mirror of https://github.com/veypi/OneAuth.git
refactor(tests): Restructure test scripts with better coverage
- Add 00_none_auth.sh for unauthenticated access testing
- Replace 01_basic_auth.sh with 01_setup_users.sh for comprehensive user setup
- Replace 02_user_permission.sh with 02_resource_perm.sh for cross-user permission tests
- Update lib.sh to handle non-numeric code fields in response
- Update README.md with new test structure and usage instructions
- Update run_all.sh with new test sequence
master
veypi
1 week ago
parent
95cdcd557c
commit
1f380587a9
@ -0,0 +1,122 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# 02_resource_perm.sh
|
||||
#
|
||||
# 功能：测试跨用户资源访问权限
|
||||
# 场景：
|
||||
# 1. Admin 修改任意用户资源 (Allow)
|
||||
# 2. 普通用户修改自己资源 (Allow)
|
||||
# 3. 普通用户修改他人资源 (Deny)
|
||||
# 4. 普通用户修改 Admin 资源 (Deny)
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
# 加载公共库
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
source "$SCRIPT_DIR/lib.sh"
|
||||
|
||||
test_start "资源权限交叉验证测试"
|
||||
|
||||
# 检查服务
|
||||
check_service
|
||||
|
||||
# ==========================================
|
||||
# 准备环境 (登录三个账户)
|
||||
# ==========================================
|
||||
COMMON_PASS="password123"
|
||||
|
||||
ADMIN_USER="admin_${TEST_TIMESTAMP}"
|
||||
USER1_NAME="user1_${TEST_TIMESTAMP}"
|
||||
USER2_NAME="user2_${TEST_TIMESTAMP}"
|
||||
|
||||
step "0. 登录测试账户"
|
||||
|
||||
# Admin Login
|
||||
RES=$(login_user "$ADMIN_USER" "$COMMON_PASS")
|
||||
check_http_code "$RES" "200"
|
||||
ADMIN_TOKEN=$(get_token "$RES")
|
||||
ADMIN_ID=$(get_user_id "$RES")
|
||||
info "Admin ID: $ADMIN_ID"
|
||||
|
||||
# User1 Login
|
||||
RES=$(login_user "$USER1_NAME" "$COMMON_PASS")
|
||||
check_http_code "$RES" "200"
|
||||
USER1_TOKEN=$(get_token "$RES")
|
||||
USER1_ID=$(get_user_id "$RES")
|
||||
info "User1 ID: $USER1_ID"
|
||||
|
||||
# User2 Login
|
||||
RES=$(login_user "$USER2_NAME" "$COMMON_PASS")
|
||||
check_http_code "$RES" "200"
|
||||
USER2_TOKEN=$(get_token "$RES")
|
||||
USER2_ID=$(get_user_id "$RES")
|
||||
info "User2 ID: $USER2_ID"
|
||||
|
||||
|
||||
# ==========================================
|
||||
# 测试用例
|
||||
# ==========================================
|
||||
|
||||
# Case 1: Admin 修改 User1 (应成功)
|
||||
step "1. Admin 修改 User1 信息 (预期: 成功)"
|
||||
RES=$(api_patch "/api/users/$USER1_ID" '{"nickname": "Edited By Admin"}' "$ADMIN_TOKEN")
|
||||
check_http_code "$RES" "200"
|
||||
NICK=$(echo "$RES" | jq -r '.nickname')
|
||||
if [ "$NICK" == "Edited By Admin" ]; then
|
||||
check_success "Admin 修改 User1 成功"
|
||||
else
|
||||
error "Admin 修改失败, nickname=$NICK"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Case 2: User1 修改 User1 (应成功)
|
||||
step "2. User1 修改自己信息 (预期: 成功)"
|
||||
RES=$(api_patch "/api/users/$USER1_ID" '{"nickname": "Edited By Self"}' "$USER1_TOKEN")
|
||||
check_http_code "$RES" "200"
|
||||
NICK=$(echo "$RES" | jq -r '.nickname')
|
||||
if [ "$NICK" == "Edited By Self" ]; then
|
||||
check_success "User1 修改自己成功"
|
||||
else
|
||||
error "User1 修改自己失败, nickname=$NICK"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Case 3: User1 修改 User2 (应失败)
|
||||
step "3. User1 修改 User2 信息 (预期: 失败 403/404)"
|
||||
RES=$(api_patch "/api/users/$USER2_ID" '{"nickname": "Hacked By User1"}' "$USER1_TOKEN")
|
||||
# Vigo 可能返回 403 Forbidden 或 404 NotFound (如果做了隔离)
|
||||
code=$(echo "$RES" | jq -r '.code // 200')
|
||||
if [[ "$code" == "403"* ]] || [[ "$code" == "404"* ]] || [[ "$code" == "401"* ]]; then
|
||||
check_success "User1 修改 User2 被拒绝 (Code: $code)"
|
||||
else
|
||||
error "User1 竟然修改了 User2 ! Code: $code"
|
||||
info "Response: $RES"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Case 4: User1 修改 Admin (应失败)
|
||||
step "4. User1 修改 Admin 信息 (预期: 失败 403/404)"
|
||||
RES=$(api_patch "/api/users/$ADMIN_ID" '{"nickname": "Hacked By User1"}' "$USER1_TOKEN")
