cmbuyer/admin/internal/server/router_test.go

package server_test

import (
	"context"
	"net/http"
	"net/http/httptest"
	"net/url"
	"regexp"
	"strings"
	"testing"

	"cmbuyer/admin/internal/auth"
	"cmbuyer/admin/internal/server"
	"cmbuyer/admin/internal/tasks"

	"github.com/gin-gonic/gin"
	"golang.org/x/crypto/bcrypt"
)

var csrfPattern = regexp.MustCompile(`name="csrf_token" value="([^"]+)"`)
var createKeyPattern = regexp.MustCompile(`name="create_key" value="([^"]+)"`)

func TestHealthzIsPublic(t *testing.T) {
	router, _ := newRouter(t)
	request := httptest.NewRequest(http.MethodGet, "/healthz", nil)
	response := httptest.NewRecorder()

	router.ServeHTTP(response, request)

	if response.Code != http.StatusOK {
		t.Fatalf("healthz status = %d, want %d", response.Code, http.StatusOK)
	}
	if contentType := response.Header().Get("Content-Type"); contentType != "application/json; charset=utf-8" {
		t.Fatalf("healthz content type = %q, want application/json; charset=utf-8", contentType)
	}
	if body := response.Body.String(); body != "{\"status\":\"ok\"}" {
		t.Fatalf("healthz body = %q, want {\"status\":\"ok\"}", body)
	}
	assertSecurityHeaders(t, response)
}

func TestTasksRequiresLoginAndBlocksOpenRedirects(t *testing.T) {
	router, _ := newRouter(t)

	tasks := serve(router, http.MethodGet, "/tasks", nil, nil)
	if tasks.Code != http.StatusSeeOther {
		t.Fatalf("GET /tasks status = %d, want %d", tasks.Code, http.StatusSeeOther)
	}
	if location := tasks.Header().Get("Location"); location != "/login?return_to=%2Ftasks" {
		t.Fatalf("GET /tasks location = %q, want login return path", location)
	}

	for _, target := range []string{"https://example.invalid", "//example.invalid", `\\example.invalid`, "/other", "/tasks/..", "/tasks/../other", "/tasks/%2e%2e", "%2F%2Fevil.invalid", "%252F%252Fevil.invalid"} {
		response := serve(router, http.MethodGet, "/login?return_to="+url.QueryEscape(target), nil, nil)
		if response.Code != http.StatusOK {
			t.Fatalf("GET /login return_to=%q status = %d, want 200", target, response.Code)
		}
		if strings.Contains(response.Body.String(), target) || !strings.Contains(response.Body.String(), `name="return_to" value="/tasks"`) {
			t.Fatalf("GET /login accepted unsafe return_to %q", target)
		}
	}

	encodedPath := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%252F..", nil, nil)
	if !strings.Contains(encodedPath.Body.String(), `name="return_to" value="/tasks"`) {
		t.Fatal("encoded parent path was accepted as return_to")
	}
	encodedQuery := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fnext%3D%252Ftasks%252F..", nil, nil)
	if !strings.Contains(encodedQuery.Body.String(), `name="return_to" value="/tasks"`) {
		t.Fatal("encoded query bypass was accepted as return_to")
	}
}

func TestLoginRotatesSessionAndCSRF(t *testing.T) {
	router, _ := newRouter(t)
	initial := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fview%3Dmine", nil, nil)
	oldCookie := sessionCookie(t, initial)
	oldCSRF := csrfToken(t, initial.Body.String())

	login := serve(router, http.MethodPost, "/login", url.Values{
		"csrf_token": {oldCSRF},
		"return_to":  {"/tasks?view=mine"},
		"username":   {"admin"},
		"password":   {"test-password"},
	}, oldCookie)
	if login.Code != http.StatusSeeOther || login.Header().Get("Location") != "/tasks?view=mine" {
		t.Fatalf("successful login = (%d, %q), want 303 /tasks?view=mine", login.Code, login.Header().Get("Location"))
	}
	newCookie := sessionCookie(t, login)
	if newCookie.Value == oldCookie.Value {
		t.Fatal("successful login reused the anonymous session cookie")
	}

