDbContext db)
    {
        db.Tasks.AddRange(
            new TaskItem { Id = 1, Title = "Seeded task",  OwnerId = 1 },
            new TaskItem { Id = 2, Title = "Another task", OwnerId = 2 });
        db.SaveChanges();
    }
}

[Fact]
public async Task GetTasks_ReturnsSeededTasksAsJson()
{
    var response = await _client.GetAsync("/api/v1/tasks");

    response.StatusCode.Should().Be(HttpStatusCode.OK);
    response.Content.Headers.ContentType!.MediaType
            .Should().Be("application/json");

    var tasks = await response.Content.ReadFromJsonAsync<List<TaskDto>>();

    tasks.Should().NotBeNull();
    tasks!.Should().Contain(t => t.Title == "Seeded task");
}

[Fact]
public async Task CreateTask_WithValidBody_Returns201WithLocation()
{
    var body = new { title = "From an integration test", dueDate = "2026-09-01" };

    var response = await _client.PostAsJsonAsync("/api/v1/tasks", body);

    response.StatusCode.Should().Be(HttpStatusCode.Created);
    response.Headers.Location.Should().NotBeNull();

    var created = await response.Content.ReadFromJsonAsync<TaskDto>();
    created!.Title.Should().Be("From an integration test");
}

The moment you add [Authorize], the integration tests you just wrote start failing like this:

{
  "Jwt": {
    "Issuer": "TaskManagerApi",
    "Audience": "TaskManagerApiClients",
    "Key": "test-signing-key-at-least-32-characters-long",
    "ExpiryMinutes": 15
  },
  "Logging": {
    "LogLevel": {
      "Default": "Warning"
    }
  }
}

public static class TestTokenGenerator
{
    public const string Key = "test-signing-key-at-least-32-characters-long";

    public static string Create(int userId, string role = "User")
    {
        var claims = new[]
        {
            new Claim(ClaimTypes.NameIdentifier, userId.ToString()),
            new Claim(ClaimTypes.Name, $"user{userId}@test.local"),
            new Claim(ClaimTypes.Role, role)
        };

        var signingKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Key));
        var credentials = new SigningCredentials(signingKey, SecurityAlgorithms.HmacSha256);

        var token = new JwtSecurityToken(
            issuer:   "TaskManagerApi",
            audience: "TaskManagerApiClients",
            claims:   claims,
            expires:  DateTime.UtcNow.AddMinutes(15),
            signingCredentials: credentials);

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

private HttpClient CreateAuthenticatedClient(int userId, string role = "User")
{
    var client = _factory.CreateClient();
    client.DefaultRequestHeaders.Authorization =
        new AuthenticationHeaderValue("Bearer", TestTokenGenerator.Create(userId, role));
    return client;
}

[Fact]
public async Task GetTasks_WithoutToken_Returns401()
{
    var response = await _factory.CreateClient().GetAsync("/api/v1/tasks");

    response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}

[Fact]
public async Task DeleteTask_WhenCallerIsNotOwner_Returns403()
{
    var client = CreateAuthenticatedClient(userId: 99);

    var response = await client.DeleteAsync("/api/v1/tasks/1");

    response.StatusCode.Should().Be(HttpStatusCode.Forbidden);
}

[Fact]
public async Task DeleteTask_AsAdmin_Returns204()
{
    var client = CreateAuthenticatedClient(userId: 99, role: "Admin");

    var response = await client.DeleteAsync("/api/v1/tasks/1");

    response.StatusCode.Should().Be(HttpStatusCode.NoContent);
}

public class TestAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
    public const string SchemeName = "TestScheme";

    public TestAuthHandler(
        IOptionsMonitor<AuthenticationSchemeOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder)
        : base(options, logger, encoder) { }

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        var claims = new[]
        {
            new Claim(ClaimTypes.NameIdentifier, "1"),
            new Claim(ClaimTypes.Role, "Admin")
        };

        var identity  = new ClaimsIdentity(claims, SchemeName);
        var principal = new ClaimsPrincipal(identity);
        var ticket    = new AuthenticationTicket(principal, SchemeName);

        return Task.FromResult(AuthenticateResult.Success(ticket));
    }
}

dotnet test --collect:"XPlat Code Coverage"

• Coverage tells you which lines ran — never whether the assertions were meaningful
• A test with no Assert at all still produces 100% coverage of the code it calls
• Use the report to find untested branches, especially the error paths you forgot
• Chasing a mandated percentage produces tests written to satisfy a metric, not to catch bugs
• 60–80% on business logic is a healthy place to be for this course's capstone

Write at least five unit tests against your own TaskService, mocking ITaskRepository with Moq:

Session 23 — Logging, Monitoring & Health Checks

• Structured logging with ILogger<T> and Serilog
• Log levels, scopes, and correlation IDs that survive across requests
• Health check endpoints for the API and its database
• What to log, and what must never appear in a log file

Add a TaskManagerApi.Tests project to your Task Management API containing both unit and integration tests, and commit it alongside the API.

• At least eight unit tests for TaskService using Moq, covering the five lab cases plus three of your own error paths
• At least one test using Verify(..., Times.Never) to prove the repository is not called when validation fails
• A TestApiFactory : WebApplicationFactory<Program> that replaces the database with EF In-Memory and seeds at least two tasks
• Four integration tests: GET returns 200 with seeded data, POST returns 201 with a Location header, an unauthenticated call returns 401, and a non-owner DELETE returns 403
• dotnet test runs green from a clean clone with no database installed, and the output is pasted into your README