feat(t226): add Go ERP session login

2026-07-29 09:51:41 +08:00
parent c2f340d067
commit a5a61c05d0
23 changed files with 1633 additions and 33 deletions
@@ -1095,6 +1095,105 @@ func TestFreightSyncToNowIgnoresPrefilledManualDates(t *testing.T) {
 	}
 }

+func TestERPConnectionPageUsesCaptchaOnlyAndPreservesNoCredentials(t *testing.T) {
+	ticket := mustToken(t)
+	service := &fakeERPService{
+		fakeService: &fakeService{},
+		status: ERPConnectionStatus{
+			Configured: true,
+		},
+		image: ERPCaptchaImage{
+			Content:     []byte("captcha-image"),
+			ContentType: "image/png",
+		},
+		ticket: ticket,
+	}
+	router := newTestRouter(t, service)
+	page := performRequest(t, router, http.MethodGet, "/erp", nil, "")
+	if page.Code != http.StatusOK || !strings.Contains(page.Body.String(), "获取验证码") ||
+		strings.Contains(page.Body.String(), "private-password") {
+		t.Fatalf("ERP page = %d / %s", page.Code, page.Body)
+	}
+	assertSecurityHeaders(t, page)
+	cookie := csrfCookie(t, page)
+	values := url.Values{"csrf_token": {cookie.Value}}
+	request := httptest.NewRequest(
+		http.MethodPost,
+		"/erp/captcha",
+		strings.NewReader(values.Encode()),
+	)
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.AddCookie(cookie)
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusSeeOther ||
+		response.Header().Get("Location") != "/erp?notice=captcha-ready" ||
+		service.captchaRequests != 1 {
+		t.Fatalf("captcha response/calls = %d / %q / %d", response.Code, response.Header().Get("Location"), service.captchaRequests)
+	}
+	service.status.CaptchaReady = true
+	service.status.CaptchaTicket = ticket
+	page = performRequest(t, router, http.MethodGet, "/erp", nil, "")
+	if page.Code != http.StatusOK ||
+		!strings.Contains(page.Body.String(), "/erp/captcha/"+ticket) ||
+		!strings.Contains(page.Body.String(), `name="captcha_code"`) ||
+		strings.Contains(page.Body.String(), "password") {
+		t.Fatalf("captcha page = %d / %s", page.Code, page.Body)
+	}
+	image := performRequest(t, router, http.MethodGet, "/erp/captcha/"+ticket, nil, "")
+	if image.Code != http.StatusOK || image.Header().Get("Cache-Control") != "no-store" ||
+		image.Body.String() != "captcha-image" {
+		t.Fatalf("captcha image = %d / %q / %s", image.Code, image.Header(), image.Body)
+	}
+	cookie = csrfCookie(t, page)
+	values = url.Values{
+		"csrf_token":     {cookie.Value},
+		"captcha_ticket": {ticket},
+		"captcha_code":   {"1234"},
+	}
+	request = httptest.NewRequest(
+		http.MethodPost,
+		"/erp/login",
+		strings.NewReader(values.Encode()),
+	)
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.AddCookie(cookie)
+	response = httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusSeeOther ||
+		response.Header().Get("Location") != "/erp?notice=login-succeeded" ||
+		service.login.CaptchaTicket != ticket || service.login.CaptchaCode != "1234" {
+		t.Fatalf("login response/input = %d / %q / %+v", response.Code, response.Header().Get("Location"), service.login)
+	}
+	service.status = ERPConnectionStatus{
+		Configured:    true,
+		CaptchaReady:  true,
+		CaptchaTicket: ticket,
+	}
+	service.err = ErrERPLoginRejected
+	page = performRequest(t, router, http.MethodGet, "/erp", nil, "")
+	cookie = csrfCookie(t, page)
+	values = url.Values{
+		"csrf_token":     {cookie.Value},
+		"captcha_ticket": {ticket},
+		"captcha_code":   {"1234"},
+	}
+	request = httptest.NewRequest(
+		http.MethodPost,
+		"/erp/login",
+		strings.NewReader(values.Encode()),
+	)
+	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	request.AddCookie(cookie)
+	response = httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusUnprocessableEntity ||
+		!strings.Contains(response.Body.String(), "验证码不正确或 ERP 拒绝登录") ||
+		strings.Contains(response.Body.String(), "private") {
+		t.Fatalf("rejected login page = %d / %s", response.Code, response.Body)
+	}
+}
+
 func TestFreightDetailCreatesProcurementTaskWithCSRF(t *testing.T) {
 	const itemID = "00000000-0000-4000-8000-000000000002"
 	service := &fakeProcurementService{
@@ -1206,6 +1305,51 @@ type fakeFreightService struct {
 	err          error
 }

+type fakeERPService struct {
+	*fakeService
+	status          ERPConnectionStatus
+	image           ERPCaptchaImage
+	ticket          string
+	captchaRequests int
+	login           ERPLoginInput
+	err             error
+}
+
+func (service *fakeERPService) ERPConnectionStatus(
+	context.Context,
+) (ERPConnectionStatus, error) {
+	return service.status, service.err
+}
+
+func (service *fakeERPService) RequestERPCaptcha(
+	context.Context,
+) (ERPConnectionStatus, error) {
+	service.captchaRequests++
+	service.status.CaptchaReady = true
+	service.status.CaptchaTicket = service.ticket
+	return service.status, service.err
+}
+
+func (service *fakeERPService) OpenERPCaptcha(
+	context.Context,
+	string,
+) (ERPCaptchaImage, error) {
+	return service.image, service.err
+}
+
+func (service *fakeERPService) LoginERP(
+	_ context.Context,
+	input ERPLoginInput,
+) (ERPConnectionStatus, error) {
+	service.login = input
+	if service.err == nil {
+		service.status.Authenticated = true
+		service.status.CaptchaReady = false
+		service.status.CaptchaTicket = ""
+	}
+	return service.status, service.err
+}
+
 type fakeProcurementService struct {
 	*fakeFreightService
 	createRequestInput CreateProcurementRequestInput