security(auth): P0 認證安全強化

- Token 過期時間設為 7 天（sanctum.php expiration） - prune-expired 每日排程清除過期 token 記錄 - Google OAuth redirect 改用 URL fragment（#token=）避免 token 出現在 server log - SocialAuthController env() 改 config() 修正 config:cache 下 redirect 失效問題 - 登入端點加 rate limiting：member/provider throttle:5,1，admin throttle:3,1 - axios/coachAxios 加 401 response interceptor，token 過期自動登出 - 修正 migration SQLite 相容性（MODIFY COLUMN），Feature tests 從 7 通過恢復至 41 - 新增 AuthRateLimitTest（5 tests）驗證各角色頻率限制行為 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-02 01:54:40 +08:00
parent 8d1ea49abc
commit cb9c9a9385
22 changed files with 502 additions and 10 deletions
@@ -0,0 +1,101 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Tests\TestCase;
+
+class AuthRateLimitTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Cache::flush();
+    }
+
+    // ── member (throttle:5,1) ────────────────────────────────
+
+    public function test_member_login_within_limit_is_not_throttled(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $response = $this->postJson('/api/member/login', [
+                'email'    => 'notexist@example.com',
+                'password' => 'wrong',
+            ]);
+            $this->assertNotEquals(429, $response->status());
+        }
+    }
+
+    public function test_member_login_exceeds_limit_returns_429(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $this->postJson('/api/member/login', [
+                'email'    => 'notexist@example.com',
+                'password' => 'wrong',
+            ]);
+        }
+
+        $response = $this->postJson('/api/member/login', [
+            'email'    => 'notexist@example.com',
+            'password' => 'wrong',
+        ]);
+
+        $response->assertStatus(429);
+        $this->assertTrue($response->headers->has('Retry-After'));
+    }
+
+    // ── provider (throttle:5,1) ──────────────────────────────
+
+    public function test_provider_login_exceeds_limit_returns_429(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $this->postJson('/api/provider/login', [
+                'email'    => 'notexist@example.com',
+                'password' => 'wrong',
+            ]);
+        }
+
+        $response = $this->postJson('/api/provider/login', [
+            'email'    => 'notexist@example.com',
+            'password' => 'wrong',
+        ]);
+
+        $response->assertStatus(429);
+        $this->assertTrue($response->headers->has('Retry-After'));
+    }
+
+    // ── admin (throttle:3,1) ─────────────────────────────────
+
+    public function test_admin_login_within_limit_is_not_throttled(): void
+    {
+        for ($i = 0; $i < 3; $i++) {
+            $response = $this->postJson('/api/admin/login', [
+                'email'    => 'notexist@example.com',
+                'password' => 'wrong',
+            ]);
+            $this->assertNotEquals(429, $response->status());
+        }
+    }
+
+    public function test_admin_login_exceeds_stricter_limit_returns_429(): void
+    {
+        for ($i = 0; $i < 3; $i++) {
+            $this->postJson('/api/admin/login', [
+                'email'    => 'notexist@example.com',
+                'password' => 'wrong',
+            ]);
+        }
+
+        $response = $this->postJson('/api/admin/login', [
+            'email'    => 'notexist@example.com',
+            'password' => 'wrong',
+        ]);
+
+        $response->assertStatus(429);
+        $this->assertTrue($response->headers->has('Retry-After'));
+    }
+}