658 lines
27 KiB
Go
658 lines
27 KiB
Go
package main
|
|
|
|
import (
|
|
"bufio"
|
|
"bytes"
|
|
"context"
|
|
"database/sql"
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"syscall"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.ipao.vip/rogee/creator-hub/internal/hub"
|
|
"git.ipao.vip/rogee/creator-hub/internal/phasea"
|
|
"git.ipao.vip/rogee/creator-hub/internal/taskstate"
|
|
"github.com/gofiber/fiber/v3"
|
|
"github.com/sirupsen/logrus"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
func TestExecuteContextStopsOnSIGTERM(t *testing.T) {
|
|
if os.Getenv("CREATORHUB_SIGTERM_HELPER") == "1" {
|
|
command := &cobra.Command{Use: "shutdown-test", RunE: func(command *cobra.Command, _ []string) error {
|
|
_, _ = os.Stdout.WriteString("ready\n")
|
|
<-command.Context().Done()
|
|
_, _ = os.Stdout.WriteString("stopped\n")
|
|
return nil
|
|
}}
|
|
if err := execute(command); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return
|
|
}
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
|
|
defer cancel()
|
|
process := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestExecuteContextStopsOnSIGTERM$")
|
|
process.Env = append(os.Environ(), "CREATORHUB_SIGTERM_HELPER=1")
|
|
stdout, err := process.StdoutPipe()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := process.Start(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
scanner := bufio.NewScanner(stdout)
|
|
if !scanner.Scan() || scanner.Text() != "ready" {
|
|
t.Fatalf("helper did not become ready: %q err=%v", scanner.Text(), scanner.Err())
|
|
}
|
|
if err := process.Process.Signal(syscall.SIGTERM); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !scanner.Scan() || scanner.Text() != "stopped" {
|
|
t.Fatalf("helper did not finish cleanup: %q err=%v", scanner.Text(), scanner.Err())
|
|
}
|
|
if err := process.Wait(); err != nil || ctx.Err() != nil {
|
|
t.Fatalf("process did not exit gracefully after SIGTERM: wait=%v context=%v", err, ctx.Err())
|
|
}
|
|
}
|
|
|
|
func TestLoadConfigRejectsInvalidDatabase(t *testing.T) {
|
|
t.Setenv("CONTROL_PLANE_USERNAME", "operator")
|
|
t.Setenv("CONTROL_PLANE_PASSWORD", "unit-test-password")
|
|
t.Setenv("DATABASE_URL", "file:///tmp/creatorhub.db")
|
|
if _, err := loadConfig(); err == nil {
|
|
t.Fatal("expected non-Postgres database URL to be rejected")
|
|
}
|
|
}
|
|
|
|
func TestLoadConfigRequiresControlPlaneCredentials(t *testing.T) {
|
|
t.Setenv("CONTROL_PLANE_USERNAME", "")
|
|
t.Setenv("CONTROL_PLANE_PASSWORD", "")
|
|
if _, err := loadConfig(); err == nil {
|
|
t.Fatal("expected missing control-plane credentials to be rejected")
|
|
}
|
|
}
|
|
|
|
func TestLoadConfigPasswordLength(t *testing.T) {
|
|
t.Setenv("CONTROL_PLANE_USERNAME", "operator")
|
|
t.Setenv("CREATORHUB_CREDENTIAL_MASTER_KEY", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
|
|
for _, test := range []struct {
|
|
password string
|
|
wantErr bool
|
|
}{
|
|
{"12345", true},
|
|
{"123456", false},
|
|
} {
|
|
t.Run(test.password, func(t *testing.T) {
|
|
t.Setenv("CONTROL_PLANE_PASSWORD", test.password)
|
|
_, err := loadConfig()
|
|
if (err != nil) != test.wantErr {
|
|
t.Fatalf("loadConfig() error = %v, wantErr %v", err, test.wantErr)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestLoadConfigRequiresCredentialMasterKey(t *testing.T) {
|
|
t.Setenv("CONTROL_PLANE_USERNAME", "operator")
|
|
t.Setenv("CONTROL_PLANE_PASSWORD", "unit-test-password")
|
|
for _, key := range []string{"", "not-base64", "c2hvcnQ="} {
|
|
t.Setenv("CREATORHUB_CREDENTIAL_MASTER_KEY", key)
|
|
if _, err := loadConfig(); err == nil {
|
|
