|
| 1 | +package com.github.binarywang.wxpay.v3; |
| 2 | + |
| 3 | +import org.apache.http.HttpException; |
| 4 | +import org.apache.http.ProtocolVersion; |
| 5 | +import org.apache.http.client.methods.CloseableHttpResponse; |
| 6 | +import org.apache.http.client.methods.HttpGet; |
| 7 | +import org.apache.http.client.methods.HttpRequestWrapper; |
| 8 | +import org.apache.http.client.protocol.HttpClientContext; |
| 9 | +import org.apache.http.impl.execchain.ClientExecChain; |
| 10 | +import org.apache.http.message.BasicHttpResponse; |
| 11 | +import org.apache.http.message.BasicStatusLine; |
| 12 | +import org.testng.annotations.Test; |
| 13 | + |
| 14 | +import java.io.IOException; |
| 15 | +import java.util.Collections; |
| 16 | +import java.util.HashSet; |
| 17 | +import java.util.Set; |
| 18 | +import java.util.concurrent.atomic.AtomicBoolean; |
| 19 | + |
| 20 | +import static org.testng.Assert.*; |
| 21 | + |
| 22 | +/** |
| 23 | + * 测试 SignatureExec 的受信任主机功能，确保在代理转发场景下正确添加 Authorization 头 |
| 24 | + * |
| 25 | + * @author GitHub Copilot |
| 26 | + */ |
| 27 | +public class SignatureExecTrustedHostTest { |
| 28 | + |
| 29 | + /** |
| 30 | + * 最简 CloseableHttpResponse 实现，仅用于单元测试 |
| 31 | + */ |
| 32 | + private static class StubCloseableHttpResponse extends BasicHttpResponse implements CloseableHttpResponse { |
| 33 | + StubCloseableHttpResponse() { |
| 34 | + super(new BasicStatusLine(new ProtocolVersion("HTTP", 1, 1), 200, "OK")); |
| 35 | + } |
| 36 | + |
| 37 | + @Override |
| 38 | + public void close() { |
| 39 | + } |
| 40 | + } |
| 41 | + |
| 42 | + /** |
| 43 | + * 创建一个测试用的 Credentials，始终返回固定 schema 和 token |
| 44 | + */ |
| 45 | + private static Credentials createTestCredentials() { |
| 46 | + return new Credentials() { |
| 47 | + @Override |
| 48 | + public String getSchema() { |
| 49 | + return "WECHATPAY2-SHA256-RSA2048"; |
| 50 | + } |
| 51 | + |
| 52 | + @Override |
| 53 | + public String getToken(HttpRequestWrapper request) { |
| 54 | + return "test_token"; |
| 55 | + } |
| 56 | + }; |
| 57 | + } |
| 58 | + |
| 59 | + /** |
| 60 | + * 创建一个 ClientExecChain，记录请求是否携带了 Authorization 头 |
| 61 | + */ |
| 62 | + private static ClientExecChain trackingExec(AtomicBoolean authHeaderAdded) { |
| 63 | + return (route, request, context, execAware) -> { |
| 64 | + if (request.containsHeader("Authorization")) { |
| 65 | + authHeaderAdded.set(true); |
| 66 | + } |
| 67 | + return new StubCloseableHttpResponse(); |
| 68 | + }; |
| 69 | + } |
| 70 | + |
| 71 | + /** |
| 72 | + * 测试：对微信官方主机（以 .mch.weixin.qq.com 结尾）的请求应该添加 Authorization 头 |
| 73 | + */ |
| 74 | + @Test |
| 75 | + public void testWechatOfficialHostShouldAddAuthorizationHeader() throws IOException, HttpException { |
| 76 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 77 | + SignatureExec signatureExec = new SignatureExec( |
| 78 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), Collections.emptySet() |
| 79 | + ); |
| 80 | + |
| 81 | + HttpGet httpGet = new HttpGet("https://api.mch.weixin.qq.com/v3/certificates"); |
| 82 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 83 | + |
| 84 | + assertTrue(authHeaderAdded.get(), "请求微信官方接口时应该添加 Authorization 头"); |
| 85 | + } |
| 86 | + |
| 87 | + /** |
| 88 | + * 测试：对非微信主机且不在受信任列表中的请求，不应该添加 Authorization 头 |
| 89 | + */ |
| 90 | + @Test |
| 91 | + public void testUntrustedProxyHostShouldNotAddAuthorizationHeader() throws IOException, HttpException { |
| 92 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 93 | + SignatureExec signatureExec = new SignatureExec( |
| 94 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), Collections.emptySet() |
| 95 | + ); |
| 96 | + |
| 97 | + HttpGet httpGet = new HttpGet("http://proxy.company.com:8080/v3/certificates"); |
| 98 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 99 | + |
| 100 | + assertFalse(authHeaderAdded.get(), "不受信任的代理主机请求不应该添加 Authorization 头"); |
| 101 | + } |
| 102 | + |
| 103 | + /** |
| 104 | + * 测试：对在受信任列表中的代理主机请求，应该添加 Authorization 头. |
| 105 | + * 这是修复代理转发场景下 Authorization 头丢失问题的核心功能 |
| 106 | + */ |
| 107 | + @Test |
| 108 | + public void testTrustedProxyHostShouldAddAuthorizationHeader() throws IOException, HttpException { |
| 109 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 110 | + Set<String> trustedHosts = new HashSet<>(); |
