freedak
f7a720204a
- 移除 GovAI, nomifun-tauri, 算力盒子 的 submodule 引用 - 添加所有子项目的完整源代码 - 保留原始 .git 为 .git.bak 备份
132 lines
4.0 KiB
Rust
132 lines
4.0 KiB
Rust
//! Auth protection tests — all system endpoints return 403 without auth.
|
|
|
|
mod common;
|
|
|
|
use axum::body::Body;
|
|
use axum::http::{Request, StatusCode};
|
|
use tower::ServiceExt;
|
|
|
|
use common::{build_app, get_request};
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_get_settings() {
|
|
let (app, _) = build_app().await;
|
|
let resp = app.oneshot(get_request("/api/settings")).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_patch_settings() {
|
|
let (app, _) = build_app().await;
|
|
let req = Request::builder()
|
|
.method("PATCH")
|
|
.uri("/api/settings")
|
|
.header("content-type", "application/json")
|
|
.body(Body::from(r#"{"language":"en-US"}"#))
|
|
.unwrap();
|
|
let resp = app.oneshot(req).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_get_client_prefs() {
|
|
let (app, _) = build_app().await;
|
|
let resp = app.oneshot(get_request("/api/settings/client")).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_put_client_prefs() {
|
|
let (app, _) = build_app().await;
|
|
let req = Request::builder()
|
|
.method("PUT")
|
|
.uri("/api/settings/client")
|
|
.header("content-type", "application/json")
|
|
.body(Body::from(r#"{"key":"value"}"#))
|
|
.unwrap();
|
|
let resp = app.oneshot(req).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_get_providers() {
|
|
let (app, _) = build_app().await;
|
|
let resp = app.oneshot(get_request("/api/providers")).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_post_providers() {
|
|
let (app, _) = build_app().await;
|
|
let req = Request::builder()
|
|
.method("POST")
|
|
.uri("/api/providers")
|
|
.header("content-type", "application/json")
|
|
.body(Body::from(
|
|
r#"{"platform":"openai","name":"Test","base_url":"https://api.openai.com","api_key":"sk-test"}"#,
|
|
))
|
|
.unwrap();
|
|
let resp = app.oneshot(req).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_delete_provider() {
|
|
let (app, _) = build_app().await;
|
|
let req = Request::builder()
|
|
.method("DELETE")
|
|
.uri("/api/providers/some-id")
|
|
.body(Body::empty())
|
|
.unwrap();
|
|
let resp = app.oneshot(req).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_system_info() {
|
|
let (app, _) = build_app().await;
|
|
let resp = app.oneshot(get_request("/api/system/info")).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_check_update() {
|
|
let (app, _) = build_app().await;
|
|
let req = Request::builder()
|
|
.method("POST")
|
|
.uri("/api/system/check-update")
|
|
.header("content-type", "application/json")
|
|
.body(Body::from(r#"{}"#))
|
|
.unwrap();
|
|
let resp = app.oneshot(req).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_detect_protocol() {
|
|
let (app, _) = build_app().await;
|
|
let req = Request::builder()
|
|
.method("POST")
|
|
.uri("/api/providers/detect-protocol")
|
|
.header("content-type", "application/json")
|
|
.body(Body::from(
|
|
r#"{"base_url":"https://api.example.com","api_key":"sk-test"}"#,
|
|
))
|
|
.unwrap();
|
|
let resp = app.oneshot(req).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn auth_required_fetch_models() {
|
|
let (app, _) = build_app().await;
|
|
let req = Request::builder()
|
|
.method("POST")
|
|
.uri("/api/providers/some-id/models")
|
|
.header("content-type", "application/json")
|
|
.body(Body::from(r#"{}"#))
|
|
.unwrap();
|
|
let resp = app.oneshot(req).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
|
}
|