Add comprehensive testing guide for playground access control

Co-authored-by: qaiu <29825328+qaiu@users.noreply.github.com>

TESTING_GUIDE.md

@@ -0,0 +1,270 @@
+# Playground Access Control - Testing Guide
+
+## Quick Test Scenarios
+
+### Scenario 1: Disabled Mode (Default)
+**Configuration:**
+```yaml
+playground:
+  enabled: false
+  password: ""
+```
+
+**Expected Behavior:**
+1. Navigate to `/playground`
+2. Should see: "Playground未开启，请联系管理员在配置中启用此功能"
+3. All API endpoints (`/v2/playground/*`) should return error
+
+**API Test:**
+```bash
+curl http://localhost:6400/v2/playground/status
+# Expected: {"code":200,"msg":"success","success":true,"data":{"enabled":false,"needPassword":false,"authed":false}}
+```
+
+---
+
+### Scenario 2: Password-Protected Mode
+**Configuration:**
+```yaml
+playground:
+  enabled: true
+  password: "test123"
+```
+
+**Expected Behavior:**
+1. Navigate to `/playground`
+2. Should see password input form with lock icon
+3. Enter wrong password → Error message: "密码错误"
+4. Enter correct password "test123" → Success, editor loads
+5. Refresh page → Should remain authenticated
+
+**API Tests:**
+```bash
+# Check status
+curl http://localhost:6400/v2/playground/status
+# Expected: {"enabled":true,"needPassword":true,"authed":false}
+
+# Login with wrong password
+curl -X POST http://localhost:6400/v2/playground/login \
+  -H "Content-Type: application/json" \
+  -d '{"password":"wrong"}'
+# Expected: {"code":500,"msg":"密码错误","success":false}
+
+# Login with correct password
+curl -X POST http://localhost:6400/v2/playground/login \
+  -H "Content-Type: application/json" \
+  -d '{"password":"test123"}'
+# Expected: {"code":200,"msg":"登录成功","success":true}
+
+# Try to access without login (should fail)
+curl http://localhost:6400/v2/playground/test \
+  -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"jsCode":"function parse(){return \"test\";}","shareUrl":"http://test.com"}'
+# Expected: Error response
+```
+
+---
+
+### Scenario 3: Public Access Mode
+**Configuration:**
+```yaml
+playground:
+  enabled: true
+  password: ""
+```
+
+**Expected Behavior:**
+1. Navigate to `/playground`
+2. Should directly load the editor (no password prompt)
+3. All features work immediately
+
+**API Test:**
+```bash
+curl http://localhost:6400/v2/playground/status
+# Expected: {"enabled":true,"needPassword":false,"authed":true}
+```
+
+⚠️ **Warning**: Only use this mode in localhost or secure internal network!
+
+---
+
+## Full Feature Tests
+
+### 1. Status Endpoint
+```bash
+curl http://localhost:6400/v2/playground/status
+```
+
+Should return JSON with:
+- `enabled`: boolean
+- `needPassword`: boolean
+- `authed`: boolean
+
+### 2. Login Endpoint (when password is set)
+```bash
+curl -X POST http://localhost:6400/v2/playground/login \
+  -H "Content-Type: application/json" \
+  -d '{"password":"YOUR_PASSWORD"}'
+```
+
+### 3. Test Script Execution (after authentication)
+```bash
+curl -X POST http://localhost:6400/v2/playground/test \
+  -H "Content-Type: application/json" \
+  -d '{
+    "jsCode": "function parse(shareLinkInfo, http, logger) { return \"http://example.com/file.zip\"; }",
+    "shareUrl": "https://example.com/share/123",
+    "pwd": "",
+    "method": "parse"
+  }'
+```
+
+### 4. Get Types Definition
+```bash
+curl http://localhost:6400/v2/playground/types.js
+```
+
+### 5. Parser Management (after authentication)
+```bash
+# List parsers
+curl http://localhost:6400/v2/playground/parsers
+
+# Get parser by ID
+curl http://localhost:6400/v2/playground/parsers/1
+
+# Delete parser
+curl -X DELETE http://localhost:6400/v2/playground/parsers/1
+```
+
+---
+
+## UI Testing Checklist
+
+### When Disabled
+- [ ] Page shows "Playground未开启" message
+- [ ] No editor visible
+- [ ] Clean, centered layout
+
+### When Password Protected (Not Authenticated)
+- [ ] Password input form visible
+- [ ] Lock icon displayed
+- [ ] Can toggle password visibility
+- [ ] Enter key submits form
+- [ ] Error message shows for wrong password
+- [ ] Success message and editor loads on correct password
+
+### When Password Protected (Authenticated)
+- [ ] Editor loads immediately on page refresh
+- [ ] All features work (run, save, format, etc.)
+- [ ] Can execute tests
+- [ ] Can save/load parsers
+
+### When Public Access
+- [ ] Editor loads immediately
+- [ ] All features work without authentication
+- [ ] No password prompt visible
+
+---
+
+## Configuration Examples
+
+### Production (Recommended)
+```yaml
+playground:
+  enabled: false
+  password: ""
+```
+
+### Development Team (Public Network)
+```yaml
+playground:
+  enabled: true
+  password: "SecureP@ssw0rd2024!"
+```
+
+### Local Development
+```yaml
+playground:
+  enabled: true
+  password: ""
+```
+
+---
+
+## Common Issues
+
+### Issue: "Failed to extract session ID from cookie"
+**Cause**: Cookie parsing error
+**Solution**: This is logged as a warning and falls back to IP-based identification
+
+### Issue: Editor doesn't load after correct password
+**Cause**: Frontend state not updated
+**Solution**: Check browser console for errors, ensure initPlayground() is called
+
+### Issue: Authentication lost on page refresh
+**Cause**: Server restarted (in-memory session storage)
+**Solution**: Expected behavior - re-enter password after server restart
+
+---
+
+## Security Verification
+
+### 1. Default Security
+- [ ] Default config has `enabled: false`
+- [ ] Cannot access playground without enabling
+- [ ] No unintended API exposure
+
+### 2. Password Protection
+- [ ] Wrong password rejected
+- [ ] Session persists across requests
+- [ ] Different clients have independent sessions
+
+### 3. API Protection
+- [ ] All playground endpoints check authentication
+- [ ] Status endpoint accessible without auth (returns state only)
+- [ ] Login endpoint accessible without auth (for authentication)
+- [ ] All other endpoints require authentication when password is set
+
+---
+
+## Performance Testing
+
+### Load Test
+```bash
+# Test status endpoint
+ab -n 1000 -c 10 http://localhost:6400/v2/playground/status
+```
+
+### Session Management Test
+```bash
+# Create multiple concurrent sessions
+for i in {1..10}; do
+  curl -X POST http://localhost:6400/v2/playground/login \
+    -H "Content-Type: application/json" \
+    -d '{"password":"test123"}' &
+done
+wait
+```
+
+---
+
+## Cleanup
+
+After testing, remember to:
+1. Set `enabled: false` in production
+2. Use strong passwords if enabling in public networks
+3. Monitor access logs
+4. Regularly review created parsers
+
+---
+
+## Documentation References
+
+- Full documentation: `web-service/doc/PLAYGROUND_ACCESS_CONTROL.md`
+- Main README: `README.md` (Playground Access Control section)
+- Configuration file: `web-service/src/main/resources/app-dev.yml`
+
+---
+
+Last Updated: 2025-12-07