feat: manage existing credential actions with audited replay

internal/transport/httpserver/console_applications_test.go

@@ -15,7 +15,11 @@ import (
 	"git.yuntuo.hk/k2safe/orbit/platform/auth"
 )
 
-type fakeApplications struct{ calls int }
+type fakeApplications struct {
+	calls int
+	input consoleauth.ApplicationInput
+	op    consoleauth.ApplicationOperation
+}
 
 func (f *fakeApplications) ListApplications(context.Context, auth.Token, core.ID) (consoleauth.ApplicationPage, error) {
 	f.calls++
@@ -25,12 +29,14 @@ func (f *fakeApplications) GetApplication(context.Context, auth.Token, core.ID)
 	f.calls++
 	return consoleauth.ApplicationDetail{}, nil
 }
-func (f *fakeApplications) PrepareApplication(context.Context, auth.Token, consoleauth.ApplicationInput) (consoleauth.ApplicationOperation, error) {
+func (f *fakeApplications) PrepareApplication(_ context.Context, _ auth.Token, in consoleauth.ApplicationInput) (consoleauth.ApplicationOperation, error) {
 	f.calls++
+	f.input = in
 	return consoleauth.ApplicationOperation{}, nil
 }
-func (f *fakeApplications) ApplyApplication(context.Context, auth.Token, consoleauth.ApplicationOperation) (consoleauth.ApplicationReceipt, error) {
+func (f *fakeApplications) ApplyApplication(_ context.Context, _ auth.Token, op consoleauth.ApplicationOperation) (consoleauth.ApplicationReceipt, error) {
 	f.calls++
+	f.op = op
 	return consoleauth.ApplicationReceipt{}, nil
 }
 func TestConsoleApplicationSessionAndCSRF(t *testing.T) {
@@ -91,7 +97,7 @@ func TestConsolePreparedApplicationRoundTrip(t *testing.T) {
 	queue, _ := core.NewID()
 	opID, _ := core.NewID()
 	token, _, _ := auth.Issue(ns, cred)
-	for _, kind := range []string{"CREATE", "ROTATE", "SET_EXPIRY", "FINALIZE"} {
+	for _, kind := range []string{"CREATE", "ROTATE", "SET_EXPIRY", "FINALIZE", "SET_PERMISSIONS"} {
 		op := consoleauth.ApplicationOperation{Input: consoleauth.ApplicationInput{Kind: kind, ValidDays: 30, Reason: "test"}, OperationID: opID, ApplicationID: app, NamespaceID: ns, CredentialID: cred, Token: token, ExpiresAt: func() *time.Time { v := time.Now().UTC(); return &v }()}
 		if kind == "CREATE" {
 			op.QueueID = queue
@@ -104,12 +110,16 @@ func TestConsolePreparedApplicationRoundTrip(t *testing.T) {
 			op.Input.CredentialID = cred
 			op.Input.ExpectedRevision = 1
 		}
-		if kind == "SET_EXPIRY" || kind == "FINALIZE" {
+		if kind == "SET_EXPIRY" || kind == "FINALIZE" || kind == "SET_PERMISSIONS" {
 			op.Version = 2
 			op.Token = ""
 			op.ExpiresAt = nil
 			op.Input.ValidDays = 0
 		}
+		if kind == "SET_PERMISSIONS" {
+			op.Version = 3
+			op.Input.Actions = []string{"schedules:manage", "schedules:read", "tasks:submit"}
+		}
 		raw, err := json.Marshal(op)
 		if err != nil {
 			t.Fatal(err)
@@ -125,3 +135,88 @@ func TestConsolePreparedApplicationRoundTrip(t *testing.T) {
 		}
 	}
 }
+
+// 权限操作仍走管理员 Cookie 与同源保护；新数组字段不能放宽精确 JSON 解码。
+func TestConsolePermissionChangeHTTPBoundary(t *testing.T) {
+	ns, _ := core.NewID()
+	cred, _ := core.NewID()
+	raw, _, _ := auth.Issue(ns, cred)
+	valid := `{"kind":"SET_PERMISSIONS","namespace_id":"` + string(ns) + `","credential_id":"` + string(cred) + `","expected_revision":"7","reason":"enable scheduling","actions":["tasks:submit","schedules:read","schedules:manage"]}`
+	for _, apply := range []bool{false, true} {
+		path := "/console/applications/prepare"
+		wrap := func(in string) string { return in }
+		if apply {
+			path = "/console/applications/apply"
