feat(auth): refresh token 续期(B2) — 不透明哈希+单次旋转+/auth/refresh+/auth/logout
- auth/refresh.go: RefreshStore(Issue/Rotate/Revoke/RevokeAll/RevokeByUser), SHA-256哈希256-bit随机串, 单次旋转事务(并发重放fail-closed) - 迁移0008_refresh_tokens(id/user_id/role/token_hash UNIQUE/expires_at/revoked_at + 索引) - gateway: POST /v1/auth/refresh(旋转/续期) + /v1/auth/logout(单/全设备); login响应增refreshToken - config: AUTH_REFRESH_TTL(720h)/AUTH_REFRESH_ROTATE_DISABLED; decode.go 支持time.Duration - rotate-jwt成功后RevokeAll(响应refreshTokensRevoked), revoke-keys不动refresh - 14测试+真实二进制e2e, build/vet/test绿+交叉编译 - Docs/api-client v0.25 + api-reference §2.3/2.4 同步
This commit is contained in:
AskaEth committed
1 parent
7ecb43bd5d
commit
026b27b310
17 files changed
+1237
-13
No files matched your search
@@ -0,0 +1,286 @@
|
||||
package gateway
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"database/sql"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
|
||||
"git.yeij.top/AskaEth/Cyrene_v2/internal/bus"
|
||||
"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
|
||||
"git.yeij.top/AskaEth/Cyrene_v2/internal/db"
|
||||
)
|
||||
|
||||
// newRefreshEnv builds a gateway backed by a real JWT service and a real
|
||||
// SQLite-backed refresh store, returning the store and DB so a test can assert
|
||||
// what was persisted. The DB is isolated in memory per test.
|
||||
func newRefreshEnv(t *testing.T) (*testEnv, *auth.RefreshStore, *sql.DB) {
|
||||
t.Helper()
|
||||
ctx := context.Background()
|
||||
sqlDB, err := db.Open(ctx, ":memory:", nil)
|
||||
if err != nil {
|
||||
t.Fatalf("open in-memory db: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { _ = sqlDB.Close() })
|
||||
if err := db.MigrateUp(ctx, sqlDB, nil); err != nil {
|
||||
t.Fatalf("migrate up: %v", err)
|
||||
}
|
||||
refresh, err := auth.NewRefreshStore(ctx, sqlDB, nil)
|
||||
if err != nil {
|
||||
t.Fatalf("new refresh store: %v", err)
|
||||
}
|
||||
jwt := auth.New(config.AuthConfig{JWTSecret: testSecret})
|
||||
b := bus.New()
|
||||
cfg := &config.Config{Auth: config.AuthConfig{
|
||||
AdminUser: "admin",
|
||||
AdminPass: "secret",
|
||||
JWTSecret: testSecret,
|
||||
RefreshTTL: time.Hour,
|
||||
}}
|
||||
srv, err := New(cfg, Deps{Auth: jwt, Bus: b, Refresh: refresh})
|
||||
if err != nil {
|
||||
t.Fatalf("new server: %v", err)
|
||||
}
|
||||
ts := httptest.NewServer(srv.Handler())
|
||||
t.Cleanup(ts.Close)
|
||||
return &testEnv{srv: srv, ts: ts, auth: jwt, bus: b}, refresh, sqlDB
|
||||
}
|
||||
|
||||
// decodeData unmarshals the {data: ...} envelope payload into v.
|
||||
func decodeData(t *testing.T, body []byte, v any) {
|
||||
t.Helper()
|
||||
env := decodeBody(t, body)
|
||||
raw, ok := env["data"]
|
||||
if !ok {
|
||||
t.Fatalf("response has no data envelope: %s", body)
|
||||
}
|
||||
if err := json.Unmarshal(raw, v); err != nil {
|
||||
t.Fatalf("decode data %s: %v", body, err)
|
||||
}
|
||||
}
|
||||
|
||||
// loginRefresh performs an admin login and returns the access and refresh tokens.
|
||||
func loginRefresh(t *testing.T, ts *httptest.Server) (string, string) {
|
||||
t.Helper()
|
||||
resp, body := doReq(t, http.MethodPost, ts.URL+"/api/v1/auth/login",
|
||||
map[string]string{"username": "admin", "password": "secret"}, "")
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("login status = %d, want 200: %s", resp.StatusCode, body)
|
||||
}
|
||||
var data struct {
|
||||
Token string `json:"token"`
|
||||
RefreshToken string `json:"refreshToken"`
|
||||
Role string `json:"role"`
|
||||
ExpiresAt int64 `json:"expiresAt"`
|
||||
}
|
||||
decodeData(t, body, &data)
|
||||
if data.Token == "" || data.ExpiresAt == 0 || data.Role != "owner" {
|
||||
t.Fatalf("login payload = %+v, want token/expiresAt/role=owner", data)
|
||||
}
|
||||
if data.RefreshToken == "" {
|
||||
t.Fatalf("login payload has no refreshToken: %s", body)
|
||||
}
|
||||
return data.Token, data.RefreshToken
|
||||
}
|
||||
|
||||
// postRefresh calls /auth/refresh with token and returns the status and body.
