472 lines
21 KiB
Go
472 lines
21 KiB
Go
package server
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strconv"
|
|
"strings"
|
|
"testing"
|
|
|
|
"agent-system-backend/internal/authz/catalog"
|
|
"agent-system-backend/internal/store"
|
|
)
|
|
|
|
func bearerRequest(h http.Handler, method, path, body, key string) *httptest.ResponseRecorder {
|
|
req := httptest.NewRequest(method, path, strings.NewReader(body))
|
|
req.Header.Set("Authorization", "Bearer "+key)
|
|
if body != "" {
|
|
req.Header.Set("Content-Type", "application/json")
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
func TestProjectCreateRequiresSystemOrRolePermission(t *testing.T) {
|
|
srv, st := newAuthTestServer(t)
|
|
h := srv.Handler()
|
|
admin := bootAdmin(t, h, st)
|
|
if err := st.CreateAccount("engineer", "Engineer", "", false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
engineer, _ := st.GetAccountByOwner("engineer")
|
|
key, err := st.CreateAPIKey("engineer", "engineer-test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"未授权项目"}`, key); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("project created without permission: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
roleRec := do(h, "POST", "/api/admin/roles", `{"name":"软件工程师"}`, admin)
|
|
if roleRec.Code != http.StatusOK {
|
|
t.Fatalf("create role: %d %s", roleRec.Code, roleRec.Body.String())
|
|
}
|
|
role := decodeRoleHTTP(t, roleRec)
|
|
policy := do(h, "PUT", "/api/admin/roles/"+role.RoleID+"/permissions",
|
|
`{"expectedRoleVersion":1,"idempotencyKey":"project-create-policy","changes":[{"actionId":"project.create","allowed":true,"capAllowed":true}]}`, admin)
|
|
if policy.Code != http.StatusOK {
|
|
t.Fatalf("set role permission: %d %s", policy.Code, policy.Body.String())
|
|
}
|
|
assign := do(h, "PUT", "/api/admin/users/"+engineer.ID+"/role",
|
|
`{"roleId":"`+role.RoleID+`","expectedStateVersion":`+strconv.FormatInt(engineer.StateVersion, 10)+`,"idempotencyKey":"assign-engineer"}`, admin)
|
|
if assign.Code != http.StatusOK {
|
|
t.Fatalf("assign engineer: %d %s", assign.Code, assign.Body.String())
|
|
}
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"授权项目"}`, key); rec.Code != http.StatusOK {
|
|
t.Fatalf("role project create: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
// TestProjectCreateIsTheOnlyRolePolicyOverHTTP pins the narrowed role model
|
|
// (R2): a role carries the single project.create boolean, a batch naming any
|
|
// other action is refused outright, no linked rows are expanded on write, and
|
|
// the /api/me own-project link is a catalog projection of that boolean rather
|
|
// than something the role stored.
|
|
func TestProjectCreateIsTheOnlyRolePolicyOverHTTP(t *testing.T) {
|
|
srv, st := newAuthTestServer(t)
|
|
h := srv.Handler()
|
|
admin := bootAdmin(t, h, st)
|
|
if err := st.CreateAccount("creator", "Creator", "", false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
creator, _ := st.GetAccountByOwner("creator")
|
|
key, err := st.CreateAPIKey("creator", "creator-test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
roleRec := do(h, "POST", "/api/admin/roles", `{"name":"项目创建者"}`, admin)
|
|
if roleRec.Code != http.StatusOK {
|
|
t.Fatalf("create role: %d %s", roleRec.Code, roleRec.Body.String())
|
|
}
|
|
role := decodeRoleHTTP(t, roleRec)
|
|
permissions := "/api/admin/roles/" + role.RoleID + "/permissions"
|
|
roleView := func() *httptest.ResponseRecorder {
|
|
return do(h, "GET", "/api/admin/roles/"+role.RoleID, "", admin)
|
|
}
|
|
const enableCreate = `{"actionId":"project.create","allowed":true,"capAllowed":true}`
|
|
const denyLinked = `{"actionId":"project.members.manage","allowed":false,"capAllowed":false}`
|
|
|
|
// A batch that enables project.create and explicitly denies a linked
|
|
// own-project action is refused as a whole: the linked action is not role
|
|
// authority any more, so nothing in that batch is written.
