更新

2026-09-03 08:38:17 +08:00
parent 6cd4f1b1db
commit 842990b0e7
1853 changed files with 278406 additions and 361 deletions
@@ -0,0 +1,42 @@
+package app
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestAdminRefreshCookieSecurityModes(t *testing.T) {
+	production := &App{config: Config{Environment: "production"}}
+	recorder := httptest.NewRecorder()
+	production.setAdminRefreshCookie(recorder, "token", time.Now().Add(time.Hour))
+	cookies := recorder.Result().Cookies()
+	if len(cookies) != 1 || !cookies[0].HttpOnly || !cookies[0].Secure || cookies[0].SameSite != http.SameSiteNoneMode {
+		t.Fatalf("unexpected production cookie: %#v", cookies)
+	}
+
+	development := &App{config: Config{Environment: "development"}}
+	recorder = httptest.NewRecorder()
+	development.setAdminRefreshCookie(recorder, "token", time.Now().Add(time.Hour))
+	cookies = recorder.Result().Cookies()
+	if len(cookies) != 1 || cookies[0].Secure || cookies[0].SameSite != http.SameSiteLaxMode {
+		t.Fatalf("unexpected development cookie: %#v", cookies)
+	}
+}
+
+func TestAdminRefreshTokenRequestFallback(t *testing.T) {
+	application := &App{}
+	request := httptest.NewRequest(http.MethodPost, "/admin/v1/auth/refresh", strings.NewReader(`{"refreshToken":"body-token"}`))
+	request.Header.Set("Content-Type", "application/json")
+	if token := application.adminRefreshTokenFromRequest(request); token != "body-token" {
+		t.Fatalf("unexpected body token %q", token)
+	}
+
+	request = httptest.NewRequest(http.MethodPost, "/admin/v1/auth/refresh", strings.NewReader(`{"refreshToken":"body-token"}`))
+	request.AddCookie(&http.Cookie{Name: adminRefreshCookieKey, Value: "cookie-token"})
+	if token := application.adminRefreshTokenFromRequest(request); token != "cookie-token" {
+		t.Fatalf("cookie token must take priority, got %q", token)
+	}
+}