|
||||
code=$(echo "$RES" | jq -r '.code // 200')
|
||||
if [[ "$code" == "403"* ]] || [[ "$code" == "404"* ]] || [[ "$code" == "401"* ]]; then
|
||||
check_success "User1 修改 Admin 被拒绝 (Code: $code)"
|
||||
else
|
||||
error "User1 竟然修改了 Admin ! Code: $code"
|
||||
info "Response: $RES"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Case 5: User2 修改 User1 (应失败)
|
||||
step "5. User2 修改 User1 信息 (预期: 失败 403/404)"
|
||||
RES=$(api_patch "/api/users/$USER1_ID" '{"nickname": "Hacked By User2"}' "$USER2_TOKEN")
|
||||
code=$(echo "$RES" | jq -r '.code // 200')
|
||||
if [[ "$code" == "403"* ]] || [[ "$code" == "404"* ]] || [[ "$code" == "401"* ]]; then
|
||||
check_success "User2 修改 User1 被拒绝 (Code: $code)"
|
||||
else
|
||||
error "User2 竟然修改了 User1 ! Code: $code"
|
||||
info "Response: $RES"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
test_end
|
||||
@ -1,84 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# 用户权限测试
|
||||
# 测试内容：
|
||||
# - 第一个用户注册为 admin
|
||||
# - 第二个用户注册为 user
|
||||
# - user 可以修改自己的信息
|
||||
# - user 不能修改 admin 的信息
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
# 加载公共库
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
source "$SCRIPT_DIR/lib.sh"
|
||||
|
||||
# 测试用户
|
||||
ADMIN_USER="admin_user_$TEST_TIMESTAMP"
|
||||
ADMIN_PASS="admin123"
|
||||
ADMIN_EMAIL="$ADMIN_USER@test.com"
|
||||
|
||||
NORMAL_USER="normal_user_$TEST_TIMESTAMP"
|
||||
NORMAL_PASS="user123"
|
||||
NORMAL_EMAIL="$NORMAL_USER@test.com"
|
||||
|
||||
test_start "用户权限测试"
|
||||
|
||||
# 检查服务
|
||||
check_service
|
||||
|
||||
# 1. 第一个用户注册 (admin)
|
||||
step "1. 第一个用户注册 (自动成为 admin)"
|
||||
ADMIN_REG=$(register_user "$ADMIN_USER" "$ADMIN_PASS" "$ADMIN_EMAIL")
|
||||
echo "Admin 注册响应: $ADMIN_REG"
|
||||
check_http_code "$ADMIN_REG" "200"
|
||||
ADMIN_LOGIN=$(login_user "$ADMIN_USER" "$ADMIN_PASS")
|
||||
ADMIN_TOKEN=$(get_token "$ADMIN_LOGIN")
|
||||
ADMIN_ID=$(get_user_id "$ADMIN_LOGIN")
|
||||
info "Admin ID: $ADMIN_ID"
|
||||
check_success "Admin 注册并登录成功"
|
||||
|
||||
# 2. 第二个用户注册 (user)
|
||||
step "2. 第二个用户注册 (普通 user)"
|
||||
USER_REG=$(register_user "$NORMAL_USER" "$NORMAL_PASS" "$NORMAL_EMAIL")
|
||||
echo "User 注册响应: $USER_REG"
|
||||
check_http_code "$USER_REG" "200"
|
||||
USER_LOGIN=$(login_user "$NORMAL_USER" "$NORMAL_PASS")
|
||||
USER_TOKEN=$(get_token "$USER_LOGIN")
|
||||
USER_ID=$(get_user_id "$USER_LOGIN")
|
||||
info "User ID: $USER_ID"
|
||||
check_success "普通用户注册并登录成功"
|
||||
|
||||
# 3. user 可以修改自己的信息
|
||||
step "3. user 可以修改自己的信息"
|
||||
USER_UPDATE=$(api_patch "/api/users/$USER_ID" '{"nickname": "My Nickname"}' "$USER_TOKEN")
|
||||
echo "修改自己响应: $USER_UPDATE"
|
||||
check_http_code "$USER_UPDATE" "200"
|
||||
check_success "user 可以修改自己的信息"
|
||||
|
||||
# 4. user 不能修改 admin 的信息
|
||||
step "4. user 不能修改 admin 的信息 (应该返回 403)"
|
||||
ADMIN_UPDATE_BY_USER=$(api_patch "/api/users/$ADMIN_ID" '{"nickname": "Hacked"}' "$USER_TOKEN") || true
|
||||
echo "尝试修改 admin 响应: $ADMIN_UPDATE_BY_USER"
|
||||
if echo "$ADMIN_UPDATE_BY_USER" | grep -q '"code":403' || echo "$ADMIN_UPDATE_BY_USER" | grep -q '"code":404'; then
|
||||
check_success "user 不能修改 admin 的信息 (权限控制生效)"
|
||||
else
|
||||
error "权限控制失效"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 5. admin 可以修改任意用户的信息
|
||||
step "5. admin 可以修改任意用户的信息"
|
||||
USER_UPDATE_BY_ADMIN=$(api_patch "/api/users/$USER_ID" '{"nickname": "Updated By Admin"}' "$ADMIN_TOKEN")
|
||||
echo "Admin 修改 user 响应: $USER_UPDATE_BY_ADMIN"
|
||||
check_http_code "$USER_UPDATE_BY_ADMIN" "200"
|
||||
NICKNAME=$(echo "$USER_UPDATE_BY_ADMIN" | jq -r '.nickname')
|
||||
if [ "$NICKNAME" == "Updated By Admin" ]; then
|
||||
check_success "admin 可以修改任意用户的信息"
|
||||
else
|
||||
error "admin 修改失败"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
test_end
|
||||
Loading…
Reference in New Issue