Setup ClaimsPrincipal

public ActivityTests()
{
    // Arrange
    mockActivityService = new Mock<IActivityService>();
    mockAuthorisationService = new Mock<IAuthorisationService>();
    user = new ClaimsPrincipal(new ClaimsIdentity(new Claim[] {new(ClaimTypes.Name, "testuser")}, "TestAuthType"));
}

[Fact]
public void Create_ReturnsForbid_ForUnauthorisedUser()
{
    // Arrange

    mockAuthorisationService.Setup(x => x.Allows(It.IsAny<ClaimsPrincipal>(), To.CreateActivity)).Returns(false);
    var createModel = new CreateModel(mockActivityService.Object, mockAuthorisationService.Object);
    createModel.HydratePageModel(user);

    // Act

    var result = createModel.OnGet();

    // Assert
    Assert.IsType<ForbidResult>(result);
}