feat: complete Go backend control-plane parity

Bridge Java-to-Go runtime behavior by enforcing forward ownership checks, wiring node command dispatch/diagnostics, and adding contract coverage so migrated APIs can run with production semantics.
2026-10-05 17:46:37 +08:00 · 2026-02-07 07:10:45 +00:00
parent b6333d81a2
commit f9bc165c16
7 changed files with 3341 additions and 7 deletions
@@ -0,0 +1,128 @@
+package contract_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+	"go-backend/internal/http/response"
+)
+
+func TestForwardOwnershipAndScopeContracts(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+
+	res, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`, "contract-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, err := res.LastInsertId()
+	if err != nil {
+		t.Fatalf("get tunnel id: %v", err)
+	}
+
+	resAdmin, err := repo.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
+	`, 1, "admin_user", "admin-forward", tunnelID, "1.1.1.1:443", "fifo", now, now, 0)
+	if err != nil {
+		t.Fatalf("insert admin forward: %v", err)
+	}
+	adminForwardID, err := resAdmin.LastInsertId()
+	if err != nil {
+		t.Fatalf("get admin forward id: %v", err)
+	}
+
+	resUser, err := repo.DB().Exec(`
+		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
+		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
+	`, 2, "normal_user", "user-forward", tunnelID, "8.8.8.8:53", "fifo", now, now, 1)
+	if err != nil {
+		t.Fatalf("insert user forward: %v", err)
+	}
+	userForwardID, err := resUser.LastInsertId()
+	if err != nil {
+		t.Fatalf("get user forward id: %v", err)
+	}
+
+	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
+	if err != nil {
+		t.Fatalf("generate user token: %v", err)
+	}
+
+	t.Run("non-owner cannot delete another user's forward", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/delete", bytes.NewBufferString(`{"id":`+jsonNumber(adminForwardID)+`}`))
+		req.Header.Set("Authorization", userToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		assertCodeMsg(t, res, -1, "转发不存在")
+	})
+
+	t.Run("non-admin forward list is scoped to owner", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/list", bytes.NewBufferString(`{}`))
+		req.Header.Set("Authorization", userToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+		arr, ok := out.Data.([]interface{})
+		if !ok {
+			t.Fatalf("expected array data, got %T", out.Data)
+		}
+		if len(arr) != 1 {
+			t.Fatalf("expected 1 forward, got %d", len(arr))
+		}
+		item, ok := arr[0].(map[string]interface{})
+		if !ok {
+			t.Fatalf("expected object item, got %T", arr[0])
+		}
+		if got := int64(item["id"].(float64)); got != userForwardID {
+			t.Fatalf("expected forward id %d, got %d", userForwardID, got)
+		}
+	})
+
+	t.Run("diagnose no longer returns hardcoded success", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/diagnose", bytes.NewBufferString(`{"forwardId":`+jsonNumber(userForwardID)+`}`))
+		req.Header.Set("Authorization", userToken)
+		res := httptest.NewRecorder()
+
+		router.ServeHTTP(res, req)
+
+		var out response.R
+		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code == 0 {
+			t.Fatalf("expected non-zero code for missing runtime path, got success")
+		}
+	})
+}
+
+func jsonNumber(v int64) string {
+	return strconv.FormatInt(v, 10)
+}
@@ -0,0 +1,154 @@
+package contract_test
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+	httpserver "go-backend/internal/http"
+	"go-backend/internal/http/handler"
+	"go-backend/internal/http/response"
+	"go-backend/internal/store/sqlite"
+)
+
+func TestOpenAPISubStoreContracts(t *testing.T) {
+	router, repo := setupContractRouter(t, "contract-jwt-secret")
+
+	const tunnelFlowGB = int64(500)
+	const tunnelInFlow = int64(123)
+	const tunnelOutFlow = int64(456)
+	const tunnelExpTimeMs = int64(2727251700000)
+
+	now := time.Now().UnixMilli()
+	res, err := repo.DB().Exec(`INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		"contract-tunnel", 1.0, 1, "tls", 1, now, now, 1, nil, 0)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, err := res.LastInsertId()
+	if err != nil {
+		t.Fatalf("last insert id: %v", err)
+	}
+	if _, err := repo.DB().Exec(`INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(?, ?, NULL, ?, ?, ?, ?, ?, ?, ?)`,
+		1, tunnelID, 99999, tunnelFlowGB, tunnelInFlow, tunnelOutFlow, 1, tunnelExpTimeMs, 1); err != nil {
+		t.Fatalf("insert user_tunnel: %v", err)
+	}
+
+	t.Run("default user subscription payload", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user", nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+
+		expected := "upload=0; download=0; total=107373108658176; expire=2727251700"
+		if string(body) != expected {
+			t.Fatalf("expected body %q, got %q", expected, string(body))
+		}
+		if got := resp.Header().Get("subscription-userinfo"); got != expected {
+			t.Fatalf("expected subscription-userinfo %q, got %q", expected, got)
+		}
+		if !strings.Contains(resp.Header().Get("Content-Type"), "text/plain") {
+			t.Fatalf("expected text/plain content type, got %q", resp.Header().Get("Content-Type"))
+		}
+	})
+
+	t.Run("tunnel scoped subscription payload", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user&tunnel="+strconv.FormatInt(tunnelID, 10), nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+
+		expected := "upload=123; download=456; total=536870912000; expire=2727251700"
+		if string(body) != expected {
+			t.Fatalf("expected body %q, got %q", expected, string(body))
+		}
+		if got := resp.Header().Get("subscription-userinfo"); got != expected {
+			t.Fatalf("expected subscription-userinfo %q, got %q", expected, got)
+		}
+	})
+
+	t.Run("invalid credentials returns contract error", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=wrong", nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		assertCodeMsg(t, resp, -1, "鉴权失败")
+	})
+
+	t.Run("missing tunnel returns contract error", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/open_api/sub_store?user=admin_user&pwd=admin_user&tunnel=999999", nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		assertCodeMsg(t, resp, -1, "隧道不存在")
+	})
+}
+
+func TestSpeedLimitTunnelsRouteAlias(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, _ := setupContractRouter(t, secret)
+
+	t.Run("missing token blocked", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		assertCodeMsg(t, resp, 401, "未登录或token已过期")
+	})
+
+	t.Run("admin token receives success envelope", func(t *testing.T) {
+		token, err := auth.GenerateToken(1, "admin_user", 0, secret)
+		if err != nil {
+			t.Fatalf("generate token: %v", err)
+		}
+
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
+		req.Header.Set("Authorization", token)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		var out response.R
+		if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+	})
+}
+
+func setupContractRouter(t *testing.T, jwtSecret string) (http.Handler, *sqlite.Repository) {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "contract.db")
+	repo, err := sqlite.Open(dbPath)
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = repo.Close()
+	})
+
+	h := handler.New(repo, jwtSecret)
+	return httpserver.NewRouter(h, jwtSecret), repo
+}