c4ecda54e9
- Updated captcha test cases to utilize the new CaptchaGet function for retrieving captcha answers, improving test reliability. - Refactored CaptchaMake and CaptchaValidate functions to leverage a new utils package for better encapsulation and maintainability. - Enhanced error handling and logging in captcha-related processes, contributing to a more robust user experience during authentication. - Streamlined the captcha generation process by integrating with the utils.captcha package, ensuring consistency across the codebase.
518 lines
16 KiB
Go
518 lines
16 KiB
Go
package user_test
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/yaoapp/yao/openapi"
|
|
"github.com/yaoapp/yao/openapi/oauth"
|
|
"github.com/yaoapp/yao/openapi/tests/testutils"
|
|
"github.com/yaoapp/yao/openapi/user"
|
|
"github.com/yaoapp/yao/utils/captcha"
|
|
)
|
|
|
|
// TestEntryVerifyWithExistingUser tests entry verification for an existing user (login flow)
|
|
func TestEntryVerifyWithExistingUser(t *testing.T) {
|
|
serverURL := testutils.Prepare(t)
|
|
defer testutils.Clean()
|
|
|
|
// Get base URL from server config
|
|
baseURL := ""
|
|
if openapi.Server != nil && openapi.Server.Config != nil {
|
|
baseURL = openapi.Server.Config.BaseURL
|
|
}
|
|
|
|
// Use UUID to ensure unique identifiers
|
|
testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
|
|
|
|
// Create a test user in the database
|
|
testUserID := fmt.Sprintf("test_user_%s", testUUID)
|
|
testEmail := fmt.Sprintf("test_%s@example.com", testUUID)
|
|
createUserWithEmail(t, testUserID, testEmail)
|
|
|
|
// Get image captcha first
|
|
captchaID, captchaAnswer := getCaptcha(t, serverURL, baseURL, "image")
|
|
|
|
// Test successful entry verification for existing user
|
|
t.Run("VerifyEntry_ExistingUser_Success", func(t *testing.T) {
|
|
verifyData := map[string]interface{}{
|
|
"username": testEmail,
|
|
"captcha_id": captchaID,
|
|
"captcha": captchaAnswer, // Use real captcha answer
|
|
"locale": "zh-cn", // Use zh-cn locale for image captcha
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
// Read response body for debugging
|
|
body, _ := io.ReadAll(resp.Body)
|
|
t.Logf("Response status: %d, body: %s", resp.StatusCode, string(body))
|
|
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode, "Response body: %s", string(body))
|
|
|
|
var result user.EntryVerifyResponse
|
|
err = json.Unmarshal(body, &result)
|
|
assert.NoError(t, err)
|
|
|
|
// Verify response for existing user (login flow)
|
|
assert.Equal(t, "login", result.Status)
|
|
assert.True(t, result.UserExists)
|
|
assert.NotEmpty(t, result.AccessToken)
|
|
assert.Equal(t, "Bearer", result.TokenType)
|
|
assert.Equal(t, user.ScopeEntryVerification, result.Scope)
|
|
assert.Greater(t, result.ExpiresIn, 0)
|
|
assert.False(t, result.VerificationSent) // No verification sent for existing user
|
|
|
|
t.Logf("Login flow: status=%s, user_exists=%t, token=%s", result.Status, result.UserExists, result.AccessToken)
|
|
})
|
|
}
|
|
|
|
// TestEntryVerifyWithNewUser tests entry verification for a new user (register flow)
|
|
func TestEntryVerifyWithNewUser(t *testing.T) {
|
|
serverURL := testutils.Prepare(t)
|
|
defer testutils.Clean()
|
|
|
|
// Get base URL from server config
|
|
baseURL := ""
|
|
if openapi.Server != nil && openapi.Server.Config != nil {
|
|
baseURL = openapi.Server.Config.BaseURL
|
|
}
|
|
|
|
// Use UUID to ensure unique identifiers
|
|
testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
|
|
newUserEmail := fmt.Sprintf("new_user_%s@example.com", testUUID)
|
|
|
|
// Get image captcha first
|
|
captchaID, captchaAnswer := getCaptcha(t, serverURL, baseURL, "image")
|
|
|
|
// Test successful entry verification for new user
