feat(admin): add administrator sessions

2026-08-04 14:57:40 +08:00
parent 8ee26be95a
commit 47c0844f9c
12 changed files with 1001 additions and 13 deletions
@@ -2,18 +2,164 @@
 package server

 import (
+	"crypto/subtle"
+	"errors"
 	"net/http"
+	"net/url"
+	"strings"
+
+	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/transport/webui"

 	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
 )

-// NewRouter 返回当前服务范围内的完整 HTTP 路由。
-func NewRouter() *gin.Engine {
-	router := gin.New()
+const maxFormBytes = 8 << 10

-	router.GET("/healthz", func(context *gin.Context) {
-		context.JSON(http.StatusOK, gin.H{"status": "ok"})
-	})
+// Options 是路由层需要的安全依赖。凭据由启动配置注入，不能在路由中设置默认值。
+type Options struct {
+	AdminUsername       string
+	AdminPasswordBcrypt string
+	Sessions            *auth.Manager
+}

-	return router
+// NewRouter 返回当前服务范围内的完整 HTTP 路由。
+func NewRouter(options Options) (*gin.Engine, error) {
+	if options.AdminUsername == "" || options.AdminPasswordBcrypt == "" || options.Sessions == nil {
+		return nil, errors.New("server authentication options are incomplete")
+	}
+
+	router := gin.New()
+	router.Use(gin.Recovery())
+	router.Use(securityHeaders())
+	router.GET("/healthz", healthz)
+	router.GET("/login", loginPage(options))
+	router.POST("/login", login(options))
+	router.POST("/logout", logout(options))
+	router.GET("/tasks", tasksPage(options))
+
+	return router, nil
+}
+
+func healthz(context *gin.Context) {
+	context.JSON(http.StatusOK, gin.H{"status": "ok"})
+}
+
+func securityHeaders() gin.HandlerFunc {
+	return func(context *gin.Context) {
+		context.Header("Cache-Control", "no-store")
+		context.Header("X-Content-Type-Options", "nosniff")
+		context.Header("Referrer-Policy", "no-referrer")
+		context.Header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'")
+		context.Next()
+	}
+}
+
+func loginPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		csrfToken, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
+		if authenticated {
+			context.Redirect(http.StatusSeeOther, "/tasks")
+			return
+		}
+
+		renderLogin(context, http.StatusOK, csrfToken, returnTo(context.Query("return_to")), "", "")
+	}
+}
+
+func login(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		limitFormBody(context)
+		csrfToken := context.PostForm("csrf_token")
+		returnPath := returnTo(context.PostForm("return_to"))
+		username := context.PostForm("username")
+		password := context.PostForm("password")
+
+		if _, ok := options.Sessions.VerifyCSRF(context.Request, csrfToken); !ok {
+			newCSRF, _ := options.Sessions.Ensure(context.Writer, context.Request)
+			renderLogin(context, http.StatusForbidden, newCSRF, returnPath, "", "请求已过期，请重新登录。")
+			return
+		}
+
+		usernameMatches := subtle.ConstantTimeCompare([]byte(options.AdminUsername), []byte(username)) == 1
+		passwordMatches := bcrypt.CompareHashAndPassword([]byte(options.AdminPasswordBcrypt), []byte(password)) == nil
+		if !usernameMatches || !passwordMatches {
+			csrf, _ := options.Sessions.Ensure(context.Writer, context.Request)
+			renderLogin(context, http.StatusUnauthorized, csrf, returnPath, "", "账号或密码不正确，请检查后重试。")
+			return
+		}
+
+		options.Sessions.RotateAuthenticated(context.Writer, context.Request)
+		context.Redirect(http.StatusSeeOther, returnPath)
+	}
+}
+
+func logout(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		limitFormBody(context)
+		authenticated, ok := options.Sessions.VerifyCSRF(context.Request, context.PostForm("csrf_token"))
+		if !ok || !authenticated {
+			context.Status(http.StatusForbidden)
+			return
+		}
+
+		options.Sessions.Logout(context.Writer, context.Request)
+		context.Redirect(http.StatusSeeOther, "/login")
+	}
+}
+
+func tasksPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		csrfToken, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
+		if !authenticated {
+			context.Redirect(http.StatusSeeOther, "/login?return_to="+url.QueryEscape(context.Request.URL.RequestURI()))
+			return
+		}
+
+		context.Header("Content-Type", "text/html; charset=utf-8")
+		if err := webui.RenderTasks(context.Writer, webui.TasksData{CSRFToken: csrfToken}); err != nil {
+			_ = context.Error(err)
+		}
+	}
+}
+
+func renderLogin(context *gin.Context, status int, csrfToken, returnPath, username, message string) {
+	context.Header("Content-Type", "text/html; charset=utf-8")
+	context.Status(status)
+	if err := webui.RenderLogin(context.Writer, webui.LoginData{
+		CSRFToken: csrfToken,
+		ReturnTo:  returnPath,
+		Username:  username,
+		Error:     message,
+	}); err != nil {
+		_ = context.Error(err)
+	}
+}
+
+func limitFormBody(context *gin.Context) {
+	context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxFormBytes)
+}
+
+func returnTo(value string) string {
+	if value == "/tasks" || strings.HasPrefix(value, "/tasks/") || strings.HasPrefix(value, "/tasks?") {
+		if strings.Contains(value, "\\") || strings.Contains(value, "%") || strings.HasPrefix(value, "//") {
+			return "/tasks"
+		}
+		parsed, err := url.ParseRequestURI(value)
+		if err == nil && parsed.IsAbs() == false && parsed.Host == "" && hasSafeTaskPath(parsed.Path) {
+			return value
+		}
+	}
+
+	return "/tasks"
+}
+
+func hasSafeTaskPath(path string) bool {
+	for _, segment := range strings.Split(path, "/") {
+		if segment == "." || segment == ".." {
+			return false
+		}
+	}
+	return true
 }
@@ -3,26 +3,291 @@ package server_test
 import (
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"strings"
 	"testing"

