feat(auth): implement user and device authentication

2026-07-26 15:18:48 +08:00
parent c5d3b215ff
commit 49db5b8305
66 changed files with 6216 additions and 271 deletions
@@ -0,0 +1,41 @@
+package authcommon
+
+import (
+	"context"
+	"testing"
+
+	"cmroubao/backend-api/internal/domain"
+)
+
+func TestPrincipalRoundTrip(t *testing.T) {
+	want := domain.AuthPrincipal{
+		UserID:   "user-1",
+		Username: "buyer",
+		Role:     domain.UserRoleBuyer,
+		DeviceID: "device-1",
+	}
+	ctx := WithPrincipal(context.Background(), want)
+
+	got, ok := Principal(ctx)
+
+	if !ok || got != want {
+		t.Fatalf("Principal() = %+v, %t", got, ok)
+	}
+}
+
+func TestValidCSRFPairRequiresOneCanonical256BitValue(t *testing.T) {
+	valid := "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE"
+	if !ValidCSRFPair(valid, valid) {
+		t.Fatal("valid CSRF pair was rejected")
+	}
+	for _, candidate := range []string{
+		"",
+		"short",
+		valid + "=",
+		valid[:len(valid)-1] + "b",
+	} {
+		if ValidCSRFPair(valid, candidate) {
+			t.Fatalf("invalid presented value %q was accepted", candidate)
+		}
+	}
+}