239 lines
9.7 KiB
Python
239 lines
9.7 KiB
Python
"""P2-4 portal token secret 分离 + P2-5 payment webhook secret fail-closed.
|
|
|
|
验收:
|
|
- Portal token 使用独立 secret 配置,不再复用后台 JWT secret。
|
|
- Payment webhook secret 在生产环境 (env=prod) 缺失/默认值时 fail-closed。
|
|
- 开发/测试场景保持兼容。
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# P2-4: portal token secret 与后台 JWT secret 分离
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def _reload_settings():
|
|
"""重新加载 Settings(确保读取最新环境变量)。"""
|
|
from admin.config import load_settings
|
|
|
|
return load_settings()
|
|
|
|
|
|
def test_settings_exposes_independent_portal_token_secret(monkeypatch):
|
|
"""Settings 应该有独立的 portal_token_secret 字段,默认与 jwt_secret 不同。"""
|
|
monkeypatch.setenv("GAOKAO_ENV", "dev")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "a" * 64)
|
|
monkeypatch.delenv("GAOKAO_PORTAL_TOKEN_SECRET", raising=False)
|
|
settings = _reload_settings()
|
|
assert hasattr(settings, "portal_token_secret")
|
|
# 关键验收:portal token secret 不能等于后台 jwt secret
|
|
assert settings.portal_token_secret != settings.jwt_secret
|
|
|
|
|
|
def test_settings_honors_explicit_portal_token_secret(monkeypatch):
|
|
"""GAOKAO_PORTAL_TOKEN_SECRET 显式设置时,Settings 必须采用。"""
|
|
monkeypatch.setenv("GAOKAO_ENV", "dev")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "a" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "b" * 64)
|
|
settings = _reload_settings()
|
|
assert settings.portal_token_secret == "b" * 64
|
|
|
|
|
|
def test_portal_token_secret_fails_closed_when_missing_in_prod(monkeypatch):
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "P" + "r" * 31 + "!" * 32)
|
|
monkeypatch.delenv("GAOKAO_PORTAL_TOKEN_SECRET", raising=False)
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PORTAL_TOKEN_SECRET"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_portal_token_secret_fails_closed_when_equal_to_jwt_secret_in_prod(monkeypatch):
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "J" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "J" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "P" + "r" * 31 + "!" * 32)
|
|
|
|
with pytest.raises(RuntimeError, match=r"portal token secret"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_portal_token_secret_fails_closed_when_using_dev_default_in_prod(monkeypatch):
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv(
|
|
"GAOKAO_PORTAL_TOKEN_SECRET",
|
|
"dev-only-portal-token-secret-do-not-use-in-prod",
|
|
)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "P" + "r" * 31 + "!" * 32)
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PORTAL_TOKEN_SECRET"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_portal_token_issued_via_issue_endpoint_cannot_be_verified_with_jwt_secret(
|
|
route_client,
|
|
):
|
|
"""下单签发的 portal token 必须不能用后台 jwt_secret 验签通过。
|
|
|
|
这是 P2-4 的核心安全不变量:portal token 与 admin JWT 走不同 secret。
|
|
"""
|
|
from data.customer_portal.token import verify_portal_token, PortalTokenError
|
|
|
|
resp = route_client.post(
|
|
"/api/public/orders",
|
|
json={
|
|
"service_version": "standard",
|
|
"amount_cents": 9900,
|
|
"customer_name": "张家长",
|
|
"customer_phone": "13800138000",
|
|
"customer_email": "parent@example.com",
|
|
"candidate_name": "张三",
|
|
"candidate_province": "湖南",
|
|
},
|
|
)
|
|
assert resp.status_code == 201, resp.text
|
|
token = resp.json()["portal_status_url"].split("/portal/")[1].split("/status")[0]
|
|
settings = route_client.app.state.settings
|
|
|
|
# 关键断言:用 jwt_secret 验签应当失败(因为 secret 已经分离)
|
|
with pytest.raises(PortalTokenError):
|
|
verify_portal_token(token, settings.jwt_secret)
|
|
|
|
# 应当能用独立的 portal_token_secret 验签
|
|
payload = verify_portal_token(token, settings.portal_token_secret)
|
|
assert payload["order_id"].startswith("GKO-")
|
|
|
|
|
|
def test_portal_status_page_uses_independent_secret(route_client):
|
|
"""回归:端到端 portal status 页应当使用独立 secret 并能正常访问。"""
|
|
resp = route_client.post(
|
|
"/api/public/orders",
|
|
json={
|
|
"service_version": "standard",
|
|
"amount_cents": 9900,
|
|
"customer_name": "张家长",
|
|
"customer_phone": "13800138000",
|
|
"candidate_email": "parent@example.com",
|
|
"candidate_name": "张三",
|
|
"candidate_province": "湖南",
|
|
},
|
|
)
|
|
assert resp.status_code == 201, resp.text
