Ilia Denisov
312 lines
10 KiB
Go
312 lines
10 KiB
Go
package gatewayuser_test
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/ed25519"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
|
|
gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
|
|
contractsgatewayv1 "galaxy/integration/internal/contracts/gatewayv1"
|
|
"galaxy/integration/internal/harness"
|
|
usermodel "galaxy/model/user"
|
|
|
|
"github.com/redis/go-redis/v9"
|
|
"github.com/stretchr/testify/require"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/credentials/insecure"
|
|
)
|
|
|
|
const (
|
|
gatewayUserDefaultHTTPTimeout = time.Second
|
|
gatewayUserTestTimeZone = "Europe/Kaliningrad"
|
|
)
|
|
|
|
type gatewayUserHarness struct {
|
|
redis *redis.Client
|
|
|
|
userServiceURL string
|
|
gatewayGRPCAddr string
|
|
|
|
responseSignerPublicKey ed25519.PublicKey
|
|
|
|
gatewayProcess *harness.Process
|
|
userServiceProcess *harness.Process
|
|
}
|
|
|
|
func newGatewayUserHarness(t *testing.T) *gatewayUserHarness {
|
|
t.Helper()
|
|
|
|
redisServer := harness.StartMiniredis(t)
|
|
redisClient := redis.NewClient(&redis.Options{
|
|
Addr: redisServer.Addr(),
|
|
Protocol: 2,
|
|
DisableIdentity: true,
|
|
})
|
|
t.Cleanup(func() {
|
|
require.NoError(t, redisClient.Close())
|
|
})
|
|
|
|
responseSignerPath, responseSignerPublicKey := harness.WriteResponseSignerPEM(t, t.Name())
|
|
userServiceAddr := harness.FreeTCPAddress(t)
|
|
gatewayPublicAddr := harness.FreeTCPAddress(t)
|
|
gatewayGRPCAddr := harness.FreeTCPAddress(t)
|
|
|
|
userServiceBinary := harness.BuildBinary(t, "userservice", "./user/cmd/userservice")
|
|
gatewayBinary := harness.BuildBinary(t, "gateway", "./gateway/cmd/gateway")
|
|
|
|
userServiceEnv := harness.StartUserServicePersistence(t, redisServer.Addr()).Env
|
|
userServiceEnv["USERSERVICE_LOG_LEVEL"] = "info"
|
|
userServiceEnv["USERSERVICE_INTERNAL_HTTP_ADDR"] = userServiceAddr
|
|
userServiceEnv["OTEL_TRACES_EXPORTER"] = "none"
|
|
userServiceEnv["OTEL_METRICS_EXPORTER"] = "none"
|
|
userServiceProcess := harness.StartProcess(t, "userservice", userServiceBinary, userServiceEnv)
|
|
harness.WaitForHTTPStatus(t, userServiceProcess, "http://"+userServiceAddr+"/api/v1/internal/users/user-missing/exists", http.StatusOK)
|
|
|
|
gatewayEnv := map[string]string{
|
|
"GATEWAY_LOG_LEVEL": "info",
|
|
"GATEWAY_PUBLIC_HTTP_ADDR": gatewayPublicAddr,
|
|
"GATEWAY_AUTHENTICATED_GRPC_ADDR": gatewayGRPCAddr,
|
|
"GATEWAY_USER_SERVICE_BASE_URL": "http://" + userServiceAddr,
|
|
"GATEWAY_REDIS_MASTER_ADDR": redisServer.Addr(),
|
|
|
|
"GATEWAY_REDIS_PASSWORD": "integration",
|
|
"GATEWAY_SESSION_CACHE_REDIS_KEY_PREFIX": "gateway:session:",
|
|
"GATEWAY_SESSION_EVENTS_REDIS_STREAM": "gateway:session_events",
|
|
"GATEWAY_CLIENT_EVENTS_REDIS_STREAM": "gateway:client_events",
|
|
"GATEWAY_REPLAY_REDIS_KEY_PREFIX": "gateway:replay:",
|
|
"GATEWAY_RESPONSE_SIGNER_PRIVATE_KEY_PEM_PATH": filepath.Clean(responseSignerPath),
|
|
"OTEL_TRACES_EXPORTER": "none",
|
|
"OTEL_METRICS_EXPORTER": "none",
|
|
}
|
|
gatewayProcess := harness.StartProcess(t, "gateway", gatewayBinary, gatewayEnv)
|
|
harness.WaitForHTTPStatus(t, gatewayProcess, "http://"+gatewayPublicAddr+"/healthz", http.StatusOK)
|
|
harness.WaitForTCP(t, gatewayProcess, gatewayGRPCAddr)
|
|
|
|
return &gatewayUserHarness{
|
|
redis: redisClient,
|
|
userServiceURL: "http://" + userServiceAddr,
|
|
gatewayGRPCAddr: gatewayGRPCAddr,
|
|
responseSignerPublicKey: responseSignerPublicKey,
|
|
gatewayProcess: gatewayProcess,
|
|