|
||||
func postRefresh(t *testing.T, ts *httptest.Server, token string) (int, []byte) {
|
||||
t.Helper()
|
||||
resp, body := doReq(t, http.MethodPost, ts.URL+"/api/v1/auth/refresh",
|
||||
map[string]string{"refreshToken": token}, "")
|
||||
return resp.StatusCode, body
|
||||
}
|
||||
|
||||
// wantInvalidGrant asserts a 401 with the machine-readable invalid_grant code.
|
||||
func wantInvalidGrant(t *testing.T, status int, body []byte) {
|
||||
t.Helper()
|
||||
if status != http.StatusUnauthorized {
|
||||
t.Fatalf("status = %d, want 401: %s", status, body)
|
||||
}
|
||||
env := decodeBody(t, body)
|
||||
var eobj struct {
|
||||
Code string `json:"code"`
|
||||
}
|
||||
if err := json.Unmarshal(env["error"], &eobj); err != nil {
|
||||
t.Fatalf("error envelope: %v (%s)", err, body)
|
||||
}
|
||||
if eobj.Code != "invalid_grant" {
|
||||
t.Fatalf("error code = %q, want invalid_grant: %s", eobj.Code, body)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginReturnsRefreshTokenHashedAtRest(t *testing.T) {
|
||||
env, _, sqlDB := newRefreshEnv(t)
|
||||
access, refresh := loginRefresh(t, env.ts)
|
||||
|
||||
if _, err := env.auth.Verify(access); err != nil {
|
||||
t.Fatalf("access token does not verify: %v", err)
|
||||
}
|
||||
var hash string
|
||||
if err := sqlDB.QueryRowContext(context.Background(),
|
||||
"SELECT token_hash FROM refresh_tokens WHERE user_id = 'admin'").Scan(&hash); err != nil {
|
||||
t.Fatalf("select token_hash: %v", err)
|
||||
}
|
||||
if hash == refresh {
|
||||
t.Fatal("refresh token stored in plaintext")
|
||||
}
|
||||
sum := sha256.Sum256([]byte(refresh))
|
||||
if want := hex.EncodeToString(sum[:]); hash != want {
|
||||
t.Fatalf("stored hash = %q, want %q", hash, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRefreshRotatesAccessAndRefreshTokens(t *testing.T) {
|
||||
env, _, _ := newRefreshEnv(t)
|
||||
_, oldRefresh := loginRefresh(t, env.ts)
|
||||
|
||||
status, body := postRefresh(t, env.ts, oldRefresh)
|
||||
if status != http.StatusOK {
|
||||
t.Fatalf("refresh status = %d, want 200: %s", status, body)
|
||||
}
|
||||
var data struct {
|
||||
Token string `json:"token"`
|
||||
ExpiresAt int64 `json:"expiresAt"`
|
||||
Role string `json:"role"`
|
||||
RefreshToken string `json:"refreshToken"`
|
||||
}
|
||||
decodeData(t, body, &data)
|
||||
if data.Token == "" || data.ExpiresAt == 0 || data.Role != "owner" {
|
||||
t.Fatalf("refresh payload = %+v, want token/expiresAt/role", data)
|
||||
}
|
||||
if data.RefreshToken == "" || data.RefreshToken == oldRefresh {
|
||||
t.Fatalf("refresh token not rotated: %q", data.RefreshToken)
|
||||
}
|
||||
claims, err := env.auth.Verify(data.Token)
|
||||
if err != nil {
|
||||
t.Fatalf("refreshed access token does not verify: %v", err)
|
||||
}
|
||||
if claims.Sub != "admin" || claims.Role != auth.RoleOwner {
|
||||
t.Fatalf("refreshed claims = %+v, want admin/owner", claims)
|
||||
}
|
||||
|
||||
// The presented token is single-use: replay must fail.
|
||||
status, body = postRefresh(t, env.ts, oldRefresh)
|
||||
wantInvalidGrant(t, status, body)
|
||||
|
||||
// The rotated token works.
