developer/galaxy-game
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: user service

Browse Source
This commit is contained in:
Ilia Denisov
2026-04-10 19:05:02 +02:00
committed by GitHub
parent 710bad712e
commit 23ffcb7535
140 changed files with 33418 additions and 952 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration/README.md
+26 -3
View File
@@ -8,13 +8,25 @@ Each suite must raise real service processes, speak only over public HTTP/gRPC/R
```text
integration/
├── README.md
├── go.mod
├── authsessionuser/
│ ├── authsession_user_test.go
│ └── harness_test.go
├── gatewayauthsession/
│ ├── harness_test.go
│ └── gateway_authsession_test.go
├── gatewayauthsessionuser/
│ ├── gateway_authsession_user_test.go
│ └── harness_test.go
├── gatewayuser/
│ ├── gateway_user_test.go
│ └── harness_test.go
├── go.mod
├── go.sum
└── internal/
├── contracts/
│ └── gatewayv1/
│ ├── gatewayv1/
│ │ └── contract.go
│ └── userv1/
│ └── contract.go
└── harness/
├── binary.go
@@ -35,8 +47,12 @@ integration/
## Current Boundary Suites
- `gatewayauthsession` verifies the integration boundary between real `Edge Gateway` and real `Auth / Session Service`.
- `authsessionuser` verifies the integration boundary between real `Auth / Session Service` and real `User Service`.
- `gatewayuser` verifies the direct authenticated self-service boundary between real `Edge Gateway` and real `User Service`.
- `gatewayauthsessionuser` verifies the full public-auth plus authenticated-account chain across real `Edge Gateway`, real `Auth / Session Service`, and real `User Service`.
The current fast suite uses one isolated `miniredis` instance plus external stateful HTTP stubs for mail and user services.
The current fast suites use one isolated `miniredis` instance plus either
real downstream processes or external stateful HTTP stubs where appropriate.
## Running
@@ -45,14 +61,21 @@ Run from the module directory:
```bash
cd integration
go test ./gatewayauthsession/...
go test ./authsessionuser/...
go test ./gatewayuser/...
go test ./gatewayauthsessionuser/...
```
Useful regression commands after boundary changes:
```bash
go test ./gatewayauthsession/...
go test ./authsessionuser/...
go test ./gatewayuser/...
go test ./gatewayauthsessionuser/...
cd ../gateway && go test ./...
cd ../authsession && go test ./... -run GatewayCompatibility
cd ../user && go test ./...
```
Do not use `go test ./...` from the repository root. The repository is organized through `go.work`, so verification should stay module-scoped.
integration/authsessionuser/authsession_user_test.go
+90
View File
@@ -0,0 +1,90 @@
package authsessionuser_test
import (
"net/http"
"strings"
"testing"
"github.com/stretchr/testify/require"
)
func TestAuthsessionUserBlackBoxConfirmCreatesUserWithForwardedRegistrationContext(t *testing.T) {
t.Parallel()
h := newAuthsessionUserHarness(t)
email := "created@example.com"
challengeID := h.sendChallenge(t, email)
code := lastMailCodeFor(t, h.mailStub, email)
response := h.confirmCode(t, challengeID, code)
var confirmBody struct {
DeviceSessionID string `json:"device_session_id"`
}
requireJSONStatus(t, response, http.StatusOK, &confirmBody)
require.True(t, strings.HasPrefix(confirmBody.DeviceSessionID, "device-session-"))
lookupResponse, account := lookupUserByEmail(t, h.userServiceURL, email)
require.Equalf(t, http.StatusOK, lookupResponse.StatusCode, formatStatusError(lookupResponse))
require.Equal(t, email, account.User.Email)
require.Equal(t, "en", account.User.PreferredLanguage)
require.Equal(t, testTimeZone, account.User.TimeZone)
require.True(t, strings.HasPrefix(account.User.UserID, "user-"))
require.True(t, strings.HasPrefix(account.User.RaceName, "player-"))
require.Equal(t, "free", account.User.Entitlement.PlanCode)
require.False(t, account.User.Entitlement.IsPaid)
require.Empty(t, account.User.ActiveSanctions)
require.Empty(t, account.User.ActiveLimits)
}
func TestAuthsessionUserBlackBoxConfirmForExistingUserKeepsCreateOnlySettings(t *testing.T) {
t.Parallel()
h := newAuthsessionUserHarness(t)
email := "existing@example.com"
created := postEnsureUser(t, h.userServiceURL, email, "fr-FR", "Europe/Paris")
require.Equal(t, "created", created.Outcome)
sleepForDistinctCreatedAt()
challengeID := h.sendChallenge(t, email)
code := lastMailCodeFor(t, h.mailStub, email)
response := h.confirmCode(t, challengeID, code)
var confirmBody struct {
DeviceSessionID string `json:"device_session_id"`
}
requireJSONStatus(t, response, http.StatusOK, &confirmBody)
require.True(t, strings.HasPrefix(confirmBody.DeviceSessionID, "device-session-"))
lookupResponse, account := lookupUserByEmail(t, h.userServiceURL, email)
require.Equalf(t, http.StatusOK, lookupResponse.StatusCode, formatStatusError(lookupResponse))
require.Equal(t, created.UserID, account.User.UserID)
require.Equal(t, "fr-FR", account.User.PreferredLanguage)
require.Equal(t, "Europe/Paris", account.User.TimeZone)
}
func TestAuthsessionUserBlackBoxBlockedEmailSendIsSuccessShapedAndConfirmIsRejectedWithoutCreatingUser(t *testing.T) {
t.Parallel()
h := newAuthsessionUserHarness(t)
blockedAtSendEmail := "blocked-send@example.com"
postBlockByEmail(t, h.userServiceURL, blockedAtSendEmail)
beforeBlockedSendDeliveries := len(h.mailStub.RecordedDeliveries())
blockedChallengeID := h.sendChallenge(t, blockedAtSendEmail)
require.NotEmpty(t, blockedChallengeID)
require.Len(t, h.mailStub.RecordedDeliveries(), beforeBlockedSendDeliveries)
blockedAtConfirmEmail := "blocked-confirm@example.com"
challengeID := h.sendChallenge(t, blockedAtConfirmEmail)
code := lastMailCodeFor(t, h.mailStub, blockedAtConfirmEmail)
postBlockByEmail(t, h.userServiceURL, blockedAtConfirmEmail)
confirmResponse := h.confirmCode(t, challengeID, code)
requireJSONStatusRaw(t, confirmResponse, http.StatusForbidden, `{"error":{"code":"blocked_by_policy","message":"authentication is blocked by policy"}}`)
lookupResponse, _ := lookupUserByEmail(t, h.userServiceURL, blockedAtConfirmEmail)
requireLookupNotFound(t, lookupResponse)
}
integration/authsessionuser/harness_test.go
+386
View File
@@ -0,0 +1,386 @@
package authsessionuser_test
import (
"bytes"
"encoding/json"
"errors"
"fmt"
"io"
"net/http"
"testing"
"time"
"galaxy/integration/internal/harness"
"github.com/stretchr/testify/require"
)
const (
testClientPublicKey = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
testTimeZone = "Europe/Kaliningrad"
)
type authsessionUserHarness struct {
mailStub *harness.MailStub
authsessionPublicURL string
userServiceURL string
authsessionProcess *harness.Process
userServiceProcess *harness.Process
}
func newAuthsessionUserHarness(t *testing.T) *authsessionUserHarness {
t.Helper()
redisServer := harness.StartMiniredis(t)
mailStub := harness.NewMailStub(t)
userServiceAddr := harness.FreeTCPAddress(t)
authsessionPublicAddr := harness.FreeTCPAddress(t)
authsessionInternalAddr := harness.FreeTCPAddress(t)
userServiceBinary := harness.BuildBinary(t, "userservice", "./user/cmd/userservice")
authsessionBinary := harness.BuildBinary(t, "authsession", "./authsession/cmd/authsession")
userServiceEnv := map[string]string{
"USERSERVICE_LOG_LEVEL": "info",
"USERSERVICE_INTERNAL_HTTP_ADDR": userServiceAddr,
"USERSERVICE_REDIS_ADDR": redisServer.Addr(),
"OTEL_TRACES_EXPORTER": "none",
