241 lines
12 KiB
Go
241 lines
12 KiB
Go
package app
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"lingniu/vehicle-data-platform/apps/api/internal/config"
|
|
"lingniu/vehicle-data-platform/apps/api/internal/platform"
|
|
)
|
|
|
|
const (
|
|
viewerToken = "viewer-token-at-least-16"
|
|
operatorToken = "operator-token-at-least-16"
|
|
adminToken = "admin-token-at-least-16"
|
|
)
|
|
|
|
func testAuthConfig() config.Config {
|
|
return config.Config{
|
|
AuthMode: "enforce",
|
|
AuthTokensJSON: `[
|
|
{"token":"` + viewerToken + `","name":"viewer-a","role":"viewer"},
|
|
{"token":"` + operatorToken + `","name":"operator-a","role":"operator"},
|
|
{"token":"` + adminToken + `","name":"admin-a","role":"admin"}
|
|
]`,
|
|
}
|
|
}
|
|
|
|
func authRequest(t *testing.T, cfg config.Config, method, path, token string) *httptest.ResponseRecorder {
|
|
t.Helper()
|
|
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
principal, ok := platform.PrincipalFromContext(r.Context())
|
|
if !ok {
|
|
t.Fatal("authenticated request reached handler without principal")
|
|
}
|
|
w.Header().Set("X-Principal", principal.Name+":"+principal.Role)
|
|
w.WriteHeader(http.StatusNoContent)
|
|
})
|
|
req := httptest.NewRequest(method, path, nil)
|
|
if token != "" {
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
withAPIAuth(next, cfg).ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
func TestAPIAuthEnforcesTokensAndRoleBoundaries(t *testing.T) {
|
|
cfg := testAuthConfig()
|
|
|
|
missing := authRequest(t, cfg, http.MethodGet, "/api/v2/alerts/rules", "")
|
|
if missing.Code != http.StatusUnauthorized || !strings.HasPrefix(missing.Header().Get("WWW-Authenticate"), "Bearer") {
|
|
t.Fatalf("missing token status=%d headers=%v body=%s", missing.Code, missing.Header(), missing.Body.String())
|
|
}
|
|
invalid := authRequest(t, cfg, http.MethodGet, "/api/v2/alerts/rules", "wrong-token-at-least-16")
|
|
if invalid.Code != http.StatusUnauthorized {
|
|
t.Fatalf("invalid token status=%d body=%s", invalid.Code, invalid.Body.String())
|
|
}
|
|
|
|
viewerQuery := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/events", viewerToken)
|
|
if viewerQuery.Code != http.StatusNoContent || viewerQuery.Header().Get("X-Principal") != "viewer-a:viewer" {
|
|
t.Fatalf("viewer query status=%d principal=%s", viewerQuery.Code, viewerQuery.Header().Get("X-Principal"))
|
|
}
|
|
viewerAction := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/events/a/actions", viewerToken)
|
|
if viewerAction.Code != http.StatusForbidden {
|
|
t.Fatalf("viewer mutation should be forbidden, status=%d", viewerAction.Code)
|
|
}
|
|
viewerExports := authRequest(t, cfg, http.MethodGet, "/api/v2/exports", viewerToken)
|
|
if viewerExports.Code != http.StatusNoContent {
|
|
t.Fatalf("viewer export listing should reach owner/scope enforcement, status=%d", viewerExports.Code)
|
|
}
|
|
viewerExportCreate := authRequest(t, cfg, http.MethodPost, "/api/v2/exports", viewerToken)
|
|
if viewerExportCreate.Code != http.StatusNoContent {
|
|
t.Fatalf("viewer export creation should reach owner/scope enforcement, status=%d", viewerExportCreate.Code)
|
|
}
|
|
operatorExports := authRequest(t, cfg, http.MethodGet, "/api/v2/exports/exp_1/download", operatorToken)
|
|
if operatorExports.Code != http.StatusNoContent {
|
|
t.Fatalf("operator export download status=%d", operatorExports.Code)
