feat(backend): implement task creation and admin web

2026-07-26 14:03:32 +08:00
parent 2b265c92fc
commit c5d3b215ff
58 changed files with 8773 additions and 83 deletions
@@ -0,0 +1,64 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestLoopbackAdminOnlyAllowsLoopbackAddresses(t *testing.T) {
+	for _, remoteAddress := range []string{
+		"127.0.0.1:12345",
+		"[::1]:12345",
+	} {
+		t.Run(remoteAddress, func(t *testing.T) {
+			router := gin.New()
+			router.Use(requestIDMiddleware(), loopbackAdminOnly())
+			router.GET("/tasks", func(ctx *gin.Context) {
+				ctx.Status(http.StatusNoContent)
+			})
+			request := httptest.NewRequest(http.MethodGet, "/tasks", nil)
+			request.RemoteAddr = remoteAddress
+			response := httptest.NewRecorder()
+
+			router.ServeHTTP(response, request)
+
+			if response.Code != http.StatusNoContent {
+				t.Fatalf("status = %d", response.Code)
+			}
+		})
+	}
+}
+
+func TestLoopbackAdminOnlyRejectsRemoteOrMalformedAddresses(t *testing.T) {
+	for _, remoteAddress := range []string{
+		"192.0.2.1:12345",
+		"not-an-address",
+	} {
+		t.Run(remoteAddress, func(t *testing.T) {
+			router := gin.New()
+			router.Use(requestIDMiddleware(), loopbackAdminOnly())
+			router.GET("/tasks", func(ctx *gin.Context) {
+				ctx.Status(http.StatusNoContent)
+			})
+			request := httptest.NewRequest(http.MethodGet, "/tasks", nil)
+			request.RemoteAddr = remoteAddress
+			response := httptest.NewRecorder()
+
+			router.ServeHTTP(response, request)
+
+			if response.Code != http.StatusForbidden {
+				t.Fatalf("status = %d", response.Code)
+			}
+			assertErrorCode(t, response, "ADMIN_SESSION_REQUIRED")
+			if response.Header().Get("Cache-Control") != "no-store" {
+				t.Fatalf(
+					"Cache-Control = %q",
+					response.Header().Get("Cache-Control"),
+				)
+			}
+		})
+	}
+}