"OTEL_METRICS_EXPORTER": "none",
}
userServiceProcess := harness.StartProcess(t, "userservice", userServiceBinary, userServiceEnv)
waitForUserServiceReady(t, userServiceProcess, "http://"+userServiceAddr)
authsessionEnv := map[string]string{
"AUTHSESSION_LOG_LEVEL": "info",
"AUTHSESSION_PUBLIC_HTTP_ADDR": authsessionPublicAddr,
"AUTHSESSION_INTERNAL_HTTP_ADDR": authsessionInternalAddr,
"AUTHSESSION_REDIS_ADDR": redisServer.Addr(),
"AUTHSESSION_USER_SERVICE_MODE": "rest",
"AUTHSESSION_USER_SERVICE_BASE_URL": "http://" + userServiceAddr,
"AUTHSESSION_MAIL_SERVICE_MODE": "rest",
"AUTHSESSION_MAIL_SERVICE_BASE_URL": mailStub.BaseURL(),
"OTEL_TRACES_EXPORTER": "none",
"OTEL_METRICS_EXPORTER": "none",
"AUTHSESSION_PUBLIC_HTTP_REQUEST_TIMEOUT": time.Second.String(),
"AUTHSESSION_INTERNAL_HTTP_REQUEST_TIMEOUT": time.Second.String(),
}
authsessionProcess := harness.StartProcess(t, "authsession", authsessionBinary, authsessionEnv)
waitForAuthsessionPublicReady(t, authsessionProcess, "http://"+authsessionPublicAddr)
return &authsessionUserHarness{
mailStub: mailStub,
authsessionPublicURL: "http://" + authsessionPublicAddr,
userServiceURL: "http://" + userServiceAddr,
authsessionProcess: authsessionProcess,
userServiceProcess: userServiceProcess,
}
}
func (h *authsessionUserHarness) sendChallenge(t *testing.T, email string) string {
t.Helper()
response := postJSONValue(t, h.authsessionPublicURL+"/api/v1/public/auth/send-email-code", map[string]string{
"email": email,
})
require.Equal(t, http.StatusOK, response.StatusCode)
var body struct {
ChallengeID string `json:"challenge_id"`
}
require.NoError(t, decodeStrictJSONPayload([]byte(response.Body), &body))
require.NotEmpty(t, body.ChallengeID)
return body.ChallengeID
}
func (h *authsessionUserHarness) confirmCode(t *testing.T, challengeID string, code string) httpResponse {
t.Helper()
return postJSONValue(t, h.authsessionPublicURL+"/api/v1/public/auth/confirm-email-code", map[string]string{
"challenge_id": challengeID,
"code": code,
"client_public_key": testClientPublicKey,
"time_zone": testTimeZone,
})
}
type httpResponse struct {
StatusCode int
Body string
Header http.Header
}
func postJSONValue(t *testing.T, targetURL string, body any) httpResponse {
t.Helper()
payload, err := json.Marshal(body)
require.NoError(t, err)
request, err := http.NewRequest(http.MethodPost, targetURL, bytes.NewReader(payload))
require.NoError(t, err)
request.Header.Set("Content-Type", "application/json")
client := &http.Client{
Timeout: 250 * time.Millisecond,
Transport: &http.Transport{
DisableKeepAlives: true,
},
}
t.Cleanup(client.CloseIdleConnections)
response, err := client.Do(request)
require.NoError(t, err)
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
require.NoError(t, err)
return httpResponse{
StatusCode: response.StatusCode,
Body: string(responseBody),
Header: response.Header.Clone(),
}
}
func decodeStrictJSONPayload(payload []byte, target any) error {
decoder := json.NewDecoder(bytes.NewReader(payload))
decoder.DisallowUnknownFields()
if err := decoder.Decode(target); err != nil {
return err
}
if err := decoder.Decode(&struct{}{}); err != io.EOF {
if err == nil {
return errors.New("unexpected trailing JSON input")
}
return err
}
return nil
}
func waitForUserServiceReady(t *testing.T, process *harness.Process, baseURL string) {
t.Helper()
client := &http.Client{Timeout: 250 * time.Millisecond}
deadline := time.Now().Add(10 * time.Second)
for time.Now().Before(deadline) {
request, err := http.NewRequest(http.MethodGet, baseURL+"/api/v1/internal/users/user-missing/exists", nil)
require.NoError(t, err)
response, err := client.Do(request)
if err == nil {
_, _ = io.Copy(io.Discard, response.Body)
response.Body.Close()
if response.StatusCode == http.StatusOK {
return
}
}
time.Sleep(25 * time.Millisecond)
}
t.Fatalf("wait for userservice readiness: timeout\n%s", process.Logs())
}
func waitForAuthsessionPublicReady(t *testing.T, process *harness.Process, baseURL string) {
t.Helper()
client := &http.Client{Timeout: 250 * time.Millisecond}
deadline := time.Now().Add(10 * time.Second)
for time.Now().Before(deadline) {
response, err := postJSONValueMaybe(client, baseURL+"/api/v1/public/auth/send-email-code", map[string]string{
"email": "",
})
if err == nil && response.StatusCode == http.StatusBadRequest {
return
}
time.Sleep(25 * time.Millisecond)
}
t.Fatalf("wait for authsession public readiness: timeout\n%s", process.Logs())
}
func postJSONValueMaybe(client *http.Client, targetURL string, body any) (httpResponse, error) {
payload, err := json.Marshal(body)
if err != nil {
return httpResponse{}, err
}
request, err := http.NewRequest(http.MethodPost, targetURL, bytes.NewReader(payload))
if err != nil {
return httpResponse{}, err
}
request.Header.Set("Content-Type", "application/json")
response, err := client.Do(request)
if err != nil {
return httpResponse{}, err
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
return httpResponse{}, err
}
return httpResponse{
StatusCode: response.StatusCode,
Body: string(responseBody),
Header: response.Header.Clone(),
}, nil
}
func requireJSONStatus(t *testing.T, response httpResponse, wantStatus int, target any) {
t.Helper()
require.Equal(t, wantStatus, response.StatusCode, "response body: %s", response.Body)
require.NoError(t, decodeStrictJSONPayload([]byte(response.Body), target))
}
func requireJSONStatusRaw(t *testing.T, response httpResponse, wantStatus int, wantBody string) {
t.Helper()
require.Equal(t, wantStatus, response.StatusCode, "response body: %s", response.Body)
require.JSONEq(t, wantBody, response.Body)
}
func postEnsureUser(t *testing.T, baseURL string, email string, preferredLanguage string, timeZone string) ensureByEmailResponse {
t.Helper()
response := postJSONValue(t, baseURL+"/api/v1/internal/users/ensure-by-email", map[string]any{
"email": email,
"registration_context": map[string]string{
"preferred_language": preferredLanguage,
"time_zone": timeZone,
},
})
var body ensureByEmailResponse
requireJSONStatus(t, response, http.StatusOK, &body)
return body
}
func postBlockByEmail(t *testing.T, baseURL string, email string) {
t.Helper()
response := postJSONValue(t, baseURL+"/api/v1/internal/user-blocks/by-email", map[string]string{
"email": email,
"reason_code": "policy_blocked",
})
var body blockMutationResponse
requireJSONStatus(t, response, http.StatusOK, &body)
}
func lookupUserByEmail(t *testing.T, baseURL string, email string) (httpResponse, userLookupResponse) {
t.Helper()
response := postJSONValue(t, baseURL+"/api/v1/internal/user-lookups/by-email", map[string]string{
"email": email,
})
if response.StatusCode != http.StatusOK {
return response, userLookupResponse{}
}
var body userLookupResponse
require.NoError(t, decodeStrictJSONPayload([]byte(response.Body), &body))
return response, body
}
type ensureByEmailResponse struct {
Outcome string `json:"outcome"`
UserID string `json:"user_id,omitempty"`
}
type blockMutationResponse struct {
Outcome string `json:"outcome"`
UserID string `json:"user_id,omitempty"`
}
type userLookupResponse struct {
User accountView `json:"user"`
}
type accountView struct {
UserID string `json:"user_id"`
Email string `json:"email"`
RaceName string `json:"race_name"`
PreferredLanguage string `json:"preferred_language"`
TimeZone string `json:"time_zone"`
