grendervill
86dff94a02
Реализован Gateway по AGENT.md §8.3:
- оп-коды 0/1/2/3/4/7/10/11, единый конверт {op,t,d,s};
- HELLO с интервалом сердцебиения (45 с) и идентификатором сессии;
- IDENTIFY/RESUME с проверкой токена через auth.ResolveSession;
- READY: пользователь, серверы, видимые комнаты, роли, участники и права,
собранные через движок прав (VIEW_CHANNEL-фильтрация);
- HEARTBEAT → HEARTBEAT_ACK, лимит частоты IDENTIFY (5 с);
- RESUME: буфер на 1000 событий с TTL 5 минут, догон пропущенных событий и
подтверждение RESUMED, полный READY при расхождении состояния;
- рассылка Dispatch/SendToUser с буферизацией для отключённых сессий;
- проверка Origin по allowlist доменов инстанса (AGENT.md §9.7);
- httpx.statusRecorder пробрасывает Hijack, иначе апгрейд ломается.
Тесты: 6 сценариев Gateway (READY, скрытые комнаты, неверный токен,
heartbeat, dispatch, RESUME) и 2 теста маршрута /gateway через полный стек
middleware, включая отклонение чужого Origin.
315 lines
9.9 KiB
Go
315 lines
9.9 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/coder/websocket"
|
|
|
|
"glchat/internal/auth"
|
|
"glchat/internal/config"
|
|
"glchat/internal/database"
|
|
"glchat/internal/gateway"
|
|
"glchat/internal/store"
|
|
)
|
|
|
|
func newTestServer(t *testing.T) (*Server, *database.DB) {
|
|
t.Helper()
|
|
ctx := context.Background()
|
|
db, err := database.Open(ctx, database.Options{
|
|
Path: filepath.Join(t.TempDir(), "glchat.db"),
|
|
ReadPool: 2,
|
|
Migrate: true,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("open test database: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
if err := db.Close(); err != nil {
|
|
t.Errorf("close test database: %v", err)
|
|
}
|
|
})
|
|
|
|
cfg := config.Config{
|
|
Domain: "gl.mhspx.su",
|
|
WebRoot: filepath.Join("testdata", "web"),
|
|
FilesDomain: "files.gl.mhspx.su",
|
|
InstanceName: "glchat",
|
|
ListenAddr: "127.0.0.1:0",
|
|
Version: "v0.1.0-test",
|
|
Commit: "deadbee",
|
|
BuildDate: "2026-09-19T00:00:00Z",
|
|
MaxUploadSize: 26214400,
|
|
TLSEnabled: true,
|
|
SessionPepper: "test-pepper",
|
|
MasterKey: "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff",
|
|
Argon2MemoryKiB: 1024,
|
|
Argon2Iterations: 1,
|
|
Argon2Parallelism: 1,
|
|
LogLevel: "error",
|
|
LogFormat: "json",
|
|
}
|
|
logger := slog.New(slog.DiscardHandler)
|
|
st := store.New(db)
|
|
authService, err := auth.New(context.Background(), cfg, st, logger)
|
|
if err != nil {
|
|
t.Fatalf("initialize authentication: %v", err)
|
|
}
|
|
gatewayService := gateway.New(st, authService, gateway.NewSnapshot(st), logger, cfg.AllowedOrigins())
|
|
return New(cfg, db, logger, Deps{Store: st, Auth: authService, Gateway: gatewayService}), db
|
|
}
|
|
|
|
// TestGatewayRouteUpgrades проверяет связку: маршрут /gateway доступен через
|
|
// полный стек middleware, HELLO приходит до IDENTIFY (AGENT.md 8.3).
|
|
func TestGatewayRouteUpgrades(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
httpServer := httptest.NewServer(srv.Handler())
|
|
t.Cleanup(httpServer.Close)
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
url := "ws" + strings.TrimPrefix(httpServer.URL, "http") + "/gateway"
|
|
// coder/websocket закрывает тело ответа сам (dial.go: "You never need to
|
|
// close resp.Body yourself") — отсюда nolint:bodyclose.
