Files
Commilitia-Drop/internal/db/bootstrap_test.go
T
admin 90a3790a98 扫码登录:cdrop 自签会话原语 + 薄账户层 + 受限访客 + 2FA step-up
身份仍源自 OAuth provider(user_id = OIDC sub),cdrop 在其上自维护一薄层:
自签会话令牌 + accounts 表,并新增扫码快速登录。实施蓝本见 AUTH.md。

后端 · 自签会话原语
- web_sessions 加 kind/scope/granted_by 列(bootstrap 幂等迁移);既有 oidc
  会话行为不变,新增 self(滑动续期)/ guest(受限·不续)两类
- cdrop 自签 HS256 会话 access token,密钥派生自 SESSION_SECRET,与落盘 AES、
  shortcut HS256 三密钥域隔离;jwtauth.verifySelfToken 无状态校验、靠 typ 区分
- requireFullSession 守卫:guest 会话不得改账号 / 再批准设备 / 签长效 token
- /auth/refresh 按 kind 分流:self/guest 纯自签、不触 IdP

后端 · 扫码登录(internal/httpapi/qr.go)
- qr/start・status・request・approve・deny 五端点 + login_requests 表 + reaper
- 三密钥分离:QR 仅含批准信息,会话只投递给持私有 poll_secret 的原设备
  (偷拍 QR 者无 poll_secret 领不到会话、未登录批不了准)
- 会话在新设备侧领取(cookie 不经手机)、单次消费、短 TTL

后端 · 薄账户层与 2FA step-up
- accounts 表(键 sub,不含任何凭证):exchange/refresh upsert match_key /
  显示名 / 头像 / roles,供显示与未来管理员开启迁移标记时跨源关联
- step-up(默认关):开启后 qr/approve 要求新鲜 prompt=login 授权码,后端就地
  换 id_token、JWKS 验签 + auth_time 窗口 + sub 匹配,provider 2FA 于此往返强制

前端(web/)
- 显码页 /link/new + 批准页 /link + net/qr.ts,对齐 Theme B、复用 AuthShell
  与聚珍排版管线、零新全局样式
- step-up 再认证流:批准前跑 prompt=login PKCE,回调分叉(不消费一次性 code、
  独立 state key)后带 step_up_code/verifier 调 approve
- 三语 i18n qr.*;新增 qrcode 依赖

修复 · clipboard sweeper(早已提交的损坏)
- ClearExpiredClipboards 因 clipboard.sql 全角注释触发 sqlc 1.31 多字节偏移
  bug,生成 SQL 被截断为「UPDATE clipboard_state SET content =」,sweeper 运行
  期报「incomplete input」、过期剪贴板内容从未清除(短 TTL 暴露保护失效)
- 注释改纯 ASCII 并加 bug 警告,重生成得完整 SQL;prod 已验证 sweeper 由 ERROR
  转为正常清理(cleared count=1)

构建
- .dockerignore:排除本地 node_modules 等,避免宿主原生二进制污染镜像内 vite 构建
- Dockerfile.base:GOPROXY 改为可经 --build-arg 覆盖(默认仍官方代理,受限网络
  构建时传区域镜像即可,仓库不固化区域值)

文档
- 新增 AUTH.md(账户与登录实施蓝本);README 特性;.env.example /
  compose.snippet 增配置项(QR / 自签会话 TTL / step-up / match_claim)

测试
- 自签 token 密钥域隔离、扫码端到端(领取 / 单次 / poll_secret 校验 / deny /
  step-up 门)、extractIdentity、web_sessions 升级迁移
2026-06-21 22:43:36 +08:00