DeclaredCountry string `json:"declared_country,omitempty"`
Entitlement entitlementSnapshotView `json:"entitlement"`
ActiveSanctions []activeSanctionView `json:"active_sanctions"`
ActiveLimits []activeLimitView `json:"active_limits"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
type entitlementSnapshotView struct {
PlanCode string `json:"plan_code"`
IsPaid bool `json:"is_paid"`
Source string `json:"source"`
Actor actorRefView `json:"actor"`
ReasonCode string `json:"reason_code"`
StartsAt time.Time `json:"starts_at"`
EndsAt *time.Time `json:"ends_at,omitempty"`
UpdatedAt time.Time `json:"updated_at"`
}
type activeSanctionView struct {
SanctionCode string `json:"sanction_code"`
Scope string `json:"scope"`
ReasonCode string `json:"reason_code"`
Actor actorRefView `json:"actor"`
AppliedAt time.Time `json:"applied_at"`
ExpiresAt *time.Time `json:"expires_at,omitempty"`
}
type activeLimitView struct {
LimitCode string `json:"limit_code"`
Value int `json:"value"`
ReasonCode string `json:"reason_code"`
Actor actorRefView `json:"actor"`
AppliedAt time.Time `json:"applied_at"`
ExpiresAt *time.Time `json:"expires_at,omitempty"`
}
type actorRefView struct {
Type string `json:"type"`
ID string `json:"id,omitempty"`
}
func requireLookupNotFound(t *testing.T, response httpResponse) {
t.Helper()
requireJSONStatusRaw(t, response, http.StatusNotFound, `{"error":{"code":"subject_not_found","message":"subject not found"}}`)
}
func lastMailCodeFor(t *testing.T, stub *harness.MailStub, email string) string {
t.Helper()
deliveries := stub.RecordedDeliveries()
for index := len(deliveries) - 1; index >= 0; index-- {
if deliveries[index].Email == email {
return deliveries[index].Code
}
}
t.Fatalf("mail stub did not record delivery for %s", email)
return ""
}
func sleepForDistinctCreatedAt() {
time.Sleep(10 * time.Millisecond)
}
func formatStatusError(response httpResponse) string {
return fmt.Sprintf("status=%d body=%s", response.StatusCode, response.Body)
}
integration/gatewayauthsessionuser/gateway_authsession_user_test.go
+86
View File
@@ -0,0 +1,86 @@
package gatewayauthsessionuser_test
import (
"net/http"
"strings"
"testing"
"github.com/stretchr/testify/require"
)
func TestGatewayAuthsessionUserFirstRegistrationCreatesUserAndAllowsAccountRead(t *testing.T) {
h := newGatewayAuthsessionUserHarness(t)
const email = "created@example.com"
challengeID := h.sendChallenge(t, email)
code := lastMailCodeFor(t, h.mailStub, email)
clientPrivateKey := newClientPrivateKey("first-registration")
confirmResponse := h.confirmCode(t, challengeID, code, clientPrivateKey)
var confirmBody struct {
DeviceSessionID string `json:"device_session_id"`
}
requireJSONStatus(t, confirmResponse, http.StatusOK, &confirmBody)
require.True(t, strings.HasPrefix(confirmBody.DeviceSessionID, "device-session-"))
sessionRecord := h.waitForGatewaySession(t, confirmBody.DeviceSessionID)
accountResponse := h.executeGetMyAccount(t, confirmBody.DeviceSessionID, "request-first-registration", clientPrivateKey)
require.Equal(t, sessionRecord.UserID, accountResponse.Account.UserID)
require.Equal(t, email, accountResponse.Account.Email)
require.Equal(t, "en", accountResponse.Account.PreferredLanguage)
require.Equal(t, gatewayAuthsessionUserTestTimeZone, accountResponse.Account.TimeZone)
lookupResponse, lookup := h.lookupUserByEmail(t, email)
require.Equalf(t, http.StatusOK, lookupResponse.StatusCode, "status=%d body=%s", lookupResponse.StatusCode, lookupResponse.Body)
require.Equal(t, accountResponse.Account.UserID, lookup.User.UserID)
}
func TestGatewayAuthsessionUserExistingAccountKeepsCreateOnlySettings(t *testing.T) {
h := newGatewayAuthsessionUserHarness(t)
const email = "existing@example.com"
created := h.ensureUser(t, email, "fr-FR", "Europe/Paris")
require.Equal(t, "created", created.Outcome)
challengeID := h.sendChallenge(t, email)
code := lastMailCodeFor(t, h.mailStub, email)
clientPrivateKey := newClientPrivateKey("existing-account")
confirmResponse := h.confirmCode(t, challengeID, code, clientPrivateKey)
var confirmBody struct {
DeviceSessionID string `json:"device_session_id"`
}
requireJSONStatus(t, confirmResponse, http.StatusOK, &confirmBody)
accountResponse := h.executeGetMyAccount(t, confirmBody.DeviceSessionID, "request-existing-account", clientPrivateKey)
require.Equal(t, created.UserID, accountResponse.Account.UserID)
require.Equal(t, "fr-FR", accountResponse.Account.PreferredLanguage)
require.Equal(t, "Europe/Paris", accountResponse.Account.TimeZone)
}
func TestGatewayAuthsessionUserBlockedEmailAndUserBehavior(t *testing.T) {
h := newGatewayAuthsessionUserHarness(t)
blockedAtSendEmail := "blocked-send@example.com"
h.blockByEmail(t, blockedAtSendEmail)
beforeBlockedSendDeliveries := len(h.mailStub.RecordedDeliveries())
blockedChallengeID := h.sendChallenge(t, blockedAtSendEmail)
require.NotEmpty(t, blockedChallengeID)
require.Len(t, h.mailStub.RecordedDeliveries(), beforeBlockedSendDeliveries)
blockedAtConfirmEmail := "blocked-confirm@example.com"
challengeID := h.sendChallenge(t, blockedAtConfirmEmail)
code := lastMailCodeFor(t, h.mailStub, blockedAtConfirmEmail)
h.blockByEmail(t, blockedAtConfirmEmail)
confirmResponse := h.confirmCode(t, challengeID, code, newClientPrivateKey("blocked-confirm"))
require.Equal(t, http.StatusForbidden, confirmResponse.StatusCode)
require.JSONEq(t, `{"error":{"code":"blocked_by_policy","message":"authentication is blocked by policy"}}`, confirmResponse.Body)
lookupResponse, _ := h.lookupUserByEmail(t, blockedAtConfirmEmail)
requireLookupNotFound(t, lookupResponse)
}
integration/gatewayauthsessionuser/harness_test.go
+460
View File
@@ -0,0 +1,460 @@
package gatewayauthsessionuser_test
import (
"bytes"
"context"
"crypto/ed25519"
"crypto/sha256"
"encoding/base64"
"encoding/json"
"fmt"
"io"
"net/http"
"path/filepath"
"testing"
"time"
gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
contractsgatewayv1 "galaxy/integration/internal/contracts/gatewayv1"
contractsuserv1 "galaxy/integration/internal/contracts/userv1"
"galaxy/integration/internal/harness"
usermodel "galaxy/model/user"
"github.com/redis/go-redis/v9"
"github.com/stretchr/testify/require"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials/insecure"
)
const gatewayAuthsessionUserTestTimeZone = "Europe/Kaliningrad"
type gatewayAuthsessionUserHarness struct {
redis *redis.Client
mailStub *harness.MailStub
authsessionPublicURL string
userServiceURL string
gatewayPublicURL string
gatewayGRPCAddr string
responseSignerPublicKey ed25519.PublicKey
gatewayProcess *harness.Process
authsessionProcess *harness.Process
userServiceProcess *harness.Process
}
func newGatewayAuthsessionUserHarness(t *testing.T) *gatewayAuthsessionUserHarness {
t.Helper()
redisServer := harness.StartMiniredis(t)
redisClient := redis.NewClient(&redis.Options{
Addr: redisServer.Addr(),
Protocol: 2,
DisableIdentity: true,
})
t.Cleanup(func() {
require.NoError(t, redisClient.Close())
})
mailStub := harness.NewMailStub(t)
responseSignerPath, responseSignerPublicKey := harness.WriteResponseSignerPEM(t, t.Name())
userServiceAddr := harness.FreeTCPAddress(t)
authsessionPublicAddr := harness.FreeTCPAddress(t)
authsessionInternalAddr := harness.FreeTCPAddress(t)
gatewayPublicAddr := harness.FreeTCPAddress(t)
gatewayGRPCAddr := harness.FreeTCPAddress(t)
