✅ test_dpop

✅ calls_to_anon_endpoint_should_allow_anonymous
✅ calls_to_authorized_local_endpoint_should_succeed
✅ calls_to_authorized_local_endpoint_without_csrf_should_succeed_without_antiforgery_header
✅ calls_to_local_endpoint_should_require_antiforgery_header
✅ calls_to_local_endpoint_without_csrf_should_not_require_antiforgery_header
✅ challenge_response_should_return_401
✅ challenge_response_when_response_handling_skipped_should_trigger_redirect_for_login
✅ fallback_policy_should_not_fail
✅ forbid_response_should_return_403
✅ forbidden_api_call_should_return_403
✅ put_to_local_endpoint_should_succeed
✅ unauthenticated_api_call_should_return_401
✅ unauthenticated_calls_to_authorized_local_endpoint_should_fail
✅ unauthenticated_non_bff_endpoint_should_return_302_for_login

✅ backchannel_logout_endpoint_for_incorrect_sid_should_not_logout_user
✅ backchannel_logout_endpoint_for_incorrect_sub_should_not_logout_user
✅ backchannel_logout_endpoint_should_signout
✅ backchannel_logout_should_allow_anonymous
✅ when_BackchannelLogoutAllUserSessions_is_false_backchannel_logout_should_only_logout_one_session
✅ when_BackchannelLogoutAllUserSessions_is_true_backchannel_logout_should_logout_all_sessions

✅ login_endpoint_should_accept_returnUrl
✅ login_endpoint_should_challenge_and_redirect_to_root
✅ login_endpoint_should_challenge_and_redirect_to_root_with_custom_prefix
✅ login_endpoint_should_challenge_and_redirect_to_root_with_custom_prefix_trailing_slash
✅ login_endpoint_should_challenge_and_redirect_to_root_with_root_prefix
✅ login_endpoint_should_not_accept_non_local_returnUrl
✅ login_endpoint_with_existing_session_should_challenge
✅ login_should_allow_anonymous

✅ logout_endpoint_for_anonymous_user_without_sid_should_succeed
✅ logout_endpoint_for_authenticated_should_require_sid
✅ logout_endpoint_for_authenticated_user_without_sid_should_succeed
✅ logout_endpoint_for_authenticated_when_require_option_is_false_should_not_require_sid
✅ logout_endpoint_should_accept_returnUrl
✅ logout_endpoint_should_allow_anonymous
✅ logout_endpoint_should_redirect_to_external_signout_and_return_to_root
✅ logout_endpoint_should_reject_non_local_returnUrl
✅ logout_endpoint_should_signout

✅ custom_ManagementBasePath_should_affect_basepath(path: "/login")
✅ custom_ManagementBasePath_should_affect_basepath(path: "/logout")
✅ custom_ManagementBasePath_should_affect_basepath(path: "/silent-login-callback")
✅ custom_ManagementBasePath_should_affect_basepath(path: "/silent-login")
✅ custom_ManagementBasePath_should_affect_basepath(path: "/user")

✅ user_endpoint_for_authenticated_user_should_return_claims
✅ user_endpoint_for_authenticated_user_with_sid_should_return_claims_including_logout
✅ user_endpoint_for_authenticated_user_without_csrf_header_should_fail
✅ user_endpoint_for_unauthenticated_user_should_fail
✅ when_configured_user_endpoint_for_unauthenticated_user_should_return_200_and_empty

✅ calls_to_bff_not_in_endpoint_routing_should_fail
✅ calls_to_endpoint_without_bff_metadata_should_fail
✅ calls_to_remote_endpoint_expecting_token_but_without_token_should_fail
✅ calls_to_remote_endpoint_should_fail_when_token_retrieval_fails
✅ calls_to_remote_endpoint_should_forward_client_token_to_api
✅ calls_to_remote_endpoint_should_forward_user_or_anonymous_to_api
✅ calls_to_remote_endpoint_should_forward_user_or_client_to_api
✅ calls_to_remote_endpoint_should_forward_user_to_api
✅ calls_to_remote_endpoint_should_require_csrf
✅ calls_to_remote_endpoint_should_send_token_from_token_retriever_when_token_retrieval_succeeds
✅ calls_to_remote_endpoint_with_anon_should_be_anon
✅ calls_to_remote_endpoint_with_useraccesstokenparameters_having_not_stored_corresponding_named_token_finds_no_matching_token_should_fail
✅ calls_to_remote_endpoint_with_useraccesstokenparameters_having_stored_named_token_should_forward_user_to_api
✅ endpoints_that_disable_csrf_should_not_require_csrf_header
✅ post_to_remote_endpoint_should_forward_user_to_api
✅ put_to_remote_endpoint_should_forward_user_to_api
✅ response_status_401_from_remote_endpoint_should_return_401_from_bff
✅ response_status_403_from_remote_endpoint_should_return_403_from_bff
✅ unauthenticated_calls_to_remote_endpoint_should_return_401

✅ anonymous_call_to_no_token_requirement_route_should_succeed
✅ anonymous_call_to_optional_user_token_route_should_succeed
✅ anonymous_call_to_user_token_requirement_route_should_fail
✅ anonymous_call_with_no_csrf_header_to_csrf_route_should_fail
✅ anonymous_call_with_no_csrf_header_to_no_token_requirement_no_csrf_route_should_succeed
✅ authenticated_GET_should_forward_user_to_api(route: "/api_optional_user/test")
✅ authenticated_GET_should_forward_user_to_api(route: "/api_user/test")
✅ authenticated_POST_should_forward_user_to_api(route: "/api_optional_user/test")
✅ authenticated_POST_should_forward_user_to_api(route: "/api_user/test")
✅ authenticated_PUT_should_forward_user_to_api(route: "/api_optional_user/test")
✅ authenticated_PUT_should_forward_user_to_api(route: "/api_user/test")
✅ call_to_client_token_route_should_forward_client_token_to_api
✅ call_to_user_or_client_token_route_should_forward_user_or_client_token_to_api
✅ invalid_configuration_of_routes_should_return_500
✅ response_status_401_from_remote_endpoint_should_return_401_from_bff
✅ response_status_403_from_remote_endpoint_should_return_403_from_bff

✅ Test1

✅ bff_host_name_should_propagate_to_api
✅ forwarded_host_name_with_header_forwarding_should_propagate_to_api
✅ forwarded_host_name_without_header_forwarding_propagate_to_api

✅ bff_host_name_should_propagate_to_api
✅ forwarded_host_name_should_not_propagate_to_api

✅ custom_header_should_be_forwarded
✅ custom_header_should_be_forwarded_and_xforwarded_headers_should_be_created
✅ local_endpoint_should_receive_standard_headers

✅ user_endpoint_cookie_should_slide
✅ user_endpoint_when_sliding_flag_is_passed_cookie_should_not_slide
✅ user_endpoint_when_uservalidate_renews_and_sliding_flag_is_passed_cookie_should_not_slide
✅ user_endpoint_when_uservalidate_renews_cookie_should_slide

✅ backchannel_logout_endpoint_should_revoke_refreshtoken
✅ logout_should_revoke_refreshtoken
✅ when_setting_disabled_backchannel_logout_endpoint_should_not_revoke_refreshtoken
✅ when_setting_disabled_logout_should_not_revoke_refreshtoken

✅ StoreAsync_should_remove_conflicting_entries_prior_to_creating_new_entry