525 lines
16 KiB
Go
525 lines
16 KiB
Go
package auth
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// ─── endpoints.go ──────────────────────────────────────────────────────
|
|
|
|
func TestClientID_RuntimeOverride(t *testing.T) {
|
|
t.Setenv("DWS_CLIENT_ID", "env-id")
|
|
SetClientID("flag-id")
|
|
t.Cleanup(func() { SetClientID("") })
|
|
if got := ClientID(); got != "flag-id" {
|
|
t.Fatalf("expected flag-id, got %s", got)
|
|
}
|
|
}
|
|
|
|
func TestClientID_EnvFallback(t *testing.T) {
|
|
SetClientID("")
|
|
t.Setenv("DWS_CONFIG_DIR", t.TempDir()) // Use temp dir to avoid reading persisted config
|
|
t.Setenv("DWS_CLIENT_ID", "env-id")
|
|
if got := ClientID(); got != "env-id" {
|
|
t.Fatalf("expected env-id, got %s", got)
|
|
}
|
|
}
|
|
|
|
func TestClientID_Default(t *testing.T) {
|
|
SetClientID("")
|
|
t.Setenv("DWS_CONFIG_DIR", t.TempDir()) // Use temp dir to avoid reading persisted config
|
|
t.Setenv("DWS_CLIENT_ID", "")
|
|
// When DefaultClientID is a placeholder (starts with "<"), ClientID() returns empty string
|
|
if strings.HasPrefix(DefaultClientID, "<") {
|
|
if got := ClientID(); got != "" {
|
|
t.Fatalf("expected empty string for placeholder, got %s", got)
|
|
}
|
|
} else {
|
|
if got := ClientID(); got != DefaultClientID {
|
|
t.Fatalf("expected default, got %s", got)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestClientSecret_RuntimeOverride(t *testing.T) {
|
|
t.Setenv("DWS_CLIENT_SECRET", "env-secret")
|
|
SetClientSecret("flag-secret")
|
|
t.Cleanup(func() { SetClientSecret("") })
|
|
if got := ClientSecret(); got != "flag-secret" {
|
|
t.Fatalf("expected flag-secret, got %s", got)
|
|
}
|
|
}
|
|
|
|
func TestClientSecret_EnvFallback(t *testing.T) {
|
|
SetClientSecret("")
|
|
t.Setenv("DWS_CONFIG_DIR", t.TempDir()) // Use temp dir to avoid reading persisted config
|
|
t.Setenv("DWS_CLIENT_SECRET", "env-secret")
|
|
if got := ClientSecret(); got != "env-secret" {
|
|
t.Fatalf("expected env-secret, got %s", got)
|
|
}
|
|
}
|
|
|
|
func TestClientSecret_Default(t *testing.T) {
|
|
SetClientSecret("")
|
|
t.Setenv("DWS_CONFIG_DIR", t.TempDir()) // Use temp dir to avoid reading persisted config
|
|
t.Setenv("DWS_CLIENT_SECRET", "")
|
|
if got := ClientSecret(); got != DefaultClientSecret {
|
|
t.Fatalf("expected default, got %s", got)
|
|
}
|
|
}
|
|
|
|
func TestClientID_ConcurrentAccess(t *testing.T) {
|
|
var wg sync.WaitGroup
|
|
for i := 0; i < 100; i++ {
|
|
wg.Add(2)
|
|
go func(n int) {
|
|
defer wg.Done()
|
|
SetClientID(fmt.Sprintf("id-%d", n))
|
|
}(i)
|
|
go func() {
|
|
defer wg.Done()
|
|
_ = ClientID()
|
|
}()
|
|
}
|
|
wg.Wait()
|
|
SetClientID("")
|
|
}
|
|
|
|
// ─── identity.go ───────────────────────────────────────────────────────
|
|
|
|
func TestGenerateUUID_Format(t *testing.T) {
|
|
t.Parallel()
|
|
uuid := generateUUID()
|
|
parts := strings.Split(uuid, "-")
|
|
if len(parts) != 5 {
|
|
t.Fatalf("expected 5 parts, got %d: %s", len(parts), uuid)
|
|
}
|
|
if len(uuid) != 36 {
|
|
t.Fatalf("expected 36 chars, got %d: %s", len(uuid), uuid)
|
|
}
|
|
// Version 4 marker
|
|
if uuid[14] != '4' {
|
|
t.Fatalf("expected version 4 at position 14, got %c", uuid[14])
|
|
}
|
|
}
|
|
|
|
func TestIdentity_LoadMissing(t *testing.T) {
|
|
t.Parallel()
|
|
id := Load(t.TempDir())
|
|
if id != nil {
|
|
t.Fatal("expected nil for missing identity")
|
|
}
|
|
}
|
|
|
|
func TestIdentity_EnsureExistsCreatesNew(t *testing.T) {
