niuniu/lijiaoqiao
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: close p0 auth and release gate gaps

Browse Source
This commit is contained in:
Your Name
2026-04-11 09:25:31 +08:00
parent b7b46dc827
commit 4adeee2e06
28 changed files with 3791 additions and 276 deletions
Download Patch File Download Diff File Expand all files Collapse all files

469
supply-api/e2e/e2e_test.go
View File

@@ -4,133 +4,418 @@
package e2e
import (
"os"
"context"
"encoding/json"
"net/http"
"net/http/httptest"
"strings"
"testing"
"time"
"github.com/golang-jwt/jwt/v5"
"lijiaoqiao/supply-api/internal/adapter"
"lijiaoqiao/supply-api/internal/audit"
"lijiaoqiao/supply-api/internal/domain"
"lijiaoqiao/supply-api/internal/httpapi"
"lijiaoqiao/supply-api/internal/middleware"
"lijiaoqiao/supply-api/internal/pkg/logging"
)
// E2E 测试配置
type E2EConfig struct {
BaseURL string
APIKey string
SupplierID int64
Timeout time.Duration
RetryAttempts int
type e2eOptions struct {
withdrawEnabled bool
}
// getE2EConfig 从环境变量获取 E2E 测试配置
func getE2EConfig() *E2EConfig {
return &E2EConfig{
BaseURL: getEnv("E2E_BASE_URL", "http://localhost:8080"),
APIKey: getEnv("E2E_API_KEY", "test-api-key"),
SupplierID: 1001,
Timeout: 30 * time.Second,
RetryAttempts: 3,
type e2eSystem struct {
handler http.Handler
accountSvc *e2eAccountService
auditStore *audit.MemoryAuditStore
secretKey string
tokenIssuer string
}
type e2eAccountService struct {
verifyResult *domain.VerifyResult
lastVerifySupplierID int64
}
func (s *e2eAccountService) Verify(ctx context.Context, supplierID int64, provider domain.Provider, accountType domain.AccountType, credential string) (*domain.VerifyResult, error) {
s.lastVerifySupplierID = supplierID
return s.verifyResult, nil
}
func (s *e2eAccountService) Create(ctx context.Context, req *domain.CreateAccountRequest) (*domain.Account, error) {
return &domain.Account{ID: 1, SupplierID: req.SupplierID, Provider: req.Provider, AccountType: req.AccountType, Status: domain.AccountStatusActive}, nil
}
func (s *e2eAccountService) Activate(ctx context.Context, supplierID, accountID int64) (*domain.Account, error) {
return &domain.Account{ID: accountID, SupplierID: supplierID, Status: domain.AccountStatusActive}, nil
}
func (s *e2eAccountService) Suspend(ctx context.Context, supplierID, accountID int64) (*domain.Account, error) {
return &domain.Account{ID: accountID, SupplierID: supplierID, Status: domain.AccountStatusSuspended}, nil
}
func (s *e2eAccountService) Delete(ctx context.Context, supplierID, accountID int64) error {
return nil
}
func (s *e2eAccountService) GetByID(ctx context.Context, supplierID, accountID int64) (*domain.Account, error) {
return &domain.Account{ID: accountID, SupplierID: supplierID, Status: domain.AccountStatusActive}, nil
}
type e2ePackageService struct{}
func (s *e2ePackageService) CreateDraft(ctx context.Context, supplierID int64, req *domain.CreatePackageDraftRequest) (*domain.Package, error) {
return &domain.Package{ID: 1, SupplierID: supplierID, Model: req.Model, Status: domain.PackageStatusDraft}, nil
}
func (s *e2ePackageService) Publish(ctx context.Context, supplierID, packageID int64) (*domain.Package, error) {
return &domain.Package{ID: packageID, SupplierID: supplierID, Status: domain.PackageStatusActive}, nil
}
func (s *e2ePackageService) Pause(ctx context.Context, supplierID, packageID int64) (*domain.Package, error) {
return &domain.Package{ID: packageID, SupplierID: supplierID, Status: domain.PackageStatusPaused}, nil
