mirror of
https://gitee.com/wanwujie/sub2api
synced 2026-04-03 06:52:13 +08:00
6826149a8f
Add a system-wide "Backend Mode" that disables user self-registration and self-service while keeping admin panel and API gateway fully functional. When enabled, only admin can log in; all user-facing routes return 403. Backend: - New setting key `backend_mode_enabled` with atomic cached reads (60s TTL) - BackendModeUserGuard middleware blocks non-admin authenticated routes - BackendModeAuthGuard middleware blocks registration/password-reset auth routes - Login/Login2FA/RefreshToken handlers reject non-admin when enabled - TokenPairWithUser struct for role-aware token refresh - 20 unit tests (middleware + service layer) Frontend: - Router guards redirect unauthenticated users to /login - Admin toggle in Settings page - Login page hides register link and footer in backend mode - 9 unit tests for router guard logic - i18n support (en/zh) 27 files changed, 833 insertions(+), 17 deletions(-) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
69 lines
1.6 KiB
Go
69 lines
1.6 KiB
Go
package routes
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/handler"
|
|
servermiddleware "github.com/Wei-Shaw/sub2api/internal/server/middleware"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/redis/go-redis/v9"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func newAuthRoutesTestRouter(redisClient *redis.Client) *gin.Engine {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
v1 := router.Group("/api/v1")
|
|
|
|
RegisterAuthRoutes(
|
|
v1,
|
|
&handler.Handlers{
|
|
Auth: &handler.AuthHandler{},
|
|
Setting: &handler.SettingHandler{},
|
|
},
|
|
servermiddleware.JWTAuthMiddleware(func(c *gin.Context) {
|
|
c.Next()
|
|
}),
|
|
redisClient,
|
|
nil,
|
|
)
|
|
|
|
return router
|
|
}
|
|
|
|
func TestAuthRoutesRateLimitFailCloseWhenRedisUnavailable(t *testing.T) {
|
|
rdb := redis.NewClient(&redis.Options{
|
|
Addr: "127.0.0.1:1",
|
|
DialTimeout: 50 * time.Millisecond,
|
|
ReadTimeout: 50 * time.Millisecond,
|
|
WriteTimeout: 50 * time.Millisecond,
|
|
})
|
|
t.Cleanup(func() {
|
|
_ = rdb.Close()
|
|
})
|
|
|
|
router := newAuthRoutesTestRouter(rdb)
|
|
paths := []string{
|
|
"/api/v1/auth/register",
|
|
"/api/v1/auth/login",
|
|
"/api/v1/auth/login/2fa",
|
|
"/api/v1/auth/send-verify-code",
|
|
}
|
|
|
|
for _, path := range paths {
|
|
req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(`{}`))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.RemoteAddr = "203.0.113.10:12345"
|
|
|
|
w := httptest.NewRecorder()
|
|
router.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusTooManyRequests, w.Code, "path=%s", path)
|
|
require.Contains(t, w.Body.String(), "rate limit exceeded", "path=%s", path)
|
|
}
|
|
}
|