587 lines
18 KiB
JavaScript
587 lines
18 KiB
JavaScript
/**
|
||
* 管理员功能完整性测试脚本（Cookie + CSRF 认证模型）
|
||
*
|
||
* 覆盖范围：
|
||
* 1. 鉴权与权限校验
|
||
* 2. 用户管理（列表、封禁/删除自保护、存储权限）
|
||
* 3. 系统设置（获取/更新/参数校验）
|
||
* 4. 分享管理
|
||
* 5. 系统监控（健康、存储、日志）
|
||
* 6. 上传工具接口
|
||
*/
|
||
|
||
const http = require('http');
|
||
const https = require('https');
|
||
const { UserDB } = require('./database');
|
||
|
||
const BASE_URL = process.env.TEST_BASE_URL || 'http://127.0.0.1:40001';
|
||
|
||
const state = {
|
||
adminSession: {
|
||
cookies: {},
|
||
csrfToken: ''
|
||
},
|
||
adminUserId: null,
|
||
testUserId: null,
|
||
latestSettings: null
|
||
};
|
||
|
||
const testResults = {
|
||
passed: [],
|
||
failed: [],
|
||
warnings: []
|
||
};
|
||
|
||
function makeCookieHeader(cookies) {
|
||
return Object.entries(cookies || {})
|
||
.map(([k, v]) => `${k}=${v}`)
|
||
.join('; ');
|
||
}
|
||
|
||
function storeSetCookies(session, setCookieHeader) {
|
||
if (!session || !setCookieHeader) return;
|
||
const list = Array.isArray(setCookieHeader) ? setCookieHeader : [setCookieHeader];
|
||
for (const raw of list) {
|
||
const first = String(raw || '').split(';')[0];
|
||
const idx = first.indexOf('=');
|
||
if (idx <= 0) continue;
|
||
const key = first.slice(0, idx).trim();
|
||
const value = first.slice(idx + 1).trim();
|
||
session.cookies[key] = value;
|
||
if (key === 'csrf_token') {
|
||
session.csrfToken = value;
|
||
}
|
||
}
|
||
}
|
||
|
||
function isSafeMethod(method) {
|
||
const upper = String(method || '').toUpperCase();
|
||
return upper === 'GET' || upper === 'HEAD' || upper === 'OPTIONS';
|
||
}
|
||
|
||
function request(method, path, options = {}) {
|
||
const {
|
||
data = null,
|
||
session = null,
|
||
headers = {},
|
||
requireCsrf = true
|
||
} = options;
|
||
|
||
return new Promise((resolve, reject) => {
|
||
const url = new URL(path, BASE_URL);
|
||
const transport = url.protocol === 'https:' ? https : http;
|
||
|
||
const requestHeaders = { ...headers };
|
||
if (session) {
|
||
const cookieHeader = makeCookieHeader(session.cookies);
|
||
if (cookieHeader) {
|
||
requestHeaders.Cookie = cookieHeader;
|
||
}
|
||
|
||
if (requireCsrf && !isSafeMethod(method)) {
|
||
const csrfToken = session.csrfToken || session.cookies.csrf_token;
|
||
if (csrfToken) {
|
||
requestHeaders['X-CSRF-Token'] = csrfToken;
|
||
}
|
||
}
|
||
}
|
||
|
||
let payload = null;
|
||
if (data !== null && data !== undefined) {
|
||
payload = JSON.stringify(data);
|
||
requestHeaders['Content-Type'] = 'application/json';
|
||
requestHeaders['Content-Length'] = Buffer.byteLength(payload);
|
||
}
|
||
|
||
const req = transport.request({
|
||
protocol: url.protocol,
|
||
hostname: url.hostname,
|
||
port: url.port || (url.protocol === 'https:' ? 443 : 80),
|
||
path: url.pathname + url.search,
|
||
method,
|
||
headers: requestHeaders
|
||
}, (res) => {
|
||
let body = '';
|
||
res.on('data', chunk => {
|
||
body += chunk;
|
||
});
|
||
res.on('end', () => {
|
||
if (session) {
|
||
storeSetCookies(session, res.headers['set-cookie']);
|
||
}
|
||
|
||
let parsed = body;
|
||
try {
|
||
parsed = body ? JSON.parse(body) : {};
|
||
} catch (e) {
|
||
// keep raw text
|
||
}
|
||
|
||
resolve({
|
||
status: res.statusCode,
|
||
data: parsed,