userServiceBinary := harness.BuildBinary(t, "userservice", "./user/cmd/userservice")
authsessionBinary := harness.BuildBinary(t, "authsession", "./authsession/cmd/authsession")
gatewayBinary := harness.BuildBinary(t, "gateway", "./gateway/cmd/gateway")
userServiceEnv := map[string]string{
"USERSERVICE_LOG_LEVEL": "info",
"USERSERVICE_INTERNAL_HTTP_ADDR": userServiceAddr,
"USERSERVICE_REDIS_ADDR": redisServer.Addr(),
"OTEL_TRACES_EXPORTER": "none",
"OTEL_METRICS_EXPORTER": "none",
}
userServiceProcess := harness.StartProcess(t, "userservice", userServiceBinary, userServiceEnv)
harness.WaitForHTTPStatus(t, userServiceProcess, "http://"+userServiceAddr+"/api/v1/internal/users/user-missing/exists", http.StatusOK)
authsessionEnv := map[string]string{
"AUTHSESSION_LOG_LEVEL": "info",
"AUTHSESSION_PUBLIC_HTTP_ADDR": authsessionPublicAddr,
"AUTHSESSION_PUBLIC_HTTP_REQUEST_TIMEOUT": time.Second.String(),
"AUTHSESSION_INTERNAL_HTTP_ADDR": authsessionInternalAddr,
"AUTHSESSION_INTERNAL_HTTP_REQUEST_TIMEOUT": time.Second.String(),
"AUTHSESSION_REDIS_ADDR": redisServer.Addr(),
"AUTHSESSION_USER_SERVICE_MODE": "rest",
"AUTHSESSION_USER_SERVICE_BASE_URL": "http://" + userServiceAddr,
"AUTHSESSION_USER_SERVICE_REQUEST_TIMEOUT": time.Second.String(),
"AUTHSESSION_MAIL_SERVICE_MODE": "rest",
"AUTHSESSION_MAIL_SERVICE_BASE_URL": mailStub.BaseURL(),
"AUTHSESSION_MAIL_SERVICE_REQUEST_TIMEOUT": time.Second.String(),
"AUTHSESSION_REDIS_GATEWAY_SESSION_CACHE_KEY_PREFIX": "gateway:session:",
"AUTHSESSION_REDIS_GATEWAY_SESSION_EVENTS_STREAM": "gateway:session_events",
"OTEL_TRACES_EXPORTER": "none",
"OTEL_METRICS_EXPORTER": "none",
}
authsessionProcess := harness.StartProcess(t, "authsession", authsessionBinary, authsessionEnv)
waitForAuthsessionPublicReady(t, authsessionProcess, "http://"+authsessionPublicAddr)
gatewayEnv := map[string]string{
"GATEWAY_LOG_LEVEL": "info",
"GATEWAY_PUBLIC_HTTP_ADDR": gatewayPublicAddr,
"GATEWAY_AUTHENTICATED_GRPC_ADDR": gatewayGRPCAddr,
"GATEWAY_AUTH_SERVICE_BASE_URL": "http://" + authsessionPublicAddr,
"GATEWAY_USER_SERVICE_BASE_URL": "http://" + userServiceAddr,
"GATEWAY_PUBLIC_AUTH_UPSTREAM_TIMEOUT": (500 * time.Millisecond).String(),
"GATEWAY_SESSION_CACHE_REDIS_ADDR": redisServer.Addr(),
"GATEWAY_SESSION_CACHE_REDIS_KEY_PREFIX": "gateway:session:",
"GATEWAY_SESSION_EVENTS_REDIS_STREAM": "gateway:session_events",
"GATEWAY_CLIENT_EVENTS_REDIS_STREAM": "gateway:client_events",
"GATEWAY_REPLAY_REDIS_KEY_PREFIX": "gateway:replay:",
"GATEWAY_RESPONSE_SIGNER_PRIVATE_KEY_PEM_PATH": filepath.Clean(responseSignerPath),
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_PUBLIC_AUTH_RATE_LIMIT_REQUESTS": "100",
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_PUBLIC_AUTH_RATE_LIMIT_WINDOW": "1s",
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_PUBLIC_AUTH_RATE_LIMIT_BURST": "100",
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_SEND_EMAIL_CODE_IDENTITY_RATE_LIMIT_REQUESTS": "100",
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_SEND_EMAIL_CODE_IDENTITY_RATE_LIMIT_WINDOW": "1s",
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_SEND_EMAIL_CODE_IDENTITY_RATE_LIMIT_BURST": "100",
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_CONFIRM_EMAIL_CODE_IDENTITY_RATE_LIMIT_REQUESTS": "100",
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_CONFIRM_EMAIL_CODE_IDENTITY_RATE_LIMIT_WINDOW": "1s",
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_CONFIRM_EMAIL_CODE_IDENTITY_RATE_LIMIT_BURST": "100",
"OTEL_TRACES_EXPORTER": "none",
"OTEL_METRICS_EXPORTER": "none",
}
gatewayProcess := harness.StartProcess(t, "gateway", gatewayBinary, gatewayEnv)
harness.WaitForHTTPStatus(t, gatewayProcess, "http://"+gatewayPublicAddr+"/healthz", http.StatusOK)
harness.WaitForTCP(t, gatewayProcess, gatewayGRPCAddr)
return &gatewayAuthsessionUserHarness{
redis: redisClient,
mailStub: mailStub,
authsessionPublicURL: "http://" + authsessionPublicAddr,
userServiceURL: "http://" + userServiceAddr,
gatewayPublicURL: "http://" + gatewayPublicAddr,
gatewayGRPCAddr: gatewayGRPCAddr,
responseSignerPublicKey: responseSignerPublicKey,
gatewayProcess: gatewayProcess,
authsessionProcess: authsessionProcess,
userServiceProcess: userServiceProcess,
}
}
func (h *gatewayAuthsessionUserHarness) sendChallenge(t *testing.T, email string) string {
t.Helper()
response := postJSONValue(t, h.gatewayPublicURL+"/api/v1/public/auth/send-email-code", map[string]string{
"email": email,
})
require.Equal(t, http.StatusOK, response.StatusCode)
var body struct {
ChallengeID string `json:"challenge_id"`
}
require.NoError(t, decodeStrictJSONPayload([]byte(response.Body), &body))
return body.ChallengeID
}
func (h *gatewayAuthsessionUserHarness) confirmCode(t *testing.T, challengeID string, code string, clientPrivateKey ed25519.PrivateKey) httpResponse {
t.Helper()
return postJSONValue(t, h.gatewayPublicURL+"/api/v1/public/auth/confirm-email-code", map[string]string{
"challenge_id": challengeID,
"code": code,
"client_public_key": base64.StdEncoding.EncodeToString(clientPrivateKey.Public().(ed25519.PublicKey)),
"time_zone": gatewayAuthsessionUserTestTimeZone,
})
}
func (h *gatewayAuthsessionUserHarness) ensureUser(t *testing.T, email string, preferredLanguage string, timeZone string) ensureByEmailResponse {
t.Helper()
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/users/ensure-by-email", map[string]any{
"email": email,
"registration_context": map[string]string{
"preferred_language": preferredLanguage,
"time_zone": timeZone,
},
})
var body ensureByEmailResponse
requireJSONStatus(t, response, http.StatusOK, &body)
return body
}
func (h *gatewayAuthsessionUserHarness) lookupUserByEmail(t *testing.T, email string) (httpResponse, userLookupResponse) {
t.Helper()
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/user-lookups/by-email", map[string]string{
"email": email,
})
if response.StatusCode != http.StatusOK {
return response, userLookupResponse{}
}
var body userLookupResponse
require.NoError(t, decodeStrictJSONPayload([]byte(response.Body), &body))
return response, body
}
func (h *gatewayAuthsessionUserHarness) blockByEmail(t *testing.T, email string) {
t.Helper()
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/user-blocks/by-email", map[string]string{
"email": email,
"reason_code": "policy_blocked",
})
require.Equal(t, http.StatusOK, response.StatusCode, "response body: %s", response.Body)
}
func (h *gatewayAuthsessionUserHarness) waitForGatewaySession(t *testing.T, deviceSessionID string) gatewaySessionRecord {
t.Helper()
deadline := time.Now().Add(5 * time.Second)
for time.Now().Before(deadline) {
payload, err := h.redis.Get(context.Background(), "gateway:session:"+deviceSessionID).Bytes()
if err == nil {
var record gatewaySessionRecord
require.NoError(t, decodeStrictJSONPayload(payload, &record))
return record
}
time.Sleep(25 * time.Millisecond)
}
t.Fatalf("gateway session projection for %s was not published in time", deviceSessionID)
return gatewaySessionRecord{}
}
func (h *gatewayAuthsessionUserHarness) executeGetMyAccount(t *testing.T, deviceSessionID string, requestID string, clientPrivateKey ed25519.PrivateKey) *usermodel.AccountResponse {
t.Helper()
conn := h.dialGateway(t)
client := gatewayv1.NewEdgeGatewayClient(conn)
