WeiCHENandCursor
28faa4932d
封堵鉴权旁路与导出 IDOR，DocGov 改服务端身份；对话层 PendingAction 接真实 docgov/taskrun；修复流式租约假死与会话级任务流；加固配置/doc_id/NULL；补齐 slog 与测试；前端 ErrorBoundary 与受控文档重试。 Co-authored-by: Cursor <cursoragent@cursor.com>
46 lines
1.3 KiB
Go
46 lines
1.3 KiB
Go
package server
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strconv"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
)
|
|
|
|
// loginTestAdmin 使用默认管理员凭证登录，返回 Bearer Token。
|
|
func loginTestAdmin(t *testing.T, srv *Server) string {
|
|
t.Helper()
|
|
body, _ := json.Marshal(map[string]string{
|
|
"username": srv.cfg.AdminUsername,
|
|
"password": srv.cfg.AdminPassword,
|
|
})
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", bytes.NewReader(body))
|
|
w := httptest.NewRecorder()
|
|
srv.Routes().ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("admin login failed: %d %s", w.Code, w.Body.String())
|
|
}
|
|
var session auth.SessionInfo
|
|
if err := json.NewDecoder(w.Body).Decode(&session); err != nil {
|
|
t.Fatalf("decode login session: %v", err)
|
|
}
|
|
if session.Token == "" {
|
|
t.Fatal("expected non-empty session token")
|
|
}
|
|
return session.Token
|
|
}
|
|
|
|
// withBearerAuth 为请求附加 Authorization Bearer Token。
|
|
func withBearerAuth(req *http.Request, token string) {
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
}
|
|
|
|
// withUserIDAuth 为请求附加 X-User-ID（用户必须已存在于 auth store）。
|
|
func withUserIDAuth(req *http.Request, userID int64) {
|
|
req.Header.Set("X-User-ID", strconv.FormatInt(userID, 10))
|
|
}
|