|
|
t.Parallel()
|
|
dir := t.TempDir()
|
|
id := EnsureExists(dir)
|
|
if id == nil || id.AgentID == "" {
|
|
t.Fatal("expected non-nil identity with agentID")
|
|
}
|
|
if id.Source != "dws" {
|
|
t.Fatalf("expected source dws, got %s", id.Source)
|
|
}
|
|
}
|
|
|
|
func TestIdentity_EnsureExistsLoadsExisting(t *testing.T) {
|
|
t.Parallel()
|
|
dir := t.TempDir()
|
|
id1 := EnsureExists(dir)
|
|
id2 := EnsureExists(dir)
|
|
if id1.AgentID != id2.AgentID {
|
|
t.Fatalf("expected same ID, got %s vs %s", id1.AgentID, id2.AgentID)
|
|
}
|
|
}
|
|
|
|
func TestIdentity_LoadInvalidJSON(t *testing.T) {
|
|
t.Parallel()
|
|
dir := t.TempDir()
|
|
_ = os.WriteFile(filepath.Join(dir, identityFile), []byte("not json"), 0o600)
|
|
if Load(dir) != nil {
|
|
t.Fatal("expected nil for invalid JSON")
|
|
}
|
|
}
|
|
|
|
func TestIdentity_LoadEmptyAgentID(t *testing.T) {
|
|
t.Parallel()
|
|
dir := t.TempDir()
|
|
data, _ := json.Marshal(Identity{AgentID: "", Source: "dws"})
|
|
_ = os.WriteFile(filepath.Join(dir, identityFile), data, 0o600)
|
|
if Load(dir) != nil {
|
|
t.Fatal("expected nil for empty agentID")
|
|
}
|
|
}
|
|
|
|
func TestIdentity_Headers(t *testing.T) {
|
|
t.Parallel()
|
|
id := &Identity{AgentID: "test-uuid", Source: "dws"}
|
|
h := id.Headers()
|
|
if h["x-dws-agent-id"] != "test-uuid" {
|
|
t.Fatalf("wrong agent-id header: %s", h["x-dws-agent-id"])
|
|
}
|
|
if h["x-dws-source"] != "dws" {
|
|
t.Fatalf("wrong source header: %s", h["x-dws-source"])
|
|
}
|
|
if _, ok := h["x-dingtalk-scenario-code"]; !ok {
|
|
t.Fatal("missing scenario-code header")
|
|
}
|
|
}
|
|
|
|
func TestIdentity_Headers_Nil(t *testing.T) {
|
|
t.Parallel()
|
|
var id *Identity
|
|
if h := id.Headers(); h != nil {
|
|
t.Fatalf("expected nil headers for nil identity, got %v", h)
|
|
}
|
|
}
|
|
|
|
// ─── manager.go ────────────────────────────────────────────────────────
|
|
|
|
func TestManager_SaveAndGetToken(t *testing.T) {
|
|
t.Parallel()
|
|
dir := t.TempDir()
|
|
m := NewManager(dir, nil)
|
|
if err := m.SaveToken("test-token"); err != nil {
|
|
t.Fatalf("SaveToken error: %v", err)
|
|
}
|
|
token, source, err := m.GetToken()
|
|
if err != nil {
|
|
t.Fatalf("GetToken error: %v", err)
|
|
}
|
|
if token != "test-token" {
|
|
t.Fatalf("expected test-token, got %s", token)
|
|
}
|
|
if source != "file" {
|
|
t.Fatalf("expected file source, got %s", source)
|
|
}
|
|
}
|
|
|
|
func TestManager_GetToken_Missing(t *testing.T) {
|
|
t.Parallel()
|
|
m := NewManager(t.TempDir(), nil)
|
|
_, _, err := m.GetToken()
|
|
if err == nil {
|
|
t.Fatal("expected error for missing token")
|
|
}
|
|
}
|
|
|
|
func TestManager_SaveAndGetMCPURL(t *testing.T) {
|
|
t.Parallel()
|
|
dir := t.TempDir()
|
|
m := NewManager(dir, nil)
|
|
if err := m.SaveMCPURL("https://example.com/mcp"); err != nil {
|
|
t.Fatalf("SaveMCPURL error: %v", err)
|
|
}
|
|
url, err := m.GetMCPURL()
|
|
if err != nil {
|
|
t.Fatalf("GetMCPURL error: %v", err)
|
|
}
|
|
if url != "https://example.com/mcp" {
|
|
t.Fatalf("expected url, got %s", url)
|
|
}
|
|
}
|
|
|
|
func TestManager_GetMCPURL_Missing(t *testing.T) {
|
|
t.Parallel()
|
|
m := NewManager(t.TempDir(), nil)
|
|
_, err := m.GetMCPURL()
|
|
if err == nil {
|
|
t.Fatal("expected error for missing MCP URL")
|
|
}
|
|
}
|
|
|
|
// ─── token.go ──────────────────────────────────────────────────────────
|
|
|
|
func TestTokenData_IsAccessTokenValid(t *testing.T) {
