carrier-oauth-callback

第 20260916-201504 轮 · 看它的历史
B. 🔴 跨站顶层跳转(OAuth 回调的真实形态)
  ✅ B1 🔴 跨站顶层跳转后 session 还在(页面正常渲染出来了)
       没渲染出来 ⇒ SameSite 没把 cookie 带上,整条 OAuth 回调链路走不通
  ✅ B2 🔴 没被踢到登录页

C. 🔴 state 防线
  ✅ C1 跳到了 EasyParcel
       实得 https://account.easyparcel.com/login?client_id=c575e8cd-aa46-46db-8308-e18d25bb76c6&redirect_uri=https%3A%2F%2Fapi.easyparcel.com%2Foauth%2Feasyaccount%2Fcallback&state=eyJjbGllbnRfaWQiOiJFMkUtQ0lEIiwiZWFzeWFjY291bnRfcmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9hcGkuZWFzeXBhcmNlbC5jb20vb2F1dGgvZWFzeWFjY291bnQvY2FsbGJhY2siLCJyZWRpcmVjdF91cmkiOiJodHRwOi8vbG9jYWxob3N0OjIwMDk4L2luZGV4LnBocC9BZG1pbi93YW5nemhhbmd1YW5saV9jYXJyaWVyX29hdXRoX2NiIiwic3RhdGUiOiI3YmQ2ZTI2YzVlNGFiZGMwYjFlZWJhNjFmZjcyZjBlMSIsImlzX2Rldmh1YiI6IjAifQ%3D%3D
  ✅ C2 🔴 我们的 client_id 对方原样收到
       实得 "E2E-CID"
  ✅ C3 🔴 我们的回调地址对方原样收到
       实得 "http://localhost:20098/index.php/Admin/wangzhanguanli_carrier_oauth_cb"
  ✅ C4 我们自己的 state 也在里面
       实得「7bd6e26c5e4abdc0b1eeba61ff72f0e1」
  ✅ C5 🔴 state 改一个字符就拒
       实得 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
 <head>
	<meta charset="utf-8">
	<
  ✅ C6 🔴 对的 state 能过这一关(它同时证明 session 跨站带得回来)
       仍卡在 state 校验 ⇒ 这道闸恒拒、没有分辨力。实得 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
 <head>
	<meta charset="utf-8">
	<
  ✅ C7 🔴 同一个 state 不能用第二次

D. 🔴 受限管理员
  ✅ D1 🔴 非超管访问回调:被拦
  ✅ D2 🔴 非超管发起授权:被拦
       实得 http://localhost:20098/index.php/Admin/wangzhanguanli_carrier_oauth/carrier/easyparcel
  ✅ E1 账号配置已逐字段还原
       {"client_id":"1984b3fc-ba88-4b2f-be98-1f079d253a90","client_secret":"5e9a47bc-9ffe-4366-9d4b-c8cae88d3877","access_token":"eyJhbGciOiJIUzI1NiJ9.eyJhcHAiOnsiY2xpZW50X2lkIjoiMTk4NGIzZmMtYmE4OC00YjJmLWJlOTgtMWYwNzlkMjUzYTkwIn0sInVzZXIiOnsiaWQiOiIwYWExNmI4NWNlODc1MWI4NjIzMTg3YTA5NzY0Y2M3YVpkeVp2d0ZZRHZ6OVlianhaN3MxYVE9PSIsImVhc3lfYWNjb3VudF9pZCI6IjM4ODRiYjM2LTAxMzktNGVjNi1iM2ZjLTlmM2MwZWRlNWRlZCIsImFjY291bnRfaWQiOiIxMDkyMzY1MSJ9LCJhY2NvdW50X2FwcF91dWlkIjoiOTY2N2E3NGItMmJkOS00MzUwLTkyZTMtMTA0Nzk3YzMwZjQyIiwiaWF0IjoxNzg4NzUxNTY1LCJpc3MiOiJlYXN5cGFyY2VsIiwiYXVkIjoiZWFzeXBhcmNlbCIsImV4cCI6MTc4ODc4NzU2NX0.QXolGgxFppnaZInnpH9pyEAmvMknC6-DdJzUiZ-1oH8","refresh_token":"10f13c762311cd70fce9176e092210344447037e95278d01371e0dab5be0e9ce","token_expire":"1788787565","account_currency":"MYR","env":"sandbox","account_id":"10923651"}

[还原] e2e_admin10.userauth = [12,2,66,65,3]  ✔

PASS=12 FAIL=0