userServiceProcess: userServiceProcess,
|
|
}
|
|
}
|
|
|
|
func (h *gatewayUserHarness) dialGateway(t *testing.T) *grpc.ClientConn {
|
|
t.Helper()
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
conn, err := grpc.DialContext(
|
|
ctx,
|
|
h.gatewayGRPCAddr,
|
|
grpc.WithTransportCredentials(insecure.NewCredentials()),
|
|
grpc.WithBlock(),
|
|
)
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() {
|
|
require.NoError(t, conn.Close())
|
|
})
|
|
|
|
return conn
|
|
}
|
|
|
|
func (h *gatewayUserHarness) ensureUser(t *testing.T, email string, preferredLanguage string, timeZone string) ensureByEmailResponse {
|
|
t.Helper()
|
|
|
|
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/users/ensure-by-email", map[string]any{
|
|
"email": email,
|
|
"registration_context": map[string]string{
|
|
"preferred_language": preferredLanguage,
|
|
"time_zone": timeZone,
|
|
},
|
|
})
|
|
|
|
var body ensureByEmailResponse
|
|
requireJSONStatus(t, response, http.StatusOK, &body)
|
|
return body
|
|
}
|
|
|
|
func (h *gatewayUserHarness) lookupUserByEmail(t *testing.T, email string) userLookupResponse {
|
|
t.Helper()
|
|
|
|
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/user-lookups/by-email", map[string]string{
|
|
"email": email,
|
|
})
|
|
|
|
var body userLookupResponse
|
|
requireJSONStatus(t, response, http.StatusOK, &body)
|
|
return body
|
|
}
|
|
|
|
func (h *gatewayUserHarness) applyProfileUpdateBlock(t *testing.T, userID string) {
|
|
t.Helper()
|
|
|
|
response := postJSONValue(t, h.userServiceURL+"/api/v1/internal/users/"+userID+"/sanctions/apply", map[string]any{
|
|
"sanction_code": "profile_update_block",
|
|
"scope": "lobby",
|
|
"reason_code": "manual_block",
|
|
"actor": map[string]string{
|
|
"type": "admin",
|
|
"id": "admin-1",
|
|
},
|
|
"applied_at": "2026-04-09T10:00:00Z",
|
|
})
|
|
require.Equal(t, http.StatusOK, response.StatusCode, "response body: %s", response.Body)
|
|
}
|
|
|
|
func (h *gatewayUserHarness) seedGatewaySession(t *testing.T, deviceSessionID string, userID string, clientPrivateKey ed25519.PrivateKey) {
|
|
t.Helper()
|
|
|
|
record := gatewaySessionRecord{
|
|
DeviceSessionID: deviceSessionID,
|
|
UserID: userID,
|
|
ClientPublicKey: base64.StdEncoding.EncodeToString(clientPrivateKey.Public().(ed25519.PublicKey)),
|
|
Status: "active",
|
|
}
|
|
|
|
payload, err := json.Marshal(record)
|
|
require.NoError(t, err)
|
|
require.NoError(t, h.redis.Set(context.Background(), "gateway:session:"+deviceSessionID, payload, 0).Err())
|
|
}
|
|
|
|
func (h *gatewayUserHarness) executeCommand(t *testing.T, deviceSessionID string, requestID string, messageType string, payload []byte, clientPrivateKey ed25519.PrivateKey) *gatewayv1.ExecuteCommandResponse {
|
|
t.Helper()
|
|
|
|
conn := h.dialGateway(t)
|
|
client := gatewayv1.NewEdgeGatewayClient(conn)
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
response, err := client.ExecuteCommand(ctx, newExecuteCommandRequest(deviceSessionID, requestID, messageType, payload, clientPrivateKey))
|
|
require.NoError(t, err)
|
|
assertSignedExecuteCommandResponse(t, response, h.responseSignerPublicKey)
|
|
return response
|
|
}
|
|
|
|
type httpResponse struct {
|
|
StatusCode int
|
|
Body string
|
|
Header http.Header
|
|
}
|
|
|
|
type gatewaySessionRecord struct {
|
|
DeviceSessionID string `json:"device_session_id"`
|
|
UserID string `json:"user_id"`
|
|
ClientPublicKey string `json:"client_public_key"`
|
|
Status string `json:"status"`
|
|
RevokedAtMS *int64 `json:"revoked_at_ms,omitempty"`
|
|
}
|
|
|
|
