166 lines
7.4 KiB
Go
166 lines
7.4 KiB
Go
package externaladmin
|
|
|
|
import (
|
|
"database/sql/driver"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"hyapp-admin-server/internal/cache"
|
|
"hyapp-admin-server/internal/security"
|
|
|
|
"github.com/DATA-DOG/go-sqlmock"
|
|
"gorm.io/driver/mysql"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
func TestLoginFailureLimitPersistsTimedLockAndUnifiedError(t *testing.T) {
|
|
adminSQL, adminMock, err := sqlmock.New()
|
|
if err != nil {
|
|
t.Fatalf("create admin sql mock: %v", err)
|
|
}
|
|
defer adminSQL.Close()
|
|
adminDB, err := gorm.Open(mysql.New(mysql.Config{Conn: adminSQL, SkipInitializeWithVersion: true}), &gorm.Config{})
|
|
if err != nil {
|
|
t.Fatalf("create admin gorm db: %v", err)
|
|
}
|
|
userDB, userMock, err := sqlmock.New()
|
|
if err != nil {
|
|
t.Fatalf("create user sql mock: %v", err)
|
|
}
|
|
defer userDB.Close()
|
|
|
|
passwordHash, err := security.HashPassword("correct-password")
|
|
if err != nil {
|
|
t.Fatalf("hash fixture password: %v", err)
|
|
}
|
|
// Login resolves the tenant from the globally unique account name before it
|
|
// touches the owner App database; no request App participates in either query.
|
|
adminMock.ExpectQuery("SELECT `id`,`app_code` FROM `external_admin_accounts` WHERE username = \\? LIMIT \\?").
|
|
WithArgs("operator", 1).
|
|
WillReturnRows(sqlmock.NewRows([]string{"id", "app_code"}).AddRow(7, "fami"))
|
|
userMock.ExpectQuery("SELECT app_code, app_name, logo_url FROM apps").
|
|
WithArgs("fami").
|
|
WillReturnRows(sqlmock.NewRows([]string{"app_code", "app_name", "logo_url"}).AddRow("fami", "Fami", "logo"))
|
|
adminMock.ExpectBegin()
|
|
adminMock.ExpectQuery("SELECT \\* FROM `external_admin_accounts` WHERE id = \\? AND username = \\?").
|
|
WithArgs(uint64(7), "operator", 1).
|
|
WillReturnRows(sqlmock.NewRows([]string{
|
|
"id", "app_code", "linked_app_user_id", "username", "password_hash", "permissions_json", "status",
|
|
"password_change_required", "failed_login_count", "locked_until_ms", "created_by_admin_id", "created_at_ms", "updated_at_ms",
|
|
}).AddRow(7, "fami", 9001, "operator", passwordHash, `[]`, "active", false, 0, 0, 1, 1, 1))
|
|
adminMock.ExpectExec("UPDATE `external_admin_accounts` SET").
|
|
WithArgs(uint(0), futureMillis{}, sqlmock.AnyArg(), uint64(7)).
|
|
WillReturnResult(sqlmock.NewResult(0, 1))
|
|
adminMock.ExpectExec("INSERT INTO `external_admin_login_logs`").
|
|
WithArgs(sqlmock.AnyArg(), "fami", "operator", "127.0.0.1", "browser", "failed", "failure_limit_locked", sqlmock.AnyArg()).
|
|
WillReturnResult(sqlmock.NewResult(1, 1))
|
|
adminMock.ExpectCommit()
|
|
|
|
service := NewService(adminDB, userDB, Config{MaxLoginFailures: 1, LockDuration: 10 * time.Minute})
|
|
limiter := &recordingFixedWindowLimiter{decision: cache.FixedWindowDecision{Allowed: true}}
|
|
service.limiter = limiter
|
|
_, err = service.Login(t.Context(), LoginInput{
|
|
Username: "Operator", Password: "wrong-password", IP: "127.0.0.1", UserAgent: "browser",
|
|
})
|
|
if !errors.Is(err, ErrInvalidCredentials) {
|
|
t.Fatalf("login error = %v, want unified invalid credentials", err)
|
|
}
|
|
if err := adminMock.ExpectationsWereMet(); err != nil {
|
|
t.Fatalf("admin sql expectations: %v", err)
|
|
}
|
|
if err := userMock.ExpectationsWereMet(); err != nil {
|
|
t.Fatalf("user sql expectations: %v", err)
|
|
}
|
|
if limiter.calls != 2 || len(limiter.batches) != 2 || len(limiter.batches[0]) != 3 || len(limiter.batches[1]) != 1 {
|
|
t.Fatalf("rate-limit batches = %+v", limiter.batches)
|
|
}
|
|
if !strings.Contains(limiter.batches[1][0].Key, ":app:") || limiter.batches[1][0].Limit != 120 {
|
|
t.Fatalf("resolved App limiter = %+v", limiter.batches[1])
|
|
}
|
|
for _, rule := range limiter.batches[1] {
|
|
if strings.Contains(rule.Key, ":system") || strings.Contains(rule.Key, ":ip:") || strings.Contains(rule.Key, ":identity:") {
|
|
t.Fatalf("resolved App phase repeated a pre-resolution counter: %s", rule.Key)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestLoginWithoutAppCreatesSessionFromResolvedAccountTenant(t *testing.T) {
|
|
adminSQL, adminMock, err := sqlmock.New()
|
|
if err != nil {
|
|
t.Fatalf("create admin sql mock: %v", err)
|
|
}
|
|
defer adminSQL.Close()
|
|
adminDB, err := gorm.Open(mysql.New(mysql.Config{Conn: adminSQL, SkipInitializeWithVersion: true}), &gorm.Config{})
|
|
if err != nil {
|
|
t.Fatalf("create admin gorm db: %v", err)
|
|
}
|
|
userDB, userMock, err := sqlmock.New()
|
|
if err != nil {
|
|
t.Fatalf("create user sql mock: %v", err)
|
|
}
|
|
defer userDB.Close()
|
|
passwordHash, err := security.HashPassword("correct-password")
|
|
if err != nil {
|
|
t.Fatalf("hash fixture password: %v", err)
|
|
}
|
|
|
|
adminMock.ExpectQuery("SELECT `id`,`app_code` FROM `external_admin_accounts` WHERE username = \\? LIMIT \\?").
