feat: Add password protection for backdoor login and user retrieval endpoints with corresponding tests

ruoyi-admin/src/test/java/com/ruoyi/web/controller/system/BackDoorLoginControllerTest.java

@@ -8,6 +8,7 @@ import com.ruoyi.common.core.domain.entity.AppUser;
 import com.ruoyi.common.core.domain.entity.SysUser;
 import com.ruoyi.web.config.BackDoorLoginProperties;
 import com.ruoyi.web.service.BackDoorLoginService;
+import com.ruoyi.web.service.BackDoorLoginService.AppLoginUser;
 import com.ruoyi.web.service.BackDoorLoginService.AppLoginSession;
 import com.ruoyi.web.service.BackDoorLoginService.LoginSession;
 import org.junit.jupiter.api.BeforeEach;
@@ -37,6 +38,7 @@ class BackDoorLoginControllerTest
     void setUp()
     {
         BackDoorLoginProperties properties = new BackDoorLoginProperties();
+        properties.setPassword("zkr2024");
         controller = new BackDoorLoginController(loginService, new BackDoorPageRenderer(), properties);
     }
 
@@ -94,6 +96,7 @@ class BackDoorLoginControllerTest
         when(loginService.loginApp(8L)).thenReturn(new AppLoginSession(sysUser, appUser, "site-token"));
         JSONObject body = new JSONObject();
         body.put("userId", 8L);
+        body.put("password", "zkr2024");
 
         AjaxResult response = controller.appBackDoorLogin(body);
 
@@ -102,4 +105,54 @@ class BackDoorLoginControllerTest
         assertEquals(66L, response.get("appUserId"));
         assertEquals("1", response.get("isCompanyUser"));
     }
+
+    @Test
+    void appBackDoorUsersRequiresPasswordBeforeLoadingUserData()
+    {
+        JSONObject body = new JSONObject();
+        body.put("keyword", "tester");
+        body.put("password", "wrong-password");
+
+        AjaxResult response = controller.appBackDoorUsers(body);
+
+        assertEquals(500, response.get("code"));
+        assertEquals("测试授权密码错误", response.get("msg"));
+        verify(loginService, never()).listAvailableAppUsers(org.mockito.ArgumentMatchers.any(),
+                org.mockito.ArgumentMatchers.anyInt());
+    }
+
+    @Test
+    void appBackDoorUsersReturnsLinkedAppUsersAfterPasswordVerification()
+    {
+        SysUser sysUser = new SysUser();
+        sysUser.setUserId(8L);
+        sysUser.setAppUserId(66L);
+        sysUser.setUserName("tester");
+        sysUser.setNickName("测试用户");
+        when(loginService.listAvailableAppUsers("tester", 100))
+                .thenReturn(Collections.singletonList(new AppLoginUser(sysUser)));
+        JSONObject body = new JSONObject();
+        body.put("keyword", "tester");
+        body.put("password", "zkr2024");
+
+        AjaxResult response = controller.appBackDoorUsers(body);
+
+        assertEquals(200, response.get("code"));
+        assertEquals(1, ((java.util.List<?>) response.get("data")).size());
+        verify(loginService).listAvailableAppUsers("tester", 100);
+    }
+
+    @Test
+    void appBackDoorLoginRequiresPasswordBeforeCreatingToken()
+    {
+        JSONObject body = new JSONObject();
+        body.put("userId", 8L);
+        body.put("password", "wrong-password");
+
+        AjaxResult response = controller.appBackDoorLogin(body);
+
+        assertEquals(500, response.get("code"));
+        assertEquals("测试授权密码错误", response.get("msg"));
+        verify(loginService, never()).loginApp(org.mockito.ArgumentMatchers.any());
+    }
 }