+			wrap = func(in string) string {
+				return `{"version":3,"input":` + in + `,"operation_id":"` + string(ns) + `","application_id":"` + string(ns) + `","namespace_id":"` + string(ns) + `","credential_id":"` + string(cred) + `"}`
+			}
+		}
+		for _, tc := range []struct {
+			name, body, origin, fetch    string
+			cookie, validSession, header bool
+			status                       int
+		}{
+			{"valid", valid, "http://example.com", "same-origin", true, true, true, 200},
+			{"SDK bearer only", valid, "", "", false, true, true, 401},
+			{"expired session", valid, "", "", true, false, true, 401},
+			{"missing custom header", valid, "", "", true, true, false, 403},
+			{"cross origin", valid, "https://elsewhere.example", "", true, true, true, 403},
+			{"opaque origin", valid, "null", "", true, true, true, 403},
+			{"origin credentials", valid, "http://user@example.com", "", true, true, true, 403},
+			{"cross site metadata", valid, "http://example.com", "cross-site", true, true, true, 403},
+			{"duplicate actions", strings.Replace(valid, `"actions":`, `"actions":[],"actions":`, 1), "", "", true, true, true, 400},
+			{"field alias", strings.Replace(valid, `"actions":`, `"Actions":`, 1), "", "", true, true, true, 400},
+			{"unknown scope field", strings.TrimSuffix(valid, "}") + `,"queues":["*"]}`, "", "", true, true, true, 400},
+			{"null actions", strings.Replace(valid, `["tasks:submit","schedules:read","schedules:manage"]`, `null`, 1), "", "", true, true, true, 400},
+			{"null element", strings.Replace(valid, `"tasks:submit"`, `null`, 1), "", "", true, true, true, 400},
+			{"numeric element", strings.Replace(valid, `"tasks:submit"`, `12`, 1), "", "", true, true, true, 400},
+			{"numeric revision", strings.Replace(valid, `"expected_revision":"7"`, `"expected_revision":7`, 1), "", "", true, true, true, 400},
+		} {
+			t.Run(path+"/"+tc.name, func(t *testing.T) {
+				authStore := &fakeConsoleAuth{valid: tc.validSession}
+				store := &fakeApplications{}
+				server := NewWithConsoleAuth("", nil, authStore)
+				RegisterConsoleApplications(server, authStore, store)
+				req := httptest.NewRequest(http.MethodPost, "http://example.com"+path, strings.NewReader(wrap(tc.body)))
+				req.Header.Set("Content-Type", "application/json")
+				req.Header.Set("Authorization", "Bearer "+raw)
+				if tc.cookie {
+					req.AddCookie(&http.Cookie{Name: consoleSessionCookie, Value: raw})
+				}
+				if tc.header {
+					req.Header.Set("X-Orbit-Console", "1")
+				}
+				if tc.origin != "" {
+					req.Header.Set("Origin", tc.origin)
+				}
+				if tc.fetch != "" {
+					req.Header.Set("Sec-Fetch-Site", tc.fetch)
+				}
+				res := httptest.NewRecorder()
+				server.Handler.ServeHTTP(res, req)
+				if res.Code != tc.status {
+					t.Fatalf("status=%d want=%d", res.Code, tc.status)
+				}
+				if res.Header().Get("Cache-Control") != "no-store" {
+					t.Fatal("permission response is cacheable")
+				}
+				if tc.status != 200 {
+					if store.calls != 0 {
+						t.Fatal("rejected request reached store")
+					}
+					return
+				}
+				input := store.input
+				if apply {
+					input = store.op.Input
+					if store.op.Version != 3 || store.op.Token != "" {
+						t.Fatal("permission envelope changed")
+					}
+				}
+				if store.calls != 1 || input.Kind != "SET_PERMISSIONS" || input.ExpectedRevision != 7 || len(input.Actions) != 3 || input.Actions[2] != "schedules:manage" {
+					t.Fatal("permission intent changed")
+				}
+			})
+		}
+	}
+}