You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
#!/bin/bash
#
# 未登录访问测试
# 测试内容：验证受保护接口在未登录状态下拒绝访问
#
set -e
# 加载公共库
SCRIPT_DIR = " $( cd " $( dirname " ${ BASH_SOURCE [0] } " ) " && pwd ) "
source " $SCRIPT_DIR /lib.sh "
test_start "未登录访问测试 (None Auth)"
# 检查服务
check_service
# 定义要测试的受保护接口列表
# 格式: "METHOD PATH [BODY]"
PROTECTED_ENDPOINTS = (
"GET /api/auth/me"
"POST /api/auth/logout {}"
"GET /api/users"
"POST /api/users {}"
"GET /api/orgs"
"POST /api/orgs {}"
"GET /api/roles"
"POST /api/roles {}"
"GET /api/settings"
"GET /api/oauth/clients"
"GET /api/oauth/providers"
)
# 遍历测试
for endpoint in " ${ PROTECTED_ENDPOINTS [@] } " ; do
read -r method path body <<< " $endpoint "
step " 测试 $method $path (未登录) "
if [ " $method " = = "GET" ] ; then
RES = $( api_get " $path " "" )
elif [ " $method " = = "POST" ] ; then
RES = $( api_post " $path " " ${ body :- { } } " "" )
elif [ " $method " = = "PATCH" ] ; then
RES = $( api_patch " $path " " ${ body :- { } } " "" )
elif [ " $method " = = "DELETE" ] ; then
RES = $( api_delete " $path " "" )
fi
# 提取状态码
# 注意：
# check_http_code 默认提取 JSON 中的 code
code = $( echo " $RES " | jq -r '.code // 200' )
# 允许 401 (Standard HTTP) 或 40100 (Vigo Unauthorized)
if [ [ " $code " = = "401" || " $code " = = "40100" ] ] ; then
success " 访问被拒绝 (Code: $code ) "
else
error " 期望 401/40100, 实际: $code "
info " 响应: $RES "
# 标记失败但不立即退出，以便测试所有接口?
# 这里为了严格性，还是退出吧，或者用 fail_flag
exit 1
fi
done
test_end