feat(platform): 开源发布 - 初始化 Open AI Canvas

backend/cmd/server/main_test.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestAllowedOriginWildcard(t *testing.T) {
+	t.Setenv("CANVAS_CORS_ORIGINS", "*")
+	context, _ := gin.CreateTestContext(httptest.NewRecorder())
+	context.Request = httptest.NewRequest("GET", "http://backend/api/health", nil)
+	if !allowedOrigin(context, "https://example.com") {
+		t.Fatal("wildcard CORS should allow a valid HTTPS origin")
+	}
+	if allowedOrigin(context, "ftp://example.com") {
+		t.Fatal("wildcard CORS should reject non-HTTP origins")
+	}
+}
+
+func TestAllowedOriginUsesForwardedHost(t *testing.T) {
+	t.Setenv("CANVAS_CORS_ORIGINS", "")
+	context, _ := gin.CreateTestContext(httptest.NewRecorder())
+	context.Request = httptest.NewRequest("GET", "http://backend/api/health", nil)
+	context.Request.Header.Set("X-Forwarded-Host", " canvas.example.com, proxy.internal")
+	if !allowedOrigin(context, "https://canvas.example.com") {
+		t.Fatal("forwarded public host should be treated as same-origin")
+	}
+}
+
+func TestRedactCanvasSharePath(t *testing.T) {
+	got := redactCanvasSharePath("/api/public/canvas-shares/private-token/resources/resource-1/file")
+	if got != "/api/public/canvas-shares/:token/resources/resource-1/file" {
+		t.Fatalf("unexpected redacted path: %s", got)
+	}
+	if got := redactCanvasSharePath("/api/tasks"); got != "/api/tasks" {
+		t.Fatalf("unrelated path changed: %s", got)
+	}
+}