feat: integrate AI candidate review and automatic publication

internal/integration/development_user_credential_test.go

@@ -0,0 +1,62 @@
+package integration
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"git.sundynix.cn/Blizzard/Veyra/internal/apperror"
+	"git.sundynix.cn/Blizzard/Veyra/internal/repository"
+	"git.sundynix.cn/Blizzard/Veyra/internal/service"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func testDevelopmentUserCredentialChange(t *testing.T, ctx context.Context, pool *pgxpool.Pool, auth *service.AuthService) {
+	t.Helper()
+	user, err := auth.ProvisionUser(ctx, "maintenance_user", "a-maintenance-password", "Maintenance", "USER")
+	if err != nil {
+		t.Fatal(err)
+	}
+	session, err := auth.Login(ctx, "maintenance_user", "a-maintenance-password", "app")
+	if err != nil {
+		t.Fatal(err)
+	}
+	repo := repository.NewIdentityRepository(pool)
+	updater := service.NewDevelopmentUserCredentialService(repo, true)
+	if _, err := service.NewDevelopmentUserCredentialService(repo, false).Set(ctx, "maintenance_user", "maintenance_new", "tiny"); !errors.Is(err, apperror.ErrForbidden) {
+		t.Fatal("production maintenance allowed")
+	}
+	if _, err := updater.Set(ctx, "operator", "maintenance_new", "tiny"); !errors.Is(err, apperror.ErrForbidden) {
+		t.Fatal("administrator changed through USER command")
+	}
+	if _, err := updater.Set(ctx, "maintenance_user", "maintenance_new", "abc"); !errors.Is(err, apperror.ErrInvalidInput) {
+		t.Fatal("invalid password accepted")
+	}
+	if _, err := updater.Set(ctx, "maintenance_user", "bob", "tiny"); !errors.Is(err, apperror.ErrConflict) {
+		t.Fatal("duplicate login accepted")
+	}
+	if _, err := auth.Authenticate(ctx, session.Token, "app"); err != nil {
+		t.Fatal("failed change revoked session")
+	}
+	id, err := updater.Set(ctx, "maintenance_user", "maintenance_new", "tiny")
+	if err != nil || id != user.ID {
+		t.Fatal("user identity not preserved")
+	}
+	if _, err := auth.Authenticate(ctx, session.Token, "app"); !errors.Is(err, apperror.ErrUnauthenticated) {
+		t.Fatal("old session remained valid")
+	}
+	if _, err := auth.Login(ctx, "maintenance_user", "a-maintenance-password", "app"); !errors.Is(err, apperror.ErrUnauthenticated) {
+		t.Fatal("old credentials remained valid")
+	}
+	login, err := auth.Login(ctx, "maintenance_new", "tiny", "app")
+	if err != nil || login.User.ID != user.ID {
+		t.Fatal("new credentials failed")
+	}
+	if _, err := auth.Login(ctx, "maintenance_new", "tiny", "admin"); !errors.Is(err, apperror.ErrUnauthenticated) && !errors.Is(err, apperror.ErrForbidden) {
+		t.Fatal("USER authenticated as administrator")
+	}
+	_, credential, err := repo.FindCredential(ctx, "maintenance_new")
+	if err != nil || credential.PasswordHash == "tiny" {
+		t.Fatal("password stored without hashing")
+	}
+}