|
||
headers: res.headers
|
||
});
|
||
});
|
||
});
|
||
|
||
req.on('error', reject);
|
||
|
||
if (payload) {
|
||
req.write(payload);
|
||
}
|
||
req.end();
|
||
});
|
||
}
|
||
|
||
async function initCsrf(session) {
|
||
const res = await request('GET', '/api/csrf-token', {
|
||
session,
|
||
requireCsrf: false
|
||
});
|
||
|
||
if (res.status === 200 && res.data && res.data.csrfToken) {
|
||
session.csrfToken = res.data.csrfToken;
|
||
}
|
||
|
||
return res;
|
||
}
|
||
|
||
function assert(condition, message) {
|
||
if (!condition) {
|
||
throw new Error(message);
|
||
}
|
||
}
|
||
|
||
function warn(message) {
|
||
testResults.warnings.push(message);
|
||
console.log(`[WARN] ${message}`);
|
||
}
|
||
|
||
async function test(name, fn) {
|
||
try {
|
||
await fn();
|
||
testResults.passed.push(name);
|
||
console.log(`[PASS] ${name}`);
|
||
} catch (error) {
|
||
testResults.failed.push({ name, error: error.message });
|
||
console.log(`[FAIL] ${name}: ${error.message}`);
|
||
}
|
||
}
|
||
|
||
function ensureTestUser() {
|
||
if (state.testUserId) {
|
||
return;
|
||
}
|
||
|
||
const suffix = Date.now();
|
||
const username = `admin_test_user_${suffix}`;
|
||
const email = `${username}@test.local`;
|
||
const password = `AdminTest#${suffix}`;
|
||
|
||
const id = UserDB.create({
|
||
username,
|
||
email,
|
||
password,
|
||
is_verified: 1
|
||
});
|
||
|
||
UserDB.update(id, {
|
||
is_active: 1,
|
||
is_banned: 0,
|
||
storage_permission: 'user_choice',
|
||
current_storage_type: 'oss'
|
||
});
|
||
|
||
state.testUserId = id;
|
||
}
|
||
|
||
function cleanupTestUser() {
|
||
if (!state.testUserId) return;
|
||
try {
|
||
UserDB.delete(state.testUserId);
|
||
} catch (error) {
|
||
warn(`清理测试用户失败: ${error.message}`);
|
||
} finally {
|
||
state.testUserId = null;
|
||
}
|
||
}
|
||
|
||
// 1. 安全检查：未认证访问应被拒绝
|
||
async function testUnauthorizedAccess() {
|
||
const res = await request('GET', '/api/admin/users');
|
||
assert(res.status === 401, `未认证访问应返回401，实际返回: ${res.status}`);
|
||
}
|
||
|
||
// 2. 安全检查：无效 Token 应被拒绝
|
||
async function testInvalidTokenAccess() {
|
||
const res = await request('GET', '/api/admin/users', {
|
||
headers: {
|
||
Authorization: 'Bearer invalid-token'
|
||
}
|
||
});
|
||
assert(res.status === 401, `无效token应返回401，实际: ${res.status}`);
|
||
}
|
||
|
||
// 3. 管理员登录（基于 Cookie）
|
||
async function testAdminLogin() {
|
||
await initCsrf(state.adminSession);
|
||
|
||
const res = await request('POST', '/api/login', {
|
||
data: {
|
||
username: 'admin',
|
||
password: 'admin123'
|
||
},
|
||
session: state.adminSession,
|
||
requireCsrf: false
|
||
});
|
||
|
||
assert(res.status === 200, `登录应返回200，实际: ${res.status}`);
|
||
assert(res.data && res.data.success === true, `登录失败: ${res.data?.message || 'unknown'}`);
|
||
assert(!!state.adminSession.cookies.token, '登录后应写入 token Cookie');
|
||
|
||
await initCsrf(state.adminSession);
|
||
|
||
const profileRes = await request('GET', '/api/user/profile', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(profileRes.status === 200, `读取profile应返回200，实际: ${profileRes.status}`);
|
||
assert(profileRes.data?.success === true, '读取profile应成功');
|
||
assert(profileRes.data?.user?.is_admin === 1, '登录账号应为管理员');
|
||
|
||
