实现首轮协议与 Transit 签名 PoC

2026-09-11 15:52:19 +00:00
parent cc30a7cb6a
commit ab5dbebca7
13 changed files with 1023 additions and 0 deletions
@@ -0,0 +1,69 @@
+package protocol
+
+import (
+	"errors"
+	"net/url"
+	"reflect"
+	"testing"
+)
+
+func TestParseExchangeRequest(t *testing.T) {
+	request, err := ParseExchangeRequest(validForm())
+	if err != nil {
+		t.Fatalf("ParseExchangeRequest() error = %v", err)
+	}
+
+	if request.ClientID != "homelab-infra-ci" {
+		t.Fatalf("ClientID = %q", request.ClientID)
+	}
+	if !reflect.DeepEqual(request.Scopes, []string{"bao.login", "ssh.certificate"}) {
+		t.Fatalf("Scopes = %#v", request.Scopes)
+	}
+}
+
+func TestParseExchangeRequestRejectsInvalidInput(t *testing.T) {
+	tests := []struct {
+		name   string
+		mutate func(url.Values)
+		code   string
+	}{
+		{name: "missing client id", mutate: func(v url.Values) { v.Del("client_id") }, code: "invalid_request"},
+		{name: "short client id", mutate: func(v url.Values) { v.Set("client_id", "ci") }, code: "invalid_request"},
+		{name: "uppercase client id", mutate: func(v url.Values) { v.Set("client_id", "CI-worker") }, code: "invalid_request"},
+		{name: "leading hyphen", mutate: func(v url.Values) { v.Set("client_id", "-ci-worker") }, code: "invalid_request"},
+		{name: "missing token", mutate: func(v url.Values) { v.Del("subject_token") }, code: "invalid_request"},
+		{name: "wrong grant", mutate: func(v url.Values) { v.Set("grant_type", "client_credentials") }, code: "unsupported_grant_type"},
+		{name: "missing audience", mutate: func(v url.Values) { v.Del("audience") }, code: "invalid_target"},
+		{name: "multiple audiences", mutate: func(v url.Values) { v.Add("audience", "second") }, code: "invalid_target"},
+		{name: "missing scope", mutate: func(v url.Values) { v.Del("scope") }, code: "invalid_scope"},
+		{name: "actor token", mutate: func(v url.Values) { v.Set("actor_token", "not-supported") }, code: "invalid_request"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			form := validForm()
+			test.mutate(form)
+
+			_, err := ParseExchangeRequest(form)
+			var requestErr *RequestError
+			if !errors.As(err, &requestErr) {
+				t.Fatalf("error = %v, want RequestError", err)
+			}
+			if requestErr.Code != test.code {
+				t.Fatalf("error code = %q, want %q", requestErr.Code, test.code)
+			}
+		})
+	}
+}
+
+func validForm() url.Values {
+	return url.Values{
+		"grant_type":           {TokenExchangeGrantType},
+		"client_id":            {"homelab-infra-ci"},
+		"subject_token":        {"test-subject-token"},
+		"subject_token_type":   {JWTTokenType},
+		"requested_token_type": {AccessTokenType},
+		"audience":             {"https://bao.ad.ddupan.top:8200"},
+		"scope":                {"bao.login ssh.certificate"},
+	}
+}