重組前檢查點:根目錄 main package

2026-10-03 09:23:38 +08:00
commit f373cb8d37
45 changed files with 5332 additions and 0 deletions
@@ -0,0 +1,291 @@
+package main
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"gorm.io/gorm"
+)
+
+func TestNewApplicationConfidential(t *testing.T) {
+	a, secret, err := NewApplication("示範應用", ClientConfidential,
+		[]string{"https://app.example.com/oidc/callback"},
+		[]GrantType{GrantAuthorizationCode, GrantRefreshToken},
+		"openid profile offline_access")
+	if err != nil {
+		t.Fatal("NewApplication: ", err)
+	}
+	if len(a.ClientID) != 22 {
+		t.Errorf("ClientID 應為 16 bytes 亂數的 base64url（22 字元），得到 %d 字元", len(a.ClientID))
+	}
+	if a.IsPublic() {
+		t.Error("機密式 Client 的 IsPublic() 應為 false")
+	}
+	if len(secret) != 43 {
+		t.Errorf("client secret 應為 32 bytes 亂數的 base64url（43 字元），得到 %d 字元", len(secret))
+	}
+	if !strings.HasPrefix(a.ClientSecretHash, "$argon2id$") {
+		t.Errorf("ClientSecretHash 應為 argon2id PHC 字串，得到 %q", a.ClientSecretHash)
+	}
+	if strings.Contains(a.ClientSecretHash, secret) {
+		t.Error("client secret 不應以明文出現在雜湊欄位")
+	}
+	if !a.CheckSecret(secret) {
+		t.Error("正確的 client secret 應驗證成功")
+	}
+	if a.CheckSecret("wrong-secret") {
+		t.Error("錯誤的 client secret 不應驗證成功")
+	}
+	if err := a.Validate(); err != nil {
+		t.Error("新建立的註冊資料應通過驗證: ", err)
+	}
+}
+
+func TestNewApplicationPublic(t *testing.T) {
+	a, secret, err := NewApplication("行動應用", ClientPublic,
+		[]string{"com.example.app:/oidc/callback"}, nil, "")
+	if err != nil {
+		t.Fatal("NewApplication: ", err)
+	}
+	if !a.IsPublic() {
+		t.Error("公開式 Client 的 IsPublic() 應為 true")
+	}
+	if secret != "" {
+		t.Errorf("公開式 Client 不應簽發 client secret，得到 %q", secret)
+	}
+	if a.ClientSecretHash != "" {
+		t.Errorf("公開式 Client 不應存 secret 雜湊，得到 %q", a.ClientSecretHash)
+	}
+	for _, s := range []string{"", "anything"} {
+		if a.CheckSecret(s) {
+			t.Errorf("公開式 Client 的 CheckSecret(%q) 應為 false", s)
+		}
+	}
+	if _, err := a.GenerateSecret(); err == nil {
+		t.Error("公開式 Client 呼叫 GenerateSecret 應回傳錯誤")
+	}
+}
+
+func TestNewApplicationDefaults(t *testing.T) {
+	a, _, err := NewApplication("  示範應用  ", ClientConfidential,
+		[]string{"https://app.example.com/cb"}, nil, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a.Name != "示範應用" {
+		t.Errorf("名稱應去除首尾空白，得到 %q", a.Name)
+	}
+	if !reflect.DeepEqual(a.GrantTypes, GrantTypes{GrantAuthorizationCode}) {
+		t.Errorf("未指定 grant type 應預設 authorization_code，得到 %v", a.GrantTypes)
+	}
+	if a.Scope != defaultScope {
+		t.Errorf("未指定 scope 應預設 %q，得到 %q", defaultScope, a.Scope)
+	}
+}
+
+func TestNewApplicationClientIDUnique(t *testing.T) {
+	a, _, err := NewApplication("A", ClientPublic, []string{"https://a.example.com/cb"}, nil, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, _, err := NewApplication("B", ClientPublic, []string{"https://b.example.com/cb"}, nil, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a.ClientID == b.ClientID {
+		t.Error("兩次建立的 client_id 不應相同")
+	}
+}
+
+func TestNewApplicationClientCredentialsWithoutRedirectURIs(t *testing.T) {
+	// 僅 client_credentials 的機器對機器應用不經過瀏覽器，無須 redirect URI。
+	a, secret, err := NewApplication("批次服務", ClientConfidential, nil,
+		[]GrantType{GrantClientCredentials}, "openid")
+	if err != nil {
+		t.Fatal("僅 client_credentials 註冊不應要求 redirect URI: ", err)
+	}
+	if secret == "" || !a.CheckSecret(secret) {
