Update: 将子项目从 submodule 转为完整内容

- 移除 GovAI, nomifun-tauri, 算力盒子的 submodule 引用 - 添加所有子项目的完整源代码 - 保留原始 .git 为 .git.bak 备份
2026-07-04 19:20:46 +08:00
parent 54d6465fa7
commit f7a720204a
3360 changed files with 802660 additions and 3 deletions
@@ -0,0 +1,131 @@
+//! Auth protection tests — all system endpoints return 403 without auth.
+
+mod common;
+
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use tower::ServiceExt;
+
+use common::{build_app, get_request};
+
+#[tokio::test]
+async fn auth_required_get_settings() {
+    let (app, _) = build_app().await;
+    let resp = app.oneshot(get_request("/api/settings")).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_patch_settings() {
+    let (app, _) = build_app().await;
+    let req = Request::builder()
+        .method("PATCH")
+        .uri("/api/settings")
+        .header("content-type", "application/json")
+        .body(Body::from(r#"{"language":"en-US"}"#))
+        .unwrap();
+    let resp = app.oneshot(req).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_get_client_prefs() {
+    let (app, _) = build_app().await;
+    let resp = app.oneshot(get_request("/api/settings/client")).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_put_client_prefs() {
+    let (app, _) = build_app().await;
+    let req = Request::builder()
+        .method("PUT")
+        .uri("/api/settings/client")
+        .header("content-type", "application/json")
+        .body(Body::from(r#"{"key":"value"}"#))
+        .unwrap();
+    let resp = app.oneshot(req).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_get_providers() {
+    let (app, _) = build_app().await;
+    let resp = app.oneshot(get_request("/api/providers")).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_post_providers() {
+    let (app, _) = build_app().await;
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/providers")
+        .header("content-type", "application/json")
+        .body(Body::from(
+            r#"{"platform":"openai","name":"Test","base_url":"https://api.openai.com","api_key":"sk-test"}"#,
+        ))
+        .unwrap();
+    let resp = app.oneshot(req).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_delete_provider() {
+    let (app, _) = build_app().await;
+    let req = Request::builder()
+        .method("DELETE")
+        .uri("/api/providers/some-id")
+        .body(Body::empty())
+        .unwrap();
+    let resp = app.oneshot(req).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_system_info() {
+    let (app, _) = build_app().await;
+    let resp = app.oneshot(get_request("/api/system/info")).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_check_update() {
+    let (app, _) = build_app().await;
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/system/check-update")
+        .header("content-type", "application/json")
+        .body(Body::from(r#"{}"#))
+        .unwrap();
+    let resp = app.oneshot(req).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_detect_protocol() {
+    let (app, _) = build_app().await;
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/providers/detect-protocol")
+        .header("content-type", "application/json")
+        .body(Body::from(
+            r#"{"base_url":"https://api.example.com","api_key":"sk-test"}"#,
+        ))
+        .unwrap();
+    let resp = app.oneshot(req).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}
+
+#[tokio::test]
+async fn auth_required_fetch_models() {
+    let (app, _) = build_app().await;
+    let req = Request::builder()
+        .method("POST")
+        .uri("/api/providers/some-id/models")
+        .header("content-type", "application/json")
+        .body(Body::from(r#"{}"#))
+        .unwrap();
+    let resp = app.oneshot(req).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::FORBIDDEN);
+}