OneAuth/tests/edge_case_test.go

package tests

import (
	"strings"
	"testing"
)

// TestSQLInjection 测试 SQL 注入防护
func TestSQLInjection(t *testing.T) {
	ensureUsers(t)

	// 测试用户名中的 SQL 注入
	t.Run("SQL Injection in username", func(t *testing.T) {
		resp := doRequest(t, "POST", "/api/auth/register", map[string]string{
			"username": "admin' OR '1'='1",
			"password": "password123",
			"email":    "sql@test.com",
		}, "")
		// 应该正常处理，不应该崩溃或返回异常
		if resp.Code == 500 {
			t.Errorf("SQL injection caused server error: %s", resp.Body.String())
		}
	})

	// 测试组织代码中的 SQL 注入
	t.Run("SQL Injection in org code", func(t *testing.T) {
		resp := doRequest(t, "POST", "/api/orgs", map[string]string{
			"code": "test' OR '1'='1",
			"name": "SQL Test Org",
		}, User1Token)
		// 应该正常处理或返回业务错误，而不是 SQL 错误
		if resp.Code == 500 {
			t.Errorf("SQL injection in org code caused server error: %s", resp.Body.String())
		}
	})

	// 测试搜索中的 SQL 注入
	t.Run("SQL Injection in search", func(t *testing.T) {
		resp := doRequest(t, "GET", "/api/auth/users?keyword=admin' OR '1'='1", nil, AdminToken)
		// 应该正常处理
		if resp.Code == 500 {
			t.Errorf("SQL injection in search caused server error: %s", resp.Body.String())
		}
	})
}

// TestXSSPrevention 测试 XSS 防护
func TestXSSPrevention(t *testing.T) {
	ensureUsers(t)

	xssPayload := "<script>alert('xss')</script>"

	// 测试昵称中的 XSS
	t.Run("XSS in nickname", func(t *testing.T) {
		resp := doRequest(t, "PATCH", "/api/auth/me", map[string]string{
			"nickname": xssPayload,
		}, User1Token)

		if resp.Code == 200 {
			// 检查返回的数据是否被转义
			if strings.Contains(resp.Body.String(), "<script>") {
				t.Logf("Warning: XSS payload not escaped in response: %s", resp.Body.String())
			}
		}
	})

	// 测试组织名称中的 XSS
	t.Run("XSS in org name", func(t *testing.T) {
		resp := doRequest(t, "POST", "/api/orgs", map[string]string{
			"code": "xss_test_org",
			"name": xssPayload,
		}, User1Token)

		if resp.Code == 200 {
			if strings.Contains(resp.Body.String(), "<script>") {
				t.Logf("Warning: XSS payload not escaped in org response: %s", resp.Body.String())
			}
		}
	})
}

// TestInputValidation 测试输入验证
func TestInputValidation(t *testing.T) {
	ensureUsers(t)

	// 测试空用户名
	t.Run("Empty username", func(t *testing.T) {
		resp := doRequest(t, "POST", "/api/auth/register", map[string]string{
			"username": "",
			"password": "password123",
			"email":    "empty@test.com",
		}, "")
		if resp.Code == 200 {
			t.Errorf("Empty username should be rejected, got 200")
		}
	})

	// 测试空密码
	t.Run("Empty password", func(t *testing.T) {
		resp := doRequest(t, "POST", "/api/auth/register", map[string]string{
			"username": "testuser_empty_pass",
			"password": "",
			"email":    "emptypass@test.com",
		}, "")
		if resp.Code == 200 {
			t.Errorf("Empty password should be rejected, got 200")
		}
	})

	// 测试超长输入
	t.Run("Overlong username", func(t *testing.T) {
		longUsername := strings.Repeat("a", 300)
		resp := doRequest(t, "POST", "/api/auth/register", map[string]string{
			"username": longUsername,
			"password": "password123",
			"email":    "long@test.com",
		}, "")
		if resp.Code == 200 {
			t.Logf("Warning: Overlong username was accepted")
		}
	})

	// 测试无效邮箱格式
	t.Run("Invalid email format", func(t *testing.T) {
		resp := doRequest(t, "POST", "/api/auth/register", map[string]string{
			"username": "testuser_invalid_email",
			"password": "password123",
			"email":    "not-an-email",
		}, "")
		if resp.Code == 200 {
			t.Logf("Warning: Invalid email format was accepted")
		}
	})
}

// TestIDOR 测试不安全的直接对象引用 (IDOR)
func TestIDOR(t *testing.T) {
	ensureUsers(t)

	// 测试：User1 尝试访问 User2 的敏感信息
	t.Run("User1 tries to access User2's data", func(t *testing.T) {
		// 尝试通过 /api/users/{id} 访问其他用户信息
		resp := doRequest(t, "GET", "/api/users/"+User2ID, nil, User1Token)
		if resp.Code == 200 {
			// 检查是否返回了敏感信息
			t.Logf("Warning: User1 can access User2's data: %s", resp.Body.String())
		}
	})

	// 测试：User1 尝试修改 User2 的信息
	t.Run("User1 tries to modify User2's data", func(t *testing.T) {
		resp := doRequest(t, "PATCH", "/api/users/"+User2ID, map[string]string{
			"nickname": "Hacked by User1",
		}, User1Token)
		if resp.Code == 200 {
			t.Errorf("User1 should not be able to modify User2's data, got 200")
		}
	})
}

// TestAuthorizationBypass 测试授权绕过
func TestAuthorizationBypass(t *testing.T) {
	ensureUsers(t)