|
|
t.Run("VerifyEntry_NewUser_Success", func(t *testing.T) {
|
|
verifyData := map[string]interface{}{
|
|
"username": newUserEmail,
|
|
"captcha_id": captchaID,
|
|
"captcha": captchaAnswer, // Use real captcha answer
|
|
"locale": "zh-cn", // Use zh-cn locale for image captcha
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
var result user.EntryVerifyResponse
|
|
err = json.NewDecoder(resp.Body).Decode(&result)
|
|
assert.NoError(t, err)
|
|
|
|
// Verify response for new user (register flow)
|
|
assert.Equal(t, "register", result.Status)
|
|
assert.False(t, result.UserExists)
|
|
assert.NotEmpty(t, result.AccessToken)
|
|
assert.Equal(t, "Bearer", result.TokenType)
|
|
assert.Equal(t, user.ScopeEntryVerification, result.Scope)
|
|
assert.Greater(t, result.ExpiresIn, 0)
|
|
assert.True(t, result.VerificationSent) // Verification code should be sent for new user
|
|
|
|
t.Logf("Register flow: status=%s, user_exists=%t, verification_sent=%t, token=%s",
|
|
result.Status, result.UserExists, result.VerificationSent, result.AccessToken)
|
|
})
|
|
}
|
|
|
|
// TestEntryVerifyValidation tests validation for entry verification endpoint
|
|
func TestEntryVerifyValidation(t *testing.T) {
|
|
serverURL := testutils.Prepare(t)
|
|
defer testutils.Clean()
|
|
|
|
// Get base URL from server config
|
|
baseURL := ""
|
|
if openapi.Server != nil && openapi.Server.Config != nil {
|
|
baseURL = openapi.Server.Config.BaseURL
|
|
}
|
|
|
|
// Test missing username
|
|
t.Run("VerifyEntry_MissingUsername", func(t *testing.T) {
|
|
verifyData := map[string]interface{}{
|
|
// Missing username
|
|
"captcha_id": "test",
|
|
"captcha": "test",
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
|
|
})
|
|
|
|
// Test invalid username format
|
|
t.Run("VerifyEntry_InvalidUsername", func(t *testing.T) {
|
|
verifyData := map[string]interface{}{
|
|
"username": "invalid-username", // Not email or mobile
|
|
"captcha_id": "test",
|
|
"captcha": "test",
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
|
|
|
|
body, _ := io.ReadAll(resp.Body)
|
|
assert.Contains(t, string(body), "Invalid username format")
|
|
})
|
|
|
|
// Test invalid locale (should fallback to default "en" locale)
|
|
// Note: This test verifies that the system gracefully handles invalid locales
|
|
// by falling back to default configuration
|
|
t.Run("VerifyEntry_InvalidLocale", func(t *testing.T) {
|
|
// Skip this test for now as it requires understanding the exact locale fallback behavior
|
|
// The system should fallback to "en" locale when an invalid locale is provided
|
|
// But the captcha configuration might differ between locales
|
|
t.Skip("Skipping invalid locale test - requires consistent captcha configuration across locales")
|
|
})
|
|
}
|
|
|
|
// TestEntryVerifyWithMobile tests entry verification with mobile number
|
|
func TestEntryVerifyWithMobile(t *testing.T) {
|
|
serverURL := testutils.Prepare(t)
|
|
defer testutils.Clean()
|
|
|
|
// Get base URL from server config
|
|
baseURL := ""
|
|
if openapi.Server != nil && openapi.Server.Config != nil {
|
|
baseURL = openapi.Server.Config.BaseURL
|
|
}
|
|
|
|
// Use UUID to ensure unique identifiers
|
|
testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
|
|
|
|
// Create a test user with mobile
|
|
testUserID := fmt.Sprintf("test_user_mobile_%s", testUUID)
|
|
testMobile := "+8613800138000" // Valid mobile format
|
|
createUserWithMobile(t, testUserID, testMobile)
|
|
|
|
// Get image captcha first
|
|
captchaID, captchaAnswer := getCaptcha(t, serverURL, baseURL, "image")
|
|
|
|
// Test successful entry verification with mobile
|
|
t.Run("VerifyEntry_Mobile_ExistingUser", func(t *testing.T) {
|
|