|
|
conn, _, err := websocket.Dial(ctx, url, &websocket.DialOptions{ //nolint:bodyclose // тело закрывает библиотека
|
|
HTTPHeader: map[string][]string{"Origin": {"https://gl.mhspx.su"}},
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("dial /gateway: %v", err)
|
|
}
|
|
t.Cleanup(func() { _ = conn.CloseNow() })
|
|
|
|
_, data, err := conn.Read(ctx)
|
|
if err != nil {
|
|
t.Fatalf("read HELLO: %v", err)
|
|
}
|
|
var envelope struct {
|
|
Op int `json:"op"`
|
|
}
|
|
if err := json.Unmarshal(data, &envelope); err != nil {
|
|
t.Fatalf("decode HELLO: %v", err)
|
|
}
|
|
if envelope.Op != gateway.OpHello {
|
|
t.Fatalf("op = %d, want HELLO (%d)", envelope.Op, gateway.OpHello)
|
|
}
|
|
}
|
|
|
|
// TestGatewayRejectsForeignOrigin: подключение с чужого домена отклоняется
|
|
// (AGENT.md 9.7).
|
|
func TestGatewayRejectsForeignOrigin(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
httpServer := httptest.NewServer(srv.Handler())
|
|
t.Cleanup(httpServer.Close)
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
url := "ws" + strings.TrimPrefix(httpServer.URL, "http") + "/gateway"
|
|
conn, _, err := websocket.Dial(ctx, url, &websocket.DialOptions{ //nolint:bodyclose // тело закрывает библиотека
|
|
HTTPHeader: map[string][]string{"Origin": {"https://evil.example"}},
|
|
})
|
|
if err == nil {
|
|
_ = conn.CloseNow()
|
|
t.Fatal("connection from a foreign origin must be rejected")
|
|
}
|
|
}
|
|
|
|
func TestHealthz(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/healthz", nil))
|
|
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
var body map[string]any
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode response: %v", err)
|
|
}
|
|
if body["status"] != "ok" {
|
|
t.Errorf("status field = %v, want ok", body["status"])
|
|
}
|
|
if body["version"] != "v0.1.0-test" {
|
|
t.Errorf("version field = %v", body["version"])
|
|
}
|
|
if rec.Header().Get("X-Request-Id") == "" {
|
|
t.Error("X-Request-Id header is missing")
|
|
}
|
|
if rec.Header().Get("X-Content-Type-Options") != "nosniff" {
|
|
t.Error("security headers are missing")
|
|
}
|
|
}
|
|
|
|
func TestReadyzReportsDatabase(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/readyz", nil))
|
|
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
var body struct {
|
|
Status string `json:"status"`
|
|
Checks map[string]string `json:"checks"`
|
|
}
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode response: %v", err)
|
|
}
|
|
if body.Status != "ready" {
|
|
t.Errorf("status = %q, want ready", body.Status)
|
|
}
|
|
if body.Checks["database"] != "ok" {
|
|
t.Errorf("database check = %q, want ok", body.Checks["database"])
|
|
}
|
|
}
|
|
|
|
func TestReadyzFailsWhenDatabaseClosed(t *testing.T) {
|
|
srv, db := newTestServer(t)
|
|
if err := db.Close(); err != nil {
|
|
t.Fatalf("close database: %v", err)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/readyz", nil))
|
|
|
|
if rec.Code != http.StatusServiceUnavailable {
|
|
t.Fatalf("status = %d, want 503", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestMetaEndpoint(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/api/v1/meta", nil))
|
|
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
var body struct {
|
|
APIVersion string `json:"api_version"`
|
|
BaseURL string `json:"base_url"`
|
|
}
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode response: %v", err)
|
|
}
|
|
if body.APIVersion != "v1" {
|
|
t.Errorf("api_version = %q, want v1", body.APIVersion)
|
|
}
|
|
