对接

internal/server/middleware/auth_test.go

@@ -6,6 +6,7 @@ import (
 	"kra/internal/biz/system"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/gin-gonic/gin"
@@ -79,3 +80,36 @@ func TestAuthenticateWebSocketSupportsBearerHeaderAndReportsInvalidToken(t *test
 		t.Fatalf("invalid token status=%d, want %d", invalidRecorder.Code, http.StatusUnauthorized)
 	}
 }
+
+func TestAuthenticateWebSocketOptionalFallsBackToAnonymous(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	stub := &tokenAuthenticatorStub{err: system.ErrTokenExpired}
+	recorder := httptest.NewRecorder()
+	context, _ := gin.CreateTestContext(recorder)
+	context.Request = httptest.NewRequest(http.MethodGet, "/ws", nil)
+	context.Request.AddCookie(&http.Cookie{Name: "x-token", Value: "expired-token"})
+
+	if AuthenticateWebSocketOptional(context, stub) {
+		t.Fatal("expired token was treated as authenticated")
+	}
+	if Claims(context) != nil {
+		t.Fatalf("anonymous fallback retained claims: %#v", Claims(context))
+	}
+	if recorder.Code == http.StatusUnauthorized {
+		t.Fatalf("optional authentication interrupted public handshake: body=%s", recorder.Body.String())
+	}
+	if cookie := recorder.Header().Get("Set-Cookie"); !strings.Contains(cookie, "x-token=") || !strings.Contains(cookie, "Max-Age=0") {
+		t.Fatalf("expired token cookie was not cleared: %q", cookie)
+	}
+}
+
+func TestAuthenticateWebSocketOptionalStoresValidClaims(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	stub := &tokenAuthenticatorStub{claims: &system.AuthClaims{ID: 9}}
+	context, _ := gin.CreateTestContext(httptest.NewRecorder())
+	context.Request = httptest.NewRequest(http.MethodGet, "/ws?token=valid-token", nil)
+
+	if !AuthenticateWebSocketOptional(context, stub) || Claims(context) == nil || Claims(context).ID != 9 {
+		t.Fatalf("valid optional token was not applied: claims=%#v", Claims(context))
+	}
+}