|
|
t.Parallel()
|
|
tests := []struct {
|
|
name string
|
|
data *TokenData
|
|
want bool
|
|
}{
|
|
{"nil", nil, false},
|
|
{"empty token", &TokenData{}, false},
|
|
{"expired", &TokenData{AccessToken: "t", ExpiresAt: time.Now().Add(-time.Hour)}, false},
|
|
{"valid", &TokenData{AccessToken: "t", ExpiresAt: time.Now().Add(time.Hour)}, true},
|
|
{"within buffer", &TokenData{AccessToken: "t", ExpiresAt: time.Now().Add(3 * time.Minute)}, false},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
if got := tt.data.IsAccessTokenValid(); got != tt.want {
|
|
t.Fatalf("IsAccessTokenValid() = %v, want %v", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestTokenData_IsRefreshTokenValid(t *testing.T) {
|
|
t.Parallel()
|
|
tests := []struct {
|
|
name string
|
|
data *TokenData
|
|
want bool
|
|
}{
|
|
{"nil", nil, false},
|
|
{"empty", &TokenData{}, false},
|
|
{"expired", &TokenData{RefreshToken: "r", RefreshExpAt: time.Now().Add(-time.Hour)}, false},
|
|
{"valid", &TokenData{RefreshToken: "r", RefreshExpAt: time.Now().Add(time.Hour)}, true},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
if got := tt.data.IsRefreshTokenValid(); got != tt.want {
|
|
t.Fatalf("IsRefreshTokenValid() = %v, want %v", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestTokenData_HasPersistentCode(t *testing.T) {
|
|
t.Parallel()
|
|
if (&TokenData{}).HasPersistentCode() {
|
|
t.Fatal("expected false for empty")
|
|
}
|
|
if !(&TokenData{PersistentCode: "code"}).HasPersistentCode() {
|
|
t.Fatal("expected true")
|
|
}
|
|
var nilData *TokenData
|
|
if nilData.HasPersistentCode() {
|
|
t.Fatal("expected false for nil")
|
|
}
|
|
}
|
|
|
|
func TestRevokeTokenRemote(t *testing.T) {
|
|
t.Parallel()
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
defer srv.Close()
|
|
// Can't easily test since LogoutURL is a const. Just test that it doesn't panic with real URL.
|
|
}
|
|
|
|
func TestRevokeTokenRemoteForDataUsesExactTokenMetadata(t *testing.T) {
|
|
configDir := t.TempDir()
|
|
var got struct {
|
|
ClientID string `json:"clientId"`
|
|
AccessToken string `json:"accessToken"`
|
|
}
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path != MCPRevokeTokenPath {
|
|
t.Errorf("revoke path = %q, want %q", r.URL.Path, MCPRevokeTokenPath)
|
|
}
|
|
if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
|
|
t.Errorf("decode revoke body: %v", err)
|
|
}
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
defer srv.Close()
|
|
|
|
t.Setenv("DWS_CONFIG_DIR", configDir)
|
|
if err := os.WriteFile(filepath.Join(configDir, "mcp_url"), []byte(srv.URL), 0o600); err != nil {
|
|
t.Fatalf("write mcp_url: %v", err)
|
|
}
|
|
SetClientID("wrong-global-client")
|
|
t.Cleanup(func() { SetClientID("") })
|
|
|
|
data := &TokenData{
|
|
AccessToken: "exact-account-token",
|
|
ClientID: "exact-account-client",
|
|
Source: "mcp",
|
|
}
|
|
if err := RevokeTokenRemoteForData(t.Context(), data); err != nil {
|
|
t.Fatalf("RevokeTokenRemoteForData() error = %v", err)
|
|
}
|
|
if got.ClientID != data.ClientID || got.AccessToken != data.AccessToken {
|
|
t.Fatalf("revoke body = %#v, want exact token metadata", got)
|
|
}
|
|
}
|
|
|
|
// ─── oauth_helpers.go ──────────────────────────────────────────────────
|
|
|
|
type tokenResponse struct {
|
|
AccessToken string `json:"accessToken"`
|
|
RefreshToken string `json:"refreshToken"`
|
|
PersistentCode string `json:"persistentCode"`
