feat: 实现 Admin 首次初始化与网页登录 (#50)

admin/handler/web/auth_test.go

@@ -0,0 +1,66 @@
+package web
+
+import (
+	"crypto/tls"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestSafeNext只允许本站绝对路径(t *testing.T) {
+	for _, test := range []struct {
+		raw  string
+		want string
+	}{
+		{"/pdd?status=pending", "/pdd?status=pending"},
+		{"", "/shopee"},
+		{"https://example.com", "/shopee"},
+		{"//example.com/path", "/shopee"},
+		{"pdd", "/shopee"},
+	} {
+		if got := safeNext(test.raw); got != test.want {
+			t.Errorf("safeNext(%q) = %q，期望 %q", test.raw, got, test.want)
+		}
+	}
+}
+
+func TestAuthCookie安全属性(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	for _, test := range []struct {
+		name   string
+		tls    bool
+		secure bool
+	}{
+		{"HTTP", false, false},
+		{"HTTPS", true, true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			response := httptest.NewRecorder()
+			request := httptest.NewRequest(http.MethodGet, "/login", nil)
+			if test.tls {
+				request.TLS = &tls.ConnectionState{}
+			}
+			context, _ := gin.CreateTestContext(response)
+			context.Request = request
+			setAuthCookie(context, "raw-token", time.Now().Add(12*time.Hour))
+
+			cookies := response.Result().Cookies()
+			if len(cookies) != 1 {
+				t.Fatalf("Set-Cookie 数量 = %d，期望 1", len(cookies))
+			}
+			cookie := cookies[0]
+			if cookie.Name != authCookieName || cookie.Value != "raw-token" || cookie.Path != "/" {
+				t.Errorf("Cookie 名称、值或 Path 不正确: %#v", cookie)
+			}
+			if !cookie.HttpOnly || cookie.SameSite != http.SameSiteLaxMode || cookie.Secure != test.secure {
+				t.Errorf("Cookie 安全属性不正确: %#v", cookie)
+			}
+			if cookie.MaxAge != 12*60*60 {
+				t.Errorf("Cookie MaxAge = %d，期望 43200", cookie.MaxAge)
+			}
+		})
+	}
+}