weichen
4d1ca60067
Why: System, role, and project entry permissions need explicit actions instead of a single administrator flag or unrestricted project creation. Evidence: The full Backend test suite passed, including role APIs, action isolation, project.create denial/allow, storage migration coverage, and account write fences. Impact: Adds versioned role and grant endpoints, maps account actions to explicit permissions, and requires project.create authority. Refs: Focused role and permission system task 3
37 lines
1.1 KiB
Go
37 lines
1.1 KiB
Go
package server
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"agent-system-backend/internal/store"
|
|
)
|
|
|
|
// createLegacyAPIKeyFixture creates the historical integration identity
|
|
// explicitly before exercising the formal, non-creating key issuance path.
|
|
func createLegacyAPIKeyFixture(t *testing.T, st *store.Store, owner, name string) (string, error) {
|
|
t.Helper()
|
|
if err := st.EnsureUser(owner, ""); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return st.CreateAPIKey(owner, name)
|
|
}
|
|
|
|
func grantProjectCreateFixture(t *testing.T, st *store.Store, owner string) {
|
|
t.Helper()
|
|
account, err := st.GetAccountByOwner(owner)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
role, err := st.CreateRole(owner, store.RoleCreate{Name: "项目创建测试职位-" + owner})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := st.ReplaceRolePermissions(owner, role.RoleID, role.RoleVersion,
|
|
[]store.RolePermissionChange{{ActionID: "project.create", Allowed: true, CapAllowed: true}}, "fixture-policy-"+owner); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := st.AssignUserRole(owner, account.ID, role.RoleID, account.StateVersion, "fixture-binding-"+owner); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|