t.Fatalf("accepted invalid credential master key %q", key)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestControlPlaneAuthentication(t *testing.T) {
|
|
logger := logrus.StandardLogger()
|
|
previousOutput := logger.Out
|
|
var logs bytes.Buffer
|
|
logrus.SetOutput(&logs)
|
|
t.Cleanup(func() { logrus.SetOutput(previousOutput) })
|
|
|
|
directory := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(directory, "index.html"), []byte("index"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
app := newHandler(directory, "operator", "unit-test-password")
|
|
|
|
health, err := app.Test(httptest.NewRequest(http.MethodGet, "/healthz", nil))
|
|
if err != nil || health.StatusCode != http.StatusNoContent {
|
|
t.Fatalf("health check must remain public: status=%d err=%v", health.StatusCode, err)
|
|
}
|
|
health.Body.Close()
|
|
|
|
for _, path := range []string{
|
|
"/", "/api/phase-a/accounts", "/api/browsers", "/api/network-exits", "/api/phase-a/tasks", "/api/phase-a/audit",
|
|
} {
|
|
request := httptest.NewRequest(http.MethodGet, path, nil)
|
|
response, err := app.Test(request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
response.Body.Close()
|
|
if response.StatusCode != http.StatusUnauthorized || response.Header.Get("WWW-Authenticate") == "" {
|
|
t.Fatalf("GET %s was not protected: status=%d", path, response.StatusCode)
|
|
}
|
|
}
|
|
|
|
for name, test := range map[string]struct {
|
|
user, password string
|
|
want int
|
|
}{
|
|
"valid": {"operator", "unit-test-password", http.StatusOK},
|
|
"wrong user": {"other", "unit-test-password", http.StatusUnauthorized},
|
|
"wrong password": {"operator", "credential-must-not-be-logged", http.StatusUnauthorized},
|
|
} {
|
|
t.Run(name, func(t *testing.T) {
|
|
request := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
request.SetBasicAuth(test.user, test.password)
|
|
response, err := app.Test(request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
response.Body.Close()
|
|
if response.StatusCode != test.want {
|
|
t.Fatalf("status=%d want=%d", response.StatusCode, test.want)
|
|
}
|
|
})
|
|
}
|
|
if strings.Contains(logs.String(), "credential-must-not-be-logged") {
|
|
t.Fatalf("authentication credential reached logs: %s", logs.String())
|
|
}
|
|
}
|
|
|
|
type controlPlaneRouteCase struct {
|
|
method, pattern, path, body string
|
|
wantAuthenticatedStatus int
|
|
}
|
|
|
|
type testCredentialBridge struct {
|
|
values map[string]string
|
|
}
|
|
|
|
func (bridge *testCredentialBridge) Store(ctx context.Context, _ phasea.CredentialReference, key, value string) error {
|
|
if err := ctx.Err(); err != nil {
|
|
return err
|
|
}
|
|
bridge.values[key] = value
|
|
return nil
|
|
}
|
|
|
|
func (bridge *testCredentialBridge) Delete(ctx context.Context, _ phasea.CredentialReference, key string) error {
|
|
if err := ctx.Err(); err != nil {
|
|
return err
|
|
}
|
|
delete(bridge.values, key)
|
|
return nil
|
|
}
|
|
|
|
func TestControlPlaneRouteRegistrationMatrix(t *testing.T) {
|
|
app := fiber.New()
|
|
app.Use(authenticate("operator", "unit-test-password"))
|
|
registerHubWithNetwork(app, nil, nil, nil)
|
|
registerPhaseA(app, nil, nil, nil)
|
|
routes := controlPlaneRouteMatrix()
|
|
assertControlPlaneRouteMatrix(t, app, routes)
|
|
|
|
for _, route := range routes {
|
|
if response := do(app, route.method, route.path, route.body); response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("registered route %s %s returned %d without credentials, want %d", route.method, route.path,
|
|
response.Code, http.StatusUnauthorized)
|
|
}
|
|
}
|
|
if response := do(app, http.MethodPost, "/api/not-registered", ""); response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("unregistered route returned %d without credentials, want %d", response.Code, http.StatusUnauthorized)
