feat(auth): JWT(HS256 stdlib) + RBAC(owner/admin/viewer) + API key + 密码 hash；config 校验

internal/auth/apikey_test.go

@@ -0,0 +1,82 @@
+package auth
+
+import (
+	"errors"
+	"testing"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
+)
+
+func newTestAPIKey() *APIKey {
+	return NewAPIKey(config.AuthConfig{})
+}
+
+func TestAPIKey_GenerateVerify(t *testing.T) {
+	t.Parallel()
+	k := newTestAPIKey()
+	key, err := k.Generate(RoleAdmin)
+	if err != nil {
+		t.Fatalf("Generate error: %v", err)
+	}
+	if key == "" {
+		t.Fatal("Generate returned empty key")
+	}
+	if !k.Verify(key) {
+		t.Errorf("Verify(%q) = false, want true", key)
+	}
+	role, ok := k.Lookup(key)
+	if !ok || role != RoleAdmin {
+		t.Errorf("Lookup(%q) = (%q,%v), want (admin,true)", key, role, ok)
+	}
+}
+
+func TestAPIKey_GenerateUnique(t *testing.T) {
+	t.Parallel()
+	k := newTestAPIKey()
+	a, err := k.Generate(RoleViewer)
+	if err != nil {
+		t.Fatalf("Generate error: %v", err)
+	}
+	b, err := k.Generate(RoleViewer)
+	if err != nil {
+		t.Fatalf("Generate error: %v", err)
+	}
+	if a == b {
+		t.Fatal("two keys are identical, random generation ineffective")
+	}
+}
+
+func TestAPIKey_GenerateInvalidRole(t *testing.T) {
+	t.Parallel()
+	k := newTestAPIKey()
+	if _, err := k.Generate(Role("god")); !errors.Is(err, ErrInvalidRole) {
+		t.Fatalf("Generate invalid role err = %v, want ErrInvalidRole", err)
+	}
+}
+
+func TestAPIKey_VerifyUnknown(t *testing.T) {
+	t.Parallel()
+	k := newTestAPIKey()
+	if k.Verify("not-a-key") {
+		t.Error("Verify('not-a-key') = true, want false")
+	}
+	if k.Verify("") {
+		t.Error("Verify('') = true, want false")
+	}
+}
+
+func TestAPIKey_Revoke(t *testing.T) {
+	t.Parallel()
+	k := newTestAPIKey()
+	key, err := k.Generate(RoleViewer)
+	if err != nil {
+		t.Fatalf("Generate error: %v", err)
+	}
+	if !k.Verify(key) {
+		t.Fatalf("Verify before revoke = false, want true")
+	}
+	k.Revoke(key)
+	if k.Verify(key) {
+		t.Error("Verify after revoke = true, want false")
+	}
+}