forked from alterminal/alterminal
358 lines
12 KiB
Go
358 lines
12 KiB
Go
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestPasswordRequestValidate(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
in passwordRequest
|
|
isForm bool
|
|
wantErr string // 空字串表示應通過
|
|
}{
|
|
{"最小欄位", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "n3w-secret!"}, false, ""},
|
|
{"表單確認欄位相符", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "n3w-secret!", Confirm: "n3w-secret!"}, true, ""},
|
|
{"缺目前密碼", passwordRequest{NewPassword: "n3w-secret!"}, false, "目前的密碼"},
|
|
{"缺新密碼", passwordRequest{CurrentPassword: "sup3r-secret"}, false, "新密碼不可為空"},
|
|
{"新密碼過短", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "short"}, false, "密碼長度至少"},
|
|
{"表單確認欄位不一致", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "n3w-secret!", Confirm: "other-pass"}, true, "兩次輸入的新密碼不一致"},
|
|
{"JSON 流程不檢查確認欄位", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "n3w-secret!", Confirm: "other-pass"}, false, ""},
|
|
{"新密碼與目前密碼相同", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "sup3r-secret"}, false, "不可與目前的密碼相同"},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
err := tt.in.validate(tt.isForm)
|
|
if tt.wantErr == "" {
|
|
if err != nil {
|
|
t.Fatalf("validate() = %v, want nil", err)
|
|
}
|
|
return
|
|
}
|
|
if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
|
|
t.Fatalf("validate() = %v, want error containing %q", err, tt.wantErr)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// 未帶 Session Cookie 的路徑不會查詢資料庫,可用 nil db 測試。
|
|
func TestPasswordHandlersRequireSession(t *testing.T) {
|
|
t.Run("GET 未登入導向 /login 並攜回 next", func(t *testing.T) {
|
|
rec := httptest.NewRecorder()
|
|
PasswordPageHandler(nil)(rec, httptest.NewRequest(http.MethodGet, "/password", nil))
|
|
if rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("status = %d, want 303", rec.Code)
|
|
}
|
|
if loc := rec.Header().Get("Location"); loc != "/login?next=%2Fpassword" {
|
|
t.Fatalf("Location = %q, want /login?next=%%2Fpassword", loc)
|
|
}
|
|
})
|
|
|
|
t.Run("POST 表單未登入導向 /login", func(t *testing.T) {
|
|
rec := httptest.NewRecorder()
|
|
PasswordChangeHandler(nil)(rec, formPost("csrf_token=token-A", nil))
|
|
if rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("status = %d, want 303", rec.Code)
|
|
}
|
|
if loc := rec.Header().Get("Location"); loc != "/login?next=%2Fpassword" {
|
|
t.Fatalf("Location = %q, want /login?next=%%2Fpassword", loc)
|
|
}
|
|
})
|
|
|
|
t.Run("POST JSON 未登入回 401", func(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodPost, "/password", strings.NewReader(`{}`))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
rec := httptest.NewRecorder()
|
|
PasswordChangeHandler(nil)(rec, req)
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want 401", rec.Code)
|
|
}
|
|
if !strings.Contains(rec.Body.String(), `"error"`) {
|
|
t.Fatalf("JSON 流程應回錯誤: %s", rec.Body.String())
|
|
}
|
|
})
|
|
|
|
t.Run("不支援的 Content-Type 回 415", func(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodPost, "/password", strings.NewReader("x=1"))
|
|
req.Header.Set("Content-Type", "text/plain")
|
|
rec := httptest.NewRecorder()
|
|
PasswordChangeHandler(nil)(rec, req)
|
|
if rec.Code != http.StatusUnsupportedMediaType {
|
|
t.Fatalf("status = %d, want 415", rec.Code)
|
|
}
|
|
})
|
|
}
|
|
|
|
// renderPasswordPage 不查詢資料庫,可直接以虛構 Session 測試表單輸出。
|
|
func TestRenderPasswordPage(t *testing.T) {
|
|
rec := httptest.NewRecorder()
|
|
s := &Session{
|
|
ID: "test-session",
|
|
User: User{Username: "alice", Email: "alice@example.com"},
|
|
ExpiresAt: time.Now().Add(24 * time.Hour),
|
|
}
|
|
renderPasswordPage(rec, httptest.NewRequest(http.MethodGet, "/password", nil), http.StatusOK, s, "", "")
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
body := rec.Body.String()
|
|
for _, want := range []string{
|
|
`action="/password"`,
|
|
`name="csrf_token"`,
|
|
`name="current_password"`,
|
|