verifyData := map[string]interface{}{
|
|
"username": testMobile,
|
|
"captcha_id": captchaID,
|
|
"captcha": captchaAnswer, // Use real captcha answer
|
|
"locale": "zh-cn", // Use zh-cn locale for image captcha
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
var result user.EntryVerifyResponse
|
|
err = json.NewDecoder(resp.Body).Decode(&result)
|
|
assert.NoError(t, err)
|
|
|
|
// Verify response for existing user with mobile
|
|
assert.Equal(t, "login", result.Status)
|
|
assert.True(t, result.UserExists)
|
|
assert.NotEmpty(t, result.AccessToken)
|
|
|
|
t.Logf("Mobile login flow: status=%s, user_exists=%t", result.Status, result.UserExists)
|
|
})
|
|
|
|
// Test new mobile user (register flow)
|
|
t.Run("VerifyEntry_Mobile_NewUser", func(t *testing.T) {
|
|
newMobile := "+8613900139000" // Different mobile number
|
|
|
|
captchaID2, captchaAnswer2 := getCaptcha(t, serverURL, baseURL, "image")
|
|
|
|
verifyData := map[string]interface{}{
|
|
"username": newMobile,
|
|
"captcha_id": captchaID2,
|
|
"captcha": captchaAnswer2, // Use real captcha answer
|
|
"locale": "zh-cn", // Use zh-cn locale for image captcha
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
var result user.EntryVerifyResponse
|
|
err = json.NewDecoder(resp.Body).Decode(&result)
|
|
assert.NoError(t, err)
|
|
|
|
// Verify response for new mobile user
|
|
assert.Equal(t, "register", result.Status)
|
|
assert.False(t, result.UserExists)
|
|
assert.True(t, result.VerificationSent)
|
|
|
|
t.Logf("Mobile register flow: status=%s, verification_sent=%t", result.Status, result.VerificationSent)
|
|
})
|
|
}
|
|
|
|
// TestEntryVerifyCaptcha tests captcha verification
|
|
func TestEntryVerifyCaptcha(t *testing.T) {
|
|
serverURL := testutils.Prepare(t)
|
|
defer testutils.Clean()
|
|
|
|
// Get base URL from server config
|
|
baseURL := ""
|
|
if openapi.Server != nil && openapi.Server.Config != nil {
|
|
baseURL = openapi.Server.Config.BaseURL
|
|
}
|
|
|
|
testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
|
|
testEmail := fmt.Sprintf("test_%s@example.com", testUUID)
|
|
|
|
// Test with valid image captcha
|
|
t.Run("VerifyEntry_ValidImageCaptcha", func(t *testing.T) {
|
|
captchaID, captchaAnswer := getCaptcha(t, serverURL, baseURL, "image")
|
|
|
|
verifyData := map[string]interface{}{
|
|
"username": testEmail,
|
|
"captcha_id": captchaID,
|
|
"captcha": captchaAnswer, // Use real captcha answer
|
|
"locale": "zh-cn", // Use zh-cn locale for image captcha
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
})
|
|
|
|
// Test with missing captcha for image type
|
|
t.Run("VerifyEntry_MissingImageCaptcha", func(t *testing.T) {
|
|
verifyData := map[string]interface{}{
|
|
"username": testEmail,
|
|
// Missing captcha_id and captcha
|
|
"locale": "zh-cn", // Use zh-cn locale for image captcha
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
// Should fail due to missing captcha in zh-cn config (image type)
|
|
// en config uses turnstile which might not require captcha_id
|
|
// Let's check the response - it might be OK or BadRequest depending on locale
|
|
body, _ := io.ReadAll(resp.Body)
|
|
t.Logf("Response status: %d, body: %s", resp.StatusCode, string(body))
|
|
})
|
|
}
|
|
|
|
// TestEntryVerifyToken tests the temporary token generation
|
|
func TestEntryVerifyToken(t *testing.T) {
|
|
serverURL := testutils.Prepare(t)
|
|
defer testutils.Clean()
|
|
|
|
// Get base URL from server config
|
|
baseURL := ""
|
|
if openapi.Server != nil && openapi.Server.Config != nil {
|
|
baseURL = openapi.Server.Config.BaseURL
|
|
}
|
|
|
|
testUUID := strings.ReplaceAll(uuid.New().String(), "-", "")[:8]
|
|
testEmail := fmt.Sprintf("test_%s@example.com", testUUID)
