新增活跃会话管理与通行密钥、钱包登录

internal/service/userapikey_test.go

@@ -17,13 +17,14 @@ import (
 type apiKeyClient struct {
 	oci.Client
 
-	keys        []oci.TenantUserApiKey
-	uploadFp    string
-	uploadErr   error
-	uploadedPub string
-	deleted     []string
-	validateErr error
-	validated   []string // ValidateKey 收到的指纹序列
+	keys          []oci.TenantUserApiKey
+	uploadFp      string
+	uploadErr     error
+	uploadedPub   string
+	deleted       []string
+	validateErr   error
+	validated     []string // ValidateKey 收到的指纹序列
+	validatedUser string   // ValidateKey 最近一次使用的签名用户
 }
 
 func (f *apiKeyClient) ListTenantUserApiKeys(ctx context.Context, cred oci.Credentials, homeRegion, userID string) ([]oci.TenantUserApiKey, error) {
@@ -45,6 +46,7 @@ func (f *apiKeyClient) DeleteTenantUserApiKey(ctx context.Context, cred oci.Cred
 
 func (f *apiKeyClient) ValidateKey(ctx context.Context, cred oci.Credentials) (oci.TenancyInfo, error) {
 	f.validated = append(f.validated, cred.Fingerprint)
+	f.validatedUser = cred.UserOCID
 	if f.validateErr != nil {
 		return oci.TenancyInfo{}, f.validateErr
 	}
@@ -149,14 +151,17 @@ func TestActivateApiKey(t *testing.T) {
 	const newKey = "-----BEGIN RSA PRIVATE KEY-----\nnew\n-----END RSA PRIVATE KEY-----"
 	tests := []struct {
 		name        string
+		userID      string
 		privateKey  string
 		validateErr error
 		wantErr     bool
 		wantFp      string // 期望落库指纹
+		wantUser    string // 期望落库签名用户
 	}{
-		{"成功:验证通过后落库,不删任何 key", newKey, nil, false, "11:22"},
-		{"验证失败:配置不动", newKey, errors.New("401"), true, "aa:bb"},
-		{"私钥非 PEM:直接拒绝", "not-a-pem", nil, true, "aa:bb"},
+		{"成功:验证通过后落库,不删任何 key", "", newKey, nil, false, "11:22", "ocid1.user.oc1..me"},
+		{"切换用户:以新用户验证并一并落库", "ocid1.user.oc1..other", newKey, nil, false, "11:22", "ocid1.user.oc1..other"},
+		{"验证失败:配置不动", "", newKey, errors.New("401"), true, "aa:bb", "ocid1.user.oc1..me"},
+		{"私钥非 PEM:直接拒绝", "", "not-a-pem", nil, true, "aa:bb", "ocid1.user.oc1..me"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -164,7 +169,7 @@ func TestActivateApiKey(t *testing.T) {
 			s := newTestService(t, fc)
 			cfg := seedApiKeyConfig(t, s)
 
-			err := s.ActivateApiKey(context.Background(), cfg.ID, "11:22", tt.privateKey)
+			err := s.ActivateApiKey(context.Background(), cfg.ID, tt.userID, "11:22", tt.privateKey)
 			if (err != nil) != tt.wantErr {
 				t.Fatalf("err = %v, wantErr %v", err, tt.wantErr)
 			}
@@ -175,13 +180,16 @@ func TestActivateApiKey(t *testing.T) {
 			if got.Fingerprint != tt.wantFp {
 				t.Fatalf("fingerprint = %q, want %q", got.Fingerprint, tt.wantFp)
 			}
+			if got.UserOCID != tt.wantUser {
+				t.Fatalf("userOCID = %q, want %q", got.UserOCID, tt.wantUser)
+			}
 			if len(fc.deleted) != 0 {
 				t.Fatalf("deleted = %v, want none", fc.deleted)
 			}
 			if tt.wantErr {
 				return
 			}
-			// 成功路径:落库私钥可解密且与回传一致,验证调用用的是新指纹
+			// 成功路径:落库私钥可解密且与回传一致,验证调用用的是新指纹与目标用户
 			plain, err := s.cipher.DecryptString(got.PrivateKeyEnc)
 			if err != nil || plain != newKey {
 				t.Fatalf("persisted key mismatch (err=%v)", err)
@@ -189,6 +197,9 @@ func TestActivateApiKey(t *testing.T) {
 			if len(fc.validated) == 0 || fc.validated[0] != "11:22" {
 				t.Fatalf("validated = %v", fc.validated)
 			}
+			if fc.validatedUser != tt.wantUser {
+				t.Fatalf("validatedUser = %q, want %q", fc.validatedUser, tt.wantUser)
+			}
 		})
 	}
 }