feat(auth): 验证码/注册/登录/JWT 鉴权模块 (tsk_2PFfyviECIXh)

实现 server/internal/auth 控制面鉴权底座，对应 doc/02 §4.1、doc/06 §3： - POST /v1/auth/code：IP+邮箱双维度 Redis 滑窗限频（同邮箱 1/min、同 IP 10/h） + 一次性邮箱域黑名单（embed 词表）→ 6 位数字码写 auth:code:{email} TTL 10min → 异步发信（SMTP / 开发态 log mailer）。 - POST /v1/auth/register：验码（一次性，删 key；超次数烧码）→ 单事务建号（uuid + dp_uuid 应用层生成、argon2id）+ 7 天 PRO 试用（source='trial'）→ 签发 JWT。 - POST /v1/auth/login：argon2id 校验（失败恒定时、未知用户走 dummy hash）；失败计数限流 rl:login:{email} + 锁定；banned 拒绝。 - POST /v1/auth/refresh：RS256，access 15min + refresh 30d 落 Redis 白名单 jwt:refresh:{jti}，旋转时删旧写新；JWT 头带 kid，验证端接受新旧公钥支持轮换。 - RequireAuth 中间件：解析 Bearer access，注入 user id（复用 codes.CtxKeyUserID 避免循环依赖）+ uuid + claims 到 context。 - 错误体统一走 internal/apierr 的 {code, message_zh, message_en}，文案双语脱敏。 - 文件拆分：handler/service/password/token/ratelimit/emailcheck/store/mailer/ middleware/errors/keyloader；config 增加可选 JWT PEM 路径/kid 加载。测试：password/token/ratelimit/emailcheck/service/handler/middleware 单测（miniredis，含注册全流程、重复邮箱 409、验证码错误/过期/复用/烧码、限频 429 带 Retry-After、登录失败锁定、banned 拒绝、refresh 旋转后旧 token 失效）， go test -race 通过；集成测试 integration_test.go（testcontainers MySQL8+Redis， register→login→refresh→受保护接口全链路，构建 tag integration）与 codes 模块同构。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 12:19:10 +08:00
parent 787151245e
commit a5e25b444f
22 changed files with 2756 additions and 3 deletions
@@ -0,0 +1,148 @@
+package auth
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/wangjia/pangolin/server/internal/codes"
+)
+
+// newTestHandler builds a Handler + chi router for HTTP-level tests.
+func newTestHandler(t *testing.T, cfg ServiceConfig) (*Service, http.Handler) {
+	t.Helper()
+	svc, _, _ := newService(t, cfg)
+	h := NewHandler(svc)
+	r := chi.NewRouter()
+	h.RegisterRoutes(r)
+	return svc, r
+}
+
+func doJSON(t *testing.T, h http.Handler, method, path string, body interface{}) *httptest.ResponseRecorder {
+	t.Helper()
+	var buf bytes.Buffer
+	if body != nil {
+		_ = json.NewEncoder(&buf).Encode(body)
+	}
+	req := httptest.NewRequest(method, path, &buf)
+	req.RemoteAddr = "203.0.113.5:1234"
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+func TestHandler_SendCode_204(t *testing.T) {
+	_, h := newTestHandler(t, ServiceConfig{})
+	rec := doJSON(t, h, http.MethodPost, "/auth/code", map[string]string{"email": "u@example.com"})
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want 204 (body %s)", rec.Code, rec.Body)
+	}
+}
+
+func TestHandler_SendCode_RateLimited_RetryAfter(t *testing.T) {
+	_, h := newTestHandler(t, ServiceConfig{EmailPerMinute: 1})
+	_ = doJSON(t, h, http.MethodPost, "/auth/code", map[string]string{"email": "u@example.com"})
+	rec := doJSON(t, h, http.MethodPost, "/auth/code", map[string]string{"email": "u@example.com"})
+	if rec.Code != http.StatusTooManyRequests {
+		t.Fatalf("status = %d, want 429", rec.Code)
+	}
+	ra := rec.Header().Get("Retry-After")
+	if ra == "" {
+		t.Fatal("missing Retry-After header")
+	}
+	if n, err := strconv.Atoi(ra); err != nil || n <= 0 {
+		t.Fatalf("bad Retry-After %q", ra)
+	}
+}
+
+func TestHandler_RegisterLoginRefresh_HTTP(t *testing.T) {
+	svc, h := newTestHandler(t, ServiceConfig{})
+	const email = "flow@example.com"
+
+	// Send code, read it from Redis.
+	_ = doJSON(t, h, http.MethodPost, "/auth/code", map[string]string{"email": email})
+	code := codeInRedis(t, svc, email)
+
+	// Register.
+	rec := doJSON(t, h, http.MethodPost, "/auth/register", map[string]string{
+		"email": email, "code": code, "password": "password123",
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("register status = %d (body %s)", rec.Code, rec.Body)
+	}
+	var reg tokenPairResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &reg)
+	if reg.AccessToken == "" || reg.ExpiresIn != 900 {
+		t.Fatalf("bad register response: %+v", reg)
+	}
+
+	// Login.
+	rec = doJSON(t, h, http.MethodPost, "/auth/login", map[string]string{
+		"email": email, "password": "password123",
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("login status = %d (body %s)", rec.Code, rec.Body)
+	}
+	var login tokenPairResponse
+	_ = json.Unmarshal(rec.Body.Bytes(), &login)
+
+	// Refresh.
+	rec = doJSON(t, h, http.MethodPost, "/auth/refresh", map[string]string{
+		"refresh_token": login.RefreshToken,
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("refresh status = %d (body %s)", rec.Code, rec.Body)
+	}
+}
+
+func TestMiddleware_RequireAuth(t *testing.T) {
+	rdb, _ := newMiniRedis(t)
+	tm := newTokenManager(t, rdb, time.Now)
+
+	// Protected handler that echoes the injected user id.
+	var gotUID int64
+	var gotOK bool
+	protected := RequireAuth(tm)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotUID, gotOK = UserIDFromContext(r.Context())
+		// Confirm the codes module reads the same value via its exported key.
+		if v, ok := r.Context().Value(codes.CtxKeyUserID).(int64); !ok || v != gotUID {
+			t.Errorf("codes.CtxKeyUserID mismatch: %v", v)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	// No token → 401.
+	rec := httptest.NewRecorder()
+	protected.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/me", nil))
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("no-token status = %d, want 401", rec.Code)
+	}
+
+	// Valid token → 200 with injected uid.
+	pair, _ := tm.Issue(context.Background(), 77, "uuid-77")
+	req := httptest.NewRequest(http.MethodGet, "/me", nil)
+	req.Header.Set("Authorization", "Bearer "+pair.AccessToken)
+	rec = httptest.NewRecorder()
+	protected.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("valid-token status = %d, want 200", rec.Code)
+	}
+	if !gotOK || gotUID != 77 {
+		t.Fatalf("injected uid = %d ok=%v, want 77", gotUID, gotOK)
+	}
+
+	// Refresh token must be rejected by access middleware.
+	req = httptest.NewRequest(http.MethodGet, "/me", nil)
+	req.Header.Set("Authorization", "Bearer "+pair.RefreshToken)
+	rec = httptest.NewRecorder()
+	protected.ServeHTTP(rec, req)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("refresh-as-access status = %d, want 401", rec.Code)
+	}
+}