|
|
}
|
|
}
|
|
|
|
func TestControlPlaneRegisteredRouteMatrix(t *testing.T) {
|
|
databaseURL := os.Getenv("CREATORHUB_POSTGRES_TEST_URL")
|
|
if databaseURL == "" {
|
|
t.Skip("set CREATORHUB_POSTGRES_TEST_URL to run control-plane route coverage")
|
|
}
|
|
databaseURL = isolatedControlPlaneDatabaseURL(t, databaseURL)
|
|
ctx := context.Background()
|
|
phaseAStore, err := phasea.Open(ctx, databaseURL)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = phaseAStore.Close() })
|
|
hubStore, err := hub.Open(ctx, databaseURL)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = hubStore.Close() })
|
|
|
|
webDirectory := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(webDirectory, "index.html"), []byte("index"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
app := newHandlerWithStores(webDirectory, "operator", "unit-test-password", phaseAStore, hubStore)
|
|
routes := controlPlaneRouteMatrix()
|
|
assertControlPlaneRouteMatrix(t, app, routes)
|
|
|
|
for _, route := range routes {
|
|
route := route
|
|
t.Run(route.method+" "+route.pattern, func(t *testing.T) {
|
|
if response := do(app, route.method, route.path, route.body); response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("unauthenticated %s %s returned %d, want %d", route.method, route.path, response.Code, http.StatusUnauthorized)
|
|
}
|
|
response := do(app, route.method, route.path, route.body, "operator", "unit-test-password")
|
|
if response.Code != route.wantAuthenticatedStatus {
|
|
t.Fatalf("authenticated %s %s returned %d, want %d: %s", route.method, route.path, response.Code,
|
|
route.wantAuthenticatedStatus, response.Body.String())
|
|
}
|
|
})
|
|
}
|
|
|
|
for _, route := range []struct {
|
|
method, path string
|
|
want int
|
|
}{
|
|
{http.MethodPost, "/api/not-registered", http.StatusMethodNotAllowed},
|
|
{http.MethodDelete, "/api/not-registered", http.StatusMethodNotAllowed},
|
|
} {
|
|
t.Run("unregistered "+route.method, func(t *testing.T) {
|
|
if response := do(app, route.method, route.path, ""); response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("unauthenticated unregistered %s %s returned %d, want %d", route.method, route.path, response.Code, http.StatusUnauthorized)
|
|
}
|
|
if response := do(app, route.method, route.path, "", "operator", "unit-test-password"); response.Code != route.want {
|
|
t.Fatalf("authenticated unregistered %s %s returned %d, want %d", route.method, route.path, response.Code, route.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func assertControlPlaneRouteMatrix(t *testing.T, app *fiber.App, routes []controlPlaneRouteCase) {
|
|
t.Helper()
|
|
expected := make(map[string]struct{}, len(routes))
|
|
for _, route := range routes {
|
|
key := controlPlaneRouteKey(route.method, route.pattern)
|
|
if _, exists := expected[key]; exists {
|
|
t.Fatalf("duplicate route matrix entry: %s", key)
|
|
}
|
|
expected[key] = struct{}{}
|
|
}
|
|
actual := registeredControlPlaneRoutes(app)
|
|
for key := range expected {
|
|
if _, exists := actual[key]; !exists {
|
|
t.Errorf("route matrix is missing registered route: %s", key)
|
|
}
|
|
}
|
|
for key := range actual {
|
|
if _, exists := expected[key]; !exists {
|
|
t.Errorf("registered API route is missing from route matrix: %s", key)
|
|
}
|
|
}
|
|
}
|
|
|
|
func controlPlaneRouteKey(method, path string) string { return method + " " + path }
|
|
|
|
func registeredControlPlaneRoutes(app *fiber.App) map[string]struct{} {
|
|
routes := map[string]struct{}{}
|
|
for _, methodRoutes := range app.Stack() {