+	"cmbuyer/admin/internal/auth"
 	"cmbuyer/admin/internal/server"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
 )

-func TestHealthz(t *testing.T) {
+var csrfPattern = regexp.MustCompile(`name="csrf_token" value="([^"]+)"`)
+
+func TestHealthzIsPublic(t *testing.T) {
+	router, _ := newRouter(t)
 	request := httptest.NewRequest(http.MethodGet, "/healthz", nil)
 	response := httptest.NewRecorder()

-	server.NewRouter().ServeHTTP(response, request)
+	router.ServeHTTP(response, request)

 	if response.Code != http.StatusOK {
 		t.Fatalf("healthz status = %d, want %d", response.Code, http.StatusOK)
 	}
-
 	if contentType := response.Header().Get("Content-Type"); contentType != "application/json; charset=utf-8" {
 		t.Fatalf("healthz content type = %q, want application/json; charset=utf-8", contentType)
 	}
-
 	if body := response.Body.String(); body != "{\"status\":\"ok\"}" {
 		t.Fatalf("healthz body = %q, want {\"status\":\"ok\"}", body)
 	}
+	assertSecurityHeaders(t, response)
+}
+
+func TestTasksRequiresLoginAndBlocksOpenRedirects(t *testing.T) {
+	router, _ := newRouter(t)
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, nil)
+	if tasks.Code != http.StatusSeeOther {
+		t.Fatalf("GET /tasks status = %d, want %d", tasks.Code, http.StatusSeeOther)
+	}
+	if location := tasks.Header().Get("Location"); location != "/login?return_to=%2Ftasks" {
+		t.Fatalf("GET /tasks location = %q, want login return path", location)
+	}
+
+	for _, target := range []string{"https://example.invalid", "//example.invalid", `\\example.invalid`, "/other", "/tasks/..", "/tasks/../other", "/tasks/%2e%2e", "%2F%2Fevil.invalid", "%252F%252Fevil.invalid"} {
+		response := serve(router, http.MethodGet, "/login?return_to="+url.QueryEscape(target), nil, nil)
+		if response.Code != http.StatusOK {
+			t.Fatalf("GET /login return_to=%q status = %d, want 200", target, response.Code)
+		}
+		if strings.Contains(response.Body.String(), target) || !strings.Contains(response.Body.String(), `name="return_to" value="/tasks"`) {
+			t.Fatalf("GET /login accepted unsafe return_to %q", target)
+		}
+	}
+
+	encodedPath := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%252F..", nil, nil)
+	if !strings.Contains(encodedPath.Body.String(), `name="return_to" value="/tasks"`) {
+		t.Fatal("encoded parent path was accepted as return_to")
+	}
+	encodedQuery := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fnext%3D%252Ftasks%252F..", nil, nil)
+	if !strings.Contains(encodedQuery.Body.String(), `name="return_to" value="/tasks"`) {
+		t.Fatal("encoded query bypass was accepted as return_to")
+	}
+}
+
+func TestLoginRotatesSessionAndCSRF(t *testing.T) {
+	router, _ := newRouter(t)
+	initial := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fview%3Dmine", nil, nil)
+	oldCookie := sessionCookie(t, initial)
+	oldCSRF := csrfToken(t, initial.Body.String())
+
+	login := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {oldCSRF},
+		"return_to":  {"/tasks?view=mine"},
+		"username":   {"admin"},
+		"password":   {"test-password"},
+	}, oldCookie)
+	if login.Code != http.StatusSeeOther || login.Header().Get("Location") != "/tasks?view=mine" {
+		t.Fatalf("successful login = (%d, %q), want 303 /tasks?view=mine", login.Code, login.Header().Get("Location"))
+	}
+	newCookie := sessionCookie(t, login)
