pro/im_server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: unify internal api authentication

Browse Source
This commit is contained in:
richjohnrambo
2026-09-21 23:08:15 +08:00
parent 186cfa21c8
commit dc36ce292e
3 changed files with 36 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal_cultivate_test.go
+20 -8
View File
@@ -1,16 +1,21 @@
package main
import (
"crypto/hmac"
"crypto/sha256"
"encoding/hex"
"net/http"
"net/http/httptest"
"strconv"
"strings"
"testing"
"time"
)
func TestInternalCultivateRequiresSignedServiceRequest(t *testing.T) {
previous := internalAPI
defer func() { internalAPI = previous }()
internalAPI = internalAPIRuntime{config: internalAPIConfig{Enabled: true, Services: map[string]internalAPIServiceConfig{"cultivate-server": {Secret: "secret", Allow: []string{internalCapabilityCultivate}}}}}
internalAPI = internalAPIRuntime{config: internalAPIConfig{Enabled: true, Services: map[string]internalAPIServiceConfig{"hotgo-admin": {Secret: "secret"}}}}
req := httptest.NewRequest(http.MethodPost, "/internal/cultivate/tenants/default/users/batch", strings.NewReader(`{"user_ids":[1]}`))
rec := httptest.NewRecorder()
serveInternalCultivate(rec, req, "/internal/cultivate/")
@@ -19,18 +24,25 @@ func TestInternalCultivateRequiresSignedServiceRequest(t *testing.T) {
}
}
func TestInternalCultivateRejectsWrongCapability(t *testing.T) {
func TestInternalCultivateUsesSharedInternalCredential(t *testing.T) {
previous := internalAPI
defer func() { internalAPI = previous }()
internalAPI = internalAPIRuntime{config: internalAPIConfig{Enabled: true, Services: map[string]internalAPIServiceConfig{"cultivate-server": {Secret: "secret", Allow: []string{internalCapabilityAdminQuery}}}}}
internalAPI = internalAPIRuntime{config: internalAPIConfig{Enabled: true, TimeWindowSeconds: 300, Services: map[string]internalAPIServiceConfig{
"hotgo-admin": {Secret: "shared-secret", Allow: []string{"admin_query"}},
"cultivate-server": {Secret: "ignored-separate-secret", Allow: []string{"cultivate"}},
}}}
req := httptest.NewRequest(http.MethodPost, "/internal/cultivate/tenants/default/users/batch", strings.NewReader(`{"user_ids":[1]}`))
req.Header.Set(internalHeaderService, "cultivate-server")
req.Header.Set(internalHeaderTimestamp, "1")
timestamp := strconv.FormatInt(time.Now().Unix(), 10)
req.Header.Set(internalHeaderTimestamp, timestamp)
req.Header.Set(internalHeaderNonce, "nonce")
req.Header.Set(internalHeaderSignature, "signature")
bodyHash := sha256.Sum256([]byte(`{"user_ids":[1]}`))
signingText := strings.Join([]string{req.Method, req.URL.RequestURI(), hex.EncodeToString(bodyHash[:]), timestamp, "nonce"}, "\n")
mac := hmac.New(sha256.New, []byte("shared-secret"))
_, _ = mac.Write([]byte(signingText))
req.Header.Set(internalHeaderSignature, hex.EncodeToString(mac.Sum(nil)))
rec := httptest.NewRecorder()
serveInternalCultivate(rec, req, "/internal/cultivate/")
if rec.Code != http.StatusForbidden {
t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
if !authorizeInternalAPI(rec, req) {
t.Fatalf("shared internal credential was rejected: status=%d body=%s", rec.Code, rec.Body.String())
}
}