yml2213
85332df2bd
- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计 - 用户 token 增加版本控制，冻结/改密/退出即时撤销会话 - 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie - 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属 - 公开商品接口返回最小字段，隐藏号主身份与内部状态 - 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象
55 lines
2.1 KiB
Go
55 lines
2.1 KiB
Go
package paymentaccount
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"hfb_sys/backend/internal/model"
|
|
|
|
"gorm.io/driver/sqlite"
|
|
"gorm.io/gorm"
|
|
"gorm.io/gorm/logger"
|
|
)
|
|
|
|
func TestPrivateCertificateURLsConvertsLegacyPublicURL(t *testing.T) {
|
|
values := privateCertificateURLs([]string{
|
|
"/api/public/files/object?key=payment-cert%2F2026%2Fqr.jpg",
|
|
"/api/public/files/object?key=avatar%2Fuser.jpg",
|
|
})
|
|
if values[0] != "/api/files/object?key=payment-cert%2F2026%2Fqr.jpg" {
|
|
t.Fatalf("payment certificate URL = %q", values[0])
|
|
}
|
|
if values[1] != "/api/public/files/object?key=avatar%2Fuser.jpg" {
|
|
t.Fatalf("non-certificate URL changed = %q", values[1])
|
|
}
|
|
}
|
|
|
|
func TestValidateCertificateURLsRequiresUploaderOwnership(t *testing.T) {
|
|
db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
|
|
if err != nil {
|
|
t.Fatalf("open sqlite error = %v", err)
|
|
}
|
|
if err := db.AutoMigrate(&model.FileUploadOwner{}); err != nil {
|
|
t.Fatalf("migrate upload owners error = %v", err)
|
|
}
|
|
if err := db.Create(&model.FileUploadOwner{UserID: 1, ObjectKey: "payment-cert/owned.jpg"}).Error; err != nil {
|
|
t.Fatalf("create upload owner error = %v", err)
|
|
}
|
|
repo := NewRepository(db, nil)
|
|
ownedURL := "/api/files/object?key=payment-cert%2Fowned.jpg"
|
|
if err := repo.validateCertificateURLs(context.Background(), 1, []string{ownedURL}, nil); err != nil {
|
|
t.Fatalf("owned certificate rejected: %v", err)
|
|
}
|
|
if err := repo.validateCertificateURLs(context.Background(), 2, []string{ownedURL}, nil); !errors.Is(err, ErrInvalidCertificateURL) {
|
|
t.Fatalf("other user's certificate validation error = %v", err)
|
|
}
|
|
if err := repo.validateCertificateURLs(context.Background(), 1, []string{"/api/files/object?key=listing%2Fowned.jpg"}, nil); !errors.Is(err, ErrInvalidCertificateURL) {
|
|
t.Fatalf("non-certificate file validation error = %v", err)
|
|
}
|
|
legacyURL := "/api/public/files/object?key=payment-cert%2Flegacy.jpg"
|
|
if err := repo.validateCertificateURLs(context.Background(), 1, []string{legacyURL}, []string{legacyURL}); err != nil {
|
|
t.Fatalf("existing legacy certificate rejected: %v", err)
|
|
}
|
|
}
|