ila/yovision
1
0
Fork 0
Code Issues 14 Pull Requests 14 Actions Packages Projects Releases Wiki Activity

test: enforce player navigation boundary (#54)

Browse Source
This commit is contained in:
ila
2026-08-13 21:32:50 +08:00
parent abbc9a7093
commit 41a6d0826a
1 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Sense/server/app/sense/identity/http_test.go
+40
View File
@@ -21,6 +21,9 @@ func TestHTTPLoginCookieAndProductBoundary(t *testing.T) {
}
app := platform.NewApp(platform.Config{DatabaseMode: platform.DatabaseModeMemory}, nil, slog.New(slog.NewTextHandler(io.Discard, nil)))
NewModule(service, cfg).Register(app)
app.Handle("GET /same-origin-frame", RequireSameOriginFrame(PermissionMediaRead, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusNoContent)
})))
bootstrap := httptest.NewRequest(http.MethodPost, "/api/v1/identity/bootstrap", bytes.NewBufferString(`{"username":"admin","display_name":"管理员","password":"StrongPass2026"}`))
bootstrap.Header.Set("X-Sense-Bootstrap-Token", "bootstrap-test")
@@ -56,4 +59,41 @@ func TestHTTPLoginCookieAndProductBoundary(t *testing.T) {
if senseResult.Code != http.StatusOK {
t.Fatalf("Sense product header status = %d", senseResult.Code)
}
meWithoutProduct := httptest.NewRequest(http.MethodGet, "/api/v1/identity/me", nil)
meWithoutProduct.AddCookie(cookies[0])
missingProductResult := httptest.NewRecorder()
app.Handler().ServeHTTP(missingProductResult, meWithoutProduct)
if missingProductResult.Code != http.StatusUnauthorized {
t.Fatalf("missing product header status = %d", missingProductResult.Code)
}
frame := httptest.NewRequest(http.MethodGet, "/same-origin-frame", nil)
frame.AddCookie(cookies[0])
frame.Header.Set("Sec-Fetch-Site", "same-origin")
frame.Header.Set("Sec-Fetch-Mode", "navigate")
frame.Header.Set("Sec-Fetch-Dest", "iframe")
frameResult := httptest.NewRecorder()
app.Handler().ServeHTTP(frameResult, frame)
if frameResult.Code != http.StatusNoContent {
t.Fatalf("same-origin frame status = %d, body = %s", frameResult.Code, frameResult.Body.String())
}
frame.Header.Set("Sec-Fetch-Site", "cross-site")
crossSiteResult := httptest.NewRecorder()
app.Handler().ServeHTTP(crossSiteResult, frame)
if crossSiteResult.Code != http.StatusUnauthorized {
t.Fatalf("cross-site frame status = %d", crossSiteResult.Code)
}
missingCookie := httptest.NewRequest(http.MethodGet, "/same-origin-frame", nil)
missingCookie.Header.Set("Sec-Fetch-Site", "same-origin")
missingCookie.Header.Set("Sec-Fetch-Mode", "navigate")
missingCookie.Header.Set("Sec-Fetch-Dest", "iframe")
missingCookieResult := httptest.NewRecorder()
app.Handler().ServeHTTP(missingCookieResult, missingCookie)
if missingCookieResult.Code != http.StatusUnauthorized {
t.Fatalf("missing-cookie frame status = %d", missingCookieResult.Code)
}
}