}
func (s *e2ePackageService) Unlist(ctx context.Context, supplierID, packageID int64) (*domain.Package, error) {
return &domain.Package{ID: packageID, SupplierID: supplierID, Status: domain.PackageStatusExpired}, nil
}
func (s *e2ePackageService) Clone(ctx context.Context, supplierID, packageID int64) (*domain.Package, error) {
return &domain.Package{ID: packageID + 1, SupplierID: supplierID, Status: domain.PackageStatusDraft}, nil
}
func (s *e2ePackageService) BatchUpdatePrice(ctx context.Context, supplierID int64, req *domain.BatchUpdatePriceRequest) (*domain.BatchUpdatePriceResponse, error) {
return &domain.BatchUpdatePriceResponse{Total: len(req.Items), SuccessCount: len(req.Items)}, nil
}
func (s *e2ePackageService) GetByID(ctx context.Context, supplierID, packageID int64) (*domain.Package, error) {
return &domain.Package{ID: packageID, SupplierID: supplierID, Status: domain.PackageStatusActive}, nil
}
type e2eSettlementService struct{}
func (s *e2eSettlementService) Withdraw(ctx context.Context, supplierID int64, req *domain.WithdrawRequest) (*domain.Settlement, error) {
now := time.Now().UTC()
return &domain.Settlement{
ID: 1,
SupplierID: supplierID,
SettlementNo: "SET-001",
Status: domain.SettlementStatusPending,
TotalAmount: req.Amount,
NetAmount: req.Amount,
CreatedAt: now,
UpdatedAt: now,
}, nil
}
func (s *e2eSettlementService) Cancel(ctx context.Context, supplierID, settlementID int64) (*domain.Settlement, error) {
now := time.Now().UTC()
return &domain.Settlement{ID: settlementID, SupplierID: supplierID, Status: domain.SettlementStatusFailed, CreatedAt: now, UpdatedAt: now}, nil
}
func (s *e2eSettlementService) GetByID(ctx context.Context, supplierID, settlementID int64) (*domain.Settlement, error) {
now := time.Now().UTC()
return &domain.Settlement{ID: settlementID, SupplierID: supplierID, Status: domain.SettlementStatusPending, CreatedAt: now, UpdatedAt: now}, nil
}
func (s *e2eSettlementService) List(ctx context.Context, supplierID int64) ([]*domain.Settlement, error) {
now := time.Now().UTC()
return []*domain.Settlement{{ID: 1, SupplierID: supplierID, Status: domain.SettlementStatusPending, CreatedAt: now, UpdatedAt: now}}, nil
}
type e2eEarningService struct{}
func (s *e2eEarningService) ListRecords(ctx context.Context, supplierID int64, startDate, endDate string, page, pageSize int) ([]*domain.EarningRecord, int, error) {
return []*domain.EarningRecord{
{ID: 1, SupplierID: supplierID, EarningsType: "usage", Amount: 100, Status: "available", EarnedAt: time.Now().UTC()},
}, 1, nil
}
func (s *e2eEarningService) GetBillingSummary(ctx context.Context, supplierID int64, startDate, endDate string) (*domain.BillingSummary, error) {
return &domain.BillingSummary{
Period: domain.BillingPeriod{Start: startDate, End: endDate},
Summary: domain.BillingTotal{TotalRevenue: 100, TotalOrders: 1, TotalUsage: 1000, TotalRequests: 10, AvgSuccessRate: 1, NetEarnings: 95},
}, nil
}
type staticTokenBackend struct {
statusByTokenID map[string]string
}
func (b *staticTokenBackend) CheckTokenStatus(ctx context.Context, tokenID string) (string, error) {
if status, ok := b.statusByTokenID[tokenID]; ok {
return status, nil
}
return "active", nil
}
func newE2ESystem(t *testing.T, opts e2eOptions) *e2eSystem {
t.Helper()
accountSvc := &e2eAccountService{
verifyResult: &domain.VerifyResult{
VerifyStatus: "pass",
AvailableQuota: 2048,
RiskScore: 0,
CheckItems: []domain.CheckItem{