|
||||
if status, body = postRefresh(t, env.ts, data.RefreshToken); status != http.StatusOK {
|
||||
t.Fatalf("rotate replacement status = %d, want 200: %s", status, body)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRefreshRejectsBadGrants(t *testing.T) {
|
||||
env, refresh, sqlDB := newRefreshEnv(t)
|
||||
ctx := context.Background()
|
||||
|
||||
expired := "expired-token-value"
|
||||
sum := sha256.Sum256([]byte(expired))
|
||||
if _, err := sqlDB.ExecContext(ctx,
|
||||
`INSERT INTO refresh_tokens (id, user_id, role, token_hash, expires_at) VALUES (?, ?, ?, ?, ?)`,
|
||||
"seed-expired", "admin", "owner", hex.EncodeToString(sum[:]),
|
||||
time.Now().UTC().Add(-time.Minute).Format(time.RFC3339Nano)); err != nil {
|
||||
t.Fatalf("seed expired token: %v", err)
|
||||
}
|
||||
revoked, _, err := refresh.Issue(ctx, "admin", auth.RoleOwner, time.Hour)
|
||||
if err != nil {
|
||||
t.Fatalf("issue revoked token: %v", err)
|
||||
}
|
||||
if ok, err := refresh.Revoke(ctx, revoked); err != nil || !ok {
|
||||
t.Fatalf("revoke = (%v, %v), want (true, nil)", ok, err)
|
||||
}
|
||||
|
||||
cases := map[string]string{
|
||||
"empty": "",
|
||||
"garbage": "not-a-real-token",
|
||||
"expired": expired,
|
||||
"revoked": revoked,
|
||||
}
|
||||
for name, token := range cases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
status, body := postRefresh(t, env.ts, token)
|
||||
wantInvalidGrant(t, status, body)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestLogoutRevokesRefreshToken(t *testing.T) {
|
||||
env, _, _ := newRefreshEnv(t)
|
||||
_, refreshToken := loginRefresh(t, env.ts)
|
||||
|
||||
resp, body := doReq(t, http.MethodPost, env.ts.URL+"/api/v1/auth/logout",
|
||||
map[string]string{"refreshToken": refreshToken}, "")
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("logout status = %d, want 200: %s", resp.StatusCode, body)
|
||||
}
|
||||
var data struct {
|
||||
Revoked bool `json:"revoked"`
|
||||
}
|
||||
decodeData(t, body, &data)
|
||||
if !data.Revoked {
|
||||
t.Fatalf("logout revoked = false, want true: %s", body)
|
||||
}
|
||||
if status, body := postRefresh(t, env.ts, refreshToken); status != http.StatusUnauthorized {
|
||||
t.Fatalf("refresh after logout status = %d, want 401: %s", status, body)
|
||||
}
|
||||
|
||||
// Logout is idempotent: a second call reports revoked=false, not an error.
|
||||
resp, body = doReq(t, http.MethodPost, env.ts.URL+"/api/v1/auth/logout",
|
||||
map[string]string{"refreshToken": refreshToken}, "")
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("second logout status = %d, want 200: %s", resp.StatusCode, body)
|
||||
}
|
||||
decodeData(t, body, &data)
|
||||
if data.Revoked {
|
||||
t.Fatalf("second logout revoked = true, want false")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLogoutWithAccessTokenRevokesUserGrants(t *testing.T) {
|
||||
env, _, _ := newRefreshEnv(t)
|
||||
access, refreshToken := loginRefresh(t, env.ts)
|
||||
|
||||
resp, body := doReq(t, http.MethodPost, env.ts.URL+"/api/v1/auth/logout", nil, access)
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("logout status = %d, want 200: %s", resp.StatusCode, body)
|
||||
}
|
||||
var data struct {
|
||||
Revoked bool `json:"revoked"`
|
||||
RevokedCount int64 `json:"revokedCount"`
|
||||
}
|
||||
decodeData(t, body, &data)
|
||||
if !data.Revoked || data.RevokedCount != 1 {
|
||||
t.Fatalf("logout payload = %+v, want revoked with 1 grant", data)
|
||||
}
|
||||
if status, body := postRefresh(t, env.ts, refreshToken); status != http.StatusUnauthorized {
|
||||
t.Fatalf("refresh after access-token logout status = %d, want 401: %s", status, body)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRotateJWTInvalidatesRefreshTokens(t *testing.T) {
|
||||
env, _, _ := newRefreshEnv(t)
|
||||
_, refreshToken := loginRefresh(t, env.ts)
|
||||
|
||||
owner := env.token(t, auth.RoleOwner)
|
||||
resp, body := doReq(t, http.MethodPost, env.ts.URL+"/api/v1/admin/system/rotate-jwt",
|
||||
map[string]string{"newSecret": "a-brand-new-jwt-secret-at-least-32-chars"}, owner)
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("rotate-jwt status = %d, want 200: %s", resp.StatusCode, body)
|
||||
}
|
||||
var data struct {
|
||||
Rotated bool `json:"rotated"`
|
||||
RefreshTokensRevoked int64 `json:"refreshTokensRevoked"`
|
||||
}
|
||||
decodeData(t, body, &data)
|
||||
if !data.Rotated || data.RefreshTokensRevoked != 1 {
|
||||
t.Fatalf("rotate-jwt payload = %+v, want rotated with 1 refresh token revoked", data)
|
||||
}
|
||||
if status, body := postRefresh(t, env.ts, refreshToken); status != http.StatusUnauthorized {
|
||||
t.Fatalf("refresh after rotate-jwt status = %d, want 401: %s", status, body)
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user