fix(security): distinguish gateway context failures

2026-09-08 21:29:23 +08:00
parent 781669dfaf
commit e9ad7e333a
2 changed files with 11 additions and 3 deletions
@@ -34,7 +34,10 @@ class GatewayAccessTokenSessionValidatorTest {
        forged.addHeader(GatewayAccessTokenSessionValidator.AUTHORITIES_HEADER,
            "platform:overseas-warehouse:last-mile-order:list");
        assertThatThrownBy(() -> validator.validate(jwt(), forged))
-            .isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Untrusted");
+            .isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Invalid overseas gateway");
+
+        assertThatThrownBy(() -> validator.validate(jwt(), new MockHttpServletRequest()))
+            .isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Missing overseas gateway");
    }

    private Jwt jwt() {