|
|
}
|
|
operatorAction := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/events/a/actions", operatorToken)
|
|
if operatorAction.Code != http.StatusNoContent {
|
|
t.Fatalf("operator action status=%d body=%s", operatorAction.Code, operatorAction.Body.String())
|
|
}
|
|
operatorRule := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/rules", operatorToken)
|
|
if operatorRule.Code != http.StatusForbidden {
|
|
t.Fatalf("operator rule mutation should be forbidden, status=%d", operatorRule.Code)
|
|
}
|
|
operatorRollback := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/rules/rule-1/rollback", operatorToken)
|
|
if operatorRollback.Code != http.StatusForbidden {
|
|
t.Fatalf("operator rule rollback should be forbidden, status=%d", operatorRollback.Code)
|
|
}
|
|
operatorProfile := authRequest(t, cfg, http.MethodPut, "/api/v2/vehicles/VIN001/profile", operatorToken)
|
|
if operatorProfile.Code != http.StatusForbidden {
|
|
t.Fatalf("operator profile mutation should be forbidden, status=%d", operatorProfile.Code)
|
|
}
|
|
operatorProfileSync := authRequest(t, cfg, http.MethodPost, "/api/v2/vehicle-profiles/sync", operatorToken)
|
|
if operatorProfileSync.Code != http.StatusForbidden {
|
|
t.Fatalf("operator profile sync should be forbidden, status=%d", operatorProfileSync.Code)
|
|
}
|
|
operatorIdentityClaim := authRequest(t, cfg, http.MethodPost, "/api/v2/access/unresolved-identities/identity-1/claim", operatorToken)
|
|
if operatorIdentityClaim.Code != http.StatusForbidden {
|
|
t.Fatalf("operator identity claim should be forbidden, status=%d", operatorIdentityClaim.Code)
|
|
}
|
|
viewerSourceDiagnostic := authRequest(t, cfg, http.MethodGet, "/api/v2/operations/vehicles/VIN001/sources", viewerToken)
|
|
if viewerSourceDiagnostic.Code != http.StatusForbidden {
|
|
t.Fatalf("viewer source diagnostic should be forbidden, status=%d", viewerSourceDiagnostic.Code)
|
|
}
|
|
operatorSourceDiagnostic := authRequest(t, cfg, http.MethodGet, "/api/v2/operations/vehicles/VIN001/sources", operatorToken)
|
|
if operatorSourceDiagnostic.Code != http.StatusNoContent {
|
|
t.Fatalf("operator source diagnostic status=%d", operatorSourceDiagnostic.Code)
|
|
}
|
|
operatorSourcePolicy := authRequest(t, cfg, http.MethodPut, "/api/v2/operations/vehicles/VIN001/sources/ref", operatorToken)
|
|
if operatorSourcePolicy.Code != http.StatusForbidden {
|
|
t.Fatalf("operator source policy mutation should be forbidden, status=%d", operatorSourcePolicy.Code)
|
|
}
|
|
viewerReconciliation := authRequest(t, cfg, http.MethodGet, "/api/v2/reconciliation/summary", viewerToken)
|
|
if viewerReconciliation.Code != http.StatusForbidden {
|
|
t.Fatalf("viewer reconciliation summary should be forbidden, status=%d", viewerReconciliation.Code)
|
|
}
|
|
operatorReconciliation := authRequest(t, cfg, http.MethodPost, "/api/v2/reconciliation/issues/reconciliation-1/actions", operatorToken)
|
|
if operatorReconciliation.Code != http.StatusNoContent {
|
|
t.Fatalf("operator reconciliation action status=%d body=%s", operatorReconciliation.Code, operatorReconciliation.Body.String())
|
|
}
|
|
operatorReconciliationArchive := authRequest(t, cfg, http.MethodPost, "/api/v2/reconciliation/issues/reconciliation-1/archive", operatorToken)
|
|
if operatorReconciliationArchive.Code != http.StatusForbidden {
