优化

2026-08-18 15:04:07 +08:00
parent 10ccc005be
commit 1ef8ecb7b2
42 changed files with 3027 additions and 296 deletions
@@ -11,29 +11,42 @@ import (

 type authenticationUserRepo struct {
 	UserRepo
-	user *User
+	user          *User
+	findByUUIDErr error
 }

 func (r *authenticationUserRepo) FindUserByUsername(context.Context, string) (*User, error) {
 	return r.user, nil
 }

+func (r *authenticationUserRepo) FindUserByUUID(context.Context, string) (*User, error) {
+	return r.user, r.findByUUIDErr
+}
+
 func (*authenticationUserRepo) HasAuthorityMenu(context.Context, uint, string) (bool, error) {
 	return true, nil
 }

+func (*authenticationUserRepo) FillDepartmentNamePaths(context.Context, *User) error { return nil }
+
 type authenticationSecurityRepo struct{ SecurityRepo }

 func (*authenticationSecurityRepo) SecurityConfig(context.Context) (*SecurityConfig, error) {
 	return &SecurityConfig{CaptchaOpen: 2, CaptchaTimeout: 60}, nil
 }

-type authenticationCache struct{ activeErr error }
+type authenticationCache struct {
+	activeErr error
+	getErr    error
+}

 func (c *authenticationCache) Get(_ context.Context, key string) (string, bool, error) {
 	if key == "admin" {
 		return "", false, c.activeErr
 	}
+	if c.getErr != nil {
+		return "", false, c.getErr
+	}
 	return "", false, nil
 }
 func (*authenticationCache) Set(context.Context, string, string, time.Duration) error { return nil }
@@ -46,12 +59,20 @@ type authenticationSettings struct{ RuntimeSettings }

 func (*authenticationSettings) UseMultipoint() bool { return true }

-type authenticationIssuer struct{ TokenIssuer }
+type authenticationIssuer struct {
+	TokenIssuer
+	claims     *AuthClaims
+	issuedUser *User
+	issuedMust bool
+}

-func (*authenticationIssuer) IssueToken(*User, uint, bool, time.Duration) (*IssuedToken, error) {
+func (i *authenticationIssuer) IssueToken(user *User, _ uint, must bool, _ time.Duration) (*IssuedToken, error) {
+	i.issuedUser, i.issuedMust = user, must
 	return &IssuedToken{Value: "token", ExpiresAt: time.Now().Add(time.Hour), TTL: time.Hour}, nil
 }

+func (i *authenticationIssuer) ParseToken(string) (*AuthClaims, error) { return i.claims, nil }
+
 func (*authenticationIssuer) ReissueToken(claims *AuthClaims, _ uint) (*IssuedToken, error) {
 	return &IssuedToken{Value: "token", ExpiresAt: claims.ExpiresAt, TTL: time.Until(claims.ExpiresAt)}, nil
 }
@@ -93,6 +114,12 @@ func (a *authenticationAudit) RecordLogin(_ context.Context, value *LoginLog) er
 	return nil
 }

