T0.11: GatewayKeyService 薄封装复用 starter SignKeyResolver（四态 fail-closed）；显式引 data-redis（starter 标 optional 不传递）

2026-09-21 00:24:02 +08:00
parent d4bfe8a3b4
commit 6cb0fa1b5b
3 changed files with 114 additions and 1 deletions
@@ -0,0 +1,65 @@
+package com.yunhai.platform.gateway.auth;
+
+import com.yunhai.platform.appauth.SignKeyResolver;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatCode;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+/**
+ * GatewayKeyService 四态（T0.11 TDD，mock SignKeyResolver）：
+ * 合法 / 未知 / 禁用 / Redis 异常。D4 红线：密钥解析永远 fail-closed——
+ * 异常态断言"拒绝"（返回 null）而非抛异常（500）。
+ */
+class GatewayKeyServiceTest {
+
+    private GatewayKeyService service(SignKeyResolver resolver) {
+        GatewayKeyService svc = new GatewayKeyService();
+        ReflectionTestUtils.setField(svc, "signKeyResolver", resolver);
+        return svc;
+    }
+
+    @Test
+    void 合法appKey返回secret() {
+        SignKeyResolver resolver = mock(SignKeyResolver.class);
+        when(resolver.getSecret("100617")).thenReturn("secret-flow-center");
+        assertThat(service(resolver).getSecret("100617")).isEqualTo("secret-flow-center");
+    }
+
+    @Test
+    void 未知appKey拒绝() {
+        // starter 契约：Redis 无该 key（未知 app）返回 null
+        SignKeyResolver resolver = mock(SignKeyResolver.class);
+        when(resolver.getSecret("999999")).thenReturn(null);
+        assertThat(service(resolver).getSecret("999999")).as("未知 appKey = 拒绝").isNull();
+    }
+
+    @Test
+    void 禁用appKey拒绝() {
+        // starter SignKeyResolver 内部对 enabled=false / secret 空 fallen 返回 null（fail-closed 单层）；
+        // 网关侧语义与 starter 完全一致——到达本封装即为 null
+        SignKeyResolver resolver = mock(SignKeyResolver.class);
+        when(resolver.getSecret("100009")).thenReturn(null);
+        assertThat(service(resolver).getSecret("100009")).as("禁用 appKey = 拒绝").isNull();
+    }
+
+    @Test
+    void redis异常拒绝而非抛500() {
+        SignKeyResolver resolver = mock(SignKeyResolver.class);
+        when(resolver.getSecret("100617")).thenThrow(new RuntimeException("redis unavailable"));
+        GatewayKeyService svc = service(resolver);
+        assertThatCode(() -> {
+            assertThat(svc.getSecret("100617")).as("Redis 异常 = 拒绝（fail-closed），不抛 500").isNull();
+        }).doesNotThrowAnyException();
+        Mockito.verify(resolver).getSecret("100617");
+    }
+
+    @Test
+    void starter未装配同样拒绝() {
+        assertThat(service(null).getSecret("100617")).as("无 SignKeyResolver bean（未配 Redis）同样 fail-closed").isNull();
+    }
+}