sub2api/backend/internal/handler/dto/settings_custom_menu_test.go
zizi ac5ff854b2 feat(custom-menu): secure embedded shop pages
Add omit_auth_context as a safe default for custom menu iframe pages, converge untrusted public output, and document the deployed shop menu configuration.
2026-05-27 14:28:17 +08:00

54 lines
1.4 KiB
Go

package dto
import (
"encoding/json"
"testing"
)
func TestCustomMenuItemOmitAuthContextTriState(t *testing.T) {
tests := []struct {
name string
rawJSON string
wantNil bool
want bool
}{
{
name: "missing keeps nil",
rawJSON: `{"id":"legacy","label":"Legacy","url":"https://app.example.com/legacy","visibility":"user"}`,
wantNil: true,
},
{
name: "explicit false keeps pointer false",
rawJSON: `{"id":"trusted","label":"Trusted","url":"https://app.example.com/internal","visibility":"user","omit_auth_context":false}`,
want: false,
},
{
name: "explicit true keeps pointer true",
rawJSON: `{"id":"external","label":"External","url":"https://shop.example.com","visibility":"user","omit_auth_context":true}`,
want: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
var item CustomMenuItem
if err := json.Unmarshal([]byte(tt.rawJSON), &item); err != nil {
t.Fatalf("json.Unmarshal() error = %v", err)
}
if tt.wantNil {
if item.OmitAuthContext != nil {
t.Fatalf("OmitAuthContext = %v, want nil", *item.OmitAuthContext)
}
return
}
if item.OmitAuthContext == nil {
t.Fatalf("OmitAuthContext = nil, want %v", tt.want)
}
if *item.OmitAuthContext != tt.want {
t.Fatalf("OmitAuthContext = %v, want %v", *item.OmitAuthContext, tt.want)
}
})
}
}