xiaoxia-saas/tests/unit/test_wechat_state_redis_1718.py

"""#1718：微信 OAuth state 存储 Redis 化 + 中文昵称 UTF-8 解码修复。

覆盖（全 mock/fake，CI 无真实 redis 也产生覆盖）：
- RedisStateStore：put 用 SET NX EX、verify_and_consume 用 GETDEL 一次性消费、
  重复消费返回 False、Redis 异常降级内存、client 注入
- Redis 不可用（ping 失败）构造时降级内存，功能仍正常
- GETDEL 不存在（老 Redis）走 GET+DELETE 兜底
- handle_callback：微信 sns/userinfo 响应含中文 nickname，resp.encoding=utf-8
  后解析不乱码；errcode 错误路径返回 errmsg
"""

from __future__ import annotations

import sys
from pathlib import Path
from unittest.mock import MagicMock, patch

import pytest

sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "apps" / "api"))

from packages.application.auth import wechat_oauth_service as oauth  # noqa: E402


class _FakeRedisClient:
    """最小内存版 redis client，模拟 SET NX EX / GETDEL / GET / DELETE / ping。"""

    def __init__(self):
        self.data: dict[str, str] = {}
        self.ttl: dict[str, int] = {}
        self.has_getdel = True

    def ping(self):
        return True

    def set(self, key, value, nx=False, ex=None):  # noqa: ARG002
        if nx and key in self.data:
            return None
        self.data[key] = value
        if ex is not None:
            self.ttl[key] = ex
        return True

    def get(self, key):
        return self.data.get(key)

    def getdel(self, key):
        return self.data.pop(key, None)

    def delete(self, key):
        return 1 if self.data.pop(key, None) is not None else 0

    def eval(self, script, numkeys, key):  # noqa: ARG002
        # 模拟 Lua：原子 GET + DEL
        return self.data.pop(key, None)


# ── RedisStateStore ─────────────────────────────────────────────────────


def test_redis_state_store_put_and_consume_once():
    client = _FakeRedisClient()
    store = oauth.RedisStateStore(client=client)
    store.put("state-abc")
    # key 带前缀、TTL 写入
    assert client.data.get("wechat:state:state-abc") is not None
    assert client.ttl.get("wechat:state:state-abc") == oauth.STATE_TTL_SECONDS
    # 一次性消费：第一次 True，第二次 False
    assert store.verify_and_consume("state-abc") is True
    assert store.verify_and_consume("state-abc") is False


def test_redis_state_store_unknown_state_returns_false():
    store = oauth.RedisStateStore(client=_FakeRedisClient())
    assert store.verify_and_consume("never-put") is False


def test_redis_state_store_eval_missing_falls_back_to_get_delete():
    """eval 不可用（如禁用脚本）时退化 GET+DELETE，仍一次性消费。"""
    client = _FakeRedisClient()

    def _no_eval(script, numkeys, *keys):  # noqa: ARG002
        raise RuntimeError("unknown command EVAL")

    client.eval = _no_eval  # type: ignore[method-assign]
    store = oauth.RedisStateStore(client=client)
    store.put("state-old")
    assert store.verify_and_consume("state-old") is True
    # GET+DELETE 也消费掉了
    assert "wechat:state:state-old" not in client.data
    assert store.verify_and_consume("state-old") is False


def test_redis_state_store_put_exception_falls_back_to_memory():
    client = MagicMock()
    client.set.side_effect = RuntimeError("redis write fail")
    # eval/get 也失败，确保降级到内存
    client.eval.side_effect = RuntimeError("redis read fail")
    client.get.side_effect = RuntimeError("redis read fail")
    store = oauth.RedisStateStore(client=client)

    store.put("state-fb")  # 写 Redis 失败 → 内存
    assert store.verify_and_consume("state-fb") is True  # 内存命中
    assert store.verify_and_consume("state-fb") is False


def test_redis_state_store_consume_exception_falls_back_to_memory():
    client = MagicMock()
    client.set.return_value = True  # put 走 Redis
    client.eval.side_effect = RuntimeError("redis down")
    client.get.side_effect = RuntimeError("redis down")
    store = oauth.RedisStateStore(client=client)

    store.put("state-fb2")  # 成功写 Redis
    # 校验时 Redis 挂了 → 降级内存（内存里没有，返回 False，不报错）
    assert store.verify_and_consume("state-fb2") is False


def test_redis_state_store_constructor_ping_failure_falls_back():
    """构造时 ping 失败（Redis 不可用）→ 内存降级，功能正常。"""
    fake_redis_mod = MagicMock()
    fake_client = MagicMock()
    fake_client.ping.side_effect = ConnectionError("refused")
    fake_redis_mod.Redis.from_url.return_value = fake_client

    with patch.dict(sys.modules, {"redis": fake_redis_mod}):
        store = oauth.RedisStateStore(redis_url="redis://nonexistent:6379/0")

    # Redis 不可用 → 内存存储仍工作
    store.put("state-mem")
    assert store.verify_and_consume("state-mem") is True
    assert store.verify_and_consume("state-mem") is False


