From 2871aba7280d36a1dc4da7b159e8f304d838c50a Mon Sep 17 00:00:00 2001 From: ila Date: Mon, 24 Aug 2026 12:24:35 +0800 Subject: [PATCH] =?UTF-8?q?test:=20=E8=A1=A5=E5=85=85=20API=20Key=20?= =?UTF-8?q?=E5=BD=92=E5=B1=9E=E4=B8=8E=E5=94=AF=E4=B8=80=E6=80=A7=E9=AA=8C?= =?UTF-8?q?=E8=AF=81=20(#41)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/core/apikey/mysql_integration_test.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/internal/core/apikey/mysql_integration_test.go b/internal/core/apikey/mysql_integration_test.go index 389c6a9..3dca76f 100644 --- a/internal/core/apikey/mysql_integration_test.go +++ b/internal/core/apikey/mysql_integration_test.go @@ -63,6 +63,22 @@ func TestGORMRepositoryMySQL(t *testing.T) { if err := repository.Create(context.Background(), &key); err != nil { return err } + otherUser := model.User{ + Email: fmt.Sprintf("api-key-other-%d@chorus.invalid", suffix), PasswordHash: "synthetic", + DisplayName: "Other API Key Test", Status: "active", + } + if err := tx.Create(&otherUser).Error; err != nil { + return err + } + if _, err := repository.ByIDForUser(context.Background(), key.ID, otherUser.ID); !errors.Is(err, ErrAPIKeyNotFound) { + return fmt.Errorf("cross-user API key read error = %v, want ErrAPIKeyNotFound", err) + } + duplicate := key + duplicate.ID = 0 + duplicate.UserID = otherUser.ID + if err := repository.Create(context.Background(), &duplicate); err == nil { + return errors.New("duplicate public id was accepted") + } loaded, err := repository.ByPublicID(context.Background(), publicID) if err != nil || loaded.ID != key.ID || string(loaded.SecretHash) != string(hash[:]) { return fmt.Errorf("load created api key: id=%d err=%w", loaded.ID, err)