	tasks := serve(router, http.MethodGet, "/tasks", nil, newCookie)
	if tasks.Code != http.StatusOK {
		t.Fatalf("GET /tasks after login status = %d, want 200", tasks.Code)
	}
	if newCSRF := csrfToken(t, tasks.Body.String()); newCSRF == oldCSRF {
		t.Fatal("successful login reused the anonymous CSRF token")
	}
	for _, forbidden := range []string{"建单", "试选", "拼多多", "规格", "单价", "证据"} {
		if strings.Contains(tasks.Body.String(), forbidden) {
			t.Fatalf("task shell must not expose deferred feature content %q", forbidden)
		}
	}
	assertSecurityHeaders(t, initial)
	assertSecurityHeaders(t, tasks)
}

func TestLoginPageIncludesAccessibleFormBasics(t *testing.T) {
	router, _ := newRouter(t)
	page := serve(router, http.MethodGet, "/login", nil, nil)
	body := page.Body.String()
	for _, want := range []string{
		`<label for="username">`,
		`<label for="password">`,
		`autocomplete="username"`,
		`autocomplete="current-password"`,
		`min-height:44px`,
		`:focus-visible`,
		`prefers-reduced-motion`,
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("login page is missing %q", want)
		}
	}
	if strings.Contains(body, "http://") || strings.Contains(body, "https://") || strings.Contains(body, "<script") {
		t.Fatal("login page must not load external resources or require client-side JavaScript")
	}

	failure := serve(router, http.MethodPost, "/login", url.Values{
		"csrf_token": {csrfToken(t, body)},
		"username":   {"admin"},
		"password":   {"wrong"},
	}, sessionCookie(t, page))
	if !strings.Contains(failure.Body.String(), `role="alert"`) {
		t.Fatal("login failure must announce its error")
	}
}

func TestLoginCSRFAndCredentialFailuresAreSafe(t *testing.T) {
	router, _ := newRouter(t)
	page := serve(router, http.MethodGet, "/login", nil, nil)
	cookie := sessionCookie(t, page)

	withoutCSRF := serve(router, http.MethodPost, "/login", url.Values{
		"username": {"admin"},
		"password": {"test-password"},
	}, cookie)
	if withoutCSRF.Code != http.StatusForbidden || !strings.Contains(withoutCSRF.Body.String(), "请求已过期") {
		t.Fatalf("login without CSRF = (%d, %q), want rejected form", withoutCSRF.Code, withoutCSRF.Body.String())
	}

	page = serve(router, http.MethodGet, "/login", nil, cookie)
	badCredentials := serve(router, http.MethodPost, "/login", url.Values{
		"csrf_token": {csrfToken(t, page.Body.String())},
		"username":   {"unknown"},
		"password":   {"wrong"},
	}, cookie)
	if badCredentials.Code != http.StatusUnauthorized {
		t.Fatalf("login with invalid credentials status = %d, want 401", badCredentials.Code)
	}
	if body := badCredentials.Body.String(); !strings.Contains(body, "账号或密码不正确") || strings.Contains(body, "unknown") {
		t.Fatalf("invalid login leaked account detail: %q", body)
	}
}

func TestTamperedCookieCannotAccessTasks(t *testing.T) {
	router, _ := newRouter(t)
	page := serve(router, http.MethodGet, "/login", nil, nil)
	cookie := sessionCookie(t, page)

	tampered := *cookie
	tampered.Value = flipCookieValue(t, cookie.Value)
	response := serve(router, http.MethodGet, "/tasks", nil, &tampered)
	if response.Code != http.StatusSeeOther {
		t.Fatalf("tampered cookie status = %d, want 303", response.Code)
	}

}

func TestTaskCreationRendersSharedFormsAndPersistsOnlyDraft(t *testing.T) {
	router, _ := newRouter(t)
	cookie := authenticate(t, router)

