优化结构

2026-08-24 20:12:41 +08:00
parent 7643152c1e
commit d3c20c578f
9 changed files with 197 additions and 228 deletions
@@ -0,0 +1,77 @@
+package system
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"kra/internal/biz/system"
+
+	jwt "github.com/golang-jwt/jwt/v5"
+)
+
+func TestGenerateAndParseWithIssuerRoundTrip(t *testing.T) {
+	token, want, err := generateToken("secret", "kra-admin", time.Hour, time.Minute, 7, 8, "uuid", "alice", "Alice", true, 9)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := parseTokenWithIssuer(token, "secret", "kra-admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.ID != want.ID || got.Username != want.Username || got.Audience[0] != tokenAudience {
+		t.Fatalf("claims = %#v, want %#v", got, want)
+	}
+}
+
+func TestParseRejectsWrongIssuerAndAudience(t *testing.T) {
+	token, _, err := generateToken("secret", "kra-admin", time.Hour, time.Minute, 1, 1, "uuid", "user", "", false, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = parseTokenWithIssuer(token, "secret", "other"); !errors.Is(err, system.ErrTokenInvalid) {
+		t.Fatalf("wrong issuer error = %v, want ErrTokenInvalid", err)
+	}
+	claims := &tokenClaims{RegisteredClaims: jwt.RegisteredClaims{Audience: jwt.ClaimStrings{"other"}, Issuer: "kra-admin", IssuedAt: jwt.NewNumericDate(time.Now()), NotBefore: jwt.NewNumericDate(time.Now().Add(-time.Second)), ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour))}}
+	token, err = signToken("secret", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = parseTokenWithIssuer(token, "secret", "kra-admin"); !errors.Is(err, system.ErrTokenInvalid) {
+		t.Fatalf("wrong audience error = %v, want ErrTokenInvalid", err)
+	}
+}
+
+func TestParseRejectsMissingRequiredTimeClaims(t *testing.T) {
+	claims := &tokenClaims{RegisteredClaims: jwt.RegisteredClaims{Audience: jwt.ClaimStrings{tokenAudience}, Issuer: "kra-admin"}}
+	token, err := signToken("secret", claims)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = parseTokenWithIssuer(token, "secret", "kra-admin"); !errors.Is(err, system.ErrTokenInvalid) {
+		t.Fatalf("missing time claims error = %v, want ErrTokenInvalid", err)
+	}
+}
+
+func TestSigningOptionsRejectInvalidValues(t *testing.T) {
+	if _, _, err := generateToken("", "kra", time.Hour, 0, 1, 1, "", "", "", false, 0); !errors.Is(err, errEmptySigningKey) {
+		t.Fatalf("empty key error = %v", err)
+	}
+	if _, _, err := generateToken("secret", "kra", 0, 0, 1, 1, "", "", "", false, 0); err == nil {
+		t.Fatal("zero expiration was accepted")
+	}
+	if _, err := signToken("secret", nil); !errors.Is(err, errInvalidClaims) {
+		t.Fatalf("nil claims error = %v", err)
+	}
+}
+
+func TestParseRejectsAlgorithmConfusion(t *testing.T) {
+	claims := &tokenClaims{RegisteredClaims: jwt.RegisteredClaims{Audience: jwt.ClaimStrings{tokenAudience}, Issuer: "kra-admin", IssuedAt: jwt.NewNumericDate(time.Now()), NotBefore: jwt.NewNumericDate(time.Now().Add(-time.Second)), ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour))}}
+	token, err := jwt.NewWithClaims(jwt.SigningMethodHS512, claims).SignedString([]byte("secret"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = parseTokenWithIssuer(token, "secret", "kra-admin"); !errors.Is(err, system.ErrTokenSignatureInvalid) {
+		t.Fatalf("algorithm confusion error = %v, want ErrTokenSignatureInvalid", err)
+	}
+}