|
|
ExpiresIn int64 `json:"expiresIn"`
|
|
}
|
|
|
|
func TestBuildTokenData_DefaultExpiry(t *testing.T) {
|
|
resp := tokenResponse{
|
|
AccessToken: "access-123",
|
|
RefreshToken: "refresh-456",
|
|
ExpiresIn: 0,
|
|
}
|
|
data := buildTokenDataFromResponse(resp)
|
|
if data == nil {
|
|
t.Fatal("expected non-nil token data")
|
|
}
|
|
if data.AccessToken != "access-123" {
|
|
t.Fatalf("wrong access token: %s", data.AccessToken)
|
|
}
|
|
}
|
|
|
|
func TestParseMCPTokenResponseIncludesCorpName(t *testing.T) {
|
|
provider := &OAuthProvider{}
|
|
data, err := provider.parseMCPTokenResponse([]byte(`{
|
|
"accessToken": "access-123",
|
|
"refreshToken": "refresh-456",
|
|
"expiresIn": 7200,
|
|
"corpId": "ding123",
|
|
"corpName": "钉钉（中国）信息技术有限公司"
|
|
}`))
|
|
if err != nil {
|
|
t.Fatalf("parseMCPTokenResponse() error = %v", err)
|
|
}
|
|
if data.CorpID != "ding123" {
|
|
t.Fatalf("corp id = %q, want ding123", data.CorpID)
|
|
}
|
|
if data.CorpName != "钉钉（中国）信息技术有限公司" {
|
|
t.Fatalf("corp name = %q, want 钉钉（中国）信息技术有限公司", data.CorpName)
|
|
}
|
|
}
|
|
|
|
func TestParseMCPTokenResponseCorpNameFallbacks(t *testing.T) {
|
|
provider := &OAuthProvider{}
|
|
for _, tc := range []struct {
|
|
name string
|
|
body string
|
|
want string
|
|
}{
|
|
{
|
|
name: "snake",
|
|
body: `{"accessToken":"access","refreshToken":"refresh","expiresIn":7200,"corpId":"ding123","corp_name":"Snake Corp"}`,
|
|
want: "Snake Corp",
|
|
},
|
|
{
|
|
name: "orgName",
|
|
body: `{"accessToken":"access","refreshToken":"refresh","expiresIn":7200,"corpId":"ding123","orgName":"Org Corp"}`,
|
|
want: "Org Corp",
|
|
},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
data, err := provider.parseMCPTokenResponse([]byte(tc.body))
|
|
if err != nil {
|
|
t.Fatalf("parseMCPTokenResponse() error = %v", err)
|
|
}
|
|
if data.CorpName != tc.want {
|
|
t.Fatalf("corp name = %q, want %q", data.CorpName, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestBuildAuthURLIncludesTargetCorpID(t *testing.T) {
|
|
authURL := buildAuthURL("client-id", "http://127.0.0.1:1234/callback", "ding-target")
|
|
if !strings.Contains(authURL, "corpId=ding-target") {
|
|
t.Fatalf("auth URL missing target corpId: %s", authURL)
|
|
}
|
|
}
|
|
|
|
func TestCrossPlatformCoverageBuildAuthURLForInternationalRegion(t *testing.T) {
|
|
authURL := buildAuthURLForRegion("client-id", "http://127.0.0.1:1234/callback", "", LoginRegionInternational)
|
|
if !strings.HasPrefix(authURL, InternationalAuthorizeURL+"?") {
|
|
t.Fatalf("auth URL = %s, want international authorize host", authURL)
|
|
}
|
|
}
|
|
|
|
func TestCrossPlatformCoverageNotEnabledHTMLUsesRegionAwareAuthorizeURL(t *testing.T) {
|
|
if !strings.Contains(notEnabledHTML, "status.authorizeUrl") {
|
|
t.Fatal("not-enabled page must read the authorize URL from the regional login status")
|
|
}
|
|
if strings.Contains(notEnabledHTML, `"https://login.dingtalk.com/oauth2/auth?client_id="`) {
|
|
t.Fatal("not-enabled page must not hard-code the domestic authorize URL")
|
|
}
|
|
}
|
|
|
|
func TestCrossPlatformCoverageLoginRegionEndpointDefaults(t *testing.T) {
|
|
if got := AuthorizeURLForLoginRegion(LoginRegionDefault); got != AuthorizeURL {
|
|
t.Fatalf("default authorize URL = %q, want %q", got, AuthorizeURL)
|
|
}
|
|
if got := DeviceBaseURLForLoginRegion(LoginRegionDefault); got != DefaultDeviceBaseURL {
|
|
