Aska
1ebc82fffd
agent-111 JWT过期重置+系统设置去占位: - ws.ts 识别401/过期 markAuthExpired(清token+停重连+expired态),isTokenExpired;wsParse.ts拆出压行371;scheduleReconnect有token未过期才重连 - api.ts REST 401→auth_expired+清token+引导重登;login走skipAuthExpired密码错不误清 - types.ts WsStatus加expired;TopBar/Nav expired显示登录过期;System.tsx去alert占位改4张事实卡+合并Notice agent-113 用户端登录页: - components/Login.tsx Miuix登录卡(用户名/密码→login()→setAuthToken);App !getAuthToken()→<Login>;AdminApp LoginGate指向 agent-112 系统设置前三个(owner+审计): - auth.APIKey.RevokeAll(吊销全部key);auth.JWTService.RotateSecret(≥32校验+并发安全+新密钥不回显) - gateway admin_system.go: POST revoke-keys/rotate-jwt/backup(VACUUM INTO)/restore(防路径穿越+恢复前自动备份+原子替换+需重启) - wire.go 传DatabasePath;全仓 build/vet/test绿+交叉编译;api-client v0.17系统设置契约 实机验证: 登录(role=owner)+revoke-keys 200+渠道列表含kook; 全仓绿+前端build绿; .env密码仅登录验证不打印
108 lines
2.4 KiB
Go
108 lines
2.4 KiB
Go
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
|
|
)
|
|
|
|
func newTestAPIKey() *APIKey {
|
|
return NewAPIKey(config.AuthConfig{})
|
|
}
|
|
|
|
func TestAPIKey_GenerateVerify(t *testing.T) {
|
|
t.Parallel()
|
|
k := newTestAPIKey()
|
|
key, err := k.Generate(RoleAdmin)
|
|
if err != nil {
|
|
t.Fatalf("Generate error: %v", err)
|
|
}
|
|
if key == "" {
|
|
t.Fatal("Generate returned empty key")
|
|
}
|
|
if !k.Verify(key) {
|
|
t.Errorf("Verify(%q) = false, want true", key)
|
|
}
|
|
role, ok := k.Lookup(key)
|
|
if !ok || role != RoleAdmin {
|
|
t.Errorf("Lookup(%q) = (%q,%v), want (admin,true)", key, role, ok)
|
|
}
|
|
}
|
|
|
|
func TestAPIKey_GenerateUnique(t *testing.T) {
|
|
t.Parallel()
|
|
k := newTestAPIKey()
|
|
a, err := k.Generate(RoleViewer)
|
|
if err != nil {
|
|
t.Fatalf("Generate error: %v", err)
|
|
}
|
|
b, err := k.Generate(RoleViewer)
|
|
if err != nil {
|
|
t.Fatalf("Generate error: %v", err)
|
|
}
|
|
if a == b {
|
|
t.Fatal("two keys are identical, random generation ineffective")
|
|
}
|
|
}
|
|
|
|
func TestAPIKey_GenerateInvalidRole(t *testing.T) {
|
|
t.Parallel()
|
|
k := newTestAPIKey()
|
|
if _, err := k.Generate(Role("god")); !errors.Is(err, ErrInvalidRole) {
|
|
t.Fatalf("Generate invalid role err = %v, want ErrInvalidRole", err)
|
|
}
|
|
}
|
|
|
|
func TestAPIKey_VerifyUnknown(t *testing.T) {
|
|
t.Parallel()
|
|
k := newTestAPIKey()
|
|
if k.Verify("not-a-key") {
|
|
t.Error("Verify('not-a-key') = true, want false")
|
|
}
|
|
if k.Verify("") {
|
|
t.Error("Verify('') = true, want false")
|
|
}
|
|
}
|
|
|
|
func TestAPIKey_Revoke(t *testing.T) {
|
|
t.Parallel()
|
|
k := newTestAPIKey()
|
|
key, err := k.Generate(RoleViewer)
|
|
if err != nil {
|
|
t.Fatalf("Generate error: %v", err)
|
|
}
|
|
if !k.Verify(key) {
|
|
t.Fatalf("Verify before revoke = false, want true")
|
|
}
|
|
k.Revoke(key)
|
|
if k.Verify(key) {
|
|
t.Error("Verify after revoke = true, want false")
|
|
}
|
|
}
|
|
|
|
func TestAPIKey_RevokeAll(t *testing.T) {
|
|
t.Parallel()
|
|
k := newTestAPIKey()
|
|
keys := make([]string, 0, 3)
|
|
for _, role := range []Role{RoleOwner, RoleAdmin, RoleViewer} {
|
|
key, err := k.Generate(role)
|
|
if err != nil {
|
|
t.Fatalf("Generate error: %v", err)
|
|
}
|
|
keys = append(keys, key)
|
|
}
|
|
if got := k.RevokeAll(); got != 3 {
|
|
t.Fatalf("RevokeAll() = %d, want 3", got)
|
|
}
|
|
for _, key := range keys {
|
|
if k.Verify(key) {
|
|
t.Errorf("Verify(%q) after RevokeAll = true, want false", key)
|
|
}
|
|
}
|
|
// An empty table reports zero and is a safe no-op.
|
|
if got := k.RevokeAll(); got != 0 {
|
|
t.Fatalf("RevokeAll() on empty table = %d, want 0", got)
|
|
}
|
|
}
|