lc_garage/internal/initialize/router_security_test.go

package initialize

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"
	"github.com/stretchr/testify/require"
	"go.uber.org/zap"
	"wails-app/internal/config"
	"wails-app/internal/global"
)

func setupRouterSecurityTest(t *testing.T, debugRoutes bool) *gin.Engine {
	t.Helper()
	previousConfig := global.GVA_CONFIG
	previousLog := global.GVA_LOG
	t.Cleanup(func() {
		global.GVA_CONFIG = previousConfig
		global.GVA_LOG = previousLog
	})
	global.GVA_CONFIG = config.Server{}
	global.GVA_CONFIG.System.DebugRoutes = debugRoutes
	global.GVA_CONFIG.Local.StorePath = "/uploads"
	global.GVA_LOG = zap.NewNop()
	gin.SetMode(gin.TestMode)
	return Routers()
}

func TestDebugRoutesAreNotRegisteredByDefault(t *testing.T) {
	router := setupRouterSecurityTest(t, false)
	routes := map[string]string{}
	for _, route := range router.Routes() {
		routes[route.Path] = route.Method
	}
	require.Equal(t, "POST", routes["/ticket-machine/button"])
	require.NotContains(t, routes, "/ticket-machine/test")
	require.NotContains(t, routes, "/ticket-machine/debug")
	require.NotContains(t, routes, "/ticket-machine/usb-list")
	require.NotContains(t, routes, "/channel/test-event")
}

func TestIncidentRoutesRegisteredAndRequireAuth(t *testing.T) {
	router := setupRouterSecurityTest(t, false)
	cases := []struct{ method, path string }{
		{http.MethodGet, "/incident/list"},
		{http.MethodGet, "/incident/stats"},
		{http.MethodGet, "/incident/1"},
		{http.MethodPost, "/incident"},
		{http.MethodPost, "/incident/1/transition"},
	}
	for _, tc := range cases {
		recorder := httptest.NewRecorder()
		request := httptest.NewRequest(tc.method, tc.path, nil)
		router.ServeHTTP(recorder, request)
		// 未登录一律 401（说明路由存在且受 JWT 保护）
		require.Equal(t, http.StatusUnauthorized, recorder.Code, "%s %s", tc.method, tc.path)
	}
}

func TestEnabledDebugRoutesStillRequireAuthentication(t *testing.T) {
	router := setupRouterSecurityTest(t, true)
	recorder := httptest.NewRecorder()
	request := httptest.NewRequest(http.MethodPost, "/channel/test-event?plate=TEST", nil)
	router.ServeHTTP(recorder, request)

	require.Equal(t, http.StatusUnauthorized, recorder.Code)
	require.Contains(t, recorder.Body.String(), "未登录或非法访问")
}