feat(platform): proxy amap security requests

vehicle-data-platform/apps/api/internal/app/server_test.go

@@ -77,9 +77,81 @@ func TestAppConfigScriptIsRuntimeRendered(t *testing.T) {
 		t.Fatalf("Cache-Control = %q, want no-store", got)
 	}
 	body := rec.Body.String()
-	for _, want := range []string{"window.__LINGNIU_APP_CONFIG__=", `"amapWebJsKey":"web-key"`, `"amapSecurityJsCode":"security-code"`, `"amapSecurityServiceHost":"/_AMapService"`} {
+	for _, want := range []string{"window.__LINGNIU_APP_CONFIG__=", `"amapWebJsKey":"web-key"`, `"amapSecurityServiceHost":"/_AMapService"`} {
 		if !strings.Contains(body, want) {
 			t.Fatalf("app config script missing %q: %s", want, body)
 		}
 	}
+	if strings.Contains(body, "security-code") || strings.Contains(body, "amapSecurityJsCode") {
+		t.Fatalf("app config script should not expose AMap security code: %s", body)
+	}
+}
+
+func TestAMapSecurityProxyAppendsServerSideJscode(t *testing.T) {
+	var gotPath string
+	var gotJscode string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotJscode = r.URL.Query().Get("jscode")
+		w.Header().Set("X-AMap-Test", "ok")
+		_, _ = w.Write([]byte("proxied"))
+	}))
+	defer upstream.Close()
+
+	handler := withAMapSecurityProxy(http.NotFoundHandler(), config.Config{
+		AMapSecurityCode: "security-code",
+		AMapServiceHost:  "/_AMapService",
+	}, amapProxyUpstreams{RestAPI: upstream.URL}, http.DefaultClient)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/_AMapService/v3/weather/weatherInfo?city=440100", nil)
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body=%s", rec.Code, rec.Body.String())
+	}
+	if gotPath != "/v3/weather/weatherInfo" || gotJscode != "security-code" {
+		t.Fatalf("upstream path=%q jscode=%q", gotPath, gotJscode)
+	}
+	if rec.Body.String() != "proxied" || rec.Header().Get("X-AMap-Test") != "ok" {
+		t.Fatalf("proxy response not copied: headers=%v body=%s", rec.Header(), rec.Body.String())
+	}
+}
+
+func TestAMapSecurityProxyRoutesKnownMapResources(t *testing.T) {
+	seen := map[string]string{}
+	newUpstream := func(name string) *httptest.Server {
+		return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			seen[name] = r.URL.Path
+			_, _ = w.Write([]byte(name))
+		}))
+	}
+	rest := newUpstream("rest")
+	webapi := newUpstream("webapi")
+	fmap := newUpstream("fmap")
+	defer rest.Close()
+	defer webapi.Close()
+	defer fmap.Close()
+
+	handler := withAMapSecurityProxy(http.NotFoundHandler(), config.Config{
+		AMapSecurityCode: "security-code",
+		AMapServiceHost:  "/_AMapService",
+	}, amapProxyUpstreams{RestAPI: rest.URL, WebAPI: webapi.URL, FMap: fmap.URL}, http.DefaultClient)
+
+	for _, path := range []string{
+		"/_AMapService/v4/map/styles",
+		"/_AMapService/v3/vectormap",
+		"/_AMapService/v3/weather/weatherInfo",
+	} {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		handler.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("%s status = %d body=%s", path, rec.Code, rec.Body.String())
+		}
+	}
+
+	if seen["webapi"] != "/v4/map/styles" || seen["fmap"] != "/v3/vectormap" || seen["rest"] != "/v3/weather/weatherInfo" {
+		t.Fatalf("unexpected proxy routing: %+v", seen)
+	}
 }