159 lines
4.7 KiB
Go

package db
import (
"context"
"path/filepath"
"sort"
"testing"
)
func TestBootstrapCreatesAllTables(t *testing.T) {
tmp := filepath.Join(t.TempDir(), "test.db")
d, err := Open(tmp)
if err != nil {
t.Fatalf("open: %v", err)
}
defer d.Close()
if err := Bootstrap(context.Background(), d); err != nil {
t.Fatalf("bootstrap: %v", err)
}
want := []string{"accounts", "clipboard_state", "devices", "login_requests", "push_subscriptions", "shortcut_tokens", "transfer_sessions", "web_sessions"}
rows, err := d.Query("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name")
if err != nil {
t.Fatalf("query tables: %v", err)
}
defer rows.Close()
var got []string
for rows.Next() {
var name string
if err := rows.Scan(&name); err != nil {
t.Fatalf("scan: %v", err)
}
got = append(got, name)
}
sort.Strings(got)
if len(got) != len(want) {
t.Fatalf("table count: got %v, want %v", got, want)
}
for i := range want {
if got[i] != want[i] {
t.Errorf("table[%d]: got %q, want %q", i, got[i], want[i])
}
}
}
func TestBootstrapIsIdempotent(t *testing.T) {
tmp := filepath.Join(t.TempDir(), "test.db")
d, err := Open(tmp)
if err != nil {
t.Fatalf("open: %v", err)
}
defer d.Close()
for i := 0; i < 3; i++ {
if err := Bootstrap(context.Background(), d); err != nil {
t.Fatalf("bootstrap iter %d: %v", i, err)
}
}
}
func TestOpenEnablesWALMode(t *testing.T) {
tmp := filepath.Join(t.TempDir(), "test.db")
d, err := Open(tmp)
if err != nil {
t.Fatalf("open: %v", err)
}
defer d.Close()
var mode string
if err := d.QueryRow("PRAGMA journal_mode").Scan(&mode); err != nil {
t.Fatalf("pragma: %v", err)
}
if mode != "wal" {
t.Errorf("journal_mode: got %q, want %q", mode, "wal")
}
}
// Simulates the prod upgrade: a clipboard_state created before the version
// column existed must gain it (defaulting to 0) on bootstrap, idempotently.
func TestBootstrapAddsClipboardVersionToLegacyDB(t *testing.T) {
tmp := filepath.Join(t.TempDir(), "legacy.db")
d, err := Open(tmp)
if err != nil {
t.Fatalf("open: %v", err)
}
defer d.Close()
_, err = d.Exec(`CREATE TABLE clipboard_state (
user_id TEXT PRIMARY KEY, content_type TEXT NOT NULL, content TEXT,
source_device TEXT, updated_at INTEGER NOT NULL)`)
if err != nil {
t.Fatalf("legacy schema: %v", err)
}
if _, err := d.Exec(`INSERT INTO clipboard_state (user_id, content_type, content, updated_at)
VALUES ('u', 'text/plain', 'hi', 100)`); err != nil {
t.Fatalf("seed row: %v", err)
}
if err := Bootstrap(context.Background(), d); err != nil {
t.Fatalf("bootstrap: %v", err)
}
var version int64
if err := d.QueryRow(`SELECT version FROM clipboard_state WHERE user_id='u'`).Scan(&version); err != nil {
t.Fatalf("select version (column missing?): %v", err)
}
if version != 0 {
t.Errorf("legacy row version: got %d, want 0", version)
}
// Second bootstrap must be a no-op (column already present).
if err := Bootstrap(context.Background(), d); err != nil {
t.Fatalf("second bootstrap: %v", err)
}
}
// Simulates the prod upgrade for scan-login: a web_sessions table created before
// kind/scope/granted_by existed must gain them, with an existing row defaulting
// to a normal OIDC-backed full session so its behaviour is unchanged (AUTH.md §2.2).
func TestBootstrapAddsWebSessionColumnsToLegacyDB(t *testing.T) {
tmp := filepath.Join(t.TempDir(), "legacy.db")
d, err := Open(tmp)
if err != nil {
t.Fatalf("open: %v", err)
}
defer d.Close()
_, err = d.Exec(`CREATE TABLE web_sessions (
id TEXT PRIMARY KEY, user_id TEXT NOT NULL, refresh_token TEXT NOT NULL,
device_name TEXT NOT NULL DEFAULT '', user_agent TEXT NOT NULL DEFAULT '',
created_at INTEGER NOT NULL, last_used_at INTEGER NOT NULL, expires_at INTEGER NOT NULL)`)
if err != nil {
t.Fatalf("legacy schema: %v", err)
}
if _, err := d.Exec(`INSERT INTO web_sessions (id, user_id, refresh_token, created_at, last_used_at, expires_at)
VALUES ('s', 'u', 'enc', 1, 1, 9999999999)`); err != nil {
t.Fatalf("seed row: %v", err)
}
if err := Bootstrap(context.Background(), d); err != nil {
t.Fatalf("bootstrap: %v", err)
}
var kind, scope, grantedBy string
if err := d.QueryRow(`SELECT kind, scope, granted_by FROM web_sessions WHERE id='s'`).
Scan(&kind, &scope, &grantedBy); err != nil {
t.Fatalf("select new columns (missing?): %v", err)
}
if kind != "oidc" || scope != "full" || grantedBy != "" {
t.Errorf("legacy row defaults: got kind=%q scope=%q granted_by=%q, want oidc/full/empty",
kind, scope, grantedBy)
}
// Idempotent: second bootstrap must not error on already-present columns.
if err := Bootstrap(context.Background(), d); err != nil {
t.Fatalf("second bootstrap: %v", err)
}
}