+	if newCookie.Value == oldCookie.Value {
+		t.Fatal("successful login reused the anonymous session cookie")
+	}
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, newCookie)
+	if tasks.Code != http.StatusOK {
+		t.Fatalf("GET /tasks after login status = %d, want 200", tasks.Code)
+	}
+	if newCSRF := csrfToken(t, tasks.Body.String()); newCSRF == oldCSRF {
+		t.Fatal("successful login reused the anonymous CSRF token")
+	}
+	for _, forbidden := range []string{"建单", "试选", "拼多多", "规格", "单价", "证据"} {
+		if strings.Contains(tasks.Body.String(), forbidden) {
+			t.Fatalf("task shell must not expose deferred feature content %q", forbidden)
+		}
+	}
+	assertSecurityHeaders(t, initial)
+	assertSecurityHeaders(t, tasks)
+}
+
+func TestLoginPageIncludesAccessibleFormBasics(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	body := page.Body.String()
+	for _, want := range []string{
+		`<label for="username">`,
+		`<label for="password">`,
+		`autocomplete="username"`,
+		`autocomplete="current-password"`,
+		`min-height:44px`,
+		`:focus-visible`,
+		`prefers-reduced-motion`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("login page is missing %q", want)
+		}
+	}
+	if strings.Contains(body, "http://") || strings.Contains(body, "https://") || strings.Contains(body, "<script") {
+		t.Fatal("login page must not load external resources or require client-side JavaScript")
+	}
+
+	failure := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, body)},
+		"username":   {"admin"},
+		"password":   {"wrong"},
+	}, sessionCookie(t, page))
+	if !strings.Contains(failure.Body.String(), `role="alert"`) {
+		t.Fatal("login failure must announce its error")
+	}
+}
+
+func TestLoginCSRFAndCredentialFailuresAreSafe(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	cookie := sessionCookie(t, page)
+
+	withoutCSRF := serve(router, http.MethodPost, "/login", url.Values{
+		"username": {"admin"},
+		"password": {"test-password"},
+	}, cookie)
+	if withoutCSRF.Code != http.StatusForbidden || !strings.Contains(withoutCSRF.Body.String(), "请求已过期") {
+		t.Fatalf("login without CSRF = (%d, %q), want rejected form", withoutCSRF.Code, withoutCSRF.Body.String())
+	}
+
+	page = serve(router, http.MethodGet, "/login", nil, cookie)
+	badCredentials := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, page.Body.String())},
+		"username":   {"unknown"},
+		"password":   {"wrong"},
+	}, cookie)
+	if badCredentials.Code != http.StatusUnauthorized {
+		t.Fatalf("login with invalid credentials status = %d, want 401", badCredentials.Code)
+	}
+	if body := badCredentials.Body.String(); !strings.Contains(body, "账号或密码不正确") || strings.Contains(body, "unknown") {
+		t.Fatalf("invalid login leaked account detail: %q", body)
+	}
+}
+
+func TestTamperedCookieCannotAccessTasks(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	cookie := sessionCookie(t, page)
+
+	tampered := *cookie
+	tampered.Value = flipCookieValue(t, cookie.Value)
+	response := serve(router, http.MethodGet, "/tasks", nil, &tampered)
+	if response.Code != http.StatusSeeOther {
+		t.Fatalf("tampered cookie status = %d, want 303", response.Code)
+	}
+
+}
+
+func assertSecurityHeaders(t *testing.T, response *httptest.ResponseRecorder) {
+	t.Helper()
+	want := map[string]string{
+		"Cache-Control":           "no-store",
+		"X-Content-Type-Options":  "nosniff",
