fix(t235): validate ERP user session by id

2026-07-29 11:42:41 +08:00
parent dcc9ce34e1
commit 81f75cc372
9 changed files with 197 additions and 43 deletions
@@ -76,12 +76,15 @@ func TestERPAdminAPIUsesCaptchaTicketWithoutExposingCredentials(t *testing.T) {
 				t.Fatalf("login did not retain captcha cookie: %v", err)
 			}
 			http.SetCookie(writer, &http.Cookie{Name: "erp", Value: "login", Path: "/"})
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12},"token":"private-token"}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12,"username":"private-user"},"token":"private-token"}}`))
 		case shunyunbao.UserPath:
+			if request.URL.Query().Get("id") != "12" {
+				t.Fatalf("user query = %q", request.URL.RawQuery)
+			}
 			if cookie, err := request.Cookie("erp"); err != nil || cookie.Value != "login" {
 				t.Fatalf("user session cookie = %v / %v", cookie, err)
 			}
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":12}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":12,"username":"private-user"}}`))
 		default:
 			writer.WriteHeader(http.StatusNotFound)
 		}