更新构建配置并补充测试

src/utils/access_control_test.go

@@ -0,0 +1,86 @@
+package utils
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"hubproxy/config"
+)
+
+func TestParseDockerImage(t *testing.T) {
+	tests := []struct {
+		name       string
+		image      string
+		namespace  string
+		repository string
+		tag        string
+		fullName   string
+	}{
+		{"official", "nginx", "library", "nginx", "latest", "library/nginx"},
+		{"tagged", "redis:7", "library", "redis", "7", "library/redis"},
+		{"namespaced", "user/app:v1", "user", "app", "v1", "user/app"},
+		{"registry", "ghcr.io/user/app:v2", "user", "app", "v2", "user/app"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GlobalAccessController.ParseDockerImage(tt.image)
+			if got.Namespace != tt.namespace || got.Repository != tt.repository || got.Tag != tt.tag || got.FullName != tt.fullName {
+				t.Fatalf("ParseDockerImage(%q) = %#v", tt.image, got)
+			}
+		})
+	}
+}
+
+func TestDockerAccessLists(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.toml")
+	data := []byte(`
+[access]
+whiteList = ["library/*", "good/*"]
+blackList = ["good/bad"]
+`)
+	if err := os.WriteFile(path, data, 0644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CONFIG_PATH", path)
+	if err := config.LoadConfig(); err != nil {
+		t.Fatal(err)
+	}
+
+	if allowed, reason := GlobalAccessController.CheckDockerAccess("nginx"); !allowed {
+		t.Fatalf("nginx denied: %s", reason)
+	}
+	if allowed, _ := GlobalAccessController.CheckDockerAccess("good/bad:latest"); allowed {
+		t.Fatal("blacklisted image allowed")
+	}
+	if allowed, _ := GlobalAccessController.CheckDockerAccess("other/app"); allowed {
+		t.Fatal("image outside whitelist allowed")
+	}
+}
+
+func TestGitHubAccessLists(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.toml")
+	data := []byte(`
+[access]
+whiteList = ["allowed/*"]
+blackList = ["allowed/blocked"]
+`)
+	if err := os.WriteFile(path, data, 0644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CONFIG_PATH", path)
+	if err := config.LoadConfig(); err != nil {
+		t.Fatal(err)
+	}
+
+	if allowed, reason := GlobalAccessController.CheckGitHubAccess([]string{"allowed", "repo"}); !allowed {
+		t.Fatalf("allowed/repo denied: %s", reason)
+	}
+	if allowed, _ := GlobalAccessController.CheckGitHubAccess([]string{"allowed", "blocked"}); allowed {
+		t.Fatal("blacklisted repo allowed")
+	}
+	if allowed, _ := GlobalAccessController.CheckGitHubAccess([]string{"other", "repo"}); allowed {
+		t.Fatal("repo outside whitelist allowed")
+	}
+}