|
|
t.Fatalf("operator reconciliation archive should be forbidden, status=%d", operatorReconciliationArchive.Code)
|
|
}
|
|
adminReconciliationArchive := authRequest(t, cfg, http.MethodPost, "/api/v2/reconciliation/issues/reconciliation-1/archive", adminToken)
|
|
if adminReconciliationArchive.Code != http.StatusNoContent {
|
|
t.Fatalf("admin reconciliation archive status=%d body=%s", adminReconciliationArchive.Code, adminReconciliationArchive.Body.String())
|
|
}
|
|
operatorOpenPlatform := authRequest(t, cfg, http.MethodGet, "/api/v2/open-platform/apps", operatorToken)
|
|
if operatorOpenPlatform.Code != http.StatusForbidden {
|
|
t.Fatalf("operator open-platform management should be forbidden, status=%d", operatorOpenPlatform.Code)
|
|
}
|
|
adminProfile := authRequest(t, cfg, http.MethodPut, "/api/v2/vehicles/VIN001/profile", adminToken)
|
|
if adminProfile.Code != http.StatusNoContent || adminProfile.Header().Get("X-Principal") != "admin-a:admin" {
|
|
t.Fatalf("admin profile mutation status=%d principal=%s", adminProfile.Code, adminProfile.Header().Get("X-Principal"))
|
|
}
|
|
adminProfileSync := authRequest(t, cfg, http.MethodPost, "/api/v2/vehicle-profiles/sync", adminToken)
|
|
if adminProfileSync.Code != http.StatusNoContent || adminProfileSync.Header().Get("X-Principal") != "admin-a:admin" {
|
|
t.Fatalf("admin profile sync status=%d principal=%s", adminProfileSync.Code, adminProfileSync.Header().Get("X-Principal"))
|
|
}
|
|
adminThreshold := authRequest(t, cfg, http.MethodPut, "/api/v2/access/thresholds", adminToken)
|
|
if adminThreshold.Code != http.StatusNoContent {
|
|
t.Fatalf("admin threshold status=%d body=%s", adminThreshold.Code, adminThreshold.Body.String())
|
|
}
|
|
adminIdentityClaim := authRequest(t, cfg, http.MethodPost, "/api/v2/access/unresolved-identities/identity-1/claim", adminToken)
|
|
if adminIdentityClaim.Code != http.StatusNoContent {
|
|
t.Fatalf("admin identity claim status=%d body=%s", adminIdentityClaim.Code, adminIdentityClaim.Body.String())
|
|
}
|
|
adminSourcePolicy := authRequest(t, cfg, http.MethodPut, "/api/v2/operations/vehicles/VIN001/sources/ref", adminToken)
|
|
if adminSourcePolicy.Code != http.StatusNoContent {
|
|
t.Fatalf("admin source policy status=%d body=%s", adminSourcePolicy.Code, adminSourcePolicy.Body.String())
|
|
}
|
|
adminOpenPlatform := authRequest(t, cfg, http.MethodGet, "/api/v2/open-platform/apps", adminToken)
|
|
if adminOpenPlatform.Code != http.StatusNoContent {
|
|
t.Fatalf("admin open-platform management status=%d body=%s", adminOpenPlatform.Code, adminOpenPlatform.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestDisabledMockModeProvidesOperableIdentityDirectory(t *testing.T) {
|
|
cfg := config.Config{AuthMode: "disabled", DataMode: "mock"}
|
|
handler := withAPIAuth(http.NotFoundHandler(), cfg)
|
|
|
|
listResponse := httptest.NewRecorder()
|
|
handler.ServeHTTP(listResponse, httptest.NewRequest(http.MethodGet, "/api/v2/admin/users", nil))
|
|
if listResponse.Code != http.StatusOK {
|
|
t.Fatalf("mock directory status=%d body=%s", listResponse.Code, listResponse.Body.String())
|
|
}
|
|
var listEnvelope struct {
|
|
Data []authUser `json:"data"`
|
|
}
|
|
if err := json.Unmarshal(listResponse.Body.Bytes(), &listEnvelope); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(listEnvelope.Data) < 4 || listEnvelope.Data[1].AuthProvider != "OneOS" || listEnvelope.Data[1].ExternalSubject == "" || listEnvelope.Data[2].ExternalSubject != "" {
