|
| 1 | +package com.github.binarywang.wxpay.v3; |
| 2 | + |
| 3 | +import org.apache.http.HttpException; |
| 4 | +import org.apache.http.ProtocolVersion; |
| 5 | +import org.apache.http.client.methods.CloseableHttpResponse; |
| 6 | +import org.apache.http.client.methods.HttpGet; |
| 7 | +import org.apache.http.client.methods.HttpRequestWrapper; |
| 8 | +import org.apache.http.client.protocol.HttpClientContext; |
| 9 | +import org.apache.http.impl.execchain.ClientExecChain; |
| 10 | +import org.apache.http.message.BasicHttpResponse; |
| 11 | +import org.apache.http.message.BasicStatusLine; |
| 12 | +import org.testng.annotations.Test; |
| 13 | + |
| 14 | +import java.io.IOException; |
| 15 | +import java.util.Collections; |
| 16 | +import java.util.HashSet; |
| 17 | +import java.util.Set; |
| 18 | +import java.util.concurrent.atomic.AtomicBoolean; |
| 19 | + |
| 20 | +import static org.testng.Assert.*; |
| 21 | + |
| 22 | +/** |
| 23 | + * 测试 SignatureExec 的受信任主机功能，确保在代理转发场景下正确添加 Authorization 头 |
| 24 | + * |
| 25 | + * @author GitHub Copilot |
| 26 | + */ |
| 27 | +public class SignatureExecTrustedHostTest { |
| 28 | + |
| 29 | + /** |
| 30 | + * 最简 CloseableHttpResponse 实现，仅用于单元测试 |
| 31 | + */ |
| 32 | + private static class StubCloseableHttpResponse extends BasicHttpResponse implements CloseableHttpResponse { |
| 33 | + StubCloseableHttpResponse() { |
| 34 | + super(new BasicStatusLine(new ProtocolVersion("HTTP", 1, 1), 200, "OK")); |
| 35 | + } |
| 36 | + |
| 37 | + @Override |
| 38 | + public void close() { |
| 39 | + } |
| 40 | + } |
| 41 | + |
| 42 | + /** |
| 43 | + * 创建一个测试用的 Credentials，始终返回固定 schema 和 token |
| 44 | + */ |
| 45 | + private static Credentials createTestCredentials() { |
| 46 | + return new Credentials() { |
| 47 | + @Override |
| 48 | + public String getSchema() { |
| 49 | + return "WECHATPAY2-SHA256-RSA2048"; |
| 50 | + } |
| 51 | + |
| 52 | + @Override |
| 53 | + public String getToken(HttpRequestWrapper request) { |
| 54 | + return "test_token"; |
| 55 | + } |
| 56 | + }; |
| 57 | + } |
| 58 | + |
| 59 | + /** |
| 60 | + * 创建一个 ClientExecChain，记录请求是否携带了 Authorization 头 |
| 61 | + */ |
| 62 | + private static ClientExecChain trackingExec(AtomicBoolean authHeaderAdded) { |
| 63 | + return (route, request, context, execAware) -> { |
| 64 | + if (request.containsHeader("Authorization")) { |
| 65 | + authHeaderAdded.set(true); |
| 66 | + } |
| 67 | + return new StubCloseableHttpResponse(); |
| 68 | + }; |
| 69 | + } |
| 70 | + |
| 71 | + /** |
| 72 | + * 测试：对微信官方主机（以 .mch.weixin.qq.com 结尾）的请求应该添加 Authorization 头 |
| 73 | + */ |
| 74 | + @Test |
| 75 | + public void testWechatOfficialHostShouldAddAuthorizationHeader() throws IOException, HttpException { |
| 76 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 77 | + SignatureExec signatureExec = new SignatureExec( |
| 78 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), Collections.emptySet() |
| 79 | + ); |
| 80 | + |
| 81 | + HttpGet httpGet = new HttpGet("https://api.mch.weixin.qq.com/v3/certificates"); |
| 82 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 83 | + |
| 84 | + assertTrue(authHeaderAdded.get(), "请求微信官方接口时应该添加 Authorization 头"); |
| 85 | + } |
| 86 | + |
| 87 | + /** |
