Reorganize repo: backend/, deploy/, docs/ layout + AGENTS.md
Restructure the monorepo into clear top-level directories: - backend/: Go module root (cmd, internal, pkg, configs, migrations, docs/swagger, scripts, tests, go.mod, Makefile, .air.toml) - deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd - docs/: project documentation + reports/ (moved from repo root) - AGENTS.md: new AI coding-agent guide at repo root Update all references to the new layout: - Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root) - docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile, env_file ../../.env, volume mounts ../../backend:/app - deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile - CI: working-directory: backend for go commands, file deploy/docker/Dockerfile, coverage path backend/coverage.out, health_check backend/scripts/ - backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../ - README: architecture tree, quickstart, config paths updated Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh, gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to preserve history. Build, vet, SQLite tests, and docker compose config verified.
This commit is contained in:
@@ -0,0 +1,208 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/gochat/gochat/internal/model"
|
||||
"github.com/gochat/gochat/pkg/testutil"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// newPlatformTestDB creates a test DB with PlatformApp, AccessToken, and Permissible tables.
|
||||
func newPlatformTestDB(t *testing.T) *gorm.DB {
|
||||
t.Helper()
|
||||
return testutil.NewTestDBWithModels(t,
|
||||
&model.PlatformApp{},
|
||||
&model.AccessToken{},
|
||||
&model.Permissible{},
|
||||
)
|
||||
}
|
||||
|
||||
func TestPlatformAppAuth_ValidToken(t *testing.T) {
|
||||
db := newPlatformTestDB(t)
|
||||
router := gin.New()
|
||||
router.Use(PlatformAppAuth(db))
|
||||
|
||||
// Create a PlatformApp
|
||||
pa := model.PlatformApp{Name: "TestApp", Active: ptrBool(true)}
|
||||
require.NoError(t, db.Create(&pa).Error)
|
||||
|
||||
// Create AccessToken for the PlatformApp
|
||||
rawToken := "test-platform-token-12345"
|
||||
hash := sha256.Sum256([]byte(rawToken))
|
||||
tokenHash := hex.EncodeToString(hash[:])
|
||||
|
||||
at := model.AccessToken{
|
||||
OwnerType: model.AccessTokenOwnerTypePlatformApp,
|
||||
OwnerID: pa.ID,
|
||||
Token: tokenHash,
|
||||
TokenPrefix: rawToken[:8],
|
||||
}
|
||||
require.NoError(t, db.Create(&at).Error)
|
||||
|
||||
router.GET("/test", func(c *gin.Context) {
|
||||
appID, exists := c.Get("platform_app_id")
|
||||
assert.True(t, exists)
|
||||
assert.Equal(t, pa.ID, appID)
|
||||
c.JSON(200, gin.H{"ok": true})
|
||||
})
|
||||
|
||||
w := httptest.NewRecorder()
|
||||
req, _ := http.NewRequest("GET", "/test", nil)
|
||||
req.Header.Set("api_access_token", rawToken)
|
||||
router.ServeHTTP(w, req)
|
||||
|
||||
assert.Equal(t, 200, w.Code)
|
||||
}
|
||||
|
||||
func TestPlatformAppAuth_MissingToken(t *testing.T) {
|
||||
db := newPlatformTestDB(t)
|
||||
router := gin.New()
|
||||
router.Use(PlatformAppAuth(db))
|
||||
|
||||
router.GET("/test", func(c *gin.Context) {
|
||||
c.JSON(200, gin.H{"ok": true})
|
||||
})
|
||||
|
||||
w := httptest.NewRecorder()
|
||||
req, _ := http.NewRequest("GET", "/test", nil)
|
||||
router.ServeHTTP(w, req)
|
||||
|
||||
assert.Equal(t, 401, w.Code)
|
||||
}
|
||||
|
||||
func TestPlatformAppAuth_InvalidToken(t *testing.T) {
|
||||
db := newPlatformTestDB(t)
|
||||
router := gin.New()
|
||||
router.Use(PlatformAppAuth(db))
|
||||
|
||||
router.GET("/test", func(c *gin.Context) {
|
||||
c.JSON(200, gin.H{"ok": true})
|
||||
})
|
||||
|
||||
w := httptest.NewRecorder()
|
||||
req, _ := http.NewRequest("GET", "/test", nil)
|
||||