|
|
for _, route := range methodRoutes {
|
|
if !strings.HasPrefix(route.Path, "/api/") {
|
|
continue
|
|
}
|
|
switch route.Method {
|
|
case http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete:
|
|
routes[controlPlaneRouteKey(route.Method, route.Path)] = struct{}{}
|
|
}
|
|
}
|
|
}
|
|
return routes
|
|
}
|
|
|
|
func controlPlaneRouteMatrix() []controlPlaneRouteCase {
|
|
return []controlPlaneRouteCase{
|
|
{http.MethodGet, "/api/browsers", "/api/browsers", "", http.StatusOK},
|
|
{http.MethodGet, "/api/browsers/:alias", "/api/browsers/missing", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/browsers", "/api/browsers", "", http.StatusBadRequest},
|
|
{http.MethodPost, "/api/browsers/:alias/:action", "/api/browsers/missing/start", "", http.StatusNotFound},
|
|
{http.MethodDelete, "/api/browsers/:alias", "/api/browsers/missing", "", http.StatusNotFound},
|
|
|
|
{http.MethodGet, "/api/network-exits", "/api/network-exits", "", http.StatusOK},
|
|
{http.MethodGet, "/api/network-exits/:id", "/api/network-exits/missing", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/network-exits", "/api/network-exits", "", http.StatusBadRequest},
|
|
{http.MethodPost, "/api/network-exits/:id/check", "/api/network-exits/missing/check", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/network-exits/:id/disable", "/api/network-exits/missing/disable", "", http.StatusNotFound},
|
|
|
|
{http.MethodGet, "/api/browser-images", "/api/browser-images", "", http.StatusOK},
|
|
{http.MethodPost, "/api/browser-images", "/api/browser-images", "", http.StatusBadRequest},
|
|
{http.MethodPut, "/api/browser-images/:version", "/api/browser-images/999.0.0", `{"image_ref":"registry.example/browser:missing"}`, http.StatusNotFound},
|
|
{http.MethodDelete, "/api/browser-images/:version", "/api/browser-images/999.0.0", "", http.StatusNotFound},
|
|
|
|
{http.MethodGet, "/api/gateways", "/api/gateways", "", http.StatusOK},
|
|
{http.MethodPost, "/api/gateways", "/api/gateways", "", http.StatusBadRequest},
|
|
{http.MethodDelete, "/api/gateways/:name", "/api/gateways/missing", "", http.StatusNotFound},
|
|
|
|
{http.MethodPost, "/api/phase-a/accounts", "/api/phase-a/accounts", "", http.StatusBadRequest},
|
|
{http.MethodGet, "/api/phase-a/accounts", "/api/phase-a/accounts", "", http.StatusOK},
|
|
{http.MethodGet, "/api/phase-a/accounts/:id", "/api/phase-a/accounts/missing", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/phase-a/accounts/:id/pause", "/api/phase-a/accounts/missing/pause", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/phase-a/accounts/:id/resume", "/api/phase-a/accounts/missing/resume", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/phase-a/accounts/:id/revoke", "/api/phase-a/accounts/missing/revoke", "", http.StatusNotFound},
|
|
|
|
{http.MethodPost, "/api/phase-a/drafts", "/api/phase-a/drafts", "", http.StatusBadRequest},
|
|
{http.MethodGet, "/api/phase-a/drafts", "/api/phase-a/drafts", "", http.StatusOK},
|
|
{http.MethodGet, "/api/phase-a/drafts/:id", "/api/phase-a/drafts/missing", "", http.StatusNotFound},
|
|
|
|
{http.MethodPost, "/api/phase-a/confirmations", "/api/phase-a/confirmations", "", http.StatusBadRequest},
|
|
{http.MethodGet, "/api/phase-a/confirmations", "/api/phase-a/confirmations", "", http.StatusOK},
|
|
{http.MethodGet, "/api/phase-a/confirmations/:id", "/api/phase-a/confirmations/missing", "", http.StatusNotFound},
|
|
|
|
{http.MethodPost, "/api/phase-a/tasks", "/api/phase-a/tasks", "", http.StatusBadRequest},
|
|
{http.MethodGet, "/api/phase-a/tasks", "/api/phase-a/tasks", "", http.StatusOK},
|
|
