yml2213
369b0647bb
- Auth/权限中间件取 main 演进版（错误细分、token 来源），保留 dev 的用户 cookie 与登出撤销语义 - 后台订单列表：融合 main 的首页免 COUNT 优化与关键词索引路由，保留 dev 的最小化 AdminOrderListItemDTO（结账明细仍由详情接口返回，同步调整对应集成测试） - 保留 dev 的 token_version 冻结/解冻递增与 main 的状态变化判断及通知 - 前端：保留 dev 登出接口与 main 的 fetchMe silent 参数、SSE 登录跳转；后台订单表按 dev 最小化 DTO 移除号主到手列
66 lines
2.1 KiB
Go
66 lines
2.1 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"hfb_sys/backend/internal/modules/auth"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func TestUserAuthRejectsQueryToken(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
manager := auth.NewJWTManager("test-jwt-secret-for-query-token-rejection")
|
|
pair, err := manager.GenerateSubjectPairWithVersion(1, "13800000000", "user", 1)
|
|
if err != nil {
|
|
t.Fatalf("GenerateSubjectPairWithVersion() error = %v", err)
|
|
}
|
|
|
|
engine := gin.New()
|
|
engine.GET("/protected", Auth(manager, nil), func(c *gin.Context) {
|
|
c.Status(http.StatusNoContent)
|
|
})
|
|
|
|
queryRequest := httptest.NewRequest(http.MethodGet, "/protected?token="+pair.AccessToken, nil)
|
|
queryResponse := httptest.NewRecorder()
|
|
engine.ServeHTTP(queryResponse, queryRequest)
|
|
if queryResponse.Code != http.StatusUnauthorized {
|
|
t.Fatalf("query token status = %d, want %d", queryResponse.Code, http.StatusUnauthorized)
|
|
}
|
|
|
|
bearerRequest := httptest.NewRequest(http.MethodGet, "/protected", nil)
|
|
bearerRequest.Header.Set("Authorization", "Bearer "+pair.AccessToken)
|
|
bearerResponse := httptest.NewRecorder()
|
|
engine.ServeHTTP(bearerResponse, bearerRequest)
|
|
if bearerResponse.Code != http.StatusNoContent {
|
|
t.Fatalf("bearer token status = %d, want %d", bearerResponse.Code, http.StatusNoContent)
|
|
}
|
|
}
|
|
|
|
func TestAuthRejectsRevokedUserToken(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
manager := auth.NewJWTManager("test-secret")
|
|
pair, err := manager.GenerateSubjectPairWithVersion(7, "13900000007", "user", 0)
|
|
if err != nil {
|
|
t.Fatalf("生成令牌失败：%v", err)
|
|
}
|
|
|
|
engine := gin.New()
|
|
engine.GET("/protected", Auth(manager, func(_ context.Context, _ uint64, _ int64) error {
|
|
return auth.ErrTokenVersionMismatch
|
|
}), func(c *gin.Context) {
|
|
c.Status(http.StatusNoContent)
|
|
})
|
|
request := httptest.NewRequest(http.MethodGet, "/protected", nil)
|
|
request.Header.Set("Authorization", "Bearer "+pair.AccessToken)
|
|
response := httptest.NewRecorder()
|
|
engine.ServeHTTP(response, request)
|
|
|
|
if response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("响应状态 = %d, want %d", response.Code, http.StatusUnauthorized)
|
|
}
|
|
}
|