senlinai/agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: complete audit security and frontend gaps

Browse Source
This commit is contained in:
yanweidong
2026-07-18 18:02:29 +08:00
parent 79feb20688
commit b7a84d31ea
28 changed files with 576 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
backend/internal/auth/service_test.go
View File

@@ -48,6 +48,32 @@ func TestLoginRejectsInvalidPassword(t *testing.T) {
require.ErrorContains(t, err, "invalid credentials")
}
func TestLoginReturnsSignedSessionToken(t *testing.T) {
database := newTestDB(t)
service := NewService(database, "test-secret")
token, err := service.CreateInvite(1, "lead@example.com")
require.NoError(t, err)
user, err := service.RegisterWithInvite(token, "lead@example.com", "Lead", "password123")
require.NoError(t, err)
sessionToken, err := service.Login("lead@example.com", "password123")
require.NoError(t, err)
userID, err := service.VerifySession(sessionToken)
require.NoError(t, err)
require.Equal(t, user.ID, userID)
require.NotEqual(t, fmt.Sprintf("user:%d", user.ID), sessionToken)
}
func TestVerifySessionRejectsForgeableLegacyToken(t *testing.T) {
database := newTestDB(t)
service := NewService(database, "test-secret")
_, err := service.VerifySession("user:1")
require.ErrorContains(t, err, "invalid token")
}
func newTestDB(t *testing.T) *gorm.DB {
t.Helper()
database, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{})