+type authenticationTokenRepo struct{ APITokenRepo }
+
+func (*authenticationTokenRepo) IsTokenDisabled(context.Context, string) (bool, error) {
+	return false, nil
+}
+
 func TestLoginRecordsSuccessBeforeMultipointCacheFailure(t *testing.T) {
 	hash, err := bcrypt.GenerateFromPassword([]byte("secret"), bcrypt.MinCost)
 	if err != nil {
@@ -137,3 +164,87 @@ func TestSwitchAuthorityReissuesCurrentClaimsWithoutReloadingUser(t *testing.T)
 		t.Fatalf("switch result = %+v", result)
 	}
 }
+
+func TestLoginRejectsSecurityCacheFailure(t *testing.T) {
+	cacheErr := errors.New("cache unavailable")
+	security := NewSecurityUsecase(&authenticationSecurityRepo{}, &authenticationCache{getErr: cacheErr}, &authenticationSettings{}, nil)
+	uc := NewAuthenticationUsecase(NewUserUsecase(&authenticationUserRepo{}), security, &authenticationIssuer{}, &authenticationAudit{})
+
+	_, err := uc.Login(context.Background(), &LoginAttempt{Username: "admin", Password: "secret", IP: "127.0.0.1"})
+	if !errors.Is(err, ErrLoginState) {
+		t.Fatalf("expected login-state failure, got %v", err)
+	}
+}
+
+func TestAuthenticateTokenRejectsStaleUserState(t *testing.T) {
+	issuedAt := time.Now().Add(-time.Hour).Truncate(time.Second)
+	baseClaims := AuthClaims{ID: 7, UUID: "uuid", Username: "admin", AuthorityID: 888, IssuedAt: issuedAt, ExpiresAt: time.Now().Add(time.Hour)}
+	passwordChanged := issuedAt.Add(time.Minute)
+	tests := []struct {
+		name string
+		user *User
+		want error
+	}{
+		{name: "disabled", user: &User{ID: 7, UUID: "uuid", Username: "admin", AuthorityID: 888, Enable: 0}, want: ErrUserDisabled},
+		{name: "role removed", user: &User{ID: 7, UUID: "uuid", Username: "admin", AuthorityID: 999, Enable: 1}, want: ErrTokenDisabled},
+		{name: "password changed", user: &User{ID: 7, UUID: "uuid", Username: "admin", AuthorityID: 888, Enable: 1, PasswordUpdatedAt: &passwordChanged}, want: ErrTokenDisabled},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			claims := baseClaims
+			issuer := &authenticationIssuer{claims: &claims}
+			security := NewSecurityUsecase(&authenticationSecurityRepo{}, &authenticationCache{}, &authenticationSettings{}, NewTokenUsecase(&authenticationTokenRepo{}))
+			uc := NewAuthenticationUsecase(NewUserUsecase(&authenticationUserRepo{user: test.user}), security, issuer, &authenticationAudit{})
+			_, err := uc.AuthenticateToken(context.Background(), "token")
+			if !errors.Is(err, test.want) {
+				t.Fatalf("AuthenticateToken error = %v, want %v", err, test.want)
+			}
+		})
+	}
+}
+
+func TestAuthenticateTokenRefreshesFromCurrentUser(t *testing.T) {
+	issuedAt := time.Now().Add(-time.Hour).Truncate(time.Second)
+	claims := &AuthClaims{ID: 7, UUID: "uuid", Username: "admin", NickName: "old", AuthorityID: 888, IssuedAt: issuedAt, BufferTime: 2 * time.Hour, ExpiresAt: time.Now().Add(time.Hour)}
+	user := &User{ID: 7, UUID: "uuid", Username: "admin", NickName: "current", AuthorityID: 888, Enable: 1, MustChangePassword: true}
+	issuer := &authenticationIssuer{claims: claims}
+	security := NewSecurityUsecase(&authenticationSecurityRepo{}, &authenticationCache{}, &authenticationSettings{}, NewTokenUsecase(&authenticationTokenRepo{}))
+	uc := NewAuthenticationUsecase(NewUserUsecase(&authenticationUserRepo{user: user}), security, issuer, &authenticationAudit{})
+
+	result, err := uc.AuthenticateToken(context.Background(), "token")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Refreshed == nil || result.Claims.NickName != "current" || !result.Claims.MustChangePwd {
+		t.Fatalf("unexpected authentication result: %+v", result)
+	}
+	if issuer.issuedUser != user || !issuer.issuedMust {
+		t.Fatalf("refresh used stale user state: user=%+v must=%v", issuer.issuedUser, issuer.issuedMust)
+	}
+}
+
+func TestAuthenticateTokenRejectsPasswordChangeWithinIssuedAtSecond(t *testing.T) {
+	issuedAt := time.Now().Add(-time.Minute).Truncate(time.Second)
+	passwordAtIssue := issuedAt.Add(100 * time.Millisecond)
+	passwordChanged := issuedAt.Add(900 * time.Millisecond)
+	if passwordAtIssue.Unix() != passwordChanged.Unix() {
+		t.Fatal("test setup did not keep password changes in one second")
+	}
+	claims := &AuthClaims{
+		ID:              7,
+		UUID:            "uuid",
+		Username:        "admin",
+		AuthorityID:     888,
+		IssuedAt:        issuedAt,
+		ExpiresAt:       time.Now().Add(time.Hour),
+		PasswordVersion: passwordAtIssue.UnixNano(),
+	}
+	user := &User{ID: 7, UUID: "uuid", Username: "admin", AuthorityID: 888, Enable: 1, PasswordUpdatedAt: &passwordChanged}
+	issuer := &authenticationIssuer{claims: claims}
+	security := NewSecurityUsecase(&authenticationSecurityRepo{}, &authenticationCache{}, &authenticationSettings{}, NewTokenUsecase(&authenticationTokenRepo{}))
+	uc := NewAuthenticationUsecase(NewUserUsecase(&authenticationUserRepo{user: user}), security, issuer, &authenticationAudit{})
+
+	if _, err := uc.AuthenticateToken(context.Background(), "token"); !errors.Is(err, ErrTokenDisabled) {
+		t.Fatalf("AuthenticateToken error = %v, want ErrTokenDisabled", err)
+	}
+}