+		t.Error("機密式 Client 應簽發可驗證的 client secret")
+	}
+}
+
+func TestNewApplicationInvalid(t *testing.T) {
+	cases := []struct {
+		desc   string
+		name   string
+		typ    ClientType
+		uris   []string
+		grants []GrantType
+		scope  string
+		want   string // 錯誤訊息應包含的子字串
+	}{
+		{"空名稱", "", ClientConfidential, []string{"https://a.example.com/cb"}, nil, "", "名稱"},
+		{"不支援的類型", "A", "webapp", []string{"https://a.example.com/cb"}, nil, "", "類型"},
+		{"不支援的 grant type", "A", ClientConfidential, []string{"https://a.example.com/cb"}, []GrantType{"implicit"}, "", "grant type"},
+		{"公開式使用 client_credentials", "A", ClientPublic, []string{"https://a.example.com/cb"}, []GrantType{GrantClientCredentials}, "", "client_credentials"},
+		{"refresh_token 未伴隨授權碼", "A", ClientConfidential, []string{"https://a.example.com/cb"}, []GrantType{GrantRefreshToken}, "", "refresh_token"},
+		{"授權碼流程無 redirect URI", "A", ClientConfidential, nil, []GrantType{GrantAuthorizationCode}, "", "redirect URI"},
+		{"相對 URI", "A", ClientConfidential, []string{"app.example.com/cb"}, nil, "", "絕對 URI"},
+		{"非 loopback 的 http", "A", ClientConfidential, []string{"http://app.example.com/cb"}, nil, "", "loopback"},
+		{"含 fragment", "A", ClientConfidential, []string{"https://app.example.com/cb#frag"}, nil, "", "fragment"},
+		{"含 userinfo", "A", ClientConfidential, []string{"https://user@app.example.com/cb"}, nil, "", "userinfo"},
+		{"缺少 host", "A", ClientConfidential, []string{"https:///cb"}, nil, "", "host"},
+		{"不支援的 scope", "A", ClientConfidential, []string{"https://a.example.com/cb"}, nil, "openid admin", "scope"},
+		{"offline_access 無 refresh_token grant", "A", ClientConfidential, []string{"https://a.example.com/cb"}, []GrantType{GrantAuthorizationCode}, "openid offline_access", "offline_access"},
+	}
+	for _, c := range cases {
+		_, _, err := NewApplication(c.name, c.typ, c.uris, c.grants, c.scope)
+		if err == nil {
+			t.Errorf("%s：應回傳錯誤", c.desc)
+			continue
+		}
+		if !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%s：錯誤訊息 %q 應包含 %q", c.desc, err.Error(), c.want)
+		}
+	}
+}
+
+func TestApplicationSecretRotation(t *testing.T) {
+	a, secret1, err := NewApplication("示範應用", ClientConfidential,
+		[]string{"https://app.example.com/cb"}, nil, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	secret2, err := a.GenerateSecret()
+	if err != nil {
+		t.Fatal("GenerateSecret: ", err)
+	}
+	if secret1 == secret2 {
+		t.Error("輪替後的 client secret 不應與舊值相同")
+	}
+	if a.CheckSecret(secret1) {
+		t.Error("輪替後舊 client secret 應立即失效")
+	}
+	if !a.CheckSecret(secret2) {
+		t.Error("新 client secret 應驗證成功")
+	}
+}
+
+func TestApplicationCheckSecretMalformedHash(t *testing.T) {
+	for _, hash := range []string{"", "not-a-phc-hash", "$argon2id$v=19$incomplete"} {
+		a := &Application{Type: ClientConfidential, ClientSecretHash: hash}
+		if a.CheckSecret("whatever") {
+			t.Errorf("格式無效的雜湊 %q 不應驗證成功", hash)
+		}
+	}
+}
+
+func TestRedirectURIsContains(t *testing.T) {
+	uris := RedirectURIs{"https://app.example.com/cb", "com.example.app:/cb"}
+	for _, uri := range []string{"https://app.example.com/cb", "com.example.app:/cb"} {
+		if !uris.Contains(uri) {
+			t.Errorf("已註冊的 %q 應比對成功", uri)
+		}
+	}
+	for _, uri := range []string{
+		"https://app.example.com/cb?x=1", // 未註冊的 query
+		"https://app.example.com/cb/",    // 結尾斜線不同即不同字串
+		"https://evil.example.com/cb",