|
|
token = resp.json()["portal_status_url"].split("/portal/")[1].split("/status")[0]
|
|
status_resp = route_client.get(f"/portal/{token}/status")
|
|
assert status_resp.status_code == 200, status_resp.text
|
|
assert "订单" in status_resp.text or "支付" in status_resp.text
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# P2-5: payment webhook secret fail-closed in prod
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_payment_webhook_secret_fails_closed_when_missing_in_prod(monkeypatch):
|
|
"""生产环境 GAOKAO_PAYMENT_WEBHOOK_SECRET 缺失/空字符串必须 fail-closed。"""
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64) # 满足 jwt secret prod 校验
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "Z" * 64)
|
|
monkeypatch.delenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", raising=False)
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PAYMENT_WEBHOOK_SECRET"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_payment_webhook_secret_fails_closed_when_using_legacy_default_in_prod(
|
|
monkeypatch,
|
|
):
|
|
"""生产环境若仍使用 dev 默认 secret (dev-mock-payment-secret) 必须 fail-closed。"""
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "Z" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "dev-mock-payment-secret")
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PAYMENT_WEBHOOK_SECRET"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_payment_webhook_secret_fails_closed_when_empty_in_prod(monkeypatch):
|
|
"""生产环境显式空字符串也要 fail-closed。"""
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "Z" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "")
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PAYMENT_WEBHOOK_SECRET"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_payment_webhook_secret_is_weak_rejected_in_prod(monkeypatch):
|
|
"""生产环境 webhook secret 太短 (< 16 字符) 也要 fail-closed。"""
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "Z" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "short")
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PAYMENT_WEBHOOK_SECRET"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_payment_webhook_secret_accepted_in_prod_when_strong(monkeypatch):
|
|
"""生产环境若 secret 强且非默认,允许通过。"""
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "Z" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_PROVIDER", "alipay")
|
|
monkeypatch.setenv(
|
|
"GAOKAO_PAYMENT_WEBHOOK_SECRET", "P" + "r" * 31 + "!" * 32
|
|
) # 64 chars
|
|
settings = _reload_settings()
|
|
assert settings.payment_webhook_secret == "P" + "r" * 31 + "!" * 32
|
|
|
|
|
|
def test_payment_webhook_secret_dev_default_still_works(monkeypatch):
|
|
"""dev 环境保留 dev 默认,测试可继续运行。"""
|
|
monkeypatch.setenv("GAOKAO_ENV", "dev")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.delenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", raising=False)
|
|
settings = _reload_settings()
|
|
# dev 默认 secret 应能加载成功(用于本地开发/测试)
|
|
assert settings.payment_webhook_secret == "dev-mock-payment-secret"
|
|
|
|
|
|
def test_payment_provider_mock_fails_closed_in_prod(monkeypatch):
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "Z" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "P" + "r" * 31 + "!" * 32)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_PROVIDER", "mock")
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PAYMENT_PROVIDER"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_payment_provider_alipay_sim_fails_closed_in_prod(monkeypatch):
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "Z" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "P" + "r" * 31 + "!" * 32)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_PROVIDER", "alipay_sim")
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PAYMENT_PROVIDER"):
|
|
_reload_settings()
|
|
|
|
|
|
def test_payment_provider_unknown_value_fails_closed_in_prod(monkeypatch):
|
|
monkeypatch.setenv("GAOKAO_ENV", "prod")
|
|
monkeypatch.setenv("GAOKAO_JWT_SECRET", "x" * 64)
|
|
monkeypatch.setenv("GAOKAO_PORTAL_TOKEN_SECRET", "Z" * 64)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_WEBHOOK_SECRET", "P" + "r" * 31 + "!" * 32)
|
|
monkeypatch.setenv("GAOKAO_PAYMENT_PROVIDER", "foo")
|
|
|
|
with pytest.raises(RuntimeError, match=r"GAOKAO_PAYMENT_PROVIDER=foo"):
|
|
_reload_settings()
|