chore: checkpoint 第一版

internal/httpapi/hardware_agent_provisioning_handlers_test.go

@@ -0,0 +1,83 @@
+package httpapi
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"data-terminal-cloud/internal/deviceauth"
+	"data-terminal-cloud/internal/hardwareprovision"
+)
+
+type fakeHardwareProvisioner struct {
+	response hardwareprovision.ProvisionResponse
+	err      error
+	input    hardwareprovision.ProvisionInput
+}
+
+func (f *fakeHardwareProvisioner) Provision(_ context.Context, _ deviceauth.Identity, _ string, input hardwareprovision.ProvisionInput) (hardwareprovision.ProvisionResponse, error) {
+	f.input = input
+	return f.response, f.err
+}
+
+func TestProvisionHardwareAgentCredentialHandlerReturnsNoStoreCredential(t *testing.T) {
+	service := &fakeHardwareProvisioner{response: hardwareprovision.ProvisionResponse{
+		InstanceID: "instance", ProductKey: "product", DeviceName: "device", HardwareID: "hardware",
+		DeviceSecret: "device-secret", CredentialRef: "credential-ref", CredentialVersion: 1,
+		CredentialSource: "platform_dynamic_registration", IssuedAt: time.Unix(1_700_000_000, 0).UTC(),
+	}}
+	request := httptest.NewRequest(http.MethodPost, "/device/v3/hardware-agent-credentials:provision", strings.NewReader(`{"hardware_id":"hardware"}`))
+	request.Header.Set("Idempotency-Key", "provision-request-123456")
+	request = request.WithContext(deviceauth.WithIdentity(request.Context(), deviceauth.Identity{ID: "internal", PublicID: "public", TenantID: "tenant", Status: "registered"}))
+	recorder := httptest.NewRecorder()
+
+	ProvisionHardwareAgentCredentialHandler(service).ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body.String())
+	}
+	if recorder.Header().Get("Cache-Control") != "no-store" || recorder.Header().Get("Pragma") != "no-cache" {
+		t.Fatalf("credential response was cacheable: headers=%v", recorder.Header())
+	}
+	var response struct {
+		Data hardwareprovision.ProvisionResponse `json:"data"`
+	}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if response.Data.DeviceSecret != "device-secret" || service.input.HardwareID != "hardware" {
+		t.Fatalf("unexpected response/input: response=%+v input=%+v", response.Data, service.input)
+	}
+}
+
+func TestProvisionHardwareAgentCredentialHandlerMapsUnavailable(t *testing.T) {
+	service := &fakeHardwareProvisioner{err: hardwareprovision.ErrUnavailable}
+	request := httptest.NewRequest(http.MethodPost, "/device/v3/hardware-agent-credentials:provision", strings.NewReader(`{"hardware_id":"hardware"}`))
+	request.Header.Set("Idempotency-Key", "provision-request-123456")
+	request = request.WithContext(deviceauth.WithIdentity(request.Context(), deviceauth.Identity{}))
+	recorder := httptest.NewRecorder()
+
+	ProvisionHardwareAgentCredentialHandler(service).ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusServiceUnavailable || !strings.Contains(recorder.Body.String(), "HARDWARE_AGENT_PROVISIONING_UNAVAILABLE") {
+		t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func TestProvisionHardwareAgentCredentialHandlerRejectsHardwareMismatch(t *testing.T) {
+	service := &fakeHardwareProvisioner{err: hardwareprovision.ErrHardwareMismatch}
+	request := httptest.NewRequest(http.MethodPost, "/device/v3/hardware-agent-credentials:provision", strings.NewReader(`{"hardware_id":"hardware"}`))
+	request.Header.Set("Idempotency-Key", "provision-request-123456")
+	request = request.WithContext(deviceauth.WithIdentity(request.Context(), deviceauth.Identity{}))
+	recorder := httptest.NewRecorder()
+
+	ProvisionHardwareAgentCredentialHandler(service).ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusConflict || !strings.Contains(recorder.Body.String(), "HARDWARE_AGENT_HARDWARE_MISMATCH") {
+		t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body.String())
+	}
+}