	modal := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
	if modal.Code != http.StatusOK {
		t.Fatalf("GET dialog form status = %d, want 200", modal.Code)
	}
	fullPage := serve(router, http.MethodGet, "/tasks/new", nil, cookie)
	if fullPage.Code != http.StatusOK {
		t.Fatalf("GET full form status = %d, want 200", fullPage.Code)
	}
	for _, want := range []string{`<div class="modal-scrim"`, `<dialog open`, `aria-modal="true"`, `name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `type="url" inputmode="url" maxlength="2048"`, `type="number" inputmode="numeric" min="1" step="1"`, `inputmode="decimal" pattern="[0-9]+(\.[0-9]{1,2})?"`, `maxlength="120"`, `maxlength="80"`, `required`, `autofocus`, `导入</button><a class="button primary"`, `type="search" disabled`, `disabled>筛选</button>`, `disabled>清除</button>`, `min-height:44px`, `overflow-x:auto`, `prefers-reduced-motion`} {
		if !strings.Contains(modal.Body.String(), want) {
			t.Fatalf("dialog form is missing %q", want)
		}
	}
	for _, want := range []string{`name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `name="form_mode" value="full"`} {
		if !strings.Contains(fullPage.Body.String(), want) {
			t.Fatalf("full-page form is missing %q", want)
		}
	}

	invalid := serve(router, http.MethodPost, "/tasks", url.Values{
		"csrf_token":      {csrfToken(t, modal.Body.String())},
		"create_key":      {createKey(t, modal.Body.String())},
		"title":           {`<script>alert(1)</script>`},
		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&uin=discard"},
		"sku_color":       {"black"},
		"sku_size":        {"M"},
		"quantity":        {"0"},
		"max_total_price": {"12.80"},
		"form_mode":       {"dialog"},
	}, cookie)
	if invalid.Code != http.StatusBadRequest || !strings.Contains(invalid.Body.String(), `<dialog open`) || !strings.Contains(invalid.Body.String(), "数量必须是正整数") || !strings.Contains(invalid.Body.String(), `role="alert"`) || !strings.Contains(invalid.Body.String(), `href="#quantity"`) || !strings.Contains(invalid.Body.String(), `aria-describedby="quantity-error"`) || !strings.Contains(invalid.Body.String(), `autofocus`) {
		t.Fatalf("invalid create = (%d, %q), want dialog validation response", invalid.Code, invalid.Body.String())
	}
	if strings.Contains(invalid.Body.String(), `<script>alert(1)</script>`) || !strings.Contains(invalid.Body.String(), `&lt;script&gt;alert(1)&lt;/script&gt;`) {
		t.Fatalf("invalid create did not safely preserve title: %q", invalid.Body.String())
	}
	if strings.Contains(invalid.Body.String(), "uin=discard") || !strings.Contains(invalid.Body.String(), `value="https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"`) {
		t.Fatalf("invalid create did not canonicalize product URL: %q", invalid.Body.String())
	}

	createPage := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
	key := createKey(t, createPage.Body.String())
	created := serve(router, http.MethodPost, "/tasks", url.Values{
		"csrf_token":      {csrfToken(t, createPage.Body.String())},
		"create_key":      {key},
		"title":           {"<b>夏季上衣</b>"},
		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=discard"},
		"sku_color":       {"black"},
		"sku_size":        {"M"},
		"quantity":        {"2"},
		"max_total_price": {"12.8"},
		"form_mode":       {"dialog"},
	}, cookie)
	if created.Code != http.StatusSeeOther || !strings.HasPrefix(created.Header().Get("Location"), "/tasks?created=") {
		t.Fatalf("valid create = (%d, %q), want 303 to a created-task acknowledgement", created.Code, created.Header().Get("Location"))
	}
	replay := serve(router, http.MethodPost, "/tasks", url.Values{
		"csrf_token":      {csrfToken(t, createPage.Body.String())},
		"create_key":      {key},
		"title":           {"<b>夏季上衣</b>"},
		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=discard"},
		"sku_color":       {"black"},
		"sku_size":        {"M"},
		"quantity":        {"2"},
		"max_total_price": {"12.8"},
		"form_mode":       {"dialog"},
	}, cookie)
	if replay.Code != http.StatusSeeOther {
		t.Fatalf("idempotent replay status = %d, want 303", replay.Code)
	}
	conflict := serve(router, http.MethodPost, "/tasks", url.Values{
		"csrf_token":      {csrfToken(t, createPage.Body.String())},
		"create_key":      {key},
		"title":           {"different task"},
		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"},
		"sku_color":       {"black"},
		"sku_size":        {"M"},
		"quantity":        {"2"},
		"max_total_price": {"12.80"},
		"form_mode":       {"dialog"},
	}, cookie)
	if conflict.Code != http.StatusConflict || !strings.Contains(conflict.Body.String(), "该创建请求已用于另一条任务") {
		t.Fatalf("conflicting create = (%d, %q), want a 409 form error", conflict.Code, conflict.Body.String())
	}