state.adminUserId = profileRes.data.user.id;
|
||
assert(Number.isInteger(state.adminUserId) && state.adminUserId > 0, '应获取管理员ID');
|
||
}
|
||
|
||
// 4. 用户列表获取（分页）
|
||
async function testGetUsers() {
|
||
const res = await request('GET', '/api/admin/users?paged=1&page=1&pageSize=20&sort=created_desc', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(Array.isArray(res.data?.users), 'users应为数组');
|
||
assert(!!res.data?.pagination, '分页模式应返回pagination');
|
||
}
|
||
|
||
// 5. 系统设置获取
|
||
async function testGetSettings() {
|
||
const res = await request('GET', '/api/admin/settings', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(res.data?.settings && typeof res.data.settings === 'object', '应包含settings对象');
|
||
assert(res.data?.settings?.smtp && typeof res.data.settings.smtp === 'object', '应包含smtp配置');
|
||
assert(res.data?.settings?.global_theme !== undefined, '应包含全局主题设置');
|
||
|
||
state.latestSettings = res.data.settings;
|
||
}
|
||
|
||
// 6. 更新系统设置（写回当前值，避免影响测试环境）
|
||
async function testUpdateSettings() {
|
||
const current = state.latestSettings || {};
|
||
const payload = {
|
||
global_theme: current.global_theme || 'dark',
|
||
max_upload_size: Number(current.max_upload_size || 10737418240)
|
||
};
|
||
|
||
const res = await request('POST', '/api/admin/settings', {
|
||
data: payload,
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
}
|
||
|
||
// 7. 健康检查
|
||
async function testHealthCheck() {
|
||
const res = await request('GET', '/api/admin/health-check', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(Array.isArray(res.data?.checks), '应包含checks数组');
|
||
assert(res.data?.summary && typeof res.data.summary === 'object', '应包含summary');
|
||
}
|
||
|
||
// 8. 存储统计
|
||
async function testStorageStats() {
|
||
const res = await request('GET', '/api/admin/storage-stats', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(res.data?.stats && typeof res.data.stats === 'object', '应包含stats对象');
|
||
}
|
||
|
||
// 9. 系统日志获取
|
||
async function testGetLogs() {
|
||
const res = await request('GET', '/api/admin/logs?page=1&pageSize=10', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(Array.isArray(res.data?.logs), 'logs应为数组');
|
||
}
|
||
|
||
// 10. 日志统计
|
||
async function testLogStats() {
|
||
const res = await request('GET', '/api/admin/logs/stats', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(res.data?.stats && typeof res.data.stats === 'object', '应包含stats对象');
|
||
}
|
||
|
||
// 11. 分享列表获取
|
||
async function testGetShares() {
|
||
const res = await request('GET', '/api/admin/shares', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(Array.isArray(res.data?.shares), 'shares应为数组');
|
||
}
|
||
|
||
// 12. 不能封禁自己
|
||
async function testCannotBanSelf() {
|
||
assert(state.adminUserId, '管理员ID未初始化');
|
||
|
||
const res = await request('POST', `/api/admin/users/${state.adminUserId}/ban`, {
|
||
data: { banned: true },
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `封禁自己应返回400，实际: ${res.status}`);
|
||
assert(String(res.data?.message || '').includes('不能封禁自己'), '应提示不能封禁自己');
|
||
}
|
||
|
||
// 13. 不能删除自己
|
||
async function testCannotDeleteSelf() {
|
||
assert(state.adminUserId, '管理员ID未初始化');
|
||
|
||
