feat(channels): align twitter authorization

2026-06-06 18:29:35 +08:00
parent 0f2d64c8f6
commit 5b143b6da7
7 changed files with 294 additions and 8 deletions
@@ -0,0 +1,132 @@
+package v1
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupTwitterAuthorizationRouter() *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	r.RedirectTrailingSlash = false
+	handler := NewTwitterChannelHandler(nil, nil, nil, nil)
+	r.POST("/api/v1/accounts/:account_id/twitter/authorization", handler.ChatwootAuthorization)
+	return r
+}
+
+func TestTwitterAuthorization_BadAccountID(t *testing.T) {
+	r := setupTwitterAuthorizationRouter()
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodPost, "/api/v1/accounts/abc/twitter/authorization", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	var resp map[string]interface{}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
+	errBody := resp["error"].(map[string]interface{})
+	assert.Contains(t, errBody["message"], "invalid account_id")
+}
+
+func TestTwitterAuthorization_ReturnsChatwootPayload(t *testing.T) {
+	t.Setenv("TWITTER_CONSUMER_KEY", "twitter-key")
+	t.Setenv("TWITTER_CONSUMER_SECRET", "twitter-secret")
+	t.Setenv("TWITTER_OAUTH_REQUEST_TOKEN_URL", "https://oauth.example.test/request_token")
+	t.Setenv("TWITTER_API_BASE_URL", "https://api.twitter.test")
+	t.Setenv("FRONTEND_URL", "https://app.example.test/")
+
+	originalClient := twitterAuthorizationHTTPClient
+	twitterAuthorizationHTTPClient = &http.Client{Transport: twitterAuthorizationRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, http.MethodPost, req.Method)
+		assert.Equal(t, "https://oauth.example.test/request_token", req.URL.String())
+		authHeader := req.Header.Get("Authorization")
+		assert.Contains(t, authHeader, "OAuth ")
+		assert.Contains(t, authHeader, `oauth_consumer_key="twitter-key"`)
+		assert.Contains(t, authHeader, "oauth_callback=")
+		return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("oauth_token=request-token&oauth_token_secret=request-secret")), Header: http.Header{}}, nil
+	})}
+	t.Cleanup(func() { twitterAuthorizationHTTPClient = originalClient })
+
+	r := setupTwitterAuthorizationRouter()
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodPost, "/api/v1/accounts/42/twitter/authorization", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+	var resp map[string]interface{}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
+	assert.Equal(t, true, resp["success"])
+	assert.Equal(t, "https://api.twitter.test/oauth/authorize?oauth_token=request-token", resp["url"])
+}
+
+func TestTwitterAuthorization_SignedStateMatchesCallback(t *testing.T) {
+	t.Setenv("TWITTER_CONSUMER_KEY", "twitter-key")
+	t.Setenv("TWITTER_CONSUMER_SECRET", "twitter-secret")
+	t.Setenv("TWITTER_OAUTH_REQUEST_TOKEN_URL", "https://oauth.example.test/request_token")
+	t.Setenv("FRONTEND_URL", "https://app.example.test")
+
+	originalClient := twitterAuthorizationHTTPClient
+	var callbackURL string
+	twitterAuthorizationHTTPClient = &http.Client{Transport: twitterAuthorizationRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		authHeader := req.Header.Get("Authorization")
+		for _, part := range strings.Split(strings.TrimPrefix(authHeader, "OAuth "), ",") {
+			part = strings.TrimSpace(part)
+			if strings.HasPrefix(part, "oauth_callback=") {
+				callbackURL = strings.Trim(strings.TrimPrefix(part, "oauth_callback="), `"`)
+				decoded, err := url.QueryUnescape(callbackURL)
+				require.NoError(t, err)
+				callbackURL = decoded
+			}
+		}
+		return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("oauth_token=request-token")), Header: http.Header{}}, nil
+	})}
+	t.Cleanup(func() { twitterAuthorizationHTTPClient = originalClient })
+
+	r := setupTwitterAuthorizationRouter()
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodPost, "/api/v1/accounts/42/twitter/authorization", nil)
+	r.ServeHTTP(w, req)
+	require.Equal(t, http.StatusOK, w.Code)
+
+	parsed, err := url.Parse(callbackURL)
+	require.NoError(t, err)
+	assert.Equal(t, "https://app.example.test/twitter/callback", parsed.Scheme+"://"+parsed.Host+parsed.Path)
+	claims := jwt.MapClaims{}
+	token, err := jwt.ParseWithClaims(parsed.Query().Get("state"), claims, func(token *jwt.Token) (any, error) {
+		return []byte("twitter-secret"), nil
+	})
+	require.NoError(t, err)
+	require.True(t, token.Valid)
+	assert.Equal(t, float64(42), claims["sub"])
+}
+
+func TestTwitterAuthorization_NotConfigured(t *testing.T) {
+	t.Setenv("TWITTER_CONSUMER_KEY", "")
+	t.Setenv("TWITTER_CONSUMER_SECRET", "")
+	r := setupTwitterAuthorizationRouter()
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodPost, "/api/v1/accounts/42/twitter/authorization", nil)
+	r.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusUnprocessableEntity, w.Code)
+	var resp map[string]interface{}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
+	assert.Equal(t, false, resp["success"])
+}
+
+type twitterAuthorizationRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f twitterAuthorizationRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}