	list := serve(router, http.MethodGet, created.Header().Get("Location"), nil, cookie)
	if list.Code != http.StatusOK {
		t.Fatalf("GET /tasks status = %d, want 200", list.Code)
	}
	body := list.Body.String()
	for _, want := range []string{`任务已创建，已显示在列表首行。`, `&lt;b&gt;夏季上衣&lt;/b&gt;`, `https://mobile.yangkeduo.com/goods.html?goods_id=937122477375`, `target="_blank"`, `rel="noopener noreferrer"`, `¥12.80`, `待开始`, `选择全部任务`, `选择任务`} {
		if !strings.Contains(body, want) {
			t.Fatalf("task list is missing %q", want)
		}
	}
	for _, forbidden := range []string{"utm_source", "试选", "PENDING", "支付", "订单确认", "真机", "提交订单"} {
		if strings.Contains(body, forbidden) {
			t.Fatalf("task list exposed deferred scope %q", forbidden)
		}
	}
}

func TestTaskCreationRequiresAuthenticationAndCSRF(t *testing.T) {
	router, _ := newRouter(t)
	if response := serve(router, http.MethodPost, "/tasks", url.Values{}, nil); response.Code != http.StatusForbidden {
		t.Fatalf("anonymous POST /tasks = %d, want 403", response.Code)
	}
	cookie := authenticate(t, router)
	if response := serve(router, http.MethodPost, "/tasks", url.Values{}, cookie); response.Code != http.StatusForbidden {
		t.Fatalf("POST /tasks without CSRF = %d, want 403", response.Code)
	}
}

func TestTaskCreationFailsClosedForMalformedOrOversizedForms(t *testing.T) {
	router, _ := newRouter(t)
	cookie := authenticate(t, router)
	page := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
	base := url.Values{
		"csrf_token":      {csrfToken(t, page.Body.String())},
		"create_key":      {createKey(t, page.Body.String())},
		"title":           {"title"},
		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=1;uin=malformed"},
		"sku_color":       {"black"},
		"sku_size":        {"M"},
		"quantity":        {"1"},
		"max_total_price": {"1.00"},
		"form_mode":       {"dialog"},
	}
	malformed := serve(router, http.MethodPost, "/tasks", base, cookie)
	if malformed.Code != http.StatusBadRequest || !strings.Contains(malformed.Body.String(), "canonical 商品链接") {
		t.Fatalf("malformed URL create = (%d, %q), want validation failure", malformed.Code, malformed.Body.String())
	}

	oversized := url.Values{"csrf_token": {csrfToken(t, page.Body.String())}, "title": {strings.Repeat("x", 9<<10)}}
	if response := serve(router, http.MethodPost, "/tasks", oversized, cookie); response.Code != http.StatusRequestEntityTooLarge {
		t.Fatalf("oversized form status = %d, want 413", response.Code)
	}
}

func assertSecurityHeaders(t *testing.T, response *httptest.ResponseRecorder) {
	t.Helper()
	want := map[string]string{
		"Cache-Control":           "no-store",
		"X-Content-Type-Options":  "nosniff",
		"Referrer-Policy":         "no-referrer",
		"Content-Security-Policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
	}
	for name, expected := range want {
		if got := response.Header().Get(name); got != expected {
			t.Fatalf("%s = %q, want %q", name, got, expected)
		}
	}
}

func flipCookieValue(t *testing.T, value string) string {
	t.Helper()
	if value == "" {
		t.Fatal("cannot tamper with an empty cookie")
	}
	if value[0] == 'A' {
		return "B" + value[1:]
	}
	return "A" + value[1:]
}

func TestLogoutRequiresCSRFAndRevokesSession(t *testing.T) {
	router, _ := newRouter(t)
	loginPage := serve(router, http.MethodGet, "/login", nil, nil)
	loginCookie := sessionCookie(t, loginPage)
	login := serve(router, http.MethodPost, "/login", url.Values{
		"csrf_token": {csrfToken(t, loginPage.Body.String())},
		"username":   {"admin"},
		"password":   {"test-password"},
	}, loginCookie)
	authenticatedCookie := sessionCookie(t, login)