{http.MethodGet, "/api/phase-a/tasks/:id", "/api/phase-a/tasks/missing", "", http.StatusNotFound},
|
|
{http.MethodGet, "/api/phase-a/attempts/:id", "/api/phase-a/attempts/missing", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/phase-a/tasks/:id/cancel", "/api/phase-a/tasks/missing/cancel", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/phase-a/tasks/:id/verify", "/api/phase-a/tasks/missing/verify", "", http.StatusBadRequest},
|
|
{http.MethodPost, "/api/phase-a/tasks/:id/resume", "/api/phase-a/tasks/missing/resume", "", http.StatusNotFound},
|
|
{http.MethodPost, "/api/phase-a/tasks/:id/finish", "/api/phase-a/tasks/missing/finish", "", http.StatusNotFound},
|
|
|
|
{http.MethodPost, "/api/phase-a/mock/execute", "/api/phase-a/mock/execute", "", http.StatusBadRequest},
|
|
{http.MethodGet, "/api/phase-a/audit", "/api/phase-a/audit", "", http.StatusOK},
|
|
}
|
|
}
|
|
|
|
func TestOperatorNotificationFiltersAndRedacts(t *testing.T) {
|
|
previousLevel := logrus.GetLevel()
|
|
t.Cleanup(func() { logrus.SetLevel(previousLevel) })
|
|
var output bytes.Buffer
|
|
notify := newAttentionNotifier(&output)
|
|
|
|
notify(taskstate.Transition{State: "succeeded", ReasonCode: "task_succeeded", AccountID: "account-a", TaskID: "task-a"})
|
|
if output.Len() != 0 {
|
|
t.Fatalf("successful task emitted a notification: %s", output.String())
|
|
}
|
|
|
|
for _, level := range []logrus.Level{logrus.ErrorLevel, logrus.FatalLevel, logrus.PanicLevel} {
|
|
for _, test := range []struct{ state, reason string }{
|
|
{"policy_hold", "account_paused"}, {"needs_confirmation", "exit_unhealthy"},
|
|
} {
|
|
output.Reset()
|
|
logrus.SetLevel(level)
|
|
notify(taskstate.Transition{State: test.state, ReasonCode: test.reason, AccountID: "account-a", TaskID: "task-a"})
|
|
var entry map[string]any
|
|
if err := json.Unmarshal(output.Bytes(), &entry); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if entry["event_type"] != test.state || entry["reason_code"] != test.reason ||
|
|
entry["notification_channel"] != "structured_log" || entry["account_id"] != "account-a" || entry["task_id"] != "task-a" {
|
|
t.Fatalf("unexpected notification at LOG_LEVEL=%s: %#v", level, entry)
|
|
}
|
|
for _, forbidden := range []string{"password", "authorization", "credential", "token", "secret"} {
|
|
if strings.Contains(strings.ToLower(output.String()), forbidden) {
|
|
t.Fatalf("notification contained sensitive field %q: %s", forbidden, output.String())
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestPhaseAAccountRequestRejectsUnknownFields(t *testing.T) {
|
|
for name, body := range map[string]string{
|
|
"client id": `{"id":"account-a","name":"账号 A","platform":"douyin","platform_account_key":"a","tags":[],"cookies":"sid=value"}`,
|
|
"authorization kind": `{"name":"账号 A","platform":"douyin","platform_account_key":"a","tags":[],"cookies":"sid=value","authorization_kind":"owned"}`,
|
|
"credential reference": `{"name":"账号 A","platform":"douyin","platform_account_key":"a","tags":[],"cookies":"sid=value","credential_reference":{}}`,
|
|
} {
|
|
t.Run(name, func(t *testing.T) {
|
|
app := fiber.New()
|
|
app.Post("/", func(c fiber.Ctx) error {
|
|
var input accountRequest
|
|
if err := decodePhaseA(c, &input); err != nil {
|
|
return phaseAError(c, err)
|
|
}
|
|
return c.SendStatus(http.StatusNoContent)
|
|
})
|
|
response, err := app.Test(httptest.NewRequest(http.MethodPost, "/", strings.NewReader(body)))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode != http.StatusBadRequest {
|
|
t.Fatalf("expected sensitive or unknown field to be rejected, got %d", response.StatusCode)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPhaseAAccountHTTPWorkflowRedactsSecrets(t *testing.T) {
