The existing NhsLoginTests do not follow The Standard's naming (ts-testing-002, ts-testing-007), two of them assert Assert.True(true, ...) and cannot fail, and their configuration binding is broken — GetSection("CIS").Get<ApiPlatformConfigurations>() binds nothing against the nested configuration model, so every endpoint is the empty string and the endpoint assertions are vacuous.
Replace them with integration tests that exercise the real composed object graph (real brokers, real DI container, real configuration binding) for both the SDK and the ASP.NET Core session-backed wiring, and mark the tests requiring a live NHS conversation as explicitly skipped rather than passing vacuously.
Also: NHSDigital.ApiPlatform.Sdk.Tests.Integration/appsettings.json has a live-looking CIS2 ClientId and ClientSecret committed. Move credentials to environment variables / a git-ignored appsettings.Development.json. The committed values remain in git history and must be rotated separately.
The existing
NhsLoginTestsdo not follow The Standard's naming (ts-testing-002,ts-testing-007), two of them assertAssert.True(true, ...)and cannot fail, and their configuration binding is broken —GetSection("CIS").Get<ApiPlatformConfigurations>()binds nothing against the nested configuration model, so every endpoint is the empty string and the endpoint assertions are vacuous.Replace them with integration tests that exercise the real composed object graph (real brokers, real DI container, real configuration binding) for both the SDK and the ASP.NET Core session-backed wiring, and mark the tests requiring a live NHS conversation as explicitly skipped rather than passing vacuously.
Also:
NHSDigital.ApiPlatform.Sdk.Tests.Integration/appsettings.jsonhas a live-looking CIS2ClientIdandClientSecretcommitted. Move credentials to environment variables / a git-ignoredappsettings.Development.json. The committed values remain in git history and must be rotated separately.