|
|
WithArgs("operator", 1).
|
|
WillReturnRows(sqlmock.NewRows([]string{"id", "app_code"}).AddRow(7, "fami"))
|
|
userMock.ExpectQuery("SELECT app_code, app_name, logo_url FROM apps").
|
|
WithArgs("fami").
|
|
WillReturnRows(sqlmock.NewRows([]string{"app_code", "app_name", "logo_url"}).AddRow("fami", "Fami", "logo"))
|
|
adminMock.ExpectBegin()
|
|
adminMock.ExpectQuery("SELECT \\* FROM `external_admin_accounts` WHERE id = \\? AND username = \\?").
|
|
WithArgs(uint64(7), "operator", 1).
|
|
WillReturnRows(sqlmock.NewRows([]string{
|
|
"id", "app_code", "linked_app_user_id", "username", "password_hash", "permissions_json", "status",
|
|
"password_change_required", "failed_login_count", "locked_until_ms", "last_login_at_ms", "created_by_admin_id", "created_at_ms", "updated_at_ms",
|
|
}).AddRow(7, "fami", 9001, "operator", passwordHash, `["bd:view"]`, "active", false, 0, 0, nil, 1, 1, 1))
|
|
// The session insert is the persistence proof: AppCode comes from the account
|
|
// projection even though LoginInput has no App field at all.
|
|
adminMock.ExpectExec("INSERT INTO `external_admin_sessions`").
|
|
WithArgs(uint64(7), "fami", sqlmock.AnyArg(), sqlmock.AnyArg(), "203.0.113.10", "browser", sqlmock.AnyArg(), sqlmock.AnyArg(), int64(0), "", sqlmock.AnyArg()).
|
|
WillReturnResult(sqlmock.NewResult(21, 1))
|
|
adminMock.ExpectExec("UPDATE `external_admin_accounts` SET").WillReturnResult(sqlmock.NewResult(0, 1))
|
|
adminMock.ExpectExec("INSERT INTO `external_admin_login_logs`").
|
|
WithArgs(uint64(7), "fami", "operator", "203.0.113.10", "browser", "success", "login_success", sqlmock.AnyArg()).
|
|
WillReturnResult(sqlmock.NewResult(31, 1))
|
|
adminMock.ExpectCommit()
|
|
userMock.ExpectQuery("SELECT u.user_id,").
|
|
WithArgs(sqlmock.AnyArg(), sqlmock.AnyArg(), "fami", int64(9001)).
|
|
WillReturnRows(sqlmock.NewRows([]string{
|
|
"user_id", "current_display_user_id", "default_display_user_id", "pretty_display_user_id", "pretty_id", "username", "avatar", "status",
|
|
}).AddRow(9001, "123456", "654321", "8888", "8888", "linked-user", "avatar", "active"))
|
|
|
|
service := NewService(adminDB, userDB, Config{})
|
|
service.limiter = allowFixedWindowLimiter{}
|
|
result, err := service.Login(t.Context(), LoginInput{
|
|
Username: "Operator", Password: "correct-password", IP: "203.0.113.10", UserAgent: "browser",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("login without App: %v", err)
|
|
}
|
|
if result.SessionToken == "" || result.CSRFToken == "" {
|
|
t.Fatal("successful login must issue opaque session and CSRF tokens")
|
|
}
|
|
if result.View.AppCode != "fami" || result.View.App.AppCode != "fami" || result.View.Account.Username != "operator" {
|
|
t.Fatalf("resolved session view = %+v", result.View)
|
|
}
|
|
if err := adminMock.ExpectationsWereMet(); err != nil {
|
|
t.Fatalf("admin sql expectations: %v", err)
|
|
}
|
|
if err := userMock.ExpectationsWereMet(); err != nil {
|
|
t.Fatalf("user sql expectations: %v", err)
|
|
}
|
|
}
|
|
|
|
type futureMillis struct{}
|
|
|
|
func (futureMillis) Match(value driver.Value) bool {
|
|
millis, ok := value.(int64)
|
|
return ok && millis > time.Now().UTC().UnixMilli()
|
|
}
|