payload, err := contractsuserv1.EncodeGetMyAccountRequest()
require.NoError(t, err)
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
response, err := client.ExecuteCommand(ctx, newExecuteCommandRequest(deviceSessionID, requestID, contractsuserv1.MessageTypeGetMyAccount, payload, clientPrivateKey))
require.NoError(t, err)
require.Equal(t, contractsuserv1.ResultCodeOK, response.GetResultCode())
assertSignedExecuteCommandResponse(t, response, h.responseSignerPublicKey)
accountResponse, err := contractsuserv1.DecodeAccountResponse(response.GetPayloadBytes())
require.NoError(t, err)
return accountResponse
}
func (h *gatewayAuthsessionUserHarness) dialGateway(t *testing.T) *grpc.ClientConn {
t.Helper()
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
conn, err := grpc.DialContext(
ctx,
h.gatewayGRPCAddr,
grpc.WithTransportCredentials(insecure.NewCredentials()),
grpc.WithBlock(),
)
require.NoError(t, err)
t.Cleanup(func() {
require.NoError(t, conn.Close())
})
return conn
}
type httpResponse struct {
StatusCode int
Body string
Header http.Header
}
type ensureByEmailResponse struct {
Outcome string `json:"outcome"`
UserID string `json:"user_id,omitempty"`
}
type gatewaySessionRecord struct {
DeviceSessionID string `json:"device_session_id"`
UserID string `json:"user_id"`
ClientPublicKey string `json:"client_public_key"`
Status string `json:"status"`
RevokedAtMS *int64 `json:"revoked_at_ms,omitempty"`
}
type userLookupResponse struct {
User usermodel.Account `json:"user"`
}
func postJSONValue(t *testing.T, targetURL string, body any) httpResponse {
t.Helper()
payload, err := json.Marshal(body)
require.NoError(t, err)
request, err := http.NewRequest(http.MethodPost, targetURL, bytes.NewReader(payload))
require.NoError(t, err)
request.Header.Set("Content-Type", "application/json")
client := &http.Client{Timeout: 5 * time.Second}
response, err := client.Do(request)
require.NoError(t, err)
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
require.NoError(t, err)
return httpResponse{
StatusCode: response.StatusCode,
Body: string(responseBody),
Header: response.Header.Clone(),
}
}
func decodeStrictJSONPayload(payload []byte, target any) error {
decoder := json.NewDecoder(bytes.NewReader(payload))
decoder.DisallowUnknownFields()
if err := decoder.Decode(target); err != nil {
return err
}
if err := decoder.Decode(&struct{}{}); err != io.EOF {
if err == nil {
return fmt.Errorf("unexpected trailing JSON input")
}
return err
}
return nil
}
func requireJSONStatus(t *testing.T, response httpResponse, wantStatus int, target any) {
t.Helper()
require.Equal(t, wantStatus, response.StatusCode, "response body: %s", response.Body)
require.NoError(t, decodeStrictJSONPayload([]byte(response.Body), target))
}
func requireLookupNotFound(t *testing.T, response httpResponse) {
t.Helper()
require.Equal(t, http.StatusNotFound, response.StatusCode, "response body: %s", response.Body)
require.JSONEq(t, `{"error":{"code":"subject_not_found","message":"subject not found"}}`, response.Body)
}
func lastMailCodeFor(t *testing.T, stub *harness.MailStub, email string) string {
t.Helper()
deliveries := stub.RecordedDeliveries()
for index := len(deliveries) - 1; index >= 0; index-- {
if deliveries[index].Email == email {
return deliveries[index].Code
}
}
t.Fatalf("mail stub did not record delivery for %s", email)
return ""
}
func waitForAuthsessionPublicReady(t *testing.T, process *harness.Process, baseURL string) {
t.Helper()
client := &http.Client{Timeout: 250 * time.Millisecond}
deadline := time.Now().Add(10 * time.Second)
for time.Now().Before(deadline) {
response, err := postJSONValueMaybe(client, baseURL+"/api/v1/public/auth/send-email-code", map[string]string{
"email": "",
})
if err == nil && response.StatusCode == http.StatusBadRequest {
return
}
time.Sleep(25 * time.Millisecond)
}
t.Fatalf("wait for authsession public readiness: timeout\n%s", process.Logs())
}
func postJSONValueMaybe(client *http.Client, targetURL string, body any) (httpResponse, error) {
payload, err := json.Marshal(body)
if err != nil {
return httpResponse{}, err
}
request, err := http.NewRequest(http.MethodPost, targetURL, bytes.NewReader(payload))
if err != nil {
return httpResponse{}, err
}
request.Header.Set("Content-Type", "application/json")
response, err := client.Do(request)
if err != nil {
return httpResponse{}, err
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
return httpResponse{}, err
}
return httpResponse{
StatusCode: response.StatusCode,
Body: string(responseBody),
Header: response.Header.Clone(),
}, nil
}
func newClientPrivateKey(label string) ed25519.PrivateKey {
seed := sha256.Sum256([]byte("galaxy-integration-gateway-authsession-user-client-" + label))
return ed25519.NewKeyFromSeed(seed[:])
}
func newExecuteCommandRequest(deviceSessionID string, requestID string, messageType string, payload []byte, clientPrivateKey ed25519.PrivateKey) *gatewayv1.ExecuteCommandRequest {
payloadHash := contractsgatewayv1.ComputePayloadHash(payload)
request := &gatewayv1.ExecuteCommandRequest{
ProtocolVersion: contractsgatewayv1.ProtocolVersionV1,
DeviceSessionId: deviceSessionID,
MessageType: messageType,
TimestampMs: time.Now().UnixMilli(),
RequestId: requestID,
PayloadBytes: payload,
PayloadHash: payloadHash,
TraceId: "trace-" + requestID,
}
request.Signature = contractsgatewayv1.SignRequest(clientPrivateKey, contractsgatewayv1.RequestSigningFields{
ProtocolVersion: request.GetProtocolVersion(),
DeviceSessionID: request.GetDeviceSessionId(),
MessageType: request.GetMessageType(),
TimestampMS: request.GetTimestampMs(),
RequestID: request.GetRequestId(),
PayloadHash: request.GetPayloadHash(),
})
return request
}
func assertSignedExecuteCommandResponse(t *testing.T, response *gatewayv1.ExecuteCommandResponse, publicKey ed25519.PublicKey) {
t.Helper()
require.NoError(t, contractsgatewayv1.VerifyPayloadHash(response.GetPayloadBytes(), response.GetPayloadHash()))
require.NoError(t, contractsgatewayv1.VerifyResponseSignature(publicKey, response.GetSignature(), contractsgatewayv1.ResponseSigningFields{
ProtocolVersion: response.GetProtocolVersion(),
RequestID: response.GetRequestId(),
TimestampMS: response.GetTimestampMs(),
ResultCode: response.GetResultCode(),
PayloadHash: response.GetPayloadHash(),
}))
}
integration/gatewayuser/gateway_user_test.go
+147
View File
@@ -0,0 +1,147 @@
package gatewayuser_test
import (
"testing"
contractsuserv1 "galaxy/integration/internal/contracts/userv1"
"github.com/stretchr/testify/require"
)
func TestGatewayUserGetMyAccountAuthenticated(t *testing.T) {
h := newGatewayUserHarness(t)
const (
email = "pilot@example.com"
deviceSessionID = "device-session-get-account"
requestID = "request-get-account"
)
created := h.ensureUser(t, email, "en", gatewayUserTestTimeZone)
require.Equal(t, "created", created.Outcome)
clientPrivateKey := newClientPrivateKey("get-account")
h.seedGatewaySession(t, deviceSessionID, created.UserID, clientPrivateKey)
payload, err := contractsuserv1.EncodeGetMyAccountRequest()
require.NoError(t, err)
response := h.executeCommand(t, deviceSessionID, requestID, contractsuserv1.MessageTypeGetMyAccount, payload, clientPrivateKey)
require.Equal(t, contractsuserv1.ResultCodeOK, response.GetResultCode())
accountResponse, err := contractsuserv1.DecodeAccountResponse(response.GetPayloadBytes())
