wangbo
a95184b5b6
本地 K3s 节点此前在 Kubelet 中登记为宿主机资源，负载可挤压 etcd 并在 server 重启后继续污染同一 Run。现在为三节点设置真实可调度预算、独立 etcd/数据卷和锁定依赖镜像，并持续核对 server 与 API/etcd 健康。\n\n每次验收生成独立 Run ID，报告使用独占或原子写入，负载错误记录具体阶段；数据库鉴权不可用返回带 Retry-After 的 503，避免基础设施故障被误报为 401。\n\n验证：Go 全量测试、go vet、gofmt、OpenAPI、bash -n、ShellCheck、报告测试和 k3d 配置解析均通过。
32 lines
1018 B
Go
32 lines
1018 B
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestAPIKeyStoreFailureReturnsRetryableServiceUnavailable(t *testing.T) {
|
|
authenticator := New("test-secret", "", "")
|
|
authenticator.LocalAPIKeyVerifier = func(context.Context, string) (*User, error) {
|
|
return nil, errors.New("database unavailable")
|
|
}
|
|
handler := authenticator.Require(PermissionBasic, http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
|
|
t.Fatal("unavailable authentication store must not call the protected handler")
|
|
}))
|
|
request := httptest.NewRequest(http.MethodGet, "/protected", nil)
|
|
request.Header.Set("Authorization", "Bearer sk-gw-local")
|
|
recorder := httptest.NewRecorder()
|
|
|
|
handler.ServeHTTP(recorder, request)
|
|
|
|
if recorder.Code != http.StatusServiceUnavailable {
|
|
t.Fatalf("status=%d, want 503; body=%s", recorder.Code, recorder.Body.String())
|
|
}
|
|
if recorder.Header().Get("Retry-After") != "2" {
|
|
t.Fatalf("Retry-After=%q, want 2", recorder.Header().Get("Retry-After"))
|
|
}
|
|
}
|