	missingCSRF := serve(router, http.MethodPost, "/logout", url.Values{}, authenticatedCookie)
	if missingCSRF.Code != http.StatusForbidden {
		t.Fatalf("logout without CSRF status = %d, want 403", missingCSRF.Code)
	}

	tasks := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
	logout := serve(router, http.MethodPost, "/logout", url.Values{
		"csrf_token": {csrfToken(t, tasks.Body.String())},
	}, authenticatedCookie)
	if logout.Code != http.StatusSeeOther || logout.Header().Get("Location") != "/login" {
		t.Fatalf("logout = (%d, %q), want 303 /login", logout.Code, logout.Header().Get("Location"))
	}
	if cookie := sessionCookie(t, logout); cookie.MaxAge >= 0 {
		t.Fatalf("logout cookie MaxAge = %d, want a deletion cookie", cookie.MaxAge)
	}

	reused := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
	if reused.Code != http.StatusSeeOther {
		t.Fatalf("revoked session status = %d, want 303", reused.Code)
	}
}

func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
	t.Helper()
	gin.SetMode(gin.TestMode)
	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
	if err != nil {
		t.Fatalf("generate bcrypt hash: %v", err)
	}
	manager := auth.NewManager([]byte(strings.Repeat("s", 32)), false)
	router, err := server.NewRouter(server.Options{
		AdminUsername:       "admin",
		AdminPasswordBcrypt: string(hash),
		Sessions:            manager,
		Tasks:               &memoryStore{},
	})
	if err != nil {
		t.Fatalf("NewRouter: %v", err)
	}
	return router, manager
}

type memoryStore struct{ drafts []tasks.Draft }

func (store *memoryStore) CreateDraft(_ context.Context, draft tasks.Draft) (tasks.Draft, error) {
	for _, existing := range store.drafts {
		if existing.ID == draft.ID {
			if existing.Title != draft.Title || existing.GoodsID != draft.GoodsID || existing.SKUColor != draft.SKUColor || existing.SKUSize != draft.SKUSize || existing.Quantity != draft.Quantity || existing.MaxTotalPrice != draft.MaxTotalPrice {
				return tasks.Draft{}, tasks.ErrCreateKeyConflict
			}
			return existing, nil
		}
	}
	store.drafts = append(store.drafts, draft)
	return draft, nil
}
func (store *memoryStore) ListDrafts(_ context.Context) ([]tasks.Draft, error) {
	return append([]tasks.Draft(nil), store.drafts...), nil
}

func serve(router http.Handler, method, target string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
	var body *strings.Reader
	if form == nil {
		body = strings.NewReader("")
	} else {
		body = strings.NewReader(form.Encode())
	}
	request := httptest.NewRequest(method, target, body)
	if form != nil {
		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	}
	if cookie != nil {
		request.AddCookie(cookie)
	}
	response := httptest.NewRecorder()
	router.ServeHTTP(response, request)
	return response
}

func sessionCookie(t *testing.T, response *httptest.ResponseRecorder) *http.Cookie {
	t.Helper()
	for _, cookie := range response.Result().Cookies() {
		if cookie.Name == auth.CookieName {
			return cookie
		}
	}
	t.Fatalf("response did not set %s cookie", auth.CookieName)
	return nil
}

func csrfToken(t *testing.T, body string) string {
	t.Helper()
	matches := csrfPattern.FindStringSubmatch(body)
	if len(matches) != 2 || matches[1] == "" {
		t.Fatalf("no CSRF token in response body: %q", body)
	}
	return matches[1]
}

func createKey(t *testing.T, body string) string {
	t.Helper()
	matches := createKeyPattern.FindStringSubmatch(body)
	if len(matches) != 2 || matches[1] == "" {
		t.Fatalf("no create key in response body: %q", body)
	}
	return matches[1]
}

func authenticate(t *testing.T, router http.Handler) *http.Cookie {
	t.Helper()
	page := serve(router, http.MethodGet, "/login", nil, nil)
	login := serve(router, http.MethodPost, "/login", url.Values{
		"csrf_token": {csrfToken(t, page.Body.String())},
		"username":   {"admin"},
		"password":   {"test-password"},
	}, sessionCookie(t, page))
	if login.Code != http.StatusSeeOther {
		t.Fatalf("authenticate status = %d, want 303", login.Code)
	}
	return sessionCookie(t, login)
}