require.NoError(t, err)
require.Equal(t, created.UserID, accountResponse.Account.UserID)
require.Equal(t, email, accountResponse.Account.Email)
require.Equal(t, "en", accountResponse.Account.PreferredLanguage)
require.Equal(t, gatewayUserTestTimeZone, accountResponse.Account.TimeZone)
}
func TestGatewayUserUpdateMyProfileSuccess(t *testing.T) {
h := newGatewayUserHarness(t)
const (
email = "pilot-profile@example.com"
deviceSessionID = "device-session-update-profile"
requestID = "request-update-profile"
)
created := h.ensureUser(t, email, "en", gatewayUserTestTimeZone)
clientPrivateKey := newClientPrivateKey("update-profile")
h.seedGatewaySession(t, deviceSessionID, created.UserID, clientPrivateKey)
payload, err := contractsuserv1.EncodeUpdateMyProfileRequest("Nova Prime")
require.NoError(t, err)
response := h.executeCommand(t, deviceSessionID, requestID, contractsuserv1.MessageTypeUpdateMyProfile, payload, clientPrivateKey)
require.Equal(t, contractsuserv1.ResultCodeOK, response.GetResultCode())
accountResponse, err := contractsuserv1.DecodeAccountResponse(response.GetPayloadBytes())
require.NoError(t, err)
require.Equal(t, "Nova Prime", accountResponse.Account.RaceName)
lookup := h.lookupUserByEmail(t, email)
require.Equal(t, "Nova Prime", lookup.User.RaceName)
}
func TestGatewayUserUpdateMySettingsSuccess(t *testing.T) {
h := newGatewayUserHarness(t)
const (
email = "pilot-settings@example.com"
deviceSessionID = "device-session-update-settings"
requestID = "request-update-settings"
)
created := h.ensureUser(t, email, "en", gatewayUserTestTimeZone)
clientPrivateKey := newClientPrivateKey("update-settings")
h.seedGatewaySession(t, deviceSessionID, created.UserID, clientPrivateKey)
payload, err := contractsuserv1.EncodeUpdateMySettingsRequest("fr-FR", "Europe/Paris")
require.NoError(t, err)
response := h.executeCommand(t, deviceSessionID, requestID, contractsuserv1.MessageTypeUpdateMySettings, payload, clientPrivateKey)
require.Equal(t, contractsuserv1.ResultCodeOK, response.GetResultCode())
accountResponse, err := contractsuserv1.DecodeAccountResponse(response.GetPayloadBytes())
require.NoError(t, err)
require.Equal(t, "fr-FR", accountResponse.Account.PreferredLanguage)
require.Equal(t, "Europe/Paris", accountResponse.Account.TimeZone)
lookup := h.lookupUserByEmail(t, email)
require.Equal(t, "fr-FR", lookup.User.PreferredLanguage)
require.Equal(t, "Europe/Paris", lookup.User.TimeZone)
}
func TestGatewayUserUpdateMyProfileConflict(t *testing.T) {
h := newGatewayUserHarness(t)
const (
email = "pilot-conflict@example.com"
deviceSessionID = "device-session-profile-conflict"
requestID = "request-profile-conflict"
)
created := h.ensureUser(t, email, "en", gatewayUserTestTimeZone)
h.applyProfileUpdateBlock(t, created.UserID)
clientPrivateKey := newClientPrivateKey("profile-conflict")
h.seedGatewaySession(t, deviceSessionID, created.UserID, clientPrivateKey)
payload, err := contractsuserv1.EncodeUpdateMyProfileRequest("Blocked Nova")
require.NoError(t, err)
response := h.executeCommand(t, deviceSessionID, requestID, contractsuserv1.MessageTypeUpdateMyProfile, payload, clientPrivateKey)
require.Equal(t, "conflict", response.GetResultCode())
errorResponse, err := contractsuserv1.DecodeErrorResponse(response.GetPayloadBytes())
require.NoError(t, err)
require.Equal(t, "conflict", errorResponse.Error.Code)
require.Equal(t, "request conflicts with current state", errorResponse.Error.Message)
}
func TestGatewayUserUpdateMySettingsInvalidRequest(t *testing.T) {
h := newGatewayUserHarness(t)
const (
email = "pilot-invalid@example.com"
deviceSessionID = "device-session-settings-invalid"
requestID = "request-settings-invalid"
)
created := h.ensureUser(t, email, "en", gatewayUserTestTimeZone)
clientPrivateKey := newClientPrivateKey("settings-invalid")
h.seedGatewaySession(t, deviceSessionID, created.UserID, clientPrivateKey)
payload, err := contractsuserv1.EncodeUpdateMySettingsRequest("en", "Mars/Base")
require.NoError(t, err)
response := h.executeCommand(t, deviceSessionID, requestID, contractsuserv1.MessageTypeUpdateMySettings, payload, clientPrivateKey)
require.Equal(t, "invalid_request", response.GetResultCode())
errorResponse, err := contractsuserv1.DecodeErrorResponse(response.GetPayloadBytes())
require.NoError(t, err)
require.Equal(t, "invalid_request", errorResponse.Error.Code)
require.NotEmpty(t, errorResponse.Error.Message)
}
integration/gatewayuser/harness_test.go
+311
View File
@@ -0,0 +1,311 @@
package gatewayuser_test
import (
"bytes"
"context"
"crypto/ed25519"
"crypto/sha256"
"encoding/base64"
"encoding/json"
"fmt"
"io"
"net/http"
"path/filepath"
"testing"
"time"
gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
contractsgatewayv1 "galaxy/integration/internal/contracts/gatewayv1"
"galaxy/integration/internal/harness"
usermodel "galaxy/model/user"
"github.com/redis/go-redis/v9"
"github.com/stretchr/testify/require"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials/insecure"
)
const (
gatewayUserDefaultHTTPTimeout = time.Second
gatewayUserTestTimeZone = "Europe/Kaliningrad"
)
type gatewayUserHarness struct {
redis *redis.Client
userServiceURL string
gatewayGRPCAddr string
responseSignerPublicKey ed25519.PublicKey
gatewayProcess *harness.Process
userServiceProcess *harness.Process
}
func newGatewayUserHarness(t *testing.T) *gatewayUserHarness {
t.Helper()
redisServer := harness.StartMiniredis(t)
redisClient := redis.NewClient(&redis.Options{
Addr: redisServer.Addr(),
Protocol: 2,
DisableIdentity: true,
})
t.Cleanup(func() {
require.NoError(t, redisClient.Close())
})
responseSignerPath, responseSignerPublicKey := harness.WriteResponseSignerPEM(t, t.Name())
userServiceAddr := harness.FreeTCPAddress(t)
gatewayPublicAddr := harness.FreeTCPAddress(t)
gatewayGRPCAddr := harness.FreeTCPAddress(t)
userServiceBinary := harness.BuildBinary(t, "userservice", "./user/cmd/userservice")
gatewayBinary := harness.BuildBinary(t, "gateway", "./gateway/cmd/gateway")
userServiceEnv := map[string]string{
"USERSERVICE_LOG_LEVEL": "info",
"USERSERVICE_INTERNAL_HTTP_ADDR": userServiceAddr,
"USERSERVICE_REDIS_ADDR": redisServer.Addr(),
"OTEL_TRACES_EXPORTER": "none",
"OTEL_METRICS_EXPORTER": "none",
}
userServiceProcess := harness.StartProcess(t, "userservice", userServiceBinary, userServiceEnv)
harness.WaitForHTTPStatus(t, userServiceProcess, "http://"+userServiceAddr+"/api/v1/internal/users/user-missing/exists", http.StatusOK)
gatewayEnv := map[string]string{
"GATEWAY_LOG_LEVEL": "info",
"GATEWAY_PUBLIC_HTTP_ADDR": gatewayPublicAddr,
"GATEWAY_AUTHENTICATED_GRPC_ADDR": gatewayGRPCAddr,
"GATEWAY_USER_SERVICE_BASE_URL": "http://" + userServiceAddr,
"GATEWAY_SESSION_CACHE_REDIS_ADDR": redisServer.Addr(),
"GATEWAY_SESSION_CACHE_REDIS_KEY_PREFIX": "gateway:session:",
"GATEWAY_SESSION_EVENTS_REDIS_STREAM": "gateway:session_events",
"GATEWAY_CLIENT_EVENTS_REDIS_STREAM": "gateway:client_events",
"GATEWAY_REPLAY_REDIS_KEY_PREFIX": "gateway:replay:",
"GATEWAY_RESPONSE_SIGNER_PRIVATE_KEY_PEM_PATH": filepath.Clean(responseSignerPath),
"OTEL_TRACES_EXPORTER": "none",
"OTEL_METRICS_EXPORTER": "none",
}
gatewayProcess := harness.StartProcess(t, "gateway", gatewayBinary, gatewayEnv)
harness.WaitForHTTPStatus(t, gatewayProcess, "http://"+gatewayPublicAddr+"/healthz", http.StatusOK)
