root
e045e00fbf
Add self-service password change that re-hashes the credential and bumps a per-user session version so all existing access/refresh tokens are rejected. Session version is tracked in Redis with an in-memory fallback and enforced in middleware and refresh. Scope prompt rules and rule groups to a brand: new brand_id column (migrated to a "未归属" fallback brand for existing rows), brand-filtered queries/indexes, and brand-aware admin-web tabs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
103 lines
2.8 KiB
Go
103 lines
2.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestIssueAndParse(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
pair, err := mgr.Issue(42, 10, 100, "tenant_admin")
|
|
require.NoError(t, err)
|
|
assert.NotEmpty(t, pair.AccessToken)
|
|
assert.NotEmpty(t, pair.RefreshToken)
|
|
assert.NotEmpty(t, pair.AccessJTI)
|
|
assert.NotEmpty(t, pair.RefreshJTI)
|
|
assert.NotZero(t, pair.ExpiresAt)
|
|
|
|
claims, err := mgr.Parse(pair.AccessToken)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, int64(42), claims.UserID)
|
|
assert.Equal(t, int64(10), claims.TenantID)
|
|
assert.Equal(t, int64(100), claims.PrimaryWorkspaceID)
|
|
assert.Equal(t, "tenant_admin", claims.Role)
|
|
assert.Equal(t, "access", claims.Subject)
|
|
assert.Equal(t, pair.AccessJTI, claims.ID)
|
|
assert.Equal(t, int64(0), claims.SessionVersion)
|
|
}
|
|
|
|
func TestParseRefreshToken(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
pair, err := mgr.Issue(1, 1, 10, "viewer")
|
|
require.NoError(t, err)
|
|
|
|
claims, err := mgr.Parse(pair.RefreshToken)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "refresh", claims.Subject)
|
|
assert.Equal(t, pair.RefreshJTI, claims.ID)
|
|
}
|
|
|
|
func TestIssueWithSessionVersion(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
pair, err := mgr.IssueWithSessionVersion(1, 1, 10, "viewer", 3)
|
|
require.NoError(t, err)
|
|
|
|
accessClaims, err := mgr.Parse(pair.AccessToken)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, int64(3), accessClaims.SessionVersion)
|
|
|
|
refreshClaims, err := mgr.Parse(pair.RefreshToken)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, int64(3), refreshClaims.SessionVersion)
|
|
}
|
|
|
|
func TestParseExpired(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", -1*time.Second, -1*time.Second)
|
|
|
|
pair, err := mgr.Issue(1, 1, 10, "viewer")
|
|
require.NoError(t, err)
|
|
|
|
_, err = mgr.Parse(pair.AccessToken)
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestParseWrongSecret(t *testing.T) {
|
|
mgr1 := NewManager("secret-one", 15*time.Minute, 7*24*time.Hour)
|
|
mgr2 := NewManager("secret-two", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
pair, err := mgr1.Issue(1, 1, 10, "viewer")
|
|
require.NoError(t, err)
|
|
|
|
_, err = mgr2.Parse(pair.AccessToken)
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestParseGarbage(t *testing.T) {
|
|
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
|
|
|
|
_, err := mgr.Parse("not-a-real-token")
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestHashToken(t *testing.T) {
|
|
h1 := HashToken("some-token")
|
|
h2 := HashToken("some-token")
|
|
h3 := HashToken("different-token")
|
|
|
|
assert.Equal(t, h1, h2)
|
|
assert.NotEqual(t, h1, h3)
|
|
assert.Len(t, h1, 64) // SHA-256 hex
|
|
}
|
|
|
|
func TestAccessAndRefreshTTL(t *testing.T) {
|
|
mgr := NewManager("s", 15*time.Minute, 24*time.Hour)
|
|
assert.Equal(t, 15*time.Minute, mgr.AccessTTL())
|
|
assert.Equal(t, 24*time.Hour, mgr.RefreshTTL())
|
|
}
|