{Item: "credential_format", Result: "pass", Message: "ok"},
},
},
}
auditStore := audit.NewMemoryAuditStore()
api := httpapi.NewSupplyAPI(
accountSvc,
&e2ePackageService{},
&e2eSettlementService{},
&e2eEarningService{},
nil,
auditStore,
nil,
0,
"https://statements.example.com",
func() time.Time { return time.Unix(1712800000, 0).UTC() },
)
api.SetWithdrawEnabled(opts.withdrawEnabled)
mux := http.NewServeMux()
healthHandler := httpapi.NewHealthHandlerWithDefaults(nil, nil)
mux.HandleFunc("/actuator/health", healthHandler.ServeHealth)
mux.HandleFunc("/actuator/health/live", healthHandler.ServeLiveness)
mux.HandleFunc("/actuator/health/ready", healthHandler.ServeReadiness)
api.Register(mux)
authMiddleware := middleware.NewAuthMiddleware(
middleware.AuthConfig{
SecretKey: "e2e-secret-key-should-be-long",
Algorithm: "HS256",
Issuer: "supply-api-e2e",
Enabled: true,
},
middleware.NewTokenCache(),
&staticTokenBackend{statusByTokenID: map[string]string{}},
adapter.NewAuditEmitterAdapter(auditStore),
)
logger := logging.NewLogger("supply-api-e2e", logging.LogLevelError)
var handler http.Handler = mux
handler = middleware.RequestID(handler)
handler = middleware.Recovery(handler)
handler = middleware.Logging(handler, logger)
handler = middleware.TracingMiddleware(handler)
handler = authMiddleware.TokenVerifyMiddleware(handler)
handler = authMiddleware.BearerExtractMiddleware(handler)
handler = authMiddleware.QueryKeyRejectMiddleware(handler)
return &e2eSystem{
handler: handler,
accountSvc: accountSvc,
auditStore: auditStore,
secretKey: "e2e-secret-key-should-be-long",
tokenIssuer: "supply-api-e2e",
}
}
func getEnv(key, defaultValue string) string {
if value := os.Getenv(key); value != "" {
return value
}
return defaultValue
}
func (s *e2eSystem) tokenForTenant(t *testing.T, tokenID string, tenantID int64) string {
t.Helper()
// TestE2E_HealthCheck E2E 测试：健康检查
func TestE2E_HealthCheck(t *testing.T) {
if testing.Short() {
t.Skip("Skipping E2E test in short mode")
claims := &middleware.TokenClaims{
RegisteredClaims: jwt.RegisteredClaims{
ID: tokenID,
Issuer: s.tokenIssuer,
Subject: "subject-42",
ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
IssuedAt: jwt.NewNumericDate(time.Now()),
},
SubjectID: "42",
Role: "org_admin",
Scope: []string{"supply:write", "supply:read"},
TenantID: tenantID,
}
cfg := getE2EConfig()
_, _ = cfg.Timeout, cfg.RetryAttempts // 使用配置参数
// 验证服务健康状态
// 在真实的 E2E 测试中，这里会使用 HTTP 客户端调用真实服务
t.Logf("E2E_BASE_URL: %s", cfg.BaseURL)
t.Skip("需要完整环境运行 E2E 测试")
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
tokenString, err := token.SignedString([]byte(s.secretKey))
if err != nil {
t.Fatalf("failed to sign token: %v", err)
}
return tokenString
}
// TestE2E_AccountLifecycle E2E 测试：账号完整生命周期
func TestE2E_AccountLifecycle(t *testing.T) {
if testing.Short() {
t.Skip("Skipping E2E test in short mode")
func decodeJSONBody(t *testing.T, recorder *httptest.ResponseRecorder) map[string]any {
t.Helper()
var payload map[string]any
if err := json.Unmarshal(recorder.Body.Bytes(), &payload); err != nil {
t.Fatalf("failed to decode response: %v, body=%s", err, recorder.Body.String())
}
return payload
}
func TestE2E_HealthProbe_IsPublicAndHealthy(t *testing.T) {
system := newE2ESystem(t, e2eOptions{withdrawEnabled: false})
req := httptest.NewRequest(http.MethodGet, "/actuator/health", nil)
req.Header.Set("X-Request-Id", "health-req-001")
recorder := httptest.NewRecorder()
system.handler.ServeHTTP(recorder, req)