+		"Referrer-Policy":         "no-referrer",
+		"Content-Security-Policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
+	}
+	for name, expected := range want {
+		if got := response.Header().Get(name); got != expected {
+			t.Fatalf("%s = %q, want %q", name, got, expected)
+		}
+	}
+}
+
+func flipCookieValue(t *testing.T, value string) string {
+	t.Helper()
+	if value == "" {
+		t.Fatal("cannot tamper with an empty cookie")
+	}
+	if value[0] == 'A' {
+		return "B" + value[1:]
+	}
+	return "A" + value[1:]
+}
+
+func TestLogoutRequiresCSRFAndRevokesSession(t *testing.T) {
+	router, _ := newRouter(t)
+	loginPage := serve(router, http.MethodGet, "/login", nil, nil)
+	loginCookie := sessionCookie(t, loginPage)
+	login := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, loginPage.Body.String())},
+		"username":   {"admin"},
+		"password":   {"test-password"},
+	}, loginCookie)
+	authenticatedCookie := sessionCookie(t, login)
+
+	missingCSRF := serve(router, http.MethodPost, "/logout", url.Values{}, authenticatedCookie)
+	if missingCSRF.Code != http.StatusForbidden {
+		t.Fatalf("logout without CSRF status = %d, want 403", missingCSRF.Code)
+	}
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
+	logout := serve(router, http.MethodPost, "/logout", url.Values{
+		"csrf_token": {csrfToken(t, tasks.Body.String())},
+	}, authenticatedCookie)
+	if logout.Code != http.StatusSeeOther || logout.Header().Get("Location") != "/login" {
+		t.Fatalf("logout = (%d, %q), want 303 /login", logout.Code, logout.Header().Get("Location"))
+	}
+	if cookie := sessionCookie(t, logout); cookie.MaxAge >= 0 {
+		t.Fatalf("logout cookie MaxAge = %d, want a deletion cookie", cookie.MaxAge)
+	}
+
+	reused := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
+	if reused.Code != http.StatusSeeOther {
+		t.Fatalf("revoked session status = %d, want 303", reused.Code)
+	}
+}
+
+func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("generate bcrypt hash: %v", err)
+	}
+	manager := auth.NewManager([]byte(strings.Repeat("s", 32)), false)
+	router, err := server.NewRouter(server.Options{
+		AdminUsername:       "admin",
+		AdminPasswordBcrypt: string(hash),
+		Sessions:            manager,
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+	return router, manager
+}
+
+func serve(router http.Handler, method, target string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
+	var body *strings.Reader
+	if form == nil {
+		body = strings.NewReader("")
+	} else {
+		body = strings.NewReader(form.Encode())
+	}
+	request := httptest.NewRequest(method, target, body)
+	if form != nil {
+		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	}
+	if cookie != nil {
+		request.AddCookie(cookie)
+	}
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	return response
+}
+
+func sessionCookie(t *testing.T, response *httptest.ResponseRecorder) *http.Cookie {
+	t.Helper()
+	for _, cookie := range response.Result().Cookies() {
+		if cookie.Name == auth.CookieName {
+			return cookie
+		}
+	}
+	t.Fatalf("response did not set %s cookie", auth.CookieName)
+	return nil
+}
+
+func csrfToken(t *testing.T, body string) string {
+	t.Helper()
+	matches := csrfPattern.FindStringSubmatch(body)
+	if len(matches) != 2 || matches[1] == "" {
+		t.Fatalf("no CSRF token in response body: %q", body)
+	}
+	return matches[1]
 }