wlw/ai-agent
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): delegate access control to be-system

Browse Source 
Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.
This commit is contained in:
t
2026-08-21 00:41:07 +08:00
parent 3d47227fbd
commit 2bbf42b741
447 changed files with 1901 additions and 8920 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/pkg/openidentity/openidentity_test.go
-86
View File
@@ -1,86 +0,0 @@
package openidentity
import (
"testing"
"time"
"github.com/golang-jwt/jwt/v5"
)
func TestVerifyUserTokenOK(t *testing.T) {
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
"userId": "u_10001",
"name": "张三",
"exp": time.Now().Add(time.Hour).Unix(),
}, "secret")
claims, err := verifyUserToken(token, "secret")
if err != nil {
t.Fatalf("expected token to verify: %v", err)
}
if claims.UserID != "u_10001" || claims.Name != "张三" {
t.Fatalf("unexpected claims: %#v", claims)
}
}
func TestVerifyUserTokenUsesJWTHeaderAlgorithm(t *testing.T) {
token := signTestUserToken(t, jwt.SigningMethodHS384, map[string]any{
"userId": "u_10001",
"name": "张三",
"exp": time.Now().Add(time.Hour).Unix(),
}, "secret")
claims, err := verifyUserToken(token, "secret")
if err != nil {
t.Fatalf("expected HS384 token to verify from JWT header: %v", err)
}
if claims.UserID != "u_10001" || claims.Name != "张三" {
t.Fatalf("unexpected claims: %#v", claims)
}
}
func TestVerifyUserTokenRejectsInvalidSignature(t *testing.T) {
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
"userId": "u_10001",
"name": "张三",
"exp": time.Now().Add(time.Hour).Unix(),
}, "secret")
if _, err := verifyUserToken(token, "other-secret"); err == nil {
t.Fatalf("expected invalid signature to fail")
}
}
func TestVerifyUserTokenRejectsExpiredToken(t *testing.T) {
token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
"userId": "u_10001",
"name": "张三",
"exp": time.Now().Add(-time.Minute).Unix(),
}, "secret")
if _, err := verifyUserToken(token, "secret"); err == nil {
t.Fatalf("expected expired token to fail")
}
}
func TestVerifyUserTokenRequiresUserIDAndName(t *testing.T) {
tests := []map[string]any{
{"name": "张三", "exp": time.Now().Add(time.Hour).Unix()},
{"userId": "u_10001", "exp": time.Now().Add(time.Hour).Unix()},
}
for _, payload := range tests {
token := signTestUserToken(t, jwt.SigningMethodHS256, payload, "secret")
if _, err := verifyUserToken(token, "secret"); err == nil {
t.Fatalf("expected payload %#v to fail", payload)
}
}
}
func signTestUserToken(t *testing.T, method jwt.SigningMethod, payload map[string]any, secret string) string {
t.Helper()
token, err := jwt.NewWithClaims(method, jwt.MapClaims(payload)).SignedString([]byte(secret))
if err != nil {
t.Fatal(err)
}
return token
}