mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-10-15 23:22:59 +08:00
feeeei
26e0a89323
沿用腾讯天御验证码引入的多服务商模型：aliyun_captcha_enabled 作为独立 开关，与 Cloudflare Turnstile、腾讯天御三方互斥（保存校验 + 运行时 CAPTCHA_PROVIDER_CONFLICT）。后台「安全与认证」合并为单张人机验证卡片： 总开关 + 服务商单选（Turnstile / 腾讯天御 / 阿里云），选中即启用该家并 关闭其它，落库仍是三个独立开关键，由前端映射保证互斥。 阿里云侧同时支持 aliyun 中国站与国际站（alibabacloud.com）：两站前端脚本、 region 取值与服务端 API 完全一致，仅账号与 AccessKey 相互独立，因此由 「服务地域」决定线路即可——中国内地走 captcha.cn-shanghai.aliyuncs.com， 非中国内地（新加坡）走 captcha.ap-southeast-1.aliyuncs.com，AccessKey 取自持有该实例的账号，无需在配置中区分站点。 - AliyunCaptchaService 对称 TencentCaptchaService：服务端校验走官方 SDK VerifyIntelligentCaptcha，调用异常按 fail-closed 拦截，与 Turnstile 网络错误行为对称；保存设置时真实探测 AK/SK 有效性 - 保护面对齐腾讯扩展入口：VerifyTencentCaptchaIfEnabled 通用化为 VerifyActionCaptchaIfEnabled，OAuth 登录启动、passkey 登录在阿里云 启用时同样拦截；Turnstile 维持既有覆盖不扩大 - 前端 AliyunCaptchaWidget 为表单内预验证按钮（popup 模式），同时暴露 verify() 供 OAuth 启动、passkey 等动作入口程序化弹窗；未预验证直接 提交时弹窗兜底。SDK 按钮绑定异步完成，弹窗未出现前按 tick 重试触发， 并轮询弹窗可见性识别用户关闭 - captchaVerifyParam 复用 turnstile_token 请求字段提交；公开设置下发 aliyun_captcha_enabled / scene_id / prefix / region - CSP 放行验证码 CDN：script-src/style-src 加 *.alicdn.com
94 lines
3.5 KiB
Go
94 lines
3.5 KiB
Go
package repository
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/service"
|
|
)
|
|
|
|
// newAliyunCaptchaTestTarget 起一个假的阿里云端点，让真实 SDK 走完整的签名/序列化链路。
|
|
func newAliyunCaptchaTestTarget(t *testing.T, handler http.HandlerFunc) (*aliyunCaptchaVerifier, service.AliyunCaptchaCredentials) {
|
|
t.Helper()
|
|
server := httptest.NewServer(handler)
|
|
t.Cleanup(server.Close)
|
|
|
|
verifier := &aliyunCaptchaVerifier{protocol: "HTTP", timeoutMillis: 2_000}
|
|
cred := service.AliyunCaptchaCredentials{
|
|
AccessKeyID: "test-ak-id",
|
|
AccessKeySecret: "test-ak-secret",
|
|
SceneID: "scene-1",
|
|
Endpoint: strings.TrimPrefix(server.URL, "http://"),
|
|
}
|
|
return verifier, cred
|
|
}
|
|
|
|
func TestAliyunCaptchaVerifier_VerifySuccess(t *testing.T) {
|
|
var capturedParam, capturedSceneID string
|
|
verifier, cred := newAliyunCaptchaTestTarget(t, func(w http.ResponseWriter, r *http.Request) {
|
|
require.NoError(t, r.ParseForm())
|
|
capturedParam = r.Form.Get("CaptchaVerifyParam")
|
|
capturedSceneID = r.Form.Get("SceneId")
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`{"Code":"Success","Message":"success","RequestId":"req-1","Success":true,"Result":{"VerifyResult":true,"VerifyCode":"T001"}}`))
|
|
})
|
|
|
|
result, err := verifier.VerifyCaptcha(context.Background(), cred, "the-verify-param")
|
|
require.NoError(t, err)
|
|
require.True(t, result.VerifyResult)
|
|
require.Equal(t, "T001", result.VerifyCode)
|
|
require.Equal(t, "the-verify-param", capturedParam)
|
|
require.Equal(t, "scene-1", capturedSceneID)
|
|
}
|
|
|
|
func TestAliyunCaptchaVerifier_VerifyResultFalse(t *testing.T) {
|
|
verifier, cred := newAliyunCaptchaTestTarget(t, func(w http.ResponseWriter, _ *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = w.Write([]byte(`{"Code":"Success","RequestId":"req-2","Success":true,"Result":{"VerifyResult":false,"VerifyCode":"F002"}}`))
|
|
})
|
|
|
|
result, err := verifier.VerifyCaptcha(context.Background(), cred, "bad-param")
|
|
require.NoError(t, err)
|
|
require.False(t, result.VerifyResult)
|
|
require.Equal(t, "F002", result.VerifyCode)
|
|
}
|
|
|
|
func TestAliyunCaptchaVerifier_APIErrorNormalized(t *testing.T) {
|
|
verifier, cred := newAliyunCaptchaTestTarget(t, func(w http.ResponseWriter, _ *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
_, _ = w.Write([]byte(`{"Code":"SignatureDoesNotMatch","Message":"Specified signature is not matched with our calculation.","RequestId":"req-3"}`))
|
|
})
|
|
|
|
_, err := verifier.VerifyCaptcha(context.Background(), cred, "param")
|
|
require.Error(t, err)
|
|
var apiErr *service.AliyunCaptchaAPIError
|
|
require.ErrorAs(t, err, &apiErr)
|
|
require.Equal(t, "SignatureDoesNotMatch", apiErr.Code)
|
|
}
|
|
|
|
func TestAliyunCaptchaVerifier_TransportError(t *testing.T) {
|
|
server := httptest.NewServer(http.NotFoundHandler())
|
|
endpoint := strings.TrimPrefix(server.URL, "http://")
|
|
server.Close() // 立即关闭，制造连接失败
|
|
|
|
verifier := &aliyunCaptchaVerifier{protocol: "HTTP", timeoutMillis: 2_000}
|
|
cred := service.AliyunCaptchaCredentials{
|
|
AccessKeyID: "test-ak-id",
|
|
AccessKeySecret: "test-ak-secret",
|
|
SceneID: "scene-1",
|
|
Endpoint: endpoint,
|
|
}
|
|
|
|
_, err := verifier.VerifyCaptcha(context.Background(), cred, "param")
|
|
require.Error(t, err)
|
|
var apiErr *service.AliyunCaptchaAPIError
|
|
require.False(t, errors.As(err, &apiErr), "transport errors must not be normalized to API errors")
|
|
}
|