t.Fatalf("default device base URL = %q, want %q", got, DefaultDeviceBaseURL)
|
|
}
|
|
if got := UserAccessTokenURLForLoginRegion(LoginRegionInternational); got != InternationalUserAccessTokenURL {
|
|
t.Fatalf("international user access token URL = %q, want %q", got, InternationalUserAccessTokenURL)
|
|
}
|
|
if got := MCPBaseURLForLoginRegion(LoginRegionInternational); got != InternationalMCPBaseURL {
|
|
t.Fatalf("international MCP base URL = %q, want %q", got, InternationalMCPBaseURL)
|
|
}
|
|
if got := DeviceBaseURLForLoginRegion(LoginRegionInternational); got != InternationalDeviceBaseURL {
|
|
t.Fatalf("international device base URL = %q, want %q", got, InternationalDeviceBaseURL)
|
|
}
|
|
}
|
|
|
|
func TestCrossPlatformCoverageOAuthProviderLoginRegionHelpers(t *testing.T) {
|
|
var nilProvider *OAuthProvider
|
|
if got := nilProvider.loginRegion(); got != LoginRegionDefault {
|
|
t.Fatalf("nil provider login region = %q", got)
|
|
}
|
|
nilProvider.useTokenLoginRegion(&TokenData{LoginRegion: string(LoginRegionInternational)})
|
|
nilProvider.applyLoginRegionToToken(&TokenData{})
|
|
|
|
provider := &OAuthProvider{}
|
|
provider.useTokenLoginRegion(nil)
|
|
provider.useTokenLoginRegion(&TokenData{LoginRegion: string(LoginRegionInternational)})
|
|
if provider.LoginRegion != LoginRegionInternational {
|
|
t.Fatalf("provider login region = %q, want international", provider.LoginRegion)
|
|
}
|
|
provider.useTokenLoginRegion(&TokenData{LoginRegion: string(LoginRegionDefault)})
|
|
provider.applyLoginRegionToToken(nil)
|
|
token := &TokenData{}
|
|
provider.applyLoginRegionToToken(token)
|
|
if token.LoginRegion != string(LoginRegionInternational) {
|
|
t.Fatalf("token login region = %q, want international", token.LoginRegion)
|
|
}
|
|
}
|
|
|
|
func TestCrossPlatformCoverageMCPBaseURLOverrideAffectsInternationalRegion(t *testing.T) {
|
|
restore := PushMCPBaseURLOverride("https://pre-mcp.dingtalk.io/")
|
|
defer restore()
|
|
|
|
if got := MCPBaseURLForLoginRegion(LoginRegionInternational); got != "https://pre-mcp.dingtalk.io" {
|
|
t.Fatalf("international MCP base URL = %q, want override", got)
|
|
}
|
|
}
|
|
|
|
func TestCrossPlatformCoverageLoginBaseURLOverrideAffectsInternationalRegion(t *testing.T) {
|
|
restore := PushLoginBaseURLOverride("https://pre-login.dingtalk.io/")
|
|
defer restore()
|
|
|
|
if got := DeviceBaseURLForLoginRegion(LoginRegionInternational); got != "https://pre-login.dingtalk.io" {
|
|
t.Fatalf("international device base URL = %q, want override", got)
|
|
}
|
|
if got := AuthorizeURLForLoginRegion(LoginRegionInternational); got != "https://pre-login.dingtalk.io/oauth2/auth" {
|
|
t.Fatalf("international authorize URL = %q, want override", got)
|
|
}
|
|
if got := UserAccessTokenURLForLoginRegion(LoginRegionInternational); got != "https://pre-login.dingtalk.io/v1.0/oauth2/userAccessToken" {
|
|
t.Fatalf("international user access token URL = %q, want override", got)
|
|
}
|
|
}
|
|
|
|
func buildTokenDataFromResponse(resp tokenResponse) *TokenData {
|
|
if resp.AccessToken == "" {
|
|
return nil
|
|
}
|
|
now := time.Now()
|
|
expiresIn := resp.ExpiresIn
|
|
if expiresIn <= 0 {
|
|
expiresIn = 7200
|
|
}
|
|
return &TokenData{
|
|
AccessToken: resp.AccessToken,
|
|
RefreshToken: resp.RefreshToken,
|
|
ExpiresAt: now.Add(time.Duration(expiresIn) * time.Second),
|
|
RefreshExpAt: now.Add(30 * 24 * time.Hour),
|
|
PersistentCode: resp.PersistentCode,
|
|
}
|
|
}
|