|
|
both := do(h, "PUT", permissions,
|
|
`{"expectedRoleVersion":1,"idempotencyKey":"create-and-deny-linked","changes":[`+enableCreate+`,`+denyLinked+`]}`, admin)
|
|
if both.Code != http.StatusBadRequest {
|
|
t.Fatalf("linked deny accepted beside create: %d %s", both.Code, both.Body.String())
|
|
}
|
|
stale := do(h, "PUT", permissions,
|
|
`{"expectedRoleVersion":9,"idempotencyKey":"create-stale","changes":[`+enableCreate+`]}`, admin)
|
|
if stale.Code != http.StatusConflict {
|
|
t.Fatalf("stale role version: %d %s", stale.Code, stale.Body.String())
|
|
}
|
|
policy := do(h, "PUT", permissions,
|
|
`{"expectedRoleVersion":1,"idempotencyKey":"create-only","changes":[`+enableCreate+`]}`, admin)
|
|
if policy.Code != http.StatusOK {
|
|
t.Fatalf("create-only policy: %d %s", policy.Code, policy.Body.String())
|
|
}
|
|
var receipt store.PolicyReceipt
|
|
if err := json.Unmarshal(policy.Body.Bytes(), &receipt); err != nil {
|
|
t.Fatalf("decode receipt: %v body=%s", err, policy.Body.String())
|
|
}
|
|
if receipt.ReceiptID == "" || receipt.RoleVersion != 2 || len(receipt.LinkedExpansion) != 0 ||
|
|
strings.Contains(policy.Body.String(), "linkedExpansion") {
|
|
t.Fatalf("receipt expanded linked rows: %+v body=%s", receipt, policy.Body.String())
|
|
}
|
|
requireRoleProjectAccess(t, roleView(), 2, true)
|
|
|
|
// Split across two submissions the linked deny is refused on its own, so the
|
|
// role keeps the project.create policy the first submission wrote.
|
|
denyLater := do(h, "PUT", permissions,
|
|
`{"expectedRoleVersion":2,"idempotencyKey":"deny-linked-later","changes":[`+denyLinked+`]}`, admin)
|
|
if denyLater.Code != http.StatusBadRequest {
|
|
t.Fatalf("linked deny accepted in a later batch: %d %s", denyLater.Code, denyLater.Body.String())
|
|
}
|
|
requireRoleProjectAccess(t, roleView(), 2, true)
|
|
|
|
assign := do(h, "PUT", "/api/admin/users/"+creator.ID+"/role",
|
|
`{"roleId":"`+role.RoleID+`","expectedStateVersion":`+strconv.FormatInt(creator.StateVersion, 10)+`,"idempotencyKey":"assign-creator"}`, admin)
|
|
if assign.Code != http.StatusOK {
|
|
t.Fatalf("assign creator: %d %s", assign.Code, assign.Body.String())
|
|
}
|
|
me := bearerRequest(h, "GET", "/api/me", "", key)
|
|
if me.Code != http.StatusOK {
|
|
t.Fatalf("me: %d %s", me.Code, me.Body.String())
|
|
}
|
|
var identity struct {
|
|
Linked struct {
|
|
ProjectCreate bool `json:"projectCreate"`
|
|
Source string `json:"source"`
|
|
LinkedActions []string `json:"linkedActions"`
|
|
Conflicts []string `json:"conflicts"`
|
|
} `json:"linkedCapabilities"`
|
|
}
|
|
if err := json.Unmarshal(me.Body.Bytes(), &identity); err != nil {
|
|
t.Fatalf("decode me: %v body=%s", err, me.Body.String())
|
|
}
|
|
if !identity.Linked.ProjectCreate || identity.Linked.Source != "role" || len(identity.Linked.Conflicts) != 0 ||
|
|
strings.Join(identity.Linked.LinkedActions, ",") != strings.Join(catalog.ProjectCreateLinkedActions(), ",") {
|
|
t.Fatalf("linked capabilities=%+v", identity.Linked)
|
|
}
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"创建者项目"}`, key); rec.Code != http.StatusOK {
|
|
t.Fatalf("role project create: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestSystemUserActionsDoNotImplyRoleOrPermissionManagement(t *testing.T) {
|
|
srv, st := newAuthTestServer(t)
|
|
h := srv.Handler()
|
|
admin := bootSuperAdmin(t, h, st)
|
|
if err := st.CreateAccount("viewer", "Viewer", "", false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
viewer, _ := st.GetAccountByOwner("viewer")
|
|
epoch, _ := st.AuthorityEpoch()
|
|
grant := do(h, "PUT", "/api/admin/users/"+viewer.ID+"/system-grants",
|
|
`{"expectedAuthorityEpoch":`+strconv.FormatInt(epoch, 10)+`,"idempotencyKey":"viewer-grant","actions":["system.users.view"]}`, admin)
|
|
if grant.Code != http.StatusOK {
|
|
t.Fatalf("grant viewer: %d %s", grant.Code, grant.Body.String())
|
|
}
|
|
key, err := st.CreateAPIKey("viewer", "viewer-test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if rec := bearerRequest(h, "GET", "/api/admin/users", "", key); rec.Code != http.StatusOK {
|
|
t.Fatalf("users.view denied: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec := bearerRequest(h, "POST", "/api/admin/users", `{"owner":"forbidden-user"}`, key); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("users.view created account: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec := bearerRequest(h, "GET", "/api/admin/roles", "", key); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("users.view read roles: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec := bearerRequest(h, "GET", "/api/me", "", key); rec.Code != http.StatusOK ||
|
|
!strings.Contains(rec.Body.String(), `"systemActions":["system.users.view"]`) {
|
|
t.Fatalf("me system actions: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