`name="new_password"`,
|
|
`name="confirm_password"`,
|
|
`autocomplete="current-password"`,
|
|
`autocomplete="new-password"`,
|
|
`minlength="8"`,
|
|
"<aside", // layout 側邊導覽欄
|
|
} {
|
|
if !strings.Contains(body, want) {
|
|
t.Errorf("更新密碼頁缺少 %s", want)
|
|
}
|
|
}
|
|
if !strings.Contains(rec.Header().Get("Set-Cookie"), CSRFCookieName) {
|
|
t.Fatal("輸出表單時應設定 CSRF Cookie")
|
|
}
|
|
}
|
|
|
|
func TestPasswordChangeIntegration(t *testing.T) {
|
|
db, err := openTestDB()
|
|
if err != nil {
|
|
t.Skipf("資料庫不可用，略過整合測試: %v", err)
|
|
}
|
|
suffix, err := NewToken(6)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
u := &User{Username: "pw-" + suffix, Email: "pw-" + suffix + "@example.com", Name: "Password Test"}
|
|
if err := u.SetPassword("sup3r-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := db.Create(u).Error; err != nil {
|
|
t.Fatalf("create user: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
db.Delete(&Session{}, "user_id = ?", u.ID)
|
|
db.Delete(&User{}, u.ID)
|
|
})
|
|
|
|
passwordPost := func(form url.Values, sessionID, csrf string) *http.Request {
|
|
req := formPost(form.Encode(), &http.Cookie{Name: CSRFCookieName, Value: csrf})
|
|
if sessionID != "" {
|
|
req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionID})
|
|
}
|
|
return req
|
|
}
|
|
validForm := func() url.Values {
|
|
return url.Values{
|
|
"csrf_token": {"token-A"},
|
|
"current_password": {"sup3r-secret"},
|
|
"new_password": {"n3w-secret!"},
|
|
"confirm_password": {"n3w-secret!"},
|
|
}
|
|
}
|
|
// sessionCookieValue 從回應的 Set-Cookie 取出新的 Session ID。
|
|
sessionCookieValue := func(rec *httptest.ResponseRecorder) string {
|
|
for _, sc := range rec.Header().Values("Set-Cookie") {
|
|
if strings.HasPrefix(sc, CookieName+"=") {
|
|
return strings.SplitN(strings.SplitN(sc, ";", 2)[0], "=", 2)[1]
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
t.Run("已登入者 GET 顯示表單；帳號首頁含更新密碼連結", func(t *testing.T) {
|
|
s, err := CreateSession(db, u.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
req := httptest.NewRequest(http.MethodGet, "/password", nil)
|
|
req.AddCookie(&http.Cookie{Name: CookieName, Value: s.ID})
|
|
rec := httptest.NewRecorder()
|
|
PasswordPageHandler(db)(rec, req)
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
if !strings.Contains(rec.Body.String(), `name="current_password"`) {
|
|
t.Fatal("更新密碼表單缺少目前密碼欄位")
|
|
}
|
|
|
|
home := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
home.AddCookie(&http.Cookie{Name: CookieName, Value: s.ID})
|
|
homeRec := httptest.NewRecorder()
|
|
AccountPageHandler(db)(homeRec, home)
|
|
if !strings.Contains(homeRec.Body.String(), `href="/password"`) {
|
|
t.Fatal("帳號首頁應含更新密碼連結")
|
|
}
|
|
})
|
|
|
|
t.Run("?saved=1 顯示成功訊息", func(t *testing.T) {
|
|
s, err := CreateSession(db, u.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
req := httptest.NewRequest(http.MethodGet, "/password?saved=1", nil)
|
|
req.AddCookie(&http.Cookie{Name: CookieName, Value: s.ID})
|
|
rec := httptest.NewRecorder()
|
|
PasswordPageHandler(db)(rec, req)
|
|
if !strings.Contains(rec.Body.String(), "密碼已更新") {
|
|
t.Fatal("應顯示成功訊息")
|
|
}
|
|
})
|
|
|
|
t.Run("CSRF 不符回 403 重繪表單", func(t *testing.T) {
|
|
s, err := CreateSession(db, u.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
PasswordChangeHandler(db)(rec, passwordPost(validForm(), s.ID, "token-B"))
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want 403, body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
if !strings.Contains(rec.Body.String(), "表單驗證失敗") {
|
|
t.Fatal("應顯示 CSRF 錯誤訊息")
|
|
}
|
|
if _, err := GetSession(db, s.ID); err != nil {
|
|
t.Fatalf("CSRF 失敗不應影響 Session: %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("確認欄位不一致回 400 且不更新", func(t *testing.T) {
|
|
s, err := CreateSession(db, u.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
form := validForm()
|
|
form.Set("confirm_password", "other-pass")
|
|
rec := httptest.NewRecorder()
|
|