const res = await request('DELETE', `/api/admin/users/${state.adminUserId}`, {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `删除自己应返回400，实际: ${res.status}`);
|
||
assert(String(res.data?.message || '').includes('不能删除自己'), '应提示不能删除自己');
|
||
}
|
||
|
||
// 14. 参数验证：无效用户ID
|
||
async function testInvalidUserId() {
|
||
const res = await request('POST', '/api/admin/users/invalid/ban', {
|
||
data: { banned: true },
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `无效用户ID应返回400，实际: ${res.status}`);
|
||
}
|
||
|
||
// 15. 参数验证：无效分享ID
|
||
async function testInvalidShareId() {
|
||
const res = await request('DELETE', '/api/admin/shares/invalid', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `无效分享ID应返回400，实际: ${res.status}`);
|
||
}
|
||
|
||
// 16. 存储权限设置
|
||
async function testSetStoragePermission() {
|
||
ensureTestUser();
|
||
|
||
const res = await request('POST', `/api/admin/users/${state.testUserId}/storage-permission`, {
|
||
data: {
|
||
storage_permission: 'local_only',
|
||
local_storage_quota: 2147483648,
|
||
download_traffic_quota: 3221225472
|
||
},
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
}
|
||
|
||
// 17. 参数验证：无效的存储权限值
|
||
async function testInvalidStoragePermission() {
|
||
ensureTestUser();
|
||
|
||
const res = await request('POST', `/api/admin/users/${state.testUserId}/storage-permission`, {
|
||
data: { storage_permission: 'invalid_permission' },
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `无效存储权限应返回400，实际: ${res.status}`);
|
||
}
|
||
|
||
// 18. 主题设置验证
|
||
async function testInvalidTheme() {
|
||
const res = await request('POST', '/api/admin/settings', {
|
||
data: { global_theme: 'invalid_theme' },
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `无效主题应返回400，实际: ${res.status}`);
|
||
}
|
||
|
||
// 19. 日志清理测试
|
||
async function testLogCleanup() {
|
||
const res = await request('POST', '/api/admin/logs/cleanup', {
|
||
data: { keepDays: 90 },
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(typeof res.data?.deletedCount === 'number', 'deletedCount应为数字');
|
||
}
|
||
|
||
// 20. SMTP测试（未配置时返回400，配置后可能200/500）
|
||
async function testSmtpTest() {
|
||
const res = await request('POST', '/api/admin/settings/test-smtp', {
|
||
data: { to: 'test@example.com' },
|
||
session: state.adminSession
|
||
});
|
||
|
||
if (res.status === 400 && String(res.data?.message || '').includes('SMTP未配置')) {
|
||
console.log(' - SMTP未配置，这是预期的');
|
||
return;
|
||
}
|
||
|
||
assert(res.status === 200 || res.status === 500, `应返回200或500，实际: ${res.status}`);
|
||
}
|
||
|
||
// 21. 上传工具配置生成（替代已移除的 /api/admin/check-upload-tool）
|
||
async function testGenerateUploadToolConfig() {
|
||
const res = await request('POST', '/api/upload/generate-tool', {
|
||
data: {},
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 200, `应返回200，实际: ${res.status}`);
|
||
assert(res.data?.success === true, '应返回success: true');
|
||
assert(res.data?.config && typeof res.data.config === 'object', '应包含config对象');
|
||
assert(typeof res.data?.config?.api_key === 'string' && res.data.config.api_key.length > 0, '应返回有效api_key');
|
||
}
|
||
|
||
// 22. 用户文件查看 - 无效用户ID验证
|
||
async function testInvalidUserIdForFiles() {
|
||
const res = await request('GET', '/api/admin/users/invalid/files', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `无效用户ID应返回400，实际: ${res.status}`);