	// 测试：尝试访问需要认证但没有提供 token 的端点
	t.Run("Access protected endpoint without token", func(t *testing.T) {
		endpoints := []struct {
			method string
			path   string
		}{
			{"GET", "/api/users"},
			{"GET", "/api/orgs"},
			{"GET", "/api/roles"},
			{"GET", "/api/auth/me"},
		}

		for _, ep := range endpoints {
			resp := doRequest(t, ep.method, ep.path, nil, "")
			if resp.Code == 200 {
				t.Errorf("%s %s should require authentication, got 200", ep.method, ep.path)
			}
		}
	})

	// 测试：使用无效 token
	t.Run("Access with invalid token", func(t *testing.T) {
		resp := doRequest(t, "GET", "/api/auth/me", nil, "invalid_token_here")
		if resp.Code == 200 {
			t.Errorf("Invalid token should be rejected, got 200")
		}
	})

	// 测试：使用过期 token（如果有办法生成）
	t.Run("Access with malformed token", func(t *testing.T) {
		resp := doRequest(t, "GET", "/api/auth/me", nil, "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.invalid")
		if resp.Code == 200 {
			t.Errorf("Malformed token should be rejected, got 200")
		}
	})
}

// TestPrivilegeEscalation 测试权限提升
func TestPrivilegeEscalation(t *testing.T) {
	ensureUsers(t)

	// 测试：普通用户尝试赋予自己 admin 角色
	t.Run("User tries to assign admin role to self", func(t *testing.T) {
		resp := doRequest(t, "PUT", "/api/users/"+User1ID+"/roles", map[string]any{
			"role_ids": []string{"admin"},
		}, User1Token)
		if resp.Code == 200 {
			t.Errorf("User should not be able to assign admin role to self, got 200")
		}
	})

	// 测试：普通用户尝试修改自己的权限
	t.Run("User tries to modify own permissions", func(t *testing.T) {
		resp := doRequest(t, "PUT", "/api/users/"+User1ID+"/permissions", map[string]any{
			"permission_ids": []string{"*:*"},
		}, User1Token)
		if resp.Code == 200 {
			t.Errorf("User should not be able to modify own permissions, got 200")
		}
	})

	// 测试：普通用户尝试创建系统角色
	t.Run("User tries to create system role", func(t *testing.T) {
		resp := doRequest(t, "POST", "/api/roles", map[string]string{
			"code":        "super_admin",
			"name":        "Super Admin",
			"description": "Trying to escalate privileges",
		}, User1Token)
		if resp.Code == 200 {
			t.Errorf("User should not be able to create roles, got 200")
		}
	})
}

// TestRateLimiting 测试速率限制（如果实现了）
func TestRateLimiting(t *testing.T) {
	ensureUsers(t)

	// 快速发送多个请求
	t.Run("Rapid requests", func(t *testing.T) {
		for i := 0; i < 10; i++ {
			resp := doRequest(t, "GET", "/api/auth/me", nil, User1Token)
			if resp.Code == 429 {
				t.Logf("Rate limiting detected after %d requests", i+1)
				return
			}
		}
		t.Logf("No rate limiting detected")
	})
}

// TestSpecialCharacters 测试特殊字符处理
func TestSpecialCharacters(t *testing.T) {
	ensureUsers(t)

	specialChars := []string{
		"test\x00null",      // null byte
		"test\nnewline",     // newline
		"test\rcarriage",    // carriage return
		"test\ttab",         // tab
		"test<script>",      // HTML tag
		"test../../etc/passwd", // path traversal
		"test%00",           // URL encoded null
		"test%2e%2e%2f",     // URL encoded path traversal
	}

	for _, char := range specialChars {
		safeChar := strings.ReplaceAll(char, " ", "_")
		if len(safeChar) > 4 {
			safeChar = safeChar[:4]
		}
		codeSuffix := safeChar
		if len(codeSuffix) > 8 {
			codeSuffix = codeSuffix[:8]
		}
		t.Run("Special char: "+safeChar+"...", func(t *testing.T) {
			resp := doRequest(t, "POST", "/api/orgs", map[string]string{
				"code": "test_" + codeSuffix,
				"name": char,
			}, User1Token)

			if resp.Code == 500 {
				t.Errorf("Special character caused server error: %s", resp.Body.String())
			}
		})
	}
}

// TestUUIDManipulation 测试 UUID 操作
func TestUUIDManipulation(t *testing.T) {
	ensureUsers(t)

	// 测试无效 UUID 格式
	t.Run("Invalid UUID format", func(t *testing.T) {
		resp := doRequest(t, "GET", "/api/users/invalid-uuid", nil, AdminToken)
		if resp.Code == 200 {
			t.Errorf("Invalid UUID should be rejected, got 200")
		}
	})

	// 测试不存在的 UUID
	t.Run("Non-existent UUID", func(t *testing.T) {
		resp := doRequest(t, "GET", "/api/users/12345678-1234-1234-1234-123456789abc", nil, AdminToken)
		if resp.Code == 200 {
			t.Errorf("Non-existent UUID should return 404, got 200")
		}
	})

	// 测试 SQL 注入风格的 UUID
	t.Run("SQL injection in UUID", func(t *testing.T) {
		resp := doRequest(t, "GET", "/api/users/' OR '1'='1", nil, AdminToken)
		if resp.Code == 200 {
			t.Errorf("SQL injection in UUID should be rejected, got 200")
		}
	})
}