Initial commit

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/middleware/verfyparam/verfyparam_test.go

@@ -0,0 +1,32 @@
+package verfyparam
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestTranscodeM3u8BypassesAppReplayValidationWithoutUserAgent(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(CheckReplayAttackRequest())
+	router.GET("/api/app/vid/transcode/m3u8/*source", func(ctx *gin.Context) {
+		ctx.Status(http.StatusNoContent)
+	})
+
+	req := httptest.NewRequest(
+		http.MethodGet,
+		"/api/app/vid/transcode/m3u8/laosiji/m3m/source.m3u8",
+		nil,
+	)
+	req.Header.Del("User-Agent")
+	recorder := httptest.NewRecorder()
+
+	router.ServeHTTP(recorder, req)
+
+	if recorder.Code != http.StatusNoContent {
+		t.Fatalf("light m3u8 request was blocked: status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}