mirror of https://github.com/veypi/OneAuth.git
feat: Restrict user APIs to admins and add public user search
- Add /api/auth/users endpoint for authenticated users to search other users
- Only return public info (id, username, nickname, avatar) in search results
- Change /api/user routes to require user:admin permission instead of user:read
- Update auth tests to use /api/auth/me for self updates
- Add tests for new user search endpoint
master
veypi
7 days ago
parent
b8c894b5cf
commit
b0322047cd
@ -0,0 +1,74 @@
|
||||
//
|
||||
// Copyright (C) 2024 veypi <i@veypi.com>
|
||||
// 2025-03-04 16:08:06
|
||||
// Distributed under terms of the MIT license.
|
||||
//
|
||||
|
||||
package auth
|
||||
|
||||
import (
|
||||
"github.com/veypi/vbase/cfg"
|
||||
"github.com/veypi/vbase/models"
|
||||
"github.com/veypi/vigo"
|
||||
)
|
||||
|
||||
// PublicUserInfo 公开的用户信息（仅包含无关紧要的信息）
|
||||
type PublicUserInfo struct {
|
||||
ID string `json:"id"`
|
||||
Username string `json:"username"`
|
||||
Nickname string `json:"nickname"`
|
||||
Avatar string `json:"avatar"`
|
||||
}
|
||||
|
||||
// SearchUsersRequest 搜索用户请求
|
||||
type SearchUsersRequest struct {
|
||||
Keyword *string `json:"keyword" src:"query" desc:"搜索关键词（用户名或昵称）"`
|
||||
Limit int `json:"limit" src:"query" default:"20" desc:"返回数量限制"`
|
||||
}
|
||||
|
||||
// SearchUsersResponse 搜索用户响应
|
||||
type SearchUsersResponse struct {
|
||||
Items []PublicUserInfo `json:"items"`
|
||||
Total int64 `json:"total"`
|
||||
}
|
||||
|
||||
// searchUsers 搜索用户（公开接口，仅返回公开信息）
|
||||
func searchUsers(x *vigo.X, req *SearchUsersRequest) (*SearchUsersResponse, error) {
|
||||
if req.Limit <= 0 || req.Limit > 50 {
|
||||
req.Limit = 20
|
||||
}
|
||||
|
||||
db := cfg.DB().Model(&models.User{}).Where("status = ?", models.UserStatusActive)
|
||||
|
||||
// 搜索关键词
|
||||
if req.Keyword != nil && *req.Keyword != "" {
|
||||
keyword := "%" + *req.Keyword + "%"
|
||||
db = db.Where("username LIKE ? OR nickname LIKE ?", keyword, keyword)
|
||||
}
|
||||
|
||||
var total int64
|
||||
if err := db.Count(&total).Error; err != nil {
|
||||
return nil, vigo.ErrInternalServer.WithError(err)
|
||||
}
|
||||
|
||||
var users []models.User
|
||||
if err := db.Order("created_at DESC").Limit(req.Limit).Find(&users).Error; err != nil {
|
||||
return nil, vigo.ErrInternalServer.WithError(err)
|
||||
}
|
||||
|
||||
// 转换为公开信息
|
||||
items := make([]PublicUserInfo, len(users))
|
||||
for i, user := range users {
|
||||
items[i] = PublicUserInfo{
|
||||
ID: user.ID,
|
||||
Username: user.Username,
|
||||
Nickname: user.Nickname,
|
||||
Avatar: user.Avatar,
|
||||
}
|
||||
}
|
||||
|
||||
return &SearchUsersResponse{
|
||||
Items: items,
|
||||
Total: total,
|
||||
}, nil
|
||||
}
|
||||
@ -0,0 +1,89 @@
|
||||
package tests
|
||||
|
||||
import (
|
||||
"testing"
|
||||
)
|
||||
|
||||
// PublicUserInfo 公开用户信息响应
|
||||
type PublicUserInfo struct {
|
||||
ID string `json:"id"`
|
||||
Username string `json:"username"`
|
||||
Nickname string `json:"nickname"`
|
||||
Avatar string `json:"avatar"`
|
||||
}
|
||||
|
||||
// SearchUsersResp 搜索用户响应
|
||||
type SearchUsersResp struct {
|
||||
Items []PublicUserInfo `json:"items"`
|
||||
Total int64 `json:"total"`
|
||||
}
|
||||
|
||||
func TestSearchUsers(t *testing.T) {
|
||||
// Ensure base users are created (Admin, User1, User2)
|
||||
ensureUsers(t)
|
||||
|
||||
// Test 1: Search users without auth (should fail)
|
||||
t.Run("Search Users Without Auth", func(t *testing.T) {
|
||||
resp := doRequest(t, "GET", "/api/auth/users", nil, "")
|
||||
// Should return 401 unauthorized
|
||||
assertStatus(t, resp, 401)
|
||||
})
|
||||
|
||||
// Test 2: Search users with auth
|
||||
t.Run("Search Users With Auth", func(t *testing.T) {
|
||||
resp := doRequest(t, "GET", "/api/auth/users", nil, User1Token)
|
||||
assertStatus(t, resp, 200)
|
||||
|
||||
var data SearchUsersResp
|
||||
decodeResponse(t, resp, &data)
|
||||
t.Logf("Search users response: total=%d, items=%d", data.Total, len(data.Items))
|
||||
|
||||
// Should return users
|
||||
if data.Total <= 0 {
|
||||
t.Errorf("Expected some users, got total=%d", data.Total)
|
||||
}
|
||||
})
|
||||
|
||||
// Test 3: Search users with keyword
|
||||
t.Run("Search Users With Keyword", func(t *testing.T) {
|
||||
resp := doRequest(t, "GET", "/api/auth/users?keyword=user1", nil, User1Token)
|
||||
assertStatus(t, resp, 200)
|
||||
|
||||
var data SearchUsersResp
|
||||
decodeResponse(t, resp, &data)
|
||||
t.Logf("Search users with keyword: total=%d, items=%d", data.Total, len(data.Items))
|
||||
})
|
||||
|
||||
// Test 4: Verify public info is returned (only id, username, nickname, avatar)
|
||||
t.Run("Verify Public Info Only", func(t *testing.T) {
|
||||
resp := doRequest(t, "GET", "/api/auth/users?limit=1", nil, User1Token)
|
||||
assertStatus(t, resp, 200)
|
||||
|
||||
var data SearchUsersResp
|
||||
decodeResponse(t, resp, &data)
|
||||
|
||||
if len(data.Items) > 0 {
|
||||
user := data.Items[0]
|
||||
// Should have these fields
|
||||
if user.ID == "" {
|
||||
t.Error("Expected id to be present")
|
||||
}
|
||||
if user.Username == "" {
|
||||
t.Error("Expected username to be present")
|
||||
}
|
||||
// Nickname and avatar can be empty but field should exist
|
||||
t.Logf("User public info: id=%s, username=%s, nickname=%s, avatar=%s",
|
||||
user.ID, user.Username, user.Nickname, user.Avatar)
|
||||
}
|
||||
})
|
||||
|
||||
// Test 5: Admin can search users too
|
||||
t.Run("Admin Can Search Users", func(t *testing.T) {
|
||||
resp := doRequest(t, "GET", "/api/auth/users", nil, AdminToken)
|
||||
assertStatus(t, resp, 200)
|
||||
|
||||
var data SearchUsersResp
|
||||
decodeResponse(t, resp, &data)
|
||||
t.Logf("Admin search users: total=%d", data.Total)
|
||||
})
|
||||
}
|
||||
Loading…
Reference in New Issue