|
|
import { test, expect } from "@playwright/test";
|
|
|
|
|
|
/**
|
|
|
* 模拟真人：未登录 / 错密 / 鉴权 API（韧性 A-10 / A-2 刷新恢复前置）
|
|
|
*/
|
|
|
test.describe("resilience auth (human-like)", () => {
|
|
|
test("A-10.1 未登录访问 /api/mails → 401，页面进登录", async ({
|
|
|
page,
|
|
|
request,
|
|
|
}) => {
|
|
|
const api = await request.get("/api/mails");
|
|
|
expect(api.status()).toBe(401);
|
|
|
const body = await api.json();
|
|
|
expect(body.ok).toBe(false);
|
|
|
expect(body.error?.code).toBe("UNAUTHORIZED");
|
|
|
|
|
|
await page.goto("/mails");
|
|
|
await expect(page).toHaveURL(/\/login/, { timeout: 15_000 });
|
|
|
});
|
|
|
|
|
|
test("A-10.1 错误密码不进系统", async ({ page }) => {
|
|
|
await page.goto("/login");
|
|
|
const user = page.getByLabel(/用户名/);
|
|
|
await user.click();
|
|
|
await user.fill("admin");
|
|
|
const pwd = page.getByLabel(/密码/);
|
|
|
await pwd.click();
|
|
|
await pwd.fill("definitely-wrong");
|
|
|
await page.getByRole("button", { name: /登\s*录/ }).click();
|
|
|
await expect(page).toHaveURL(/\/login/, { timeout: 10_000 });
|
|
|
await expect(
|
|
|
page.getByText(/Invalid username or password|用户名或密码|无效|失败|错误/i),
|
|
|
).toBeVisible({
|
|
|
timeout: 8_000,
|
|
|
});
|
|
|
});
|
|
|
|
|
|
test("A-10.5 登录连点超限可 429（同用户名）", async ({ request }) => {
|
|
|
const attempts = [];
|
|
|
for (let i = 0; i < 12; i++) {
|
|
|
attempts.push(
|
|
|
request.post("/api/auth/login", {
|
|
|
data: { username: "rate-limit-probe", password: "x" },
|
|
|
}),
|
|
|
);
|
|
|
}
|
|
|
const results = await Promise.all(attempts);
|
|
|
const statuses = results.map((r) => r.status());
|
|
|
expect(statuses.some((s) => s === 429 || s === 401)).toBe(true);
|
|
|
});
|
|
|
|
|
|
test("登录成功后 /api/auth/me 有用户；logout 后再 401", async ({ page }) => {
|
|
|
await page.goto("/login");
|
|
|
const user = page.getByLabel(/用户名/);
|
|
|
await user.click();
|
|
|
await user.fill("admin");
|
|
|
const pwd = page.getByLabel(/密码/);
|
|
|
await pwd.click();
|
|
|
await pwd.fill("admin123");
|
|
|
await page.getByRole("button", { name: /登\s*录/ }).click();
|
|
|
await expect(page).toHaveURL(/\/mails/, { timeout: 20_000 });
|
|
|
|
|
|
const me = await page.request.get("/api/auth/me");
|
|
|
expect(me.ok()).toBeTruthy();
|
|
|
const meBody = await me.json();
|
|
|
expect(meBody.ok).toBe(true);
|
|
|
expect(meBody.data?.username).toBe("admin");
|
|
|
|
|
|
await page.request.post("/api/auth/logout");
|
|
|
const after = await page.request.get("/api/mails");
|
|
|
expect(after.status()).toBe(401);
|
|
|
});
|
|
|
});
|