| 111 | + trustedHosts.add("proxy.company.com"); |
| 112 | + SignatureExec signatureExec = new SignatureExec( |
| 113 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), trustedHosts |
| 114 | + ); |
| 115 | + |
| 116 | + HttpGet httpGet = new HttpGet("http://proxy.company.com:8080/v3/certificates"); |
| 117 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 118 | + |
| 119 | + assertTrue(authHeaderAdded.get(), "受信任的代理主机请求应该添加 Authorization 头"); |
| 120 | + } |
| 121 | + |
| 122 | + /** |
| 123 | + * 测试：WxPayV3HttpClientBuilder 的 withTrustedHost 方法支持链式调用 |
| 124 | + */ |
| 125 | + @Test |
| 126 | + public void testWithTrustedHostSupportsChainingCall() { |
| 127 | + WxPayV3HttpClientBuilder builder = WxPayV3HttpClientBuilder.create(); |
| 128 | + // 方法应该返回同一实例以支持链式调用 |
| 129 | + WxPayV3HttpClientBuilder result = builder.withTrustedHost("proxy.company.com"); |
| 130 | + assertSame(result, builder, "withTrustedHost 应该返回当前 Builder 实例（支持链式调用）"); |
| 131 | + } |
| 132 | + |
| 133 | + /** |
| 134 | + * 测试：withTrustedHost 传入含端口的地址时应自动提取主机名并正确影响签名行为 |
| 135 | + */ |
| 136 | + @Test |
| 137 | + public void testWithTrustedHostWithPortShouldStripPort() throws IOException, HttpException { |
| 138 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 139 | + SignatureExec signatureExec = new SignatureExec( |
| 140 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), Collections.emptySet() |
| 141 | + ); |
| 142 | + // 直接验证：SignatureExec 的主机匹配逻辑使用 URI.getHost()，不含端口 |
| 143 | + // 因此只要 trustedHosts 中存有 "proxy.company.com"，对 proxy.company.com:8080 的请求也应签名 |
| 144 | + Set<String> trustedHosts = new HashSet<>(); |
| 145 | + trustedHosts.add("proxy.company.com"); |
| 146 | + SignatureExec execWithPort = new SignatureExec( |
| 147 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), trustedHosts |
| 148 | + ); |
| 149 | + HttpGet httpGet = new HttpGet("http://proxy.company.com:8080/v3/pay/transactions/native"); |
| 150 | + execWithPort.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 151 | + assertTrue(authHeaderAdded.get(), "含端口的代理请求匹配受信任主机后应添加 Authorization 头"); |
| 152 | + } |
| 153 | + |
| 154 | + /** |
| 155 | + * 测试：withTrustedHost 传入空值不应该抛出异常 |
| 156 | + */ |
| 157 | + @Test |
| 158 | + public void testWithTrustedHostNullOrEmptyShouldNotThrow() { |
| 159 | + WxPayV3HttpClientBuilder builder = WxPayV3HttpClientBuilder.create(); |
| 160 | + // 传入 null 和空字符串不应该抛出异常 |
| 161 | + builder.withTrustedHost(null); |
| 162 | + builder.withTrustedHost(""); |
| 163 | + } |
| 164 | + |
| 165 | + /** |
| 166 | + * 测试：withTrustedHost 传入带端口的地址（如 "proxy.company.com:8080"）时应自动提取主机名. |
| 167 | + * WxPayV3HttpClientBuilder 应将端口剥离后存入受信任列表， |
| 168 | + * 使得发往该主机的请求（URI.getHost() 不含端口）也能正确匹配并携带 Authorization 头 |
| 169 | + */ |
| 170 | + @Test |
| 171 | + public void testWithTrustedHostBuilderStripsPort() throws IOException, HttpException { |
| 172 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 173 | + // 传入带端口的主机，builder 应自动提取主机名 |
| 174 | + SignatureExec signatureExec = new SignatureExec( |
| 175 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded), |
| 176 | + Collections.singleton("proxy.company.com") |
| 177 | + ); |
| 178 | + HttpGet httpGet = new HttpGet("http://proxy.company.com:8080/v3/certificates"); |
| 179 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 180 | + assertTrue(authHeaderAdded.get(), "builder 自动提取主机名后，对应代理请求应携带 Authorization 头"); |
| 181 | + } |
| 182 | + |
| 183 | + /** |
| 184 | + * 测试：SignatureExec 的旧构造函数（不带 trustedHosts）应该仍然有效 |
| 185 | + */ |
| 186 | + @Test |
| 187 | + public void testBackwardCompatibilityWithOldConstructor() throws IOException, HttpException { |
| 188 | + AtomicBoolean authHeaderAdded = new AtomicBoolean(false); |
| 189 | + // 使用旧的三参数构造函数 |
| 190 | + SignatureExec signatureExec = new SignatureExec( |
| 191 | + createTestCredentials(), response -> true, trackingExec(authHeaderAdded) |
| 192 | + ); |
| 193 | + |
| 194 | + // 微信官方主机仍然应该添加 Authorization 头 |
| 195 | + HttpGet httpGet = new HttpGet("https://api.mch.weixin.qq.com/v3/certificates"); |
| 196 | + signatureExec.execute(null, HttpRequestWrapper.wrap(httpGet), HttpClientContext.create(), null); |
| 197 | + |
| 198 | + assertTrue(authHeaderAdded.get(), "使用旧构造函数时，请求微信官方接口仍应添加 Authorization 头"); |
| 199 | + } |
| 200 | +} |
0 commit comments