Codex Local
bf1233d5df
ci / verify (push) Canceled after 0s
Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.
85 lines
3.3 KiB
Go
85 lines
3.3 KiB
Go
package onboarding
|
|
|
|
import (
|
|
"context"
|
|
"data-terminal-cloud/internal/config"
|
|
"errors"
|
|
captcha "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/captcha/v20190722"
|
|
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
type fakeCaptchaAPI struct {
|
|
web, mini int
|
|
result int64
|
|
err error
|
|
t *testing.T
|
|
}
|
|
|
|
func (f *fakeCaptchaAPI) DescribeCaptchaResultWithContext(_ context.Context, r *captcha.DescribeCaptchaResultRequest) (*captcha.DescribeCaptchaResultResponse, error) {
|
|
f.web++
|
|
if *r.CaptchaAppId != 123 || *r.AppSecretKey != "web-secret-123456" || *r.Randstr != "random" || *r.CaptchaType != 9 {
|
|
f.t.Fatal("wrong web request")
|
|
}
|
|
return &captcha.DescribeCaptchaResultResponse{Response: &captcha.DescribeCaptchaResultResponseParams{CaptchaCode: common.Int64Ptr(f.result)}}, f.err
|
|
}
|
|
func (f *fakeCaptchaAPI) DescribeCaptchaMiniResultWithContext(_ context.Context, r *captcha.DescribeCaptchaMiniResultRequest) (*captcha.DescribeCaptchaMiniResultResponse, error) {
|
|
f.mini++
|
|
if *r.CaptchaAppId != 456 || *r.AppSecretKey != "mini-secret-12345" || *r.CaptchaType != 9 {
|
|
f.t.Fatal("wrong mini request")
|
|
}
|
|
return &captcha.DescribeCaptchaMiniResultResponse{Response: &captcha.DescribeCaptchaMiniResultResponseParams{CaptchaCode: common.Int64Ptr(f.result)}}, f.err
|
|
}
|
|
func TestTencentCaptchaProviderSeparatesClientsAndFailsClosed(t *testing.T) {
|
|
f := &fakeCaptchaAPI{t: t, result: 1}
|
|
p := &tencentCaptchaProvider{api: f, config: config.TencentCaptchaConfig{SaaS: config.CaptchaClientConfig{AppID: "123", AppSecretKey: "web-secret-123456"}, Mini: config.CaptchaClientConfig{AppID: "456", AppSecretKey: "mini-secret-12345"}}}
|
|
ctx := context.Background()
|
|
if err := p.Verify(ctx, "saas", "ticket", "random", "203.0.113.1"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := p.Verify(ctx, "mini_program", "ticket", "", "203.0.113.1"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if f.web != 1 || f.mini != 1 {
|
|
t.Fatal("wrong API")
|
|
}
|
|
for _, code := range []int64{0, 7, 8, 9, 21, 100} {
|
|
f.result = code
|
|
if p.Verify(ctx, "saas", "ticket", "random", "203.0.113.1") == nil {
|
|
t.Fatal("rejection accepted", code)
|
|
}
|
|
}
|
|
f.result = 1
|
|
f.err = errors.New("contains-secret-value")
|
|
if err := p.Verify(ctx, "saas", "ticket", "random", "203.0.113.1"); err == nil || strings.Contains(err.Error(), "secret-value") {
|
|
t.Fatal("error must be closed and sanitized")
|
|
}
|
|
before := f.web
|
|
for _, ticket := range []string{"", "trerror_123", strings.Repeat("x", 4097)} {
|
|
if p.Verify(ctx, "saas", ticket, "random", "203.0.113.1") == nil {
|
|
t.Fatal("bad ticket accepted")
|
|
}
|
|
}
|
|
if f.web != before {
|
|
t.Fatal("bad ticket caused API call")
|
|
}
|
|
}
|
|
func TestCaptchaClientIPTrustBoundary(t *testing.T) {
|
|
s := &Service{options: Options{TrustedProxyCIDRs: []string{"172.18.0.0/16"}}}
|
|
for _, tc := range []struct{ remote, forwarded, want string }{
|
|
{"203.0.113.9:123", "1.1.1.1", "203.0.113.9"},
|
|
{"172.18.0.4:123", "1.1.1.1, 203.0.113.9", "203.0.113.9"},
|
|
{"172.18.0.4:123", "203.0.113.9, 172.18.0.3", "203.0.113.9"},
|
|
{"[2001:db8::1]:123", "1.1.1.1", "2001:db8::1"},
|
|
} {
|
|
r := httptest.NewRequest("POST", "https://example.test", nil)
|
|
r.RemoteAddr = tc.remote
|
|
r.Header.Set("X-Forwarded-For", tc.forwarded)
|
|
if got := s.clientIP(r); got != tc.want {
|
|
t.Fatalf("ip %s want %s", got, tc.want)
|
|
}
|
|
}
|
|
}
|