+		"HTTPS://APP.EXAMPLE.COM/cb",
+		"",
+	} {
+		if uris.Contains(uri) {
+			t.Errorf("未註冊的 %q 不應比對成功（須完全相同）", uri)
+		}
+	}
+}
+
+func TestGrantTypesContains(t *testing.T) {
+	gts := GrantTypes{GrantAuthorizationCode, GrantRefreshToken}
+	if !gts.Contains(GrantAuthorizationCode) || !gts.Contains(GrantRefreshToken) {
+		t.Error("已啟用的 grant type 應比對成功")
+	}
+	if gts.Contains(GrantClientCredentials) {
+		t.Error("未啟用的 grant type 不應比對成功")
+	}
+}
+
+func TestValidateRedirectURI(t *testing.T) {
+	valid := []string{
+		"https://app.example.com/oidc/callback",
+		"https://app.example.com",         // 無 path
+		"https://app.example.com:8443/cb", // 帶 port
+		"http://localhost:8080/cb",        // loopback 例外
+		"http://127.0.0.1/cb",             // loopback IP
+		"http://[::1]:8080/cb",            // IPv6 loopback
+		"com.example.app:/oidc/callback",  // 原生應用自訂 scheme
+		"urn:ietf:wg:oauth:2.0:oob",       // opaque URI
+	}
+	for _, uri := range valid {
+		if err := validateRedirectURI(uri); err != nil {
+			t.Errorf("redirect URI %q 應有效，得到錯誤：%v", uri, err)
+		}
+	}
+	invalid := []string{
+		"",                                // 空字串
+		"app.example.com/cb",              // 相對 URI（無 scheme）
+		"/cb",                             // path only
+		"https://app.example.com/cb#frag", // fragment（RFC 6749 §3.1.2 禁止）
+		"https://user@app.example.com/cb", // userinfo
+		"https:///cb",                     // 無 host
+		"http://app.example.com/cb",       // 非 loopback 的 http
+		"myapp:",                          // 僅有 scheme
+	}
+	for _, uri := range invalid {
+		if err := validateRedirectURI(uri); err == nil {
+			t.Errorf("redirect URI %q 應無效", uri)
+		}
+	}
+}
+
+// --- 整合測試：需要本機 PostgreSQL，連不上時跳過 ---
+
+func TestApplicationPersistence(t *testing.T) {
+	db := newTestDB(t)
+	a, secret, err := NewApplication("示範應用", ClientConfidential,
+		[]string{"https://app.example.com/oidc/callback", "https://app.example.com/other"},
+		[]GrantType{GrantAuthorizationCode, GrantRefreshToken},
+		"openid profile email offline_access")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(a).Error; err != nil {
+		t.Fatalf("建立應用程式失敗：%v", err)
+	}
+
+	got, err := getApplicationByClientID(db, a.ClientID)
+	if err != nil {
+		t.Fatalf("以 client_id 查詢失敗：%v", err)
+	}
+	if got.ID == 0 || got.Name != a.Name || got.Type != a.Type || got.Scope != a.Scope {
+		t.Errorf("基本欄位往返不一致：got %+v", got)
+	}
+	if !reflect.DeepEqual(got.RedirectURIs, a.RedirectURIs) {
+		t.Errorf("RedirectURIs 往返不一致：got %v want %v", got.RedirectURIs, a.RedirectURIs)
+	}
+	if !reflect.DeepEqual(got.GrantTypes, a.GrantTypes) {
+		t.Errorf("GrantTypes 往返不一致：got %v want %v", got.GrantTypes, a.GrantTypes)
+	}
+	if !got.CheckSecret(secret) {
+		t.Error("資料庫往返後 client secret 應仍可驗證")
+	}
+	if !got.RedirectURIs.Contains("https://app.example.com/oidc/callback") {
+		t.Error("往返後 redirect URI 比對應仍可用")
+	}
+
+	dup, _, err := NewApplication("重複測試", ClientPublic,
+		[]string{"https://dup.example.com/cb"}, nil, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dup.ClientID = a.ClientID
+	if err := db.Create(dup).Error; !errors.Is(err, gorm.ErrDuplicatedKey) {
+		t.Errorf("重複的 client_id 應回 gorm.ErrDuplicatedKey，得到 %v", err)
+	}
+
+	if _, err := getApplicationByClientID(db, "no-such-client"); !errors.Is(err, gorm.ErrRecordNotFound) {
+		t.Errorf("查無 client_id 應回 gorm.ErrRecordNotFound，得到 %v", err)
+	}
+}