feat(t226): add Go ERP session login

backend-api/internal/transport/httpapi/admin_handlers_test.go

@@ -23,6 +23,7 @@ import (
 	"cmroubao/backend-api/internal/platform/assetstore"
 	"cmroubao/backend-api/internal/platform/database"
 	"cmroubao/backend-api/internal/platform/migration"
+	"cmroubao/backend-api/internal/platform/shunyunbao"
 	repository "cmroubao/backend-api/internal/repository/sqlite"
 	"cmroubao/backend-api/internal/usecase"
 
@@ -60,6 +61,100 @@ func TestCandidateDecisionDatasetResponseIncludesPersistentIdentity(t *testing.T
 	}
 }
 
+func TestERPAdminAPIUsesCaptchaTicketWithoutExposingCredentials(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(
+		writer http.ResponseWriter,
+		request *http.Request,
+	) {
+		switch request.URL.Path {
+		case shunyunbao.CaptchaPath:
+			http.SetCookie(writer, &http.Cookie{Name: "erp", Value: "captcha", Path: "/"})
+			writer.Header().Set("Content-Type", "image/png")
+			_, _ = writer.Write([]byte("captcha-image"))
+		case shunyunbao.LoginPath:
+			if _, err := request.Cookie("erp"); err != nil {
+				t.Fatalf("login did not retain captcha cookie: %v", err)
+			}
+			http.SetCookie(writer, &http.Cookie{Name: "erp", Value: "login", Path: "/"})
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12},"token":"private-token"}}`))
+		case shunyunbao.UserPath:
+			if cookie, err := request.Cookie("erp"); err != nil || cookie.Value != "login" {
+				t.Fatalf("user session cookie = %v / %v", cookie, err)
+			}
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":12}}`))
+		default:
+			writer.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer server.Close()
+	manager, err := shunyunbao.NewSessionManager(shunyunbao.SessionConfig{
+		BaseURL:           server.URL,
+		Username:          "private-user",
+		Password:          "private-password",
+		Timeout:           time.Second,
+		AllowInsecureHTTP: true,
+	})
+	if err != nil {
+		t.Fatalf("NewSessionManager() error = %v", err)
+	}
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	registerERPAdminAPI(router, &adminHandlers{services: AdminServices{ERP: manager}})
+
+	status := performERPRequest(t, router, http.MethodGet, "/api/v1/erp-session", nil, "")
+	if status.Code != http.StatusOK ||
+		strings.Contains(status.Body.String(), "private-user") ||
+		strings.Contains(status.Body.String(), "private-password") {
+		t.Fatalf("status response = %d / %s", status.Code, status.Body)
+	}
+	captcha := performERPRequest(
+		t,
+		router,
+		http.MethodPost,
+		"/api/v1/erp-session/captcha",
+		nil,
+		"",
+	)
+	if captcha.Code != http.StatusOK ||
+		strings.Contains(captcha.Body.String(), "private-password") {
+		t.Fatalf("captcha response = %d / %s", captcha.Code, captcha.Body)
+	}
+	var captchaBody map[string]any
+	decodeResponse(t, captcha, &captchaBody)
+	ticket, _ := captchaBody["captcha_ticket"].(string)
+	if len(ticket) != 43 || responseContainsKey(captchaBody["session"], "captcha_ticket") {
+		t.Fatalf("captcha response body = %#v", captchaBody)
+	}
+	image := performERPRequest(
+		t,
+		router,
+		http.MethodGet,
+		"/api/v1/erp-session/captcha/"+ticket,
+		nil,
+		"",
+	)
+	if image.Code != http.StatusOK || image.Header().Get("Cache-Control") != "no-store" ||
+		image.Body.String() != "captcha-image" {
+		t.Fatalf("captcha image = %d / %q / %s", image.Code, image.Header(), image.Body)
+	}
+	login := performERPRequest(
+		t,
+		router,
+		http.MethodPost,
+		"/api/v1/erp-session/login",
+		strings.NewReader(`{"captcha_ticket":"`+ticket+`","captcha_code":"1234"}`),
+		"application/json",
+	)
+	if login.Code != http.StatusOK ||
+		strings.Contains(login.Body.String(), "private-token") ||
+		strings.Contains(login.Body.String(), "private-password") {
+		t.Fatalf("login response = %d / %s", login.Code, login.Body)
+	}
+	if !strings.Contains(login.Body.String(), `"authenticated":true`) {
+		t.Fatalf("login does not report authenticated state: %s", login.Body)
+	}
+}
+
 func TestAdminAPIAssetAndTaskLifecycle(t *testing.T) {
 	router := newAdminIntegrationRouter(t)
 	imageBody, imageContentType := referenceUpload(t, "asset-key-1")
@@ -1306,6 +1401,23 @@ func performAdminRequest(
 	return response
 }
 
+func performERPRequest(
+	t *testing.T,
+	router http.Handler,
+	method, target string,
+	body io.Reader,
+	contentType string,
+) *httptest.ResponseRecorder {
+	t.Helper()
+	request := httptest.NewRequest(method, target, body)
+	if contentType != "" {
+		request.Header.Set("Content-Type", contentType)
+	}
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	return response
+}
+
 func decodeResponse(
 	t *testing.T,
 	response *httptest.ResponseRecorder,