req.Header.Set("api_access_token", "invalid-token")
|
||||
router.ServeHTTP(w, req)
|
||||
|
||||
assert.Equal(t, 401, w.Code)
|
||||
}
|
||||
|
||||
func TestPlatformAppAuth_UserTokenRejected(t *testing.T) {
|
||||
db := newPlatformTestDB(t)
|
||||
router := gin.New()
|
||||
router.Use(PlatformAppAuth(db))
|
||||
|
||||
// Create a User-type AccessToken (should be rejected by PlatformAuth)
|
||||
rawToken := "user-personal-token"
|
||||
hash := sha256.Sum256([]byte(rawToken))
|
||||
tokenHash := hex.EncodeToString(hash[:])
|
||||
|
||||
at := model.AccessToken{
|
||||
OwnerType: model.AccessTokenOwnerTypeUser,
|
||||
OwnerID: 999,
|
||||
Token: tokenHash,
|
||||
TokenPrefix: rawToken[:8],
|
||||
}
|
||||
require.NoError(t, db.Create(&at).Error)
|
||||
|
||||
router.GET("/test", func(c *gin.Context) {
|
||||
c.JSON(200, gin.H{"ok": true})
|
||||
})
|
||||
|
||||
w := httptest.NewRecorder()
|
||||
req, _ := http.NewRequest("GET", "/test", nil)
|
||||
req.Header.Set("api_access_token", rawToken)
|
||||
router.ServeHTTP(w, req)
|
||||
|
||||
assert.Equal(t, 401, w.Code)
|
||||
}
|
||||
|
||||
func TestPlatformAppAuth_HTTP_API_ACCESS_TOKEN_Header(t *testing.T) {
|
||||
db := newPlatformTestDB(t)
|
||||
router := gin.New()
|
||||
router.Use(PlatformAppAuth(db))
|
||||
|
||||
pa := model.PlatformApp{Name: "TestApp2", Active: ptrBool(true)}
|
||||
require.NoError(t, db.Create(&pa).Error)
|
||||
|
||||
rawToken := "test-http-header-token"
|
||||
hash := sha256.Sum256([]byte(rawToken))
|
||||
tokenHash := hex.EncodeToString(hash[:])
|
||||
|
||||
at := model.AccessToken{
|
||||
OwnerType: model.AccessTokenOwnerTypePlatformApp,
|
||||
OwnerID: pa.ID,
|
||||
Token: tokenHash,
|
||||
TokenPrefix: rawToken[:8],
|
||||
}
|
||||
require.NoError(t, db.Create(&at).Error)
|
||||
|
||||
router.GET("/test", func(c *gin.Context) {
|
||||
c.JSON(200, gin.H{"ok": true})
|
||||
})
|
||||
|
||||
w := httptest.NewRecorder()
|
||||
req, _ := http.NewRequest("GET", "/test", nil)
|
||||
req.Header.Set("HTTP_API_ACCESS_TOKEN", rawToken)
|
||||
router.ServeHTTP(w, req)
|
||||
|
||||
assert.Equal(t, 200, w.Code)
|
||||
}
|
||||
|
||||
func TestPlatformAppAuth_ContextValues(t *testing.T) {
|
||||
db := newPlatformTestDB(t)
|
||||
router := gin.New()
|
||||
router.Use(PlatformAppAuth(db))
|
||||
|
||||
pa := model.PlatformApp{Name: "ContextTestApp", Active: ptrBool(true)}
|
||||
require.NoError(t, db.Create(&pa).Error)
|
||||
|
||||
rawToken := "context-test-token"
|
||||
hash := sha256.Sum256([]byte(rawToken))
|
||||
tokenHash := hex.EncodeToString(hash[:])
|
||||
|
||||
at := model.AccessToken{
|
||||
OwnerType: model.AccessTokenOwnerTypePlatformApp,
|
||||
OwnerID: pa.ID,
|
||||
Token: tokenHash,
|
||||
TokenPrefix: rawToken[:8],
|
||||
}
|
||||
require.NoError(t, db.Create(&at).Error)
|
||||
|
||||
router.GET("/test", func(c *gin.Context) {
|
||||
// Verify all context values are set correctly
|
||||
platformApp, exists := c.Get("platform_app")
|
||||
assert.True(t, exists)
|
||||
app := platformApp.(model.PlatformApp)
|
||||
assert.Equal(t, pa.ID, app.ID)
|
||||
assert.Equal(t, pa.Name, app.Name)
|
||||
|
||||
appID, exists := c.Get("platform_app_id")
|
||||
assert.True(t, exists)
|
||||
assert.Equal(t, pa.ID, appID)
|
||||
|
||||
tokenID, exists := c.Get("access_token_id")
|
||||
assert.True(t, exists)
|
||||
assert.Equal(t, at.ID, tokenID)
|
||||
|
||||
c.JSON(200, gin.H{"ok": true})
|
||||
})
|
||||
|
||||
w := httptest.NewRecorder()
|
||||
req, _ := http.NewRequest("GET", "/test", nil)
|
||||
req.Header.Set("api_access_token", rawToken)
|
||||
router.ServeHTTP(w, req)
|
||||
|
||||
assert.Equal(t, 200, w.Code)
|
||||
}
|
||||
|
||||
func ptrBool(b bool) *bool { return &b }
|
||||
Reference in New Issue
Block a user