PasswordChangeHandler(db)(rec, passwordPost(form, s.ID, "token-A"))
|
|
if rec.Code != http.StatusBadRequest {
|
|
t.Fatalf("status = %d, want 400, body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
if !strings.Contains(rec.Body.String(), "兩次輸入的新密碼不一致") {
|
|
t.Fatal("應顯示確認欄位錯誤訊息")
|
|
}
|
|
})
|
|
|
|
t.Run("目前密碼錯誤回 401 且不更新", func(t *testing.T) {
|
|
s, err := CreateSession(db, u.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
form := validForm()
|
|
form.Set("current_password", "wrong-secret")
|
|
rec := httptest.NewRecorder()
|
|
PasswordChangeHandler(db)(rec, passwordPost(form, s.ID, "token-A"))
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want 401, body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
if !strings.Contains(rec.Body.String(), "目前的密碼錯誤") {
|
|
t.Fatal("應顯示目前密碼錯誤訊息")
|
|
}
|
|
var reloaded User
|
|
if err := db.First(&reloaded, u.ID).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !reloaded.CheckPassword("sup3r-secret") {
|
|
t.Fatal("密碼不應被更新")
|
|
}
|
|
if _, err := GetSession(db, s.ID); err != nil {
|
|
t.Fatalf("Session 不應被撤銷: %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("表單成功：更新密碼、撤銷全部 Session、輪替目前 Session", func(t *testing.T) {
|
|
current, err := CreateSession(db, u.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
other, err := CreateSession(db, u.ID) // 模擬其他裝置的登入
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
PasswordChangeHandler(db)(rec, passwordPost(validForm(), current.ID, "token-A"))
|
|
if rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("status = %d, want 303, body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
if loc := rec.Header().Get("Location"); loc != "/password?saved=1" {
|
|
t.Fatalf("Location = %q, want /password?saved=1", loc)
|
|
}
|
|
|
|
for _, old := range []string{current.ID, other.ID} {
|
|
if _, err := GetSession(db, old); !errors.Is(err, ErrSessionExpired) {
|
|
t.Fatalf("更新後舊 Session %q 應被撤銷, got %v", old, err)
|
|
}
|
|
}
|
|
newID := sessionCookieValue(rec)
|
|
if newID == "" || newID == current.ID {
|
|
t.Fatalf("應下發輪替後的新 Session Cookie, got %q", newID)
|
|
}
|
|
ns, err := GetSession(db, newID)
|
|
if err != nil {
|
|
t.Fatalf("輪替後的 Session 應有效: %v", err)
|
|
}
|
|
if ns.UserID != u.ID {
|
|
t.Fatalf("輪替後 Session 的 UserID = %d, want %d", ns.UserID, u.ID)
|
|
}
|
|
|
|
var reloaded User
|
|
if err := db.First(&reloaded, u.ID).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if reloaded.CheckPassword("sup3r-secret") {
|
|
t.Fatal("舊密碼不應再通過驗證")
|
|
}
|
|
if !reloaded.CheckPassword("n3w-secret!") {
|
|
t.Fatal("新密碼應可通過驗證")
|
|
}
|
|
})
|
|
|
|
t.Run("JSON 成功回 204；目前密碼錯誤回 401", func(t *testing.T) {
|
|
s, err := CreateSession(db, u.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
jsonPost := func(sessionID, body string) *http.Request {
|
|
req := httptest.NewRequest(http.MethodPost, "/password", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionID})
|
|
return req
|
|
}
|
|
|
|
rec := httptest.NewRecorder()
|
|
PasswordChangeHandler(db)(rec, jsonPost(s.ID, `{"current_password":"wrong-secret","new_password":"f1nal-secret!"}`))
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want 401, body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
|
|
rec = httptest.NewRecorder()
|
|
PasswordChangeHandler(db)(rec, jsonPost(s.ID, `{"current_password":"n3w-secret!","new_password":"f1nal-secret!"}`))
|
|
if rec.Code != http.StatusNoContent {
|
|
t.Fatalf("status = %d, want 204, body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
if _, err := GetSession(db, s.ID); !errors.Is(err, ErrSessionExpired) {
|
|
t.Fatal("JSON 流程亦應撤銷舊 Session")
|
|
}
|
|
if newID := sessionCookieValue(rec); newID == "" {
|
|
t.Fatal("JSON 流程亦應下發輪替後的 Session Cookie")
|
|
}
|
|
var reloaded User
|
|
if err := db.First(&reloaded, u.ID).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !reloaded.CheckPassword("f1nal-secret!") {
|
|
t.Fatal("新密碼應可通過驗證")
|
|
}
|
|
})
|
|
}
|