harness.WaitForTCP(t, gatewayProcess, gatewayGRPCAddr)
return &gatewayUserHarness{
redis: redisClient,
userServiceURL: "http://" + userServiceAddr,
gatewayGRPCAddr: gatewayGRPCAddr,
responseSignerPublicKey: responseSignerPublicKey,
gatewayProcess: gatewayProcess,
userServiceProcess: userServiceProcess,
}
}
func (h *gatewayUserHarness) dialGateway(t *testing.T) *grpc.ClientConn {
t.Helper()
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
conn, err := grpc.DialContext(
ctx,
h.gatewayGRPCAddr,
grpc.WithTransportCredentials(insecure.NewCredentials()),
grpc.WithBlock(),
)
require.NoError(t, err)
t.Cleanup(func() {
require.NoError(t, conn.Close())
})
return conn
}
func (h *gatewayUserHarness) ensureUser(t *testing.T, email string, preferredLanguage string, timeZone string) ensureByEmailResponse {
t.Helper()
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/users/ensure-by-email", map[string]any{
"email": email,
"registration_context": map[string]string{
"preferred_language": preferredLanguage,
"time_zone": timeZone,
},
})
var body ensureByEmailResponse
requireJSONStatus(t, response, http.StatusOK, &body)
return body
}
func (h *gatewayUserHarness) lookupUserByEmail(t *testing.T, email string) userLookupResponse {
t.Helper()
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/user-lookups/by-email", map[string]string{
"email": email,
})
var body userLookupResponse
requireJSONStatus(t, response, http.StatusOK, &body)
return body
}
func (h *gatewayUserHarness) applyProfileUpdateBlock(t *testing.T, userID string) {
t.Helper()
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/users/"+userID+"/sanctions/apply", map[string]any{
"sanction_code": "profile_update_block",
"scope": "lobby",
"reason_code": "manual_block",
"actor": map[string]string{
"type": "admin",
"id": "admin-1",
},
"applied_at": "2026-04-09T10:00:00Z",
})
require.Equal(t, http.StatusOK, response.StatusCode, "response body: %s", response.Body)
}
func (h *gatewayUserHarness) seedGatewaySession(t *testing.T, deviceSessionID string, userID string, clientPrivateKey ed25519.PrivateKey) {
t.Helper()
record := gatewaySessionRecord{
DeviceSessionID: deviceSessionID,
UserID: userID,
ClientPublicKey: base64.StdEncoding.EncodeToString(clientPrivateKey.Public().(ed25519.PublicKey)),
Status: "active",
}
payload, err := json.Marshal(record)
require.NoError(t, err)
require.NoError(t, h.redis.Set(context.Background(), "gateway:session:"+deviceSessionID, payload, 0).Err())
}
func (h *gatewayUserHarness) executeCommand(t *testing.T, deviceSessionID string, requestID string, messageType string, payload []byte, clientPrivateKey ed25519.PrivateKey) *gatewayv1.ExecuteCommandResponse {
t.Helper()
conn := h.dialGateway(t)
client := gatewayv1.NewEdgeGatewayClient(conn)
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
response, err := client.ExecuteCommand(ctx, newExecuteCommandRequest(deviceSessionID, requestID, messageType, payload, clientPrivateKey))
require.NoError(t, err)
assertSignedExecuteCommandResponse(t, response, h.responseSignerPublicKey)
return response
}
type httpResponse struct {
StatusCode int
Body string
Header http.Header
}
type gatewaySessionRecord struct {
DeviceSessionID string `json:"device_session_id"`
UserID string `json:"user_id"`
ClientPublicKey string `json:"client_public_key"`
Status string `json:"status"`
RevokedAtMS *int64 `json:"revoked_at_ms,omitempty"`
}
type ensureByEmailResponse struct {
Outcome string `json:"outcome"`
UserID string `json:"user_id,omitempty"`
}
type userLookupResponse struct {
User usermodel.Account `json:"user"`
}
func postJSONValue(t *testing.T, targetURL string, body any) httpResponse {
t.Helper()
payload, err := json.Marshal(body)
require.NoError(t, err)
request, err := http.NewRequest(http.MethodPost, targetURL, bytes.NewReader(payload))
require.NoError(t, err)
request.Header.Set("Content-Type", "application/json")
client := &http.Client{Timeout: gatewayUserDefaultHTTPTimeout}
response, err := client.Do(request)
require.NoError(t, err)
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
require.NoError(t, err)
return httpResponse{
StatusCode: response.StatusCode,
Body: string(responseBody),
Header: response.Header.Clone(),
}
}
func requireJSONStatus(t *testing.T, response httpResponse, wantStatus int, target any) {
t.Helper()
require.Equal(t, wantStatus, response.StatusCode, "response body: %s", response.Body)
require.NoError(t, decodeStrictJSONPayload([]byte(response.Body), target))
}
func decodeStrictJSONPayload(payload []byte, target any) error {
decoder := json.NewDecoder(bytes.NewReader(payload))
decoder.DisallowUnknownFields()
if err := decoder.Decode(target); err != nil {
return err
}
if err := decoder.Decode(&struct{}{}); err != io.EOF {
if err == nil {
return fmt.Errorf("unexpected trailing JSON input")
}
return err
}
return nil
}
func newClientPrivateKey(label string) ed25519.PrivateKey {
seed := sha256.Sum256([]byte("galaxy-integration-gateway-user-client-" + label))
return ed25519.NewKeyFromSeed(seed[:])
}
func newExecuteCommandRequest(deviceSessionID string, requestID string, messageType string, payload []byte, clientPrivateKey ed25519.PrivateKey) *gatewayv1.ExecuteCommandRequest {
payloadHash := contractsgatewayv1.ComputePayloadHash(payload)
request := &gatewayv1.ExecuteCommandRequest{
ProtocolVersion: contractsgatewayv1.ProtocolVersionV1,
DeviceSessionId: deviceSessionID,
MessageType: messageType,
TimestampMs: time.Now().UnixMilli(),
RequestId: requestID,
PayloadBytes: payload,
PayloadHash: payloadHash,
TraceId: "trace-" + requestID,
}
request.Signature = contractsgatewayv1.SignRequest(clientPrivateKey, contractsgatewayv1.RequestSigningFields{
ProtocolVersion: request.GetProtocolVersion(),
DeviceSessionID: request.GetDeviceSessionId(),
MessageType: request.GetMessageType(),
TimestampMS: request.GetTimestampMs(),
RequestID: request.GetRequestId(),
PayloadHash: request.GetPayloadHash(),
})
return request
}
func assertSignedExecuteCommandResponse(t *testing.T, response *gatewayv1.ExecuteCommandResponse, publicKey ed25519.PublicKey) {
t.Helper()
require.NoError(t, contractsgatewayv1.VerifyPayloadHash(response.GetPayloadBytes(), response.GetPayloadHash()))
require.NoError(t, contractsgatewayv1.VerifyResponseSignature(publicKey, response.GetSignature(), contractsgatewayv1.ResponseSigningFields{
ProtocolVersion: response.GetProtocolVersion(),
RequestID: response.GetRequestId(),
TimestampMS: response.GetTimestampMs(),
ResultCode: response.GetResultCode(),
PayloadHash: response.GetPayloadHash(),
}))
}
integration/go.mod
+2 -2
View File
@@ -18,8 +18,8 @@ require (
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
github.com/yuin/gopher-lua v1.1.1 // indirect
go.opentelemetry.io/otel v1.42.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
go.uber.org/atomic v1.11.0 // indirect
golang.org/x/net v0.52.0 // indirect
golang.org/x/sys v0.42.0 // indirect
integration/go.sum
+5 -5
View File
@@ -34,11 +34,11 @@ github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
integration/internal/contracts/gatewayv1/contract.go
+59
View File
@@ -38,6 +38,11 @@ var (
// ErrInvalidEventSignature reports that one gateway event signature is not
// a raw Ed25519 signature for the canonical event signing input.
