From 41a6d0826adbc87f0d757a3f1cd6f52444ee94e1 Mon Sep 17 00:00:00 2001
From: ila <2+ila@noreply.git.ilapage.cn>
Date: Thu, 13 Aug 2026 21:32:50 +0800
Subject: [PATCH] test: enforce player navigation boundary (#54)

---
 Sense/server/app/sense/identity/http_test.go | 40 ++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/Sense/server/app/sense/identity/http_test.go b/Sense/server/app/sense/identity/http_test.go
index d96302c..b60396b 100644
--- a/Sense/server/app/sense/identity/http_test.go
+++ b/Sense/server/app/sense/identity/http_test.go
@@ -21,6 +21,9 @@ func TestHTTPLoginCookieAndProductBoundary(t *testing.T) {
 	}
 	app := platform.NewApp(platform.Config{DatabaseMode: platform.DatabaseModeMemory}, nil, slog.New(slog.NewTextHandler(io.Discard, nil)))
 	NewModule(service, cfg).Register(app)
+	app.Handle("GET /same-origin-frame", RequireSameOriginFrame(PermissionMediaRead, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	})))
 
 	bootstrap := httptest.NewRequest(http.MethodPost, "/api/v1/identity/bootstrap", bytes.NewBufferString(`{"username":"admin","display_name":"管理员","password":"StrongPass2026"}`))
 	bootstrap.Header.Set("X-Sense-Bootstrap-Token", "bootstrap-test")
@@ -56,4 +59,41 @@ func TestHTTPLoginCookieAndProductBoundary(t *testing.T) {
 	if senseResult.Code != http.StatusOK {
 		t.Fatalf("Sense product header status = %d", senseResult.Code)
 	}
+
+	meWithoutProduct := httptest.NewRequest(http.MethodGet, "/api/v1/identity/me", nil)
+	meWithoutProduct.AddCookie(cookies[0])
+	missingProductResult := httptest.NewRecorder()
+	app.Handler().ServeHTTP(missingProductResult, meWithoutProduct)
+	if missingProductResult.Code != http.StatusUnauthorized {
+		t.Fatalf("missing product header status = %d", missingProductResult.Code)
+	}
+
+	frame := httptest.NewRequest(http.MethodGet, "/same-origin-frame", nil)
+	frame.AddCookie(cookies[0])
+	frame.Header.Set("Sec-Fetch-Site", "same-origin")
+	frame.Header.Set("Sec-Fetch-Mode", "navigate")
+	frame.Header.Set("Sec-Fetch-Dest", "iframe")
+	frameResult := httptest.NewRecorder()
+	app.Handler().ServeHTTP(frameResult, frame)
+	if frameResult.Code != http.StatusNoContent {
+		t.Fatalf("same-origin frame status = %d, body = %s", frameResult.Code, frameResult.Body.String())
+	}
+
+	frame.Header.Set("Sec-Fetch-Site", "cross-site")
+	crossSiteResult := httptest.NewRecorder()
+	app.Handler().ServeHTTP(crossSiteResult, frame)
+	if crossSiteResult.Code != http.StatusUnauthorized {
+		t.Fatalf("cross-site frame status = %d", crossSiteResult.Code)
+	}
+
+	missingCookie := httptest.NewRequest(http.MethodGet, "/same-origin-frame", nil)
+	missingCookie.Header.Set("Sec-Fetch-Site", "same-origin")
+	missingCookie.Header.Set("Sec-Fetch-Mode", "navigate")
+	missingCookie.Header.Set("Sec-Fetch-Dest", "iframe")
+	missingCookieResult := httptest.NewRecorder()
+	app.Handler().ServeHTTP(missingCookieResult, missingCookie)
+	if missingCookieResult.Code != http.StatusUnauthorized {
+		t.Fatalf("missing-cookie frame status = %d", missingCookieResult.Code)
+	}
 }
+