wangjia
7bbc944ae2
Deploy Server / release-deploy-server (push) Successful in 51s
服务端安全加固：多维限流（按 IP/按门店）+ 敏感接口独立速率上限抵御 DDoS/刷接口； 登录暴力破解新增按来源 IP 锁定；反代后正确识别真实客户端 IP； 门店 custom_fields 轻量配置（录入默认值）透传保存。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y2Wdwo7SmgBJU37cBrkhPK
65 lines
2.2 KiB
Go
65 lines
2.2 KiB
Go
package handler
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"gorm.io/gorm"
|
|
|
|
"github.com/wangjia/jiu/backend/internal/middleware"
|
|
"github.com/wangjia/jiu/backend/internal/model"
|
|
"github.com/wangjia/jiu/backend/testutil"
|
|
)
|
|
|
|
func setupShopRouter(db *gorm.DB) *gin.Engine {
|
|
shopH := NewShopHandler(db)
|
|
r := gin.New()
|
|
r.Use(gin.Recovery())
|
|
api := r.Group("/api/v1")
|
|
api.Use(middleware.JWT(db))
|
|
shop := api.Group("/shop")
|
|
shop.GET("/info", shopH.GetInfo)
|
|
shop.PUT("/info", shopH.UpdateInfo)
|
|
return r
|
|
}
|
|
|
|
// TestUpdateInfo_MergesCustomFields 钉死「设为默认」依赖的契约：
|
|
// 传 custom_fields 会 merge 进本店已有 custom_fields（保留旧键），且只动本店。
|
|
func TestUpdateInfo_MergesCustomFields(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
db := testutil.SetupTestDB()
|
|
shop := testutil.CreateTestShop(db, "S_CF1")
|
|
admin := testutil.CreateTestUser(db, shop.ID, "admin", "pw", "admin")
|
|
// 预置已有 custom_fields，验证 merge 不抹掉其它键
|
|
require.NoError(t, db.Model(&model.Shop{}).Where("id = ?", shop.ID).
|
|
Update("custom_fields", model.JSON{"foo": "bar"}).Error)
|
|
// 另一店做隔离对照
|
|
other := testutil.CreateTestShop(db, "S_CF2")
|
|
require.NoError(t, db.Model(&model.Shop{}).Where("id = ?", other.ID).
|
|
Update("custom_fields", model.JSON{"x": "y"}).Error)
|
|
|
|
r := setupShopRouter(db)
|
|
token := getAuthToken(admin.ID, shop.ID, "admin")
|
|
w := makeRequest(r, http.MethodPut, "/api/v1/shop/info", token, jsonBody(
|
|
"name", "改名后",
|
|
"custom_fields", map[string]interface{}{"default_series_id": 7},
|
|
))
|
|
assert.Equal(t, http.StatusOK, w.Code)
|
|
|
|
var got model.Shop
|
|
require.NoError(t, db.First(&got, shop.ID).Error)
|
|
assert.Equal(t, "改名后", got.Name)
|
|
assert.Equal(t, "bar", got.CustomFields["foo"]) // 旧键保留
|
|
assert.EqualValues(t, 7, got.CustomFields["default_series_id"]) // 新键写入
|
|
|
|
// 隔离：另一店的 custom_fields 不受影响
|
|
var o model.Shop
|
|
require.NoError(t, db.First(&o, other.ID).Error)
|
|
assert.Equal(t, "y", o.CustomFields["x"])
|
|
_, leaked := o.CustomFields["default_series_id"]
|
|
assert.False(t, leaked)
|
|
}
|