mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-11-07 08:52:26 +00:00
shaw
35748d8c51
- 提升用户为管理员 / 创建管理员账号纳入敏感操作：handler 级 EnforceStepUp 门控 （admin API key 拒绝、未启用 TOTP 拒绝、无 grant 返回 STEP_UP_REQUIRED）， 目标已是管理员的日常编辑不触发 - 管理员启用/停用 2FA 一律使用密码验证（默认通知邮箱常收不到验证码）， verification-method 按用户角色返回；普通用户行为不变 - 用户编辑/创建弹窗接入 useStepUp：命中 STEP_UP_REQUIRED 弹 TOTP 验证并自动重试 - 审计日志清理入口与其他敏感操作对齐：未启用 2FA 时直接提示先启用 TOTP， 不再弹出无法完成的验证码输入框（后端强制现场 TOTP 语义不变） - 审计日志页重构：DataTable 布局、详情弹窗分区展示、时间范围改为 ops 同款 下拉（预设窗口 + 自定义起止支持时分）
106 lines
3.2 KiB
Go
106 lines
3.2 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/service"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type stubStepUpGrantChecker struct {
|
|
granted bool
|
|
err error
|
|
}
|
|
|
|
func (s stubStepUpGrantChecker) HasStepUpGrant(ctx context.Context, userID int64, sessionKey string) (bool, error) {
|
|
return s.granted, s.err
|
|
}
|
|
|
|
type stubStepUpUserReader struct {
|
|
user *service.User
|
|
err error
|
|
}
|
|
|
|
func (s stubStepUpUserReader) GetByID(ctx context.Context, id int64) (*service.User, error) {
|
|
return s.user, s.err
|
|
}
|
|
|
|
func newStepUpTestContext(t *testing.T) (*gin.Context, *httptest.ResponseRecorder) {
|
|
t.Helper()
|
|
gin.SetMode(gin.TestMode)
|
|
rec := httptest.NewRecorder()
|
|
c, _ := gin.CreateTestContext(rec)
|
|
c.Request = httptest.NewRequest(http.MethodPost, "/sensitive", nil)
|
|
return c, rec
|
|
}
|
|
|
|
func TestEnforceStepUpRejectsAdminAPIKey(t *testing.T) {
|
|
c, rec := newStepUpTestContext(t)
|
|
c.Set("auth_method", service.AuditAuthMethodAdminAPIKey)
|
|
|
|
ok := enforceStepUp(c, stubStepUpGrantChecker{granted: true}, stubStepUpUserReader{user: &service.User{TotpEnabled: true}})
|
|
|
|
require.False(t, ok)
|
|
require.True(t, c.IsAborted())
|
|
require.Equal(t, http.StatusForbidden, rec.Code)
|
|
require.Contains(t, rec.Body.String(), "STEP_UP_ADMIN_API_KEY_FORBIDDEN")
|
|
}
|
|
|
|
func TestEnforceStepUpRequiresAuthSubject(t *testing.T) {
|
|
c, rec := newStepUpTestContext(t)
|
|
|
|
ok := enforceStepUp(c, stubStepUpGrantChecker{granted: true}, stubStepUpUserReader{user: &service.User{TotpEnabled: true}})
|
|
|
|
require.False(t, ok)
|
|
require.Equal(t, http.StatusUnauthorized, rec.Code)
|
|
}
|
|
|
|
func TestEnforceStepUpRequiresTotpEnabled(t *testing.T) {
|
|
c, rec := newStepUpTestContext(t)
|
|
c.Set(string(ContextKeyUser), AuthSubject{UserID: 1})
|
|
|
|
ok := enforceStepUp(c, stubStepUpGrantChecker{granted: true}, stubStepUpUserReader{user: &service.User{ID: 1, TotpEnabled: false}})
|
|
|
|
require.False(t, ok)
|
|
require.Equal(t, http.StatusForbidden, rec.Code)
|
|
require.Contains(t, rec.Body.String(), "STEP_UP_TOTP_NOT_ENABLED")
|
|
}
|
|
|
|
func TestEnforceStepUpFailsClosedOnGrantError(t *testing.T) {
|
|
c, rec := newStepUpTestContext(t)
|
|
c.Set(string(ContextKeyUser), AuthSubject{UserID: 1})
|
|
|
|
ok := enforceStepUp(c, stubStepUpGrantChecker{err: errors.New("redis down")}, stubStepUpUserReader{user: &service.User{ID: 1, TotpEnabled: true}})
|
|
|
|
require.False(t, ok)
|
|
require.Equal(t, http.StatusServiceUnavailable, rec.Code)
|
|
require.Contains(t, rec.Body.String(), "STEP_UP_UNAVAILABLE")
|
|
}
|
|
|
|
func TestEnforceStepUpRequiresGrant(t *testing.T) {
|
|
c, rec := newStepUpTestContext(t)
|
|
c.Set(string(ContextKeyUser), AuthSubject{UserID: 1})
|
|
|
|
ok := enforceStepUp(c, stubStepUpGrantChecker{granted: false}, stubStepUpUserReader{user: &service.User{ID: 1, TotpEnabled: true}})
|
|
|
|
require.False(t, ok)
|
|
require.Equal(t, http.StatusForbidden, rec.Code)
|
|
require.Contains(t, rec.Body.String(), "STEP_UP_REQUIRED")
|
|
}
|
|
|
|
func TestEnforceStepUpPassesWithGrant(t *testing.T) {
|
|
c, _ := newStepUpTestContext(t)
|
|
c.Set(string(ContextKeyUser), AuthSubject{UserID: 1})
|
|
|
|
ok := enforceStepUp(c, stubStepUpGrantChecker{granted: true}, stubStepUpUserReader{user: &service.User{ID: 1, TotpEnabled: true}})
|
|
|
|
require.True(t, ok)
|
|
require.False(t, c.IsAborted())
|
|
}
|