ErrInvalidEventSignature = errors.New("invalid event signature")
// ErrInvalidResponseSignature reports that one gateway unary response
// signature is not a raw Ed25519 signature for the canonical response
// signing input.
ErrInvalidResponseSignature = errors.New("invalid response signature")
)
// RequestSigningFields stores the canonical public request fields bound into
@@ -85,6 +90,25 @@ type EventSigningFields struct {
PayloadHash []byte
}
// ResponseSigningFields stores the canonical public unary response fields
// bound into one gateway signature input.
type ResponseSigningFields struct {
// ProtocolVersion identifies the gateway transport envelope version.
ProtocolVersion string
// RequestID is the transport correlation identifier echoed by the gateway.
RequestID string
// TimestampMS carries the gateway response timestamp in milliseconds.
TimestampMS int64
// ResultCode stores the stable opaque gateway result code.
ResultCode string
// PayloadHash stores the raw SHA-256 digest of PayloadBytes.
PayloadHash []byte
}
// ComputePayloadHash returns the canonical raw SHA-256 digest for payloadBytes.
func ComputePayloadHash(payloadBytes []byte) []byte {
sum := sha256.Sum256(payloadBytes)
@@ -154,6 +178,28 @@ func BuildEventSigningInput(fields EventSigningFields) []byte {
return buf
}
// BuildResponseSigningInput returns the canonical byte sequence the v1
// gateway unary response signature covers.
func BuildResponseSigningInput(fields ResponseSigningFields) []byte {
size := len("galaxy-response-v1") +
len(fields.ProtocolVersion) +
len(fields.RequestID) +
len(fields.ResultCode) +
len(fields.PayloadHash) +
(5 * binary.MaxVarintLen64) +
8
buf := make([]byte, 0, size)
buf = appendLengthPrefixedString(buf, "galaxy-response-v1")
buf = appendLengthPrefixedString(buf, fields.ProtocolVersion)
buf = appendLengthPrefixedString(buf, fields.RequestID)
buf = binary.BigEndian.AppendUint64(buf, uint64(fields.TimestampMS))
buf = appendLengthPrefixedString(buf, fields.ResultCode)
buf = appendLengthPrefixedBytes(buf, fields.PayloadHash)
return buf
}
// SignRequest returns one raw Ed25519 client signature for the canonical v1
// request signing input.
func SignRequest(privateKey ed25519.PrivateKey, fields RequestSigningFields) []byte {
@@ -173,6 +219,19 @@ func VerifyEventSignature(publicKey ed25519.PublicKey, signature []byte, fields
return nil
}
// VerifyResponseSignature reports whether signature authenticates fields under
// publicKey using the canonical gateway unary-response signing input.
func VerifyResponseSignature(publicKey ed25519.PublicKey, signature []byte, fields ResponseSigningFields) error {
if len(publicKey) != ed25519.PublicKeySize || len(signature) != ed25519.SignatureSize {
return ErrInvalidResponseSignature
}
if !ed25519.Verify(publicKey, BuildResponseSigningInput(fields), signature) {
return ErrInvalidResponseSignature
}
return nil
}
func appendLengthPrefixedString(dst []byte, value string) []byte {
return appendLengthPrefixedBytes(dst, []byte(value))
}
integration/internal/contracts/userv1/contract.go
+61
View File
@@ -0,0 +1,61 @@
// Package userv1contract provides public-contract helpers for the
// authenticated gateway v1 User Service self-service message types.
package userv1contract
import (
usermodel "galaxy/model/user"
"galaxy/transcoder"
)
const (
// MessageTypeGetMyAccount is the authenticated gateway message type used to
// read the current self-service account aggregate.
MessageTypeGetMyAccount = usermodel.MessageTypeGetMyAccount
// MessageTypeUpdateMyProfile is the authenticated gateway message type used
// to mutate self-service profile fields.
MessageTypeUpdateMyProfile = usermodel.MessageTypeUpdateMyProfile
// MessageTypeUpdateMySettings is the authenticated gateway message type used
// to mutate self-service settings fields.
MessageTypeUpdateMySettings = usermodel.MessageTypeUpdateMySettings
// ResultCodeOK is the success result code projected by gateway for all
// successful `user.*` authenticated commands.
ResultCodeOK = "ok"
)
// EncodeGetMyAccountRequest returns the FlatBuffers payload for the public
// empty get-account request.
func EncodeGetMyAccountRequest() ([]byte, error) {
return transcoder.GetMyAccountRequestToPayload(&usermodel.GetMyAccountRequest{})
}
// EncodeUpdateMyProfileRequest returns the FlatBuffers payload for one public
// self-service profile mutation request.
func EncodeUpdateMyProfileRequest(raceName string) ([]byte, error) {
return transcoder.UpdateMyProfileRequestToPayload(&usermodel.UpdateMyProfileRequest{
RaceName: raceName,
})
}
// EncodeUpdateMySettingsRequest returns the FlatBuffers payload for one public
// self-service settings mutation request.
func EncodeUpdateMySettingsRequest(preferredLanguage string, timeZone string) ([]byte, error) {
return transcoder.UpdateMySettingsRequestToPayload(&usermodel.UpdateMySettingsRequest{
PreferredLanguage: preferredLanguage,
TimeZone: timeZone,
})
}
// DecodeAccountResponse decodes the public FlatBuffers success payload shared
// by all authenticated `user.*` commands.
func DecodeAccountResponse(payload []byte) (*usermodel.AccountResponse, error) {
return transcoder.PayloadToAccountResponse(payload)
}
// DecodeErrorResponse decodes the public FlatBuffers error payload shared by
// all authenticated `user.*` commands.
func DecodeErrorResponse(payload []byte) (*usermodel.ErrorResponse, error) {
return transcoder.PayloadToErrorResponse(payload)
}