wangjia
bcc114088c
ci-pangolin / Lint — shellcheck (push) Successful in 9s
ci-pangolin / OpenAPI Sync Check (push) Successful in 17s
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Successful in 5s
ci-pangolin / Flutter — analyze + test (push) Successful in 26s
ci-pangolin / Portable SQL — 可移植性 (mysql/sqlite) (push) Successful in 5s
ci-pangolin / Codegen Drift — token 生成物未漂移 (push) Successful in 5s
ci-pangolin / Go — build + test (push) Successful in 12s
ci-pangolin / E2E Smoke — L4 进程级端到端 (push) Successful in 15s
ci-pangolin / Go — integration (mysql/redis testcontainers) (push) Failing after 4m4s
ci-pangolin / Golden — 视觉回归 (components + auth) (push) Successful in 15s
后端:新端点 POST /v1/me/devices/{uuid}/logout(ForceLogout:吊销该设备会话+
丢 Redis JTI,设备留列表)。DeleteDevice 增强:先吊销会话再删设备(FK ON DELETE
CASCADE 清理会话行)+ 按 dp_uuid 吊销数据面凭证。CredentialRevoker 接口改
per-device RevokeDevice(dpUUID),由 nodes.Service 实现(查 connect_credentials
持有节点→推 CommandTypeRevoke + 删凭证行),main 注入替 NoopRevoker;devices 注入
SessionPort/JTIRevoker。修 SQLite 跨连接死锁(会话吊销移到 delete tx 之前)。
migration 000016 sessions FK 加 ON DELETE CASCADE。
客户端:account_api.forceLogout + devicesProvider.forceLogout(UI 留 P6)。
测试:ForceLogout(吊销会话+JTI+设备保留+403/404)+ DeleteDevice(级联+按 dp_uuid
吊销);NoopRevoker 改 dp_uuid;全量 server/flutter 测试绿。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
73 lines
2.3 KiB
Go
73 lines
2.3 KiB
Go
package store_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/wangjia/pangolin/server/internal/devices"
|
|
"github.com/wangjia/pangolin/server/internal/sessions"
|
|
)
|
|
|
|
type fakeJTIRevoker struct{ revoked []string }
|
|
|
|
func (f *fakeJTIRevoker) Revoke(_ context.Context, jti string) error {
|
|
f.revoked = append(f.revoked, jti)
|
|
return nil
|
|
}
|
|
|
|
func TestSQLite_ForceLogoutAndDelete(t *testing.T) {
|
|
ctx := context.Background()
|
|
db := openSQLite(t)
|
|
if _, err := db.Exec(`INSERT INTO users (id, uuid, email, pw_hash, dp_uuid, status) VALUES (1,'u','u@e.com','h','dp','active')`); err != nil {
|
|
t.Fatalf("seed user: %v", err)
|
|
}
|
|
if _, err := db.Exec(`INSERT INTO devices (id, uuid, user_id, name, platform, dp_uuid) VALUES (10,'dev-uuid',1,'Mac','macos','dp-dev')`); err != nil {
|
|
t.Fatalf("seed device: %v", err)
|
|
}
|
|
|
|
ss := sessions.NewStore(db)
|
|
ss.Create(ctx, 1, 10, "jti-a", "", "")
|
|
ss.Create(ctx, 1, 10, "jti-b", "", "")
|
|
|
|
jr := &fakeJTIRevoker{}
|
|
cr := &devices.NoopRevoker{}
|
|
svc := devices.NewService(devices.NewStore(db), cr)
|
|
svc.SetSessionPort(ss)
|
|
svc.SetJTIRevoker(jr)
|
|
|
|
// Force-logout: sessions revoked, JTIs dropped, device kept.
|
|
if e := svc.ForceLogout(ctx, 1, "dev-uuid"); e != nil {
|
|
t.Fatalf("ForceLogout: %v", e)
|
|
}
|
|
var active int
|
|
db.QueryRow(`SELECT COUNT(*) FROM sessions WHERE device_id=10 AND revoked_at IS NULL`).Scan(&active)
|
|
if active != 0 {
|
|
t.Fatalf("force-logout left %d active sessions", active)
|
|
}
|
|
if len(jr.revoked) != 2 {
|
|
t.Fatalf("expected 2 JTIs revoked, got %v", jr.revoked)
|
|
}
|
|
if list, _ := svc.ListDevices(ctx, 1); len(list) != 1 {
|
|
t.Fatalf("device should remain after force-logout, got %d", len(list))
|
|
}
|
|
|
|
// Ownership / existence guards.
|
|
if e := svc.ForceLogout(ctx, 2, "dev-uuid"); e == nil {
|
|
t.Fatalf("expected forbidden for other user")
|
|
}
|
|
if e := svc.ForceLogout(ctx, 1, "nope"); e == nil {
|
|
t.Fatalf("expected not found for unknown device")
|
|
}
|
|
|
|
// Clear-login (delete): device gone + per-device credential revoked by dp_uuid.
|
|
if e := svc.DeleteDevice(ctx, 1, "dev-uuid"); e != nil {
|
|
t.Fatalf("DeleteDevice: %v", e)
|
|
}
|
|
if list, _ := svc.ListDevices(ctx, 1); len(list) != 0 {
|
|
t.Fatalf("device should be gone, got %d", len(list))
|
|
}
|
|
if len(cr.Calls) != 1 || cr.Calls[0] != "dp-dev" {
|
|
t.Fatalf("expected dp-dev credential revoke, got %v", cr.Calls)
|
|
}
|
|
}
|