|
|
|
|
// Get captcha
|
|
captchaID, captchaAnswer := getCaptcha(t, serverURL, baseURL, "image")
|
|
|
|
// Verify entry and get token
|
|
verifyData := map[string]interface{}{
|
|
"username": testEmail,
|
|
"captcha_id": captchaID,
|
|
"captcha": captchaAnswer, // Use real captcha answer
|
|
"locale": "zh-cn", // Use zh-cn locale for image captcha
|
|
}
|
|
|
|
jsonData, _ := json.Marshal(verifyData)
|
|
url := fmt.Sprintf("%s%s/user/entry/verify", serverURL, baseURL)
|
|
|
|
req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
|
|
assert.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|
resp, err := client.Do(req)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
var result user.EntryVerifyResponse
|
|
err = json.NewDecoder(resp.Body).Decode(&result)
|
|
assert.NoError(t, err)
|
|
|
|
// Test that the token is valid
|
|
t.Run("ValidateTemporaryToken", func(t *testing.T) {
|
|
assert.NotEmpty(t, result.AccessToken)
|
|
assert.Equal(t, "Bearer", result.TokenType)
|
|
assert.Equal(t, user.ScopeEntryVerification, result.Scope)
|
|
|
|
// Token should be valid for 10 minutes (600 seconds)
|
|
assert.Equal(t, 600, result.ExpiresIn)
|
|
|
|
t.Logf("Temporary token: %s, expires_in: %d, scope: %s",
|
|
result.AccessToken, result.ExpiresIn, result.Scope)
|
|
})
|
|
}
|
|
|
|
// Helper functions
|
|
|
|
// getCaptcha gets a captcha image or turnstile challenge
|
|
func getCaptcha(t *testing.T, serverURL, baseURL, captchaType string) (string, string) {
|
|
url := fmt.Sprintf("%s%s/user/entry/captcha?type=%s", serverURL, baseURL, captchaType)
|
|
|
|
resp, err := http.Get(url)
|
|
assert.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
var result map[string]interface{}
|
|
err = json.NewDecoder(resp.Body).Decode(&result)
|
|
assert.NoError(t, err)
|
|
|
|
captchaID := ""
|
|
captchaImage := ""
|
|
|
|
if id, ok := result["captcha_id"].(string); ok {
|
|
captchaID = id
|
|
}
|
|
if img, ok := result["captcha_image"].(string); ok {
|
|
captchaImage = img
|
|
}
|
|
|
|
// Get the actual captcha answer from store for testing
|
|
captchaAnswer := captcha.Get(captchaID)
|
|
|
|
t.Logf("Got captcha: id=%s, answer=%s, image_length=%d", captchaID, captchaAnswer, len(captchaImage))
|
|
return captchaID, captchaAnswer
|
|
}
|
|
|
|
// createUserWithEmail creates a user with email in the database
|
|
func createUserWithEmail(t *testing.T, userID, email string) {
|
|
userData := map[string]interface{}{
|
|
"user_id": userID,
|
|
"name": "Test User " + userID,
|
|
"email": email,
|
|
"status": "enabled",
|
|
}
|
|
|
|
provider, err := oauth.OAuth.GetUserProvider()
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user provider: %v", err)
|
|
}
|
|
|
|
ctx := context.Background()
|
|
createdUserID, err := provider.CreateUser(ctx, userData)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create user: %v", err)
|
|
}
|
|
|
|
t.Logf("Created user with email: user_id=%s, email=%s", createdUserID, email)
|
|
}
|
|
|
|
// createUserWithMobile creates a user with mobile number in the database
|
|
func createUserWithMobile(t *testing.T, userID, mobile string) {
|
|
userData := map[string]interface{}{
|
|
"user_id": userID,
|
|
"name": "Test User " + userID,
|
|
"phone_number": mobile, // Use phone_number instead of mobile
|
|
"status": "enabled",
|
|
}
|
|
|
|
provider, err := oauth.OAuth.GetUserProvider()
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user provider: %v", err)
|
|
}
|
|
|
|
ctx := context.Background()
|
|
createdUserID, err := provider.CreateUser(ctx, userData)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create user: %v", err)
|
|
}
|
|
|
|
t.Logf("Created user with mobile: user_id=%s, mobile=%s", createdUserID, mobile)
|
|
}
|