if recorder.Code != http.StatusOK {
t.Fatalf("expected status 200, got %d, body=%s", recorder.Code, recorder.Body.String())
}
if recorder.Header().Get("X-Request-Id") != "health-req-001" {
t.Fatalf("expected X-Request-Id response header to round-trip")
}
cfg := getE2EConfig()
_, _ = cfg.Timeout, cfg.RetryAttempts // 使用配置参数
t.Log("E2E 测试：账号完整生命周期")
t.Log("步骤：创建 -> 验证 -> 暂停 -> 恢复 -> 禁用")
t.Skip("需要完整环境运行 E2E 测试")
payload := decodeJSONBody(t, recorder)
if payload["status"] != "healthy" {
t.Fatalf("expected healthy status, got %v", payload["status"])
}
}
// TestE2E_PackageLifecycle E2E 测试：套餐完整生命周期
func TestE2E_PackageLifecycle(t *testing.T) {
if testing.Short() {
t.Skip("Skipping E2E test in short mode")
func TestE2E_ProtectedRoute_RejectsMissingBearer(t *testing.T) {
system := newE2ESystem(t, e2eOptions{withdrawEnabled: false})
req := httptest.NewRequest(http.MethodGet, "/api/v1/supply/billing?start_date=2026-04-01&end_date=2026-04-11", nil)
recorder := httptest.NewRecorder()
system.handler.ServeHTTP(recorder, req)
if recorder.Code != http.StatusUnauthorized {
t.Fatalf("expected status 401, got %d, body=%s", recorder.Code, recorder.Body.String())
}
cfg := getE2EConfig()
_, _ = cfg.Timeout, cfg.RetryAttempts // 使用配置参数
t.Log("E2E 测试：套餐完整生命周期")
t.Log("步骤：创建草稿 -> 发布 -> 暂停 -> 售罄 -> 过期")
t.Skip("需要完整环境运行 E2E 测试")
payload := decodeJSONBody(t, recorder)
errBody, ok := payload["error"].(map[string]any)
if !ok {
t.Fatalf("expected error body, got %v", payload["error"])
}
if errBody["code"] != "AUTH_MISSING_BEARER" {
t.Fatalf("expected AUTH_MISSING_BEARER, got %v", errBody["code"])
}
}
// TestE2E_SettlementWorkflow E2E 测试：结算完整流程
func TestE2E_SettlementWorkflow(t *testing.T) {
if testing.Short() {
t.Skip("Skipping E2E test in short mode")
func TestE2E_ProtectedRoute_RejectsQueryCredentialLeak(t *testing.T) {
system := newE2ESystem(t, e2eOptions{withdrawEnabled: false})
req := httptest.NewRequest(http.MethodGet, "/api/v1/supply/billing?api_key=abcdefghijklmnopqrstuvwxyz123456", nil)
recorder := httptest.NewRecorder()
system.handler.ServeHTTP(recorder, req)
if recorder.Code != http.StatusUnauthorized {
t.Fatalf("expected status 401, got %d, body=%s", recorder.Code, recorder.Body.String())
}
cfg := getE2EConfig()
_, _ = cfg.Timeout, cfg.RetryAttempts // 使用配置参数
t.Log("E2E 测试：结算完整流程")
t.Log("步骤：创建结算单 -> 处理中 -> 完成/失败 -> 提现")
t.Skip("需要完整环境运行 E2E 测试")
payload := decodeJSONBody(t, recorder)
errBody, ok := payload["error"].(map[string]any)
if !ok {
t.Fatalf("expected error body, got %v", payload["error"])
}
if errBody["code"] != "QUERY_KEY_NOT_ALLOWED" {
t.Fatalf("expected QUERY_KEY_NOT_ALLOWED, got %v", errBody["code"])
}
}
// TestE2E_WithdrawFlow E2E 测试：提现流程
func TestE2E_WithdrawFlow(t *testing.T) {
if testing.Short() {
t.Skip("Skipping E2E test in short mode")
func TestE2E_VerifyAccount_UsesTenantIDFromVerifiedToken(t *testing.T) {
system := newE2ESystem(t, e2eOptions{withdrawEnabled: false})
token := system.tokenForTenant(t, "tok-e2e-verify", 2001)
body := `{"provider":"openai","account_type":"resource","credential_input":"sk-test"}`
req := httptest.NewRequest(http.MethodPost, "/api/v1/supply/accounts/verify", strings.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-Request-Id", "verify-req-001")
recorder := httptest.NewRecorder()
system.handler.ServeHTTP(recorder, req)
if recorder.Code != http.StatusOK {
t.Fatalf("expected status 200, got %d, body=%s", recorder.Code, recorder.Body.String())
}
if system.accountSvc.lastVerifySupplierID != 2001 {