| 88 | + * 测试：对非微信主机且不在受信任列表中的请求，不应该添加 Authorization 头 |
| 89 | + */ |
| 90 | + @Test |
| 91 | + public void testUntrustedProxyHostShouldNotAddAuthorizationHeader() throws IOException, HttpException { |
| 92 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 93 | + SignatureExec signatureExec = new SignatureExec( |
| 94 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), Collections.emptySet() |
| 95 | + ); |
| 96 | + |
| 97 | + HttpGet httpGet = new HttpGet("http://proxy.company.com:8080/v3/certificates"); |
| 98 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 99 | + |
| 100 | + assertFalse(authHeaderAdded.get(), "不受信任的代理主机请求不应该添加 Authorization 头"); |
| 101 | + } |
| 102 | + |
| 103 | + /** |
| 104 | + * 测试：对在受信任列表中的代理主机请求，应该添加 Authorization 头. |
| 105 | + * 这是修复代理转发场景下 Authorization 头丢失问题的核心功能 |
| 106 | + */ |
| 107 | + @Test |
| 108 | + public void testTrustedProxyHostShouldAddAuthorizationHeader() throws IOException, HttpException { |
| 109 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 110 | + Set<String> trustedHosts = new HashSet<>(); |
| 111 | + trustedHosts.add("proxy.company.com"); |
| 112 | + SignatureExec signatureExec = new SignatureExec( |
| 113 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), trustedHosts |
| 114 | + ); |
| 115 | + |
| 116 | + HttpGet httpGet = new HttpGet("http://proxy.company.com:8080/v3/certificates"); |
| 117 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 118 | + |
| 119 | + assertTrue(authHeaderAdded.get(), "受信任的代理主机请求应该添加 Authorization 头"); |
| 120 | + } |
| 121 | + |
| 122 | + /** |
| 123 | + * 测试：WxPayV3HttpClientBuilder 的 withTrustedHost 方法应该正确设置受信任主机 |
| 124 | + */ |
| 125 | + @Test |
| 126 | + public void testWithTrustedHostBuilderMethod() { |
| 127 | + WxPayV3HttpClientBuilder builder = WxPayV3HttpClientBuilder.create(); |
| 128 | + // 方法应该支持链式调用 |
| 129 | + WxPayV3HttpClientBuilder result = builder.withTrustedHost("proxy.company.com"); |
| 130 | + assertSame(result, builder, "withTrustedHost 应该返回当前 Builder 实例（支持链式调用）"); |
| 131 | + } |
| 132 | + |
| 133 | + /** |
| 134 | + * 测试：withTrustedHost 传入空值不应该抛出异常 |
| 135 | + */ |
| 136 | + @Test |
| 137 | + public void testWithTrustedHostNullOrEmptyShouldNotThrow() { |
| 138 | + WxPayV3HttpClientBuilder builder = WxPayV3HttpClientBuilder.create(); |
| 139 | + // 传入 null 和空字符串不应该抛出异常 |
| 140 | + builder.withTrustedHost(null); |
| 141 | + builder.withTrustedHost(""); |
| 142 | + } |
| 143 | + |
| 144 | + /** |
| 145 | + * 测试：SignatureExec 的旧构造函数（不带 trustedHosts）应该仍然有效 |
| 146 | + */ |
| 147 | + @Test |
| 148 | + public void testBackwardCompatibilityWithOldConstructor() throws IOException, HttpException { |
| 149 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 150 | + // 使用旧的三参数构造函数 |
| 151 | + SignatureExec signatureExec = new SignatureExec( |
| 152 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded) |
| 153 | + ); |
| 154 | + |
| 155 | + // 微信官方主机仍然应该添加 Authorization 头 |
| 156 | + HttpGet httpGet = new HttpGet("https://api.mch.weixin.qq.com/v3/certificates"); |
| 157 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 158 | + |
| 159 | + assertTrue(authHeaderAdded.get(), "使用旧构造函数时，请求微信官方接口仍应添加 Authorization 头"); |
| 160 | + } |
| 161 | +} |
0 commit comments