|
|
databaseURL := os.Getenv("CREATORHUB_POSTGRES_TEST_URL")
|
|
if databaseURL == "" {
|
|
t.Skip("set CREATORHUB_POSTGRES_TEST_URL to run PostgreSQL integration coverage")
|
|
}
|
|
ctx := context.Background()
|
|
databaseURL = isolatedControlPlaneDatabaseURL(t, databaseURL)
|
|
store, err := phasea.Open(ctx, databaseURL)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = store.Close() })
|
|
hubStore, err := hub.Open(ctx, databaseURL)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = hubStore.Close() })
|
|
|
|
webDirectory := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(webDirectory, "index.html"), []byte("index"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
protectedApp := newHandlerWithStores(webDirectory, "operator", "unit-test-password", store, hubStore)
|
|
for _, route := range []struct{ method, path string }{
|
|
{http.MethodGet, "/api/phase-a/accounts"}, {http.MethodPost, "/api/phase-a/accounts"},
|
|
{http.MethodPost, "/api/phase-a/accounts/account-http/pause"}, {http.MethodGet, "/api/phase-a/tasks"},
|
|
{http.MethodPost, "/api/phase-a/mock/execute"}, {http.MethodGet, "/api/phase-a/audit"},
|
|
{http.MethodGet, "/api/browsers"}, {http.MethodPost, "/api/browsers/account-http/start"},
|
|
{http.MethodDelete, "/api/browsers/account-http"}, {http.MethodPut, "/api/browser-images/1"},
|
|
{http.MethodPost, "/api/network-exits/exit-http/check"}, {http.MethodPost, "/api/network-exits/exit-http/disable"},
|
|
} {
|
|
if response := do(protectedApp, route.method, route.path, ""); response.Code != http.StatusUnauthorized {
|
|
t.Fatalf("unauthenticated %s %s returned %d", route.method, route.path, response.Code)
|
|
}
|
|
}
|
|
for _, path := range []string{"/api/phase-a/accounts", "/api/browsers", "/api/phase-a/audit"} {
|
|
if response := do(protectedApp, http.MethodGet, path, "", "operator", "unit-test-password"); response.Code != http.StatusOK {
|
|
t.Fatalf("authenticated GET %s returned %d: %s", path, response.Code, response.Body.String())
|
|
}
|
|
}
|
|
app := fiber.New()
|
|
app.Use(authenticate("operator", "unit-test-password"))
|
|
credentials := &testCredentialBridge{values: map[string]string{}}
|
|
registerPhaseA(app, store, nil, credentials)
|
|
cookieHeader := "sessionid=phase-http-secret; token=value"
|
|
accountBody := `{"name":"Phase HTTP","platform":"douyin","platform_account_key":"phase-http","tags":["测试"],"cookies":"` + cookieHeader + `"}`
|
|
request := func(method, path, body string, wantStatus int) *httptest.ResponseRecorder {
|
|
t.Helper()
|
|
response := do(app, method, path, body, "operator", "unit-test-password")
|
|
if response.Code != wantStatus {
|
|
t.Fatalf("%s %s returned %d, want %d: %s", method, path, response.Code, wantStatus, response.Body.String())
|
|
}
|
|
if strings.Contains(response.Body.String(), cookieHeader) {
|
|
t.Fatalf("%s %s leaked cookies: %s", method, path, response.Body.String())
|
|
}
|
|
return response
|
|
}
|
|
|
|
created := request(http.MethodPost, "/api/phase-a/accounts", accountBody, http.StatusCreated)
|
|
var account phasea.Account
|
|
if err := json.Unmarshal(created.Body.Bytes(), &account); err != nil || account.ID == "" || account.Name != "Phase HTTP" || account.RuntimeStatus != "paused" {
|
|
t.Fatalf("unexpected account response: %#v err=%v", account, err)
|
|
}
|
|
if credentials.values["creatorhub/"+account.ID+"/cookies"] != cookieHeader {
|
|
t.Fatalf("cookies were not stored through the credential bridge: %#v", credentials.values)
|
|
}
|
|
request(http.MethodPost, "/api/phase-a/accounts", accountBody, http.StatusConflict)
|
|