type ensureByEmailResponse struct {
|
|
Outcome string `json:"outcome"`
|
|
UserID string `json:"user_id,omitempty"`
|
|
}
|
|
|
|
type userLookupResponse struct {
|
|
User usermodel.Account `json:"user"`
|
|
}
|
|
|
|
func postJSONValue(t *testing.T, targetURL string, body any) httpResponse {
|
|
t.Helper()
|
|
|
|
payload, err := json.Marshal(body)
|
|
require.NoError(t, err)
|
|
|
|
request, err := http.NewRequest(http.MethodPost, targetURL, bytes.NewReader(payload))
|
|
require.NoError(t, err)
|
|
request.Header.Set("Content-Type", "application/json")
|
|
|
|
client := &http.Client{Timeout: gatewayUserDefaultHTTPTimeout}
|
|
response, err := client.Do(request)
|
|
require.NoError(t, err)
|
|
defer response.Body.Close()
|
|
|
|
responseBody, err := io.ReadAll(response.Body)
|
|
require.NoError(t, err)
|
|
|
|
return httpResponse{
|
|
StatusCode: response.StatusCode,
|
|
Body: string(responseBody),
|
|
Header: response.Header.Clone(),
|
|
}
|
|
}
|
|
|
|
func requireJSONStatus(t *testing.T, response httpResponse, wantStatus int, target any) {
|
|
t.Helper()
|
|
|
|
require.Equal(t, wantStatus, response.StatusCode, "response body: %s", response.Body)
|
|
require.NoError(t, decodeStrictJSONPayload([]byte(response.Body), target))
|
|
}
|
|
|
|
func decodeStrictJSONPayload(payload []byte, target any) error {
|
|
decoder := json.NewDecoder(bytes.NewReader(payload))
|
|
decoder.DisallowUnknownFields()
|
|
|
|
if err := decoder.Decode(target); err != nil {
|
|
return err
|
|
}
|
|
if err := decoder.Decode(&struct{}{}); err != io.EOF {
|
|
if err == nil {
|
|
return fmt.Errorf("unexpected trailing JSON input")
|
|
}
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func newClientPrivateKey(label string) ed25519.PrivateKey {
|
|
seed := sha256.Sum256([]byte("galaxy-integration-gateway-user-client-" + label))
|
|
return ed25519.NewKeyFromSeed(seed[:])
|
|
}
|
|
|
|
func newExecuteCommandRequest(deviceSessionID string, requestID string, messageType string, payload []byte, clientPrivateKey ed25519.PrivateKey) *gatewayv1.ExecuteCommandRequest {
|
|
payloadHash := contractsgatewayv1.ComputePayloadHash(payload)
|
|
|
|
request := &gatewayv1.ExecuteCommandRequest{
|
|
ProtocolVersion: contractsgatewayv1.ProtocolVersionV1,
|
|
DeviceSessionId: deviceSessionID,
|
|
MessageType: messageType,
|
|
TimestampMs: time.Now().UnixMilli(),
|
|
RequestId: requestID,
|
|
PayloadBytes: payload,
|
|
PayloadHash: payloadHash,
|
|
TraceId: "trace-" + requestID,
|
|
}
|
|
request.Signature = contractsgatewayv1.SignRequest(clientPrivateKey, contractsgatewayv1.RequestSigningFields{
|
|
ProtocolVersion: request.GetProtocolVersion(),
|
|
DeviceSessionID: request.GetDeviceSessionId(),
|
|
MessageType: request.GetMessageType(),
|
|
TimestampMS: request.GetTimestampMs(),
|
|
RequestID: request.GetRequestId(),
|
|
PayloadHash: request.GetPayloadHash(),
|
|
})
|
|
|
|
return request
|
|
}
|
|
|
|
func assertSignedExecuteCommandResponse(t *testing.T, response *gatewayv1.ExecuteCommandResponse, publicKey ed25519.PublicKey) {
|
|
t.Helper()
|
|
|
|
require.NoError(t, contractsgatewayv1.VerifyPayloadHash(response.GetPayloadBytes(), response.GetPayloadHash()))
|
|
require.NoError(t, contractsgatewayv1.VerifyResponseSignature(publicKey, response.GetSignature(), contractsgatewayv1.ResponseSigningFields{
|
|
ProtocolVersion: response.GetProtocolVersion(),
|
|
RequestID: response.GetRequestId(),
|
|
TimestampMS: response.GetTimestampMs(),
|
|
ResultCode: response.GetResultCode(),
|
|
PayloadHash: response.GetPayloadHash(),
|
|
}))
|
|
}
|