perms-system-server/internal/logic/pub/adminLoginLogic_test.go

package pub

import (
	"context"
	"errors"
	"testing"
	"time"

	"perms-system-server/internal/response"
	"perms-system-server/internal/testutil"
	"perms-system-server/internal/types"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// TC-0015: 超管正常登录(管理后台)
func TestAdminLogin_SuperAdmin(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()
	username := testutil.UniqueId()
	password := "TestPass123"

	_, cleanUser := insertTestUser(t, ctx, svcCtx, username, password, 1, 1)
	t.Cleanup(cleanUser)

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      username,
		Password:      password,
		ManagementKey: svcCtx.Config.Auth.ManagementKey,
	})
	require.NoError(t, err)
	require.NotNil(t, resp)
	assert.NotEmpty(t, resp.AccessToken)
	assert.NotEmpty(t, resp.RefreshToken)
	assert.True(t, resp.Expires > time.Now().Unix(), "expires应为未来的unix时间戳")
	assert.Equal(t, username, resp.UserInfo.Username)
	assert.Equal(t, int64(1), resp.UserInfo.IsSuperAdmin)
	assert.Nil(t, resp.UserInfo.Perms)
	assert.Equal(t, "SUPER_ADMIN", resp.UserInfo.MemberType)
}

// TC-0016: 普通用户被拒绝(审计H1修复: 仅超管可通过管理后台登录)
func TestAdminLogin_NormalUserRejected(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()
	username := testutil.UniqueId()
	password := "TestPass123"

	_, cleanUser := insertTestUser(t, ctx, svcCtx, username, password, 1, 2)
	t.Cleanup(cleanUser)

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      username,
		Password:      password,
		ManagementKey: svcCtx.Config.Auth.ManagementKey,
	})
	require.Nil(t, resp)
	require.Error(t, err)

	var codeErr *response.CodeError
	require.True(t, errors.As(err, &codeErr))
	assert.Equal(t, 403, codeErr.Code())
	assert.Equal(t, "仅超级管理员可通过管理后台登录", codeErr.Error())
}

// TC-0017: managementKey无效
func TestAdminLogin_InvalidManagementKey(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      "anyone",
		Password:      "pass",
		ManagementKey: "wrong-key",
	})
	require.Nil(t, resp)
	require.Error(t, err)

	var codeErr *response.CodeError
	require.True(t, errors.As(err, &codeErr))
	assert.Equal(t, 401, codeErr.Code())
	assert.Equal(t, "managementKey无效", codeErr.Error())
}

// TC-0018: managementKey为空
func TestAdminLogin_EmptyManagementKey(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      "anyone",
		Password:      "pass",
		ManagementKey: "",
	})
	require.Nil(t, resp)
	require.Error(t, err)

	var codeErr *response.CodeError
	require.True(t, errors.As(err, &codeErr))
	assert.Equal(t, 401, codeErr.Code())
	assert.Equal(t, "managementKey无效", codeErr.Error())
}

// TC-0019: 用户不存在
func TestAdminLogin_UserNotFound(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      "nonexistent_" + testutil.UniqueId(),
		Password:      "whatever",
		ManagementKey: svcCtx.Config.Auth.ManagementKey,
	})
	require.Nil(t, resp)
	require.Error(t, err)

	var codeErr *response.CodeError
	require.True(t, errors.As(err, &codeErr))
	assert.Equal(t, 401, codeErr.Code())
	assert.Equal(t, "用户名或密码错误", codeErr.Error())
}

// TC-0020: 密码错误
func TestAdminLogin_WrongPassword(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()
	username := testutil.UniqueId()

	_, cleanUser := insertTestUser(t, ctx, svcCtx, username, "CorrectPass", 1, 2)
	t.Cleanup(cleanUser)

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      username,
		Password:      "WrongPass",
		ManagementKey: svcCtx.Config.Auth.ManagementKey,
	})
	require.Nil(t, resp)
	require.Error(t, err)

	var codeErr *response.CodeError
	require.True(t, errors.As(err, &codeErr))
	assert.Equal(t, 401, codeErr.Code())
	assert.Equal(t, "用户名或密码错误", codeErr.Error())
}

// TC-0021: 账号冻结
func TestAdminLogin_AccountFrozen(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()
	username := testutil.UniqueId()
	password := "TestPass123"

	_, cleanUser := insertTestUser(t, ctx, svcCtx, username, password, 2, 2)
	t.Cleanup(cleanUser)

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      username,
		Password:      password,
		ManagementKey: svcCtx.Config.Auth.ManagementKey,
	})
	require.Nil(t, resp)
	require.Error(t, err)

	var codeErr *response.CodeError
	require.True(t, errors.As(err, &codeErr))
	assert.Equal(t, 403, codeErr.Code())
	assert.Equal(t, "账号已被冻结", codeErr.Error())
}

// TC-0022: 不带productCode时token无权限(perms为空)
func TestAdminLogin_NoPermsWithoutProductCode(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()
	username := testutil.UniqueId()
	password := "TestPass123"

	_, cleanUser := insertTestUser(t, ctx, svcCtx, username, password, 1, 1)
	t.Cleanup(cleanUser)

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      username,
		Password:      password,
		ManagementKey: svcCtx.Config.Auth.ManagementKey,
	})
	require.NoError(t, err)
	require.NotNil(t, resp)
	assert.Nil(t, resp.UserInfo.Perms, "管理后台不传productCode,不应加载权限列表")
	assert.Equal(t, "SUPER_ADMIN", resp.UserInfo.MemberType, "超管即使不传productCode也会被标记SUPER_ADMIN")
}

// TC-0025: adminLogin 用户名级别限流(H-2修复验证)
func TestAdminLogin_UsernameRateLimit(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()
	require.NotNil(t, svcCtx.UsernameLoginLimit, "UsernameLoginLimit 应被配置")

	username := "rl_" + testutil.UniqueId()

	logic := NewAdminLoginLogic(ctx, svcCtx)
	var last error
	for i := 0; i < 11; i++ {
		_, last = logic.AdminLogin(&types.AdminLoginReq{
			Username:      username,
			Password:      "wrong_pass",
			ManagementKey: svcCtx.Config.Auth.ManagementKey,
		})
		require.Error(t, last)
	}
	var ce *response.CodeError
	require.True(t, errors.As(last, &ce))
	assert.Equal(t, 429, ce.Code(), "第11次应被用户名级限流")
}

// TC-0024: SQL注入username
func TestAdminLogin_SQLInjection(t *testing.T) {
	ctx := context.Background()
	svcCtx := newTestSvcCtx()

	logic := NewAdminLoginLogic(ctx, svcCtx)
	resp, err := logic.AdminLogin(&types.AdminLoginReq{
		Username:      "' OR 1=1 --",
		Password:      "anything",
		ManagementKey: svcCtx.Config.Auth.ManagementKey,
	})
	require.Nil(t, resp)
	require.Error(t, err)

	var codeErr *response.CodeError
	require.True(t, errors.As(err, &codeErr))
	assert.Equal(t, 401, codeErr.Code())
	assert.Equal(t, "用户名或密码错误", codeErr.Error())
}