初始提交：OCI 面板后端（含 GenAI 网关一期）

2026-07-09 15:31:04 +08:00
commit b9a3e97e84
168 changed files with 31794 additions and 0 deletions
@@ -0,0 +1,103 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"oci-portal/internal/crypto"
+	"oci-portal/internal/model"
+)
+
+// newCredEnv 复用 totp 环境并注入 settings(密码登录开关落 Setting 表)。
+func newCredEnv(t *testing.T) *AuthService {
+	t.Helper()
+	auth, db := newTotpEnv(t)
+	cipher, err := crypto.NewCipher("test-key")
+	if err != nil {
+		t.Fatalf("new cipher: %v", err)
+	}
+	auth.SetNotifier(nil, NewSettingService(db, cipher))
+	return auth
+}
+
+func TestUpdateCredentials(t *testing.T) {
+	auth := newCredEnv(t)
+	ctx := context.Background()
+
+	// 当前密码错误
+	err := auth.UpdateCredentials(ctx, "admin", UpdateCredentialsInput{NewPassword: "newpass-123", CurrentPassword: "wrong"})
+	if !errors.Is(err, ErrCredentialConfirm) {
+		t.Fatalf("wrong current password: err = %v, want ErrCredentialConfirm", err)
+	}
+	// 短密码 / 无变更均拒绝
+	err = auth.UpdateCredentials(ctx, "admin", UpdateCredentialsInput{NewPassword: "short", CurrentPassword: "pass123"})
+	if !errors.Is(err, ErrCredentialInvalid) {
+		t.Fatalf("short password: err = %v, want ErrCredentialInvalid", err)
+	}
+	err = auth.UpdateCredentials(ctx, "admin", UpdateCredentialsInput{NewUsername: "admin", CurrentPassword: "pass123"})
+	if !errors.Is(err, ErrCredentialInvalid) {
+		t.Fatalf("no-op change: err = %v, want ErrCredentialInvalid", err)
+	}
+
+	// 同时改名改密
+	err = auth.UpdateCredentials(ctx, "admin", UpdateCredentialsInput{
+		NewUsername: "root", NewPassword: "newpass-123", CurrentPassword: "pass123",
+	})
+	if err != nil {
+		t.Fatalf("UpdateCredentials: %v", err)
+	}
+	if _, _, err := auth.Login(ctx, "admin", "pass123", "127.0.0.1", ""); !errors.Is(err, ErrInvalidCredentials) {
+		t.Errorf("old username login: err = %v, want ErrInvalidCredentials", err)
+	}
+	if _, _, err := auth.Login(ctx, "root", "newpass-123", "127.0.0.2", ""); err != nil {
+		t.Errorf("new credentials login: %v", err)
+	}
+}
+
+func TestPasswordLoginToggle(t *testing.T) {
+	auth := newCredEnv(t)
+	ctx := context.Background()
+
+	// 未绑定外部身份不可禁用
+	if err := auth.SetPasswordLoginDisabled(ctx, "admin", true); !errors.Is(err, ErrNeedIdentity) {
+		t.Fatalf("disable without identity: err = %v, want ErrNeedIdentity", err)
+	}
+
+	var user model.User
+	if err := auth.db.Where("username = ?", "admin").First(&user).Error; err != nil {
+		t.Fatalf("find admin: %v", err)
+	}
+	ident := model.UserIdentity{UserID: user.ID, Provider: "github", Subject: "1", Display: "tester"}
+	if err := auth.db.Create(&ident).Error; err != nil {
+		t.Fatalf("seed identity: %v", err)
+	}
+
+	if err := auth.SetPasswordLoginDisabled(ctx, "admin", true); err != nil {
+		t.Fatalf("disable with identity: %v", err)
+	}
+	if off, err := auth.PasswordLoginDisabled(ctx); err != nil || !off {
+		t.Fatalf("PasswordLoginDisabled = %v, %v; want true", off, err)
+	}
+	// 密码登录被拒且不计失败(正确密码亦拒)
+	if _, _, err := auth.Login(ctx, "admin", "pass123", "127.0.0.1", ""); !errors.Is(err, ErrPasswordLoginDisabled) {
+		t.Fatalf("login while disabled: err = %v, want ErrPasswordLoginDisabled", err)
+	}
+
+	// 开关开着不能解绑最后一个身份
+	oauth := NewOAuthService(auth.db, nil, auth)
+	if err := oauth.Unbind(ctx, "admin", ident.ID); !errors.Is(err, ErrLastIdentity) {
+		t.Fatalf("unbind last identity: err = %v, want ErrLastIdentity", err)
+	}
+
+	// 恢复密码登录后可解绑、可登录
+	if err := auth.SetPasswordLoginDisabled(ctx, "admin", false); err != nil {
+		t.Fatalf("enable password login: %v", err)
+	}
+	if err := oauth.Unbind(ctx, "admin", ident.ID); err != nil {
+		t.Fatalf("unbind after enable: %v", err)
+	}
+	if _, _, err := auth.Login(ctx, "admin", "pass123", "127.0.0.3", ""); err != nil {
+		t.Errorf("login after enable: %v", err)
+	}
+}