|
|
t.Fatalf("mock identity examples are incomplete: %+v", listEnvelope.Data)
|
|
}
|
|
|
|
updateBody := `{"displayName":"华东数据客户","password":"ChangeMe2026!","status":"enabled","customerRef":"CUS-EAST","tenantRef":"tenant-east","menuKeys":["monitor"],"vehicleVins":["LMRKH9AC2R1004087"]}`
|
|
updateResponse := httptest.NewRecorder()
|
|
handler.ServeHTTP(updateResponse, httptest.NewRequest(http.MethodPut, "/api/v2/admin/users/102", strings.NewReader(updateBody)))
|
|
if updateResponse.Code != http.StatusBadRequest || !strings.Contains(updateResponse.Body.String(), "EXTERNAL_IDENTITY_PASSWORD_READ_ONLY") {
|
|
t.Fatalf("mock external credential ownership was not enforced: status=%d body=%s", updateResponse.Code, updateResponse.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAPIAuthSessionAndDisabledMode(t *testing.T) {
|
|
rec := authRequest(t, config.Config{AuthMode: "disabled"}, http.MethodGet, "/api/v2/alerts/rules", "")
|
|
if rec.Code != http.StatusNoContent || rec.Header().Get("X-Principal") != "local-developer:admin" {
|
|
t.Fatalf("disabled mode status=%d principal=%s", rec.Code, rec.Header().Get("X-Principal"))
|
|
}
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v2/session", nil)
|
|
req.Header.Set("Authorization", "Bearer "+operatorToken)
|
|
session := httptest.NewRecorder()
|
|
withAPIAuth(http.NotFoundHandler(), testAuthConfig()).ServeHTTP(session, req)
|
|
if session.Code != http.StatusOK || !strings.Contains(session.Body.String(), `"name":"operator-a"`) || !strings.Contains(session.Body.String(), `"role":"operator"`) {
|
|
t.Fatalf("session status=%d body=%s", session.Code, session.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAuthSelfServiceEndpointsAllowCustomerRole(t *testing.T) {
|
|
if role := requiredRole(httptest.NewRequest(http.MethodPost, "/api/v2/auth/logout", nil)); role != "viewer" {
|
|
t.Fatalf("logout should allow authenticated customers, required role=%s", role)
|
|
}
|
|
if role := requiredRole(httptest.NewRequest(http.MethodPut, "/api/v2/auth/password", nil)); role != "viewer" {
|
|
t.Fatalf("password change should allow authenticated customers, required role=%s", role)
|
|
}
|
|
}
|
|
|
|
func TestMileagePostQueriesAllowCustomerRole(t *testing.T) {
|
|
for _, path := range []string{"/api/mileage/daily", "/api/v2/statistics/mileage"} {
|
|
req := httptest.NewRequest(http.MethodPost, path, nil)
|
|
if role := requiredRole(req); role != "viewer" {
|
|
t.Fatalf("%s should allow authenticated customers, required role=%s", path, role)
|
|
}
|
|
if menu := requiredMenu(req); menu != "statistics" {
|
|
t.Fatalf("%s should use statistics menu scope, required menu=%s", path, menu)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAPIAuthMisconfigurationFailsClosed(t *testing.T) {
|
|
cases := []config.Config{
|
|
{AuthMode: "enforce"},
|
|
{AuthMode: "unknown"},
|
|
{AuthMode: "enforce", AuthTokensJSON: `not-json`},
|
|
{AuthMode: "enforce", AuthToken: "short"},
|
|
}
|
|
for _, cfg := range cases {
|
|
rec := authRequest(t, cfg, http.MethodGet, "/api/v2/alerts/rules", "")
|
|
if rec.Code != http.StatusServiceUnavailable {
|
|
t.Fatalf("misconfigured auth should fail closed: cfg=%+v status=%d", cfg, rec.Code)
|
|
}
|
|
}
|
|
}
|