|
||
}
|
||
|
||
// 23. 删除用户 - 无效用户ID验证
|
||
async function testInvalidUserIdForDelete() {
|
||
const res = await request('DELETE', '/api/admin/users/invalid', {
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `无效用户ID应返回400，实际: ${res.status}`);
|
||
}
|
||
|
||
// 24. 存储权限设置 - 无效用户ID验证
|
||
async function testInvalidUserIdForPermission() {
|
||
const res = await request('POST', '/api/admin/users/invalid/storage-permission', {
|
||
data: {
|
||
storage_permission: 'local_only'
|
||
},
|
||
session: state.adminSession
|
||
});
|
||
|
||
assert(res.status === 400, `无效用户ID应返回400，实际: ${res.status}`);
|
||
}
|
||
|
||
async function runTests() {
|
||
console.log('========================================');
|
||
console.log('管理员功能完整性测试（Cookie + CSRF）');
|
||
console.log('========================================\n');
|
||
|
||
console.log('\n--- 安全检查 ---');
|
||
await test('未认证访问应被拒绝', testUnauthorizedAccess);
|
||
await test('无效token应被拒绝', testInvalidTokenAccess);
|
||
|
||
await test('管理员登录', testAdminLogin);
|
||
|
||
console.log('\n--- 用户管理 ---');
|
||
await test('获取用户列表', testGetUsers);
|
||
await test('不能封禁自己', testCannotBanSelf);
|
||
await test('不能删除自己', testCannotDeleteSelf);
|
||
await test('无效用户ID验证', testInvalidUserId);
|
||
await test('设置存储权限', testSetStoragePermission);
|
||
await test('无效存储权限验证', testInvalidStoragePermission);
|
||
|
||
console.log('\n--- 系统设置 ---');
|
||
await test('获取系统设置', testGetSettings);
|
||
await test('更新系统设置', testUpdateSettings);
|
||
await test('无效主题验证', testInvalidTheme);
|
||
await test('SMTP测试', testSmtpTest);
|
||
|
||
console.log('\n--- 分享管理 ---');
|
||
await test('获取分享列表', testGetShares);
|
||
await test('无效分享ID验证', testInvalidShareId);
|
||
|
||
console.log('\n--- 系统监控 ---');
|
||
await test('健康检查', testHealthCheck);
|
||
await test('存储统计', testStorageStats);
|
||
await test('获取系统日志', testGetLogs);
|
||
await test('日志统计', testLogStats);
|
||
await test('日志清理', testLogCleanup);
|
||
|
||
console.log('\n--- 其他功能 ---');
|
||
await test('上传工具配置生成', testGenerateUploadToolConfig);
|
||
|
||
console.log('\n--- 参数验证增强 ---');
|
||
await test('用户文件查看无效ID验证', testInvalidUserIdForFiles);
|
||
await test('删除用户无效ID验证', testInvalidUserIdForDelete);
|
||
await test('存储权限设置无效ID验证', testInvalidUserIdForPermission);
|
||
|
||
cleanupTestUser();
|
||
|
||
console.log('\n========================================');
|
||
console.log('测试结果汇总');
|
||
console.log('========================================');
|
||
console.log(`通过: ${testResults.passed.length}`);
|
||
console.log(`失败: ${testResults.failed.length}`);
|
||
console.log(`警告: ${testResults.warnings.length}`);
|
||
|
||
if (testResults.failed.length > 0) {
|
||
console.log('\n失败的测试:');
|
||
for (const f of testResults.failed) {
|
||
console.log(` - ${f.name}: ${f.error}`);
|
||
}
|
||
}
|
||
|
||
if (testResults.warnings.length > 0) {
|
||
console.log('\n警告:');
|
||
for (const w of testResults.warnings) {
|
||
console.log(` - ${w}`);
|
||
}
|
||
}
|
||
|
||
console.log('\n========================================');
|
||
|
||
process.exit(testResults.failed.length > 0 ? 1 : 0);
|
||
}
|
||
|
||
runTests().catch((error) => {
|
||
cleanupTestUser();
|
||
console.error('测试执行异常:', error);
|
||
process.exit(1);
|
||
});
|