mashangyoujiu/_ai_archive/scripts/test_token_security.php

<?php
/**
 * Token安全性测试脚本
 * 测试修复后的API是否正确实施了token验证
 */

// 测试配置
$base_url = 'http://localhost/mss.nahaichuan.com'; // 根据实际情况修改
$test_endpoints = [
    // AuthController 测试端点
    '/RiderApi/Auth/getRiderInfo',
    '/RiderApi/Auth/realAuth',
    '/RiderApi/Auth/uploadHealthCert',
    
    // MessageController 测试端点
    '/RiderApi/Message/getMessageList',
    '/RiderApi/Message/getUnreadCount',
    '/RiderApi/Message/markAsRead',
    '/RiderApi/Message/markAllAsRead',
    '/RiderApi/Message/deleteMessage',
    '/RiderApi/Message/getMessageDetail',
    
    // IncomeController 测试端点
    '/RiderApi/Income/getIncomeOverview',
    '/RiderApi/Income/getIncomeDetail',
    '/RiderApi/Income/getWithdrawHistory',
    '/RiderApi/Income/getIncomeStats',
    
    // OrderController 测试端点
    '/RiderApi/Order/getAvailableOrders',
    '/RiderApi/Order/getCurrentOrder',
    
    // LocationController 测试端点
    '/RiderApi/Location/getCurrentLocation',
    '/RiderApi/Location/getLocationTrack',
    '/RiderApi/Location/calculateDeliveryDistance'
];

/**
 * 发送HTTP请求
 */
function sendRequest($url, $headers = [], $data = null, $method = 'GET') {
    $ch = curl_init();
    
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HEADER, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    
    if (!empty($headers)) {
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    }
    
    if ($method === 'POST' && $data) {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
    }
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    
    curl_close($ch);
    
    $headers = substr($response, 0, $header_size);
    $body = substr($response, $header_size);
    
    return [
        'http_code' => $http_code,
        'headers' => $headers,
        'body' => $body
    ];
}

/**
 * 测试无token访问
 */
function testWithoutToken($endpoint) {
    global $base_url;
    
    echo "测试端点: {$endpoint}\n";
    echo "测试类型: 无token访问\n";
    
    $url = $base_url . $endpoint;
    $response = sendRequest($url);
    
    $body_data = json_decode($response['body'], true);
    
    if ($body_data && isset($body_data['status']) && $body_data['status'] == 0) {
        if (isset($body_data['msg']) && (
            strpos($body_data['msg'], 'token') !== false || 
            strpos($body_data['msg'], '登录') !== false ||
            strpos($body_data['msg'], '认证') !== false ||
            strpos($body_data['msg'], '权限') !== false
        )) {
            echo "✅ 正确拒绝: {$body_data['msg']}\n";
            return true;
        } else {
            echo "⚠️  拒绝但原因不明: {$body_data['msg']}\n";
            return false;
        }
    } else {
        echo "❌ 未正确拒绝访问\n";
        echo "响应: " . $response['body'] . "\n";
        return false;
    }
}

/**
 * 测试无效token访问
 */
function testWithInvalidToken($endpoint) {
    global $base_url;
    
    echo "测试端点: {$endpoint}\n";
    echo "测试类型: 无效token访问\n";
    
    $url = $base_url . $endpoint;
    $headers = [
        'Authorization: Bearer invalid_token_12345',
        'Content-Type: application/json'
    ];
    
    $response = sendRequest($url, $headers);
    $body_data = json_decode($response['body'], true);
    
    if ($body_data && isset($body_data['status']) && $body_data['status'] == 0) {
        if (isset($body_data['msg']) && (
            strpos($body_data['msg'], 'token') !== false || 
            strpos($body_data['msg'], '登录') !== false ||
            strpos($body_data['msg'], '认证') !== false ||
            strpos($body_data['msg'], '权限') !== false ||
            strpos($body_data['msg'], '无效') !== false
        )) {
            echo "✅ 正确拒绝: {$body_data['msg']}\n";
            return true;
        } else {
            echo "⚠️  拒绝但原因不明: {$body_data['msg']}\n";
            return false;
        }
    } else {
        echo "❌ 未正确拒绝访问\n";
        echo "响应: " . $response['body'] . "\n";
        return false;
    }
}

/**
 * 运行安全测试
 */
function runSecurityTests() {
    global $test_endpoints;
    
    echo "=== 骑手API Token安全性测试 ===\n\n";
    
    $total_tests = 0;
    $passed_tests = 0;
    
    foreach ($test_endpoints as $endpoint) {
        echo "----------------------------------------\n";
        
        // 测试无token访问
        $total_tests++;
        if (testWithoutToken($endpoint)) {
            $passed_tests++;
        }
        echo "\n";
        
        // 测试无效token访问
        $total_tests++;
        if (testWithInvalidToken($endpoint)) {
            $passed_tests++;
        }
        echo "\n";
    }
    
    echo "========================================\n";
    echo "测试总结:\n";
    echo "总测试数: {$total_tests}\n";
    echo "通过测试: {$passed_tests}\n";
    echo "失败测试: " . ($total_tests - $passed_tests) . "\n";
    echo "通过率: " . round(($passed_tests / $total_tests) * 100, 2) . "%\n";
    
    if ($passed_tests == $total_tests) {
        echo "\n🎉 所有测试通过！Token验证机制工作正常。\n";
    } else {
        echo "\n⚠️  部分测试失败，请检查相关端点的token验证实现。\n";
    }
}

// 运行测试
if (php_sapi_name() === 'cli') {
    runSecurityTests();
} else {
    echo "<pre>";
    runSecurityTests();
    echo "</pre>";
}
?>