feat: initial commit - kratos admin service

internal/biz/admin_test.go

@@ -0,0 +1,166 @@
+package biz
+
+import (
+	"context"
+	"testing"
+
+	"github.com/go-kratos/kratos/v3/errors"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// fakeAdminRepo is an in-memory AdminRepo for testing the usecase in
+// isolation from the data layer.
+type fakeAdminRepo struct {
+	byName  map[string]*Admin
+	byEmail map[string]*Admin
+	created []*Admin
+}
+
+func newFakeAdminRepo() *fakeAdminRepo {
+	return &fakeAdminRepo{
+		byName:  make(map[string]*Admin),
+		byEmail: make(map[string]*Admin),
+	}
+}
+
+func (r *fakeAdminRepo) FindByID(context.Context, int64) (*Admin, error) {
+	return nil, ErrAdminNotFound
+}
+
+func (r *fakeAdminRepo) FindByName(_ context.Context, name string) (*Admin, error) {
+	a, ok := r.byName[name]
+	if !ok {
+		return nil, ErrAdminNotFound
+	}
+	return a, nil
+}
+
+func (r *fakeAdminRepo) FindByEmail(_ context.Context, email string) (*Admin, error) {
+	a, ok := r.byEmail[email]
+	if !ok {
+		return nil, ErrAdminNotFound
+	}
+	return a, nil
+}
+
+func (r *fakeAdminRepo) ListAdmins(context.Context, ...ListOption) ([]*Admin, error) {
+	return nil, nil
+}
+
+func (r *fakeAdminRepo) CreateAdmin(_ context.Context, a *Admin) (*Admin, error) {
+	r.created = append(r.created, a)
+	return a, nil
+}
+
+func (r *fakeAdminRepo) UpdateAdmin(_ context.Context, a *Admin) (*Admin, error) {
+	return a, nil
+}
+
+func (r *fakeAdminRepo) DeleteAdmin(context.Context, int64) error {
+	return nil
+}
+
+// seedAdmin inserts an admin with a bcrypt-hashed password.
+func seedAdmin(t *testing.T, repo *fakeAdminRepo, name, email, password string) *Admin {
+	t.Helper()
+	hashed, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		t.Fatalf("hash password: %v", err)
+	}
+	a := &Admin{ID: 1, Name: name, Email: email, Password: string(hashed)}
+	repo.byName[name] = a
+	repo.byEmail[email] = a
+	return a
+}
+
+func TestLoginByUsername_Success(t *testing.T) {
+	repo := newFakeAdminRepo()
+	seedAdmin(t, repo, "admin", "admin@example.com", "admin")
+	uc := NewAdminUsecase(repo)
+
+	got, err := uc.LoginByUsername(context.Background(), "admin", "admin")
+	if err != nil {
+		t.Fatalf("expected login success, got error: %v", err)
+	}
+	if got.Name != "admin" {
+		t.Fatalf("expected admin user, got %q", got.Name)
+	}
+}
+
+func TestLoginByEmail_Success(t *testing.T) {
+	repo := newFakeAdminRepo()
+	seedAdmin(t, repo, "admin", "admin@example.com", "admin")
+	uc := NewAdminUsecase(repo)
+
+	got, err := uc.LoginByEmail(context.Background(), "admin@example.com", "admin")
+	if err != nil {
+		t.Fatalf("expected login success, got error: %v", err)
+	}
+	if got.Email != "admin@example.com" {
+		t.Fatalf("expected admin user, got %q", got.Email)
+	}
+}
+
+func TestLoginByUsername_WrongPassword(t *testing.T) {
+	repo := newFakeAdminRepo()
+	seedAdmin(t, repo, "admin", "admin@example.com", "admin")
+	uc := NewAdminUsecase(repo)
+
+	_, err := uc.LoginByUsername(context.Background(), "admin", "wrong")
+	if err == nil {
+		t.Fatal("expected error for wrong password, got nil")
+	}
+	if errors.Code(err) != 401 {
+		t.Fatalf("expected 401 unauthorized, got code %d (%v)", errors.Code(err), err)
+	}
+}
+
+func TestLoginByUsername_UserNotFound(t *testing.T) {
+	repo := newFakeAdminRepo()
+	uc := NewAdminUsecase(repo)
+
+	_, err := uc.LoginByUsername(context.Background(), "ghost", "admin")
+	if err == nil {
+		t.Fatal("expected error for unknown user, got nil")
+	}
+	// Must be the same opaque 401 as a wrong password, to avoid user enumeration.
+	if errors.Code(err) != 401 {
+		t.Fatalf("expected 401 unauthorized, got code %d (%v)", errors.Code(err), err)
+	}
+	if errors.Is(err, ErrAdminNotFound) {
+		t.Fatal("login must not leak ErrAdminNotFound for unknown users")
+	}
+}
+
+func TestCreateAdmin_HashesPassword(t *testing.T) {
+	repo := newFakeAdminRepo()
+	uc := NewAdminUsecase(repo)
+
+	_, err := uc.CreateAdmin(context.Background(), &Admin{Name: "bob", Password: "secret"})
+	if err != nil {
+		t.Fatalf("create admin: %v", err)
+	}
+	if len(repo.created) != 1 {
+		t.Fatalf("expected 1 created admin, got %d", len(repo.created))
+	}
+	stored := repo.created[0].Password
+	if stored == "secret" {
+		t.Fatal("password was stored in plaintext")
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(stored), []byte("secret")); err != nil {
+		t.Fatalf("stored password is not a valid bcrypt hash of the input: %v", err)
+	}
+}
+
+func TestUpdateAdmin_EmptyPasswordLeftUnchanged(t *testing.T) {
+	repo := newFakeAdminRepo()
+	uc := NewAdminUsecase(repo)
+
+	got, err := uc.UpdateAdmin(context.Background(), &Admin{ID: 1, Name: "bob", Password: ""})
+	if err != nil {
+		t.Fatalf("update admin: %v", err)
+	}
+	if got.Password != "" {
+		t.Fatalf("empty password must be passed through unchanged, got %q", got.Password)
+	}
+}