t.Fatalf("expected supplierID 2001 from token tenant, got %d", system.accountSvc.lastVerifySupplierID)
}
cfg := getE2EConfig()
_, _ = cfg.Timeout, cfg.RetryAttempts // 使用配置参数
t.Log("E2E 测试：提现流程")
t.Log("步骤：验证余额 -> 发起提现 -> 短信验证 -> 确认 -> 到账")
t.Skip("需要完整环境运行 E2E 测试")
payload := decodeJSONBody(t, recorder)
if payload["request_id"] != "verify-req-001" {
t.Fatalf("expected request_id verify-req-001, got %v", payload["request_id"])
}
}
// TestE2E_AuditLogTrace E2E 测试：审计日志追踪
func TestE2E_AuditLogTrace(t *testing.T) {
if testing.Short() {
t.Skip("Skipping E2E test in short mode")
func TestE2E_Withdraw_DisabledBeforeSMSIntegration(t *testing.T) {
system := newE2ESystem(t, e2eOptions{withdrawEnabled: false})
token := system.tokenForTenant(t, "tok-e2e-withdraw", 2002)
body := `{"withdraw_amount":100,"payment_method":"bank","payment_account":"13800000000","sms_code":"123456"}`
req := httptest.NewRequest(http.MethodPost, "/api/v1/supply/settlements/withdraw", strings.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
recorder := httptest.NewRecorder()
system.handler.ServeHTTP(recorder, req)
if recorder.Code != http.StatusServiceUnavailable {
t.Fatalf("expected status 503, got %d, body=%s", recorder.Code, recorder.Body.String())
}
cfg := getE2EConfig()
_, _ = cfg.Timeout, cfg.RetryAttempts // 使用配置参数
t.Log("E2E 测试：审计日志追踪")
t.Log("验证操作被正确记录到审计日志")
t.Skip("需要完整环境运行 E2E 测试")
payload := decodeJSONBody(t, recorder)
errBody, ok := payload["error"].(map[string]any)
if !ok {
t.Fatalf("expected error body, got %v", payload["error"])
}
if errBody["code"] != "FEATURE_DISABLED" {
t.Fatalf("expected FEATURE_DISABLED, got %v", errBody["code"])
}
}
// TestE2E_ConcurrentWithdraw E2E 测试：并发提现
func TestE2E_ConcurrentWithdraw(t *testing.T) {
if testing.Short() {
t.Skip("Skipping E2E test in short mode")
func TestE2E_AuditEvent_CanBeReadBackThroughAPI(t *testing.T) {
system := newE2ESystem(t, e2eOptions{withdrawEnabled: false})
token := system.tokenForTenant(t, "tok-e2e-audit", 3001)
if err := system.auditStore.Emit(context.Background(), audit.Event{
TenantID: 3001,
ObjectType: "supply_account",
ObjectID: 77,
Action: "verify",
RequestID: "audit-req-001",
ResultCode: "OK",
SourceIP: "127.0.0.1",
}); err != nil {
t.Fatalf("failed to seed audit event: %v", err)
}
cfg := getE2EConfig()
_, _ = cfg.Timeout, cfg.RetryAttempts // 使用配置参数
events, err := system.auditStore.Query(context.Background(), audit.EventFilter{TenantID: 3001, Limit: 1})
if err != nil {
t.Fatalf("failed to query seeded audit event: %v", err)
}
if len(events) != 1 {
t.Fatalf("expected 1 audit event, got %d", len(events))
}
t.Log("E2E 测试：并发提现")
t.Log("验证乐观锁正确处理并发请求")
t.Skip("需要完整环境运行 E2E 测试")
req := httptest.NewRequest(http.MethodGet, "/api/v1/audit/events/"+events[0].EventID, nil)
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("X-Request-Id", "audit-read-001")
recorder := httptest.NewRecorder()
system.handler.ServeHTTP(recorder, req)
if recorder.Code != http.StatusOK {
t.Fatalf("expected status 200, got %d, body=%s", recorder.Code, recorder.Body.String())
}
payload := decodeJSONBody(t, recorder)
data, ok := payload["data"].(map[string]any)
if !ok {
t.Fatalf("expected data object, got %v", payload["data"])
}
if data["event_id"] != events[0].EventID {
t.Fatalf("expected event_id %s, got %v", events[0].EventID, data["event_id"])
}
if data["request_id"] != "audit-req-001" {
t.Fatalf("expected seeded request_id audit-req-001, got %v", data["request_id"])
}
}