if body.BaseURL != "https://gl.mhspx.su" {
|
|
t.Errorf("base_url = %q", body.BaseURL)
|
|
}
|
|
}
|
|
|
|
func TestOpenAPIDocumentIsServed(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/api/v1/openapi.json", nil))
|
|
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
var doc map[string]any
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &doc); err != nil {
|
|
t.Fatalf("openapi document is not valid json: %v", err)
|
|
}
|
|
if doc["openapi"] != "3.1.0" {
|
|
t.Errorf("openapi version = %v, want 3.1.0", doc["openapi"])
|
|
}
|
|
if _, ok := doc["paths"].(map[string]any)["/meta"]; !ok {
|
|
t.Error("openapi document does not describe /meta")
|
|
}
|
|
}
|
|
|
|
func TestUnknownAPIRouteUsesErrorEnvelope(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/api/v1/does-not-exist", nil))
|
|
|
|
if rec.Code != http.StatusNotFound {
|
|
t.Fatalf("status = %d, want 404", rec.Code)
|
|
}
|
|
var body struct {
|
|
Error struct {
|
|
Code string `json:"code"`
|
|
Message string `json:"message"`
|
|
} `json:"error"`
|
|
}
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode error envelope: %v", err)
|
|
}
|
|
if body.Error.Code == "" || body.Error.Message == "" {
|
|
t.Errorf("error envelope is incomplete: %s", rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestServesWebClientWithSPAFallback(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
|
|
cases := []struct {
|
|
path string
|
|
wantStatus int
|
|
wantSubstr string
|
|
wantHeaders map[string]string
|
|
}{
|
|
{path: "/", wantStatus: http.StatusOK, wantSubstr: "glchat"},
|
|
{path: "/app/guild/1/channel/2", wantStatus: http.StatusOK, wantSubstr: "glchat"},
|
|
{path: "/assets/app.js", wantStatus: http.StatusOK, wantSubstr: "console.log"},
|
|
}
|
|
for _, tc := range cases {
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, tc.path, nil))
|
|
if rec.Code != tc.wantStatus {
|
|
t.Errorf("GET %s status = %d, want %d", tc.path, rec.Code, tc.wantStatus)
|
|
}
|
|
if !strings.Contains(rec.Body.String(), tc.wantSubstr) {
|
|
t.Errorf("GET %s body = %q, want it to contain %q", tc.path, rec.Body.String(), tc.wantSubstr)
|
|
}
|
|
}
|
|
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/assets/app.js", nil))
|
|
if got := rec.Header().Get("Cache-Control"); !strings.Contains(got, "immutable") {
|
|
t.Errorf("assets Cache-Control = %q, want immutable", got)
|
|
}
|
|
}
|
|
|
|
func TestServeWebClientReportsMissingBundle(t *testing.T) {
|
|
ctx := context.Background()
|
|
db, err := database.Open(ctx, database.Options{
|
|
Path: filepath.Join(t.TempDir(), "glchat.db"),
|
|
ReadPool: 2,
|
|
Migrate: true,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("open test database: %v", err)
|
|
}
|
|
t.Cleanup(func() { _ = db.Close() })
|
|
|
|
cfg := config.Config{Domain: "localhost", WebRoot: t.TempDir(), LogFormat: "json", LogLevel: "error"}
|
|
logger := slog.New(slog.DiscardHandler)
|
|
srv := New(cfg, db, logger, Deps{})
|
|
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil))
|
|
if rec.Code != http.StatusServiceUnavailable {
|
|
t.Errorf("status = %d, want 503 when the bundle is absent", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestMethodNotAllowedOnMeta(t *testing.T) {
|
|
srv, _ := newTestServer(t)
|
|
rec := httptest.NewRecorder()
|
|
srv.Handler().ServeHTTP(rec, httptest.NewRequestWithContext(context.Background(), http.MethodPost, "/api/v1/meta", nil))
|
|
|
|
if rec.Code != http.StatusMethodNotAllowed {
|
|
t.Fatalf("status = %d, want 405", rec.Code)
|
|
}
|
|
}
|