60 lines
2.2 KiB
Go
60 lines
2.2 KiB
Go
package identity
|
|
|
|
import (
|
|
"bytes"
|
|
"io"
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"yovision.local/sense/internal/platform"
|
|
)
|
|
|
|
func TestHTTPLoginCookieAndProductBoundary(t *testing.T) {
|
|
store := NewMemoryStore()
|
|
cfg := Config{SigningKey: []byte("0123456789abcdef0123456789abcdef"), BootstrapToken: "bootstrap-test", SessionTTL: time.Hour}
|
|
service, err := NewService(store, cfg)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
app := platform.NewApp(platform.Config{DatabaseMode: platform.DatabaseModeMemory}, nil, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
|
NewModule(service, cfg).Register(app)
|
|
|
|
bootstrap := httptest.NewRequest(http.MethodPost, "/api/v1/identity/bootstrap", bytes.NewBufferString(`{"username":"admin","display_name":"管理员","password":"StrongPass2026"}`))
|
|
bootstrap.Header.Set("X-Sense-Bootstrap-Token", "bootstrap-test")
|
|
bootstrapResult := httptest.NewRecorder()
|
|
app.Handler().ServeHTTP(bootstrapResult, bootstrap)
|
|
if bootstrapResult.Code != http.StatusCreated {
|
|
t.Fatalf("bootstrap status = %d, body = %s", bootstrapResult.Code, bootstrapResult.Body.String())
|
|
}
|
|
|
|
login := httptest.NewRequest(http.MethodPost, "/api/v1/identity/login", bytes.NewBufferString(`{"username":"admin","password":"StrongPass2026"}`))
|
|
loginResult := httptest.NewRecorder()
|
|
app.Handler().ServeHTTP(loginResult, login)
|
|
if loginResult.Code != http.StatusOK {
|
|
t.Fatalf("login status = %d, body = %s", loginResult.Code, loginResult.Body.String())
|
|
}
|
|
cookies := loginResult.Result().Cookies()
|
|
if len(cookies) != 1 || cookies[0].Name != sessionCookieName || !cookies[0].HttpOnly || cookies[0].SameSite != http.SameSiteStrictMode {
|
|
t.Fatalf("unexpected session cookies: %#v", cookies)
|
|
}
|
|
|
|
me := httptest.NewRequest(http.MethodGet, "/api/v1/identity/me", nil)
|
|
me.AddCookie(cookies[0])
|
|
me.Header.Set("X-Product", "bell")
|
|
foreignResult := httptest.NewRecorder()
|
|
app.Handler().ServeHTTP(foreignResult, me)
|
|
if foreignResult.Code != http.StatusUnauthorized {
|
|
t.Fatalf("Bell product header status = %d", foreignResult.Code)
|
|
}
|
|
|
|
me.Header.Set("X-Product", "sense")
|
|
senseResult := httptest.NewRecorder()
|
|
app.Handler().ServeHTTP(senseResult, me)
|
|
if senseResult.Code != http.StatusOK {
|
|
t.Fatalf("Sense product header status = %d", senseResult.Code)
|
|
}
|
|
}
|