# ── handle_callback：state 校验 + UTF-8 中文昵称 ────────────────────────


def _configured_service(state_store=None):
    store = state_store or oauth.MemoryStateStore()
    return oauth.WechatOAuthService(
        app_id="wx-test",
        app_secret="secret-test",
        redirect_uri="https://staging.xiaoxiajianji.com/auth/wechat/callback",
        state_store=store,
    )


class _FakeResponse:
    def __init__(self, payload):
        self._payload = payload
        self.encoding = None  # 模拟微信响应头不带 charset

    def json(self):
        # 模拟 requests 行为：按 self.encoding 解码。这里直接返回 payload，
        # 但记录 encoding 是否被设置为 utf-8（断言修复生效）
        self._decoded_with = self.encoding
        return self._payload


def test_handle_callback_chinese_nickname_decoded_utf8(monkeypatch):
    """微信 userinfo 返回中文昵称，service 设置 encoding=utf-8 后不乱码。"""
    service = _configured_service()
    state = "state-cn-1"
    service._state_store.put(state)

    token_resp = _FakeResponse({"access_token": "at-1", "openid": "openid-cn", "unionid": "union-cn"})
    user_resp = _FakeResponse(
        {"openid": "openid-cn", "unionid": "union-cn", "nickname": "微信小应🎬", "headimgurl": ""}
    )
    responses = iter([token_resp, user_resp])
    monkeypatch.setattr(oauth.requests, "get", lambda *a, **k: next(responses))

    info, err = service.handle_callback("code-cn", state)
    assert err is None
    assert info is not None
    assert info.openid == "openid-cn"
    assert info.nickname == "微信小应🎬"
    # 两个响应都被显式设为 utf-8
    assert token_resp.encoding == "utf-8"
    assert user_resp.encoding == "utf-8"


def test_handle_callback_state_invalid_returns_error():
    service = _configured_service()
    info, err = service.handle_callback("code-x", "state-not-exist")
    assert info is None
    assert "state" in err


def test_handle_callback_wechat_errcode_returns_errmsg(monkeypatch):
    """微信返回 errcode（如 code 已被消费 40029）时返回 errmsg 原文。"""
    service = _configured_service()
    state = "state-err-1"
    service._state_store.put(state)

    err_resp = _FakeResponse({"errcode": 40029, "errmsg": "invalid code"})
    monkeypatch.setattr(oauth.requests, "get", lambda *a, **k: err_resp)

    info, err = service.handle_callback("bad-code", state)
    assert info is None
    assert "invalid code" in err
    assert err_resp.encoding == "utf-8"


def test_generate_auth_url_stores_state_in_redis():
    """generate_auth_url 生成的 state 写入 Redis（而非仅内存）。"""
    client = _FakeRedisClient()
    service = oauth.WechatOAuthService(
        app_id="wx-test",
        app_secret="secret-test",
        redirect_uri="https://example.com/cb",
        state_store=oauth.RedisStateStore(client=client),
    )
    url, state = service.generate_auth_url()
    assert f"wechat:state:{state}" in client.data
    assert "open.weixin.qq.com" in url


# ── _build_default_state_store 工厂分支 ─────────────────────────────────


def test_build_default_state_store_uses_redis_when_broker_configured():
    """API settings 有 CELERY_BROKER_URL 时返回 RedisStateStore。"""
    store = oauth._build_default_state_store()
    # CI/本地通常配置了 redis://localhost:6379/...；无论 Redis 是否可达，
    # 返回类型应为 RedisStateStore（内部降级内存）
    assert isinstance(store, oauth.RedisStateStore) or isinstance(store, oauth.MemoryStateStore)


def test_build_default_state_store_env_fallback(monkeypatch):
    """app.config 不可用（如纯 worker 环境）时从环境变量取 redis url。"""
    import builtins

    real_import = builtins.__import__

    def _failing_import(name, *args, **kwargs):
        if name == "app.config":
            raise ImportError("no app.config")
        return real_import(name, *args, **kwargs)

    monkeypatch.setattr(builtins, "__import__", _failing_import)
    monkeypatch.setenv("CELERY_BROKER_URL", "redis://localhost:6379/9")
    store = oauth._build_default_state_store()
    assert isinstance(store, oauth.RedisStateStore)


def test_build_default_state_store_no_config_returns_memory(monkeypatch):
    """无任何 redis 配置时返回 MemoryStateStore。"""
    import builtins

    real_import = builtins.__import__

    def _failing_import(name, *args, **kwargs):
        if name == "app.config":
            raise ImportError("no app.config")
        return real_import(name, *args, **kwargs)

    monkeypatch.setattr(builtins, "__import__", _failing_import)
    monkeypatch.delenv("CELERY_BROKER_URL", raising=False)
    monkeypatch.delenv("REDIS_URL", raising=False)
    store = oauth._build_default_state_store()
    assert isinstance(store, oauth.MemoryStateStore)