request(http.MethodPost, "/api/phase-a/accounts", `{"name":"Bad","platform":"douyin","platform_account_key":"bad","tags":[],"cookies":"sessionid"}`, http.StatusBadRequest)
|
|
request(http.MethodPost, "/api/phase-a/accounts", strings.TrimSuffix(accountBody, "}")+`,"password":"secret"}`, http.StatusBadRequest)
|
|
request(http.MethodGet, "/api/phase-a/accounts", "", http.StatusOK)
|
|
request(http.MethodGet, "/api/phase-a/accounts/"+account.ID, "", http.StatusOK)
|
|
|
|
db, err := sql.Open("pgx", databaseURL)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = db.Close() })
|
|
assertControlPlaneDatabaseCount(t, db, `SELECT count(*) FROM credential_reference
|
|
WHERE id = '`+account.ID+`-cookies' AND provider = 'os_keyring'`, 1)
|
|
assertControlPlaneDatabaseCount(t, db, `SELECT count(*) FROM information_schema.columns
|
|
WHERE table_schema = current_schema() AND table_name = 'social_account' AND column_name = 'cookies'`, 0)
|
|
|
|
for _, failure := range []struct {
|
|
name string
|
|
configure func(*persistentCredentialBridge)
|
|
}{
|
|
{name: "chmod", configure: func(bridge *persistentCredentialBridge) {
|
|
bridge.chmod = func(*os.File, os.FileMode) error { return errors.New("chmod unavailable") }
|
|
}},
|
|
{name: "directory-sync", configure: func(bridge *persistentCredentialBridge) {
|
|
calls := 0
|
|
bridge.syncDirectory = func(path string) error {
|
|
calls++
|
|
if calls == 1 {
|
|
return errors.New("directory sync unavailable")
|
|
}
|
|
return syncCredentialDirectory(path)
|
|
}
|
|
}},
|
|
} {
|
|
failureDirectory := t.TempDir()
|
|
failureCredentials, err := newPersistentCredentialBridge(failureDirectory, []byte("0123456789abcdef0123456789abcdef"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
failure.configure(failureCredentials)
|
|
failureApp := fiber.New()
|
|
failureApp.Use(authenticate("operator", "unit-test-password"))
|
|
registerPhaseA(failureApp, store, nil, failureCredentials)
|
|
platformKey := "phase-http-store-" + failure.name
|
|
failureBody := `{"name":"Store failure","platform":"douyin","platform_account_key":"` + platformKey + `","tags":[],"cookies":"sessionid=value"}`
|
|
failureResponse := do(failureApp, http.MethodPost, "/api/phase-a/accounts", failureBody, "operator", "unit-test-password")
|
|
if failureResponse.Code != http.StatusInternalServerError {
|
|
t.Fatalf("%s failure returned %d, want %d: %s", failure.name, failureResponse.Code, http.StatusInternalServerError, failureResponse.Body.String())
|
|
}
|
|
var failedAccounts int
|
|
if err := db.QueryRowContext(ctx, `SELECT count(*) FROM social_account WHERE platform_account_key = $1`, platformKey).Scan(&failedAccounts); err != nil || failedAccounts != 0 {
|
|
t.Fatalf("%s failure persisted %d accounts: %v", failure.name, failedAccounts, err)
|
|
}
|
|
entries, err := os.ReadDir(failureDirectory)
|
|
if err != nil || len(entries) != 0 {
|
|
t.Fatalf("%s failure left ciphertext: entries=%v err=%v", failure.name, entries, err)
|
|
}
|
|
}
|
|
|
|
if _, err := db.ExecContext(ctx, `
|
|
INSERT INTO gateway (name, endpoint, token) VALUES ('phase-http', 'http://127.0.0.1:8081', 'phase-http-gateway-token');
|
|
INSERT INTO browser_image (version, image_ref) VALUES ('1', 'example/browser:1');
|
|
INSERT INTO browser_env (alias, name, gateway_name, image_version, fingerprint)
|
|
VALUES ('account-http', 'Phase HTTP', 'phase-http', '1', '{"seed":1}');
|
|
INSERT INTO network_exit (id, protocol, host, port, health_status)
|
|
VALUES ('exit-http', 'socks5', '127.0.0.1', 1080, 'healthy')`); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := db.ExecContext(ctx, `INSERT INTO environment_binding (id, account_id, browser_env_alias, network_exit_id)
|
|
VALUES ('binding-http', $1, 'account-http', 'exit-http')`, account.ID); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
request(http.MethodPost, "/api/phase-a/accounts/"+account.ID+"/resume", "", http.StatusNoContent)
|
|
request(http.MethodPost, "/api/phase-a/accounts/"+account.ID+"/pause", "", http.StatusNoContent)
|
|
request(http.MethodPost, "/api/phase-a/accounts/"+account.ID+"/resume", "", http.StatusNoContent)
|
|
request(http.MethodPost, "/api/phase-a/accounts/"+account.ID+"/revoke", "", http.StatusNoContent)
|
|
blocked := request(http.MethodPost, "/api/phase-a/accounts/"+account.ID+"/resume", "", http.StatusConflict)
|
|
if !strings.Contains(blocked.Body.String(), `"reason_code":"account_revoked"`) {
|
|
t.Fatalf("revoked resume did not return a stable conflict reason: %s", blocked.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestPhaseAErrorRedactsInternalDetails(t *testing.T) {
|
|
app := fiber.New()
|
|
app.Get("/", func(c fiber.Ctx) error {
|
|
return phaseAError(c, errors.New("database exposed a secret value"))
|
|
})
|
|
response, err := app.Test(httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer response.Body.Close()
|
|
body, _ := io.ReadAll(response.Body)
|
|
if response.StatusCode != http.StatusInternalServerError || strings.Contains(string(body), "secret") || !strings.Contains(string(body), "phase A operation failed") {
|
|
t.Fatalf("internal error was not redacted: status=%d body=%s", response.StatusCode, body)
|
|
}
|
|
}
|
|
|
|
func TestSPAServesFileAndIndexFallback(t *testing.T) {
|
|
directory := t.TempDir()
|
|
files := map[string]string{
|
|
"index.html": "index",
|
|
"app.js": "asset",
|
|
"hello world.js": "space",
|
|
"应用.js": "unicode",
|
|
}
|
|
for name, body := range files {
|
|
if err := os.WriteFile(filepath.Join(directory, name), []byte(body), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if err := os.WriteFile(filepath.Join(directory, "..", "outside-secret.txt"), []byte("secret"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
app := newHandler(directory, "operator", "unit-test-password")
|
|
for path, want := range map[string]string{
|
|
"/app.js": "asset",
|
|
"/hello%20world.js": "space",
|
|
"/%E5%BA%94%E7%94%A8.js": "unicode",
|
|
"/%2e%2e%2foutside-secret.txt": "index",
|
|
"/dashboard": "index",
|
|
} {
|
|
request := httptest.NewRequest(http.MethodGet, path, nil)
|
|
request.SetBasicAuth("operator", "unit-test-password")
|
|
response, err := app.Test(request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
body, readErr := io.ReadAll(response.Body)
|
|
response.Body.Close()
|
|
if readErr != nil || response.StatusCode != http.StatusOK || string(body) != want {
|
|
t.Fatalf("GET %s: status=%d body=%q err=%v", path, response.StatusCode, body, readErr)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestStartupLogIncludesListenAddress(t *testing.T) {
|
|
logger := logrus.StandardLogger()
|
|
previousOutput, previousFormatter, previousLevel := logger.Out, logger.Formatter, logger.Level
|
|
t.Cleanup(func() {
|
|
logrus.SetOutput(previousOutput)
|
|
logrus.SetFormatter(previousFormatter)
|
|
logrus.SetLevel(previousLevel)
|
|
})
|
|
var output bytes.Buffer
|
|
logrus.SetOutput(&output)
|
|
logrus.SetFormatter(&logrus.JSONFormatter{})
|
|
logrus.SetLevel(logrus.InfoLevel)
|
|
|
|
logStartup(config{listenAddr: ":8080"})
|
|
var entry map[string]any
|
|
if err := json.Unmarshal(output.Bytes(), &entry); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if entry["listen_addr"] != ":8080" || entry["service"] != "control-plane" {
|
|
t.Fatalf("unexpected startup log: %#v", entry)
|
|
}
|
|
}
|