优化

auth/src/test/java/com/baiyue/auth/client/AuthorizationLoaderTest.java

@@ -0,0 +1,77 @@
+package com.baiyue.auth.client;
+
+import com.baiyue.auth.entity.AuthAccount;
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.common.core.exception.BizException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class AuthorizationLoaderTest {
+    private static final String INTERNAL_TOKEN = "test-internal-service-token-at-least-32-bytes";
+
+    @Mock private IamAuthorizationClient client;
+    @InjectMocks private AuthorizationLoader loader;
+
+    @BeforeEach
+    void setUp() {
+        ReflectionTestUtils.setField(loader, "internalToken", INTERNAL_TOKEN);
+        loader.validateConfiguration();
+    }
+
+    @Test
+    void returnsSnapshotWhenEchoedIdentityMatchesAccount() {
+        AuthAccount account = account();
+        AuthorizationSnapshot snapshot = snapshot(42L, 10001L, 9L, "MERCHANT");
+        when(client.load(eq(INTERNAL_TOKEN), any())).thenReturn(ApiResponse.success(snapshot));
+
+        assertSame(snapshot, loader.load(account));
+    }
+
+    @Test
+    void rejectsEveryMismatchedEchoedIdentityField() {
+        AuthAccount account = account();
+
+        assertIdentityMismatch(account, snapshot(43L, 10001L, 9L, "MERCHANT"));
+        assertIdentityMismatch(account, snapshot(42L, 10002L, 9L, "MERCHANT"));
+        assertIdentityMismatch(account, snapshot(42L, 10001L, 10L, "MERCHANT"));
+        assertIdentityMismatch(account, snapshot(42L, 10001L, 9L, "PLATFORM"));
+    }
+
+    private void assertIdentityMismatch(AuthAccount account, AuthorizationSnapshot snapshot) {
+        when(client.load(eq(INTERNAL_TOKEN), any())).thenReturn(ApiResponse.success(snapshot));
+
+        BizException exception = assertThrows(BizException.class, () -> loader.load(account));
+
+        assertEquals(ResultCode.FORBIDDEN, exception.getResultCode());
+    }
+
+    private AuthAccount account() {
+        AuthAccount account = new AuthAccount();
+        account.setId(42L);
+        account.setDefaultTenantId(10001L);
+        account.setDefaultMembershipId(9L);
+        account.setDefaultAppCode("MERCHANT");
+        return account;
+    }
+
+    private AuthorizationSnapshot snapshot(Long userId, Long tenantId, Long membershipId, String appCode) {
+        return new AuthorizationSnapshot(userId, tenantId, membershipId, appCode, appCode,
+                Set.of("MERCHANT_ADMIN"), Set.of("merchant:profile:view"));
+    }
+}

auth/src/test/java/com/baiyue/auth/controller/InternalAccountControllerConfigurationTest.java

@@ -0,0 +1,21 @@
+package com.baiyue.auth.controller;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class InternalAccountControllerConfigurationTest {
+    @Test
+    void rejectsEmptyAndShortInternalServiceTokens() {
+        assertTokenRejected(null);
+        assertTokenRejected("");
+        assertTokenRejected("short-token");
+    }
+
+    private void assertTokenRejected(String token) {
+        InternalAccountController controller = new InternalAccountController();
+        ReflectionTestUtils.setField(controller, "configuredToken", token);
+        assertThrows(IllegalStateException.class, controller::init);
+    }
+}