ci: 复用部署服务器缓存并支持 HTTPS 同源登录

internal/handler/identity_test.go

@@ -49,3 +49,35 @@ func TestDevelopmentLoginDisabledByDefault(t *testing.T) {
 		t.Fatal("development login open outside explicitly enabled environment")
 	}
 }
+
+func TestHTTPSPublicOriginBehindProxy(t *testing.T) {
+	auth, err := service.NewAuthService(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := func(context.Context) error { return nil }
+	for _, tc := range []struct {
+		name, publicOrigin, host, origin, forwardedProto string
+		status                                           int
+	}{
+		{"configured HTTPS", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "https", 503},
+		{"no reliance on proxy header", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "", 503},
+		{"foreign origin", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://evil.example", "https", 403},
+		{"HTTP origin rejected", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "http://veyra.sundynix.cn", "https", 403},
+		{"wrong host", "https://veyra.sundynix.cn", "evil.example", "https://veyra.sundynix.cn", "https", 403},
+		{"spoofed proxy header", "", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "https", 403},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			router := NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), IdentityOptions{Auth: auth, DevelopmentLogin: true, PublicOrigin: tc.publicOrigin})
+			req := httptest.NewRequest(http.MethodPost, "http://"+tc.host+"/api/admin/v1/auth/login", strings.NewReader(`{"login_name":"admin","password":"test-password"}`))
+			req.Header.Set("Content-Type", "application/json")
+			req.Header.Set("Origin", tc.origin)
+			req.Header.Set("X-Forwarded-Proto", tc.forwardedProto)
+			rec := httptest.NewRecorder()
+			router.ServeHTTP(rec, req)
+			if rec.Code != tc.status {
+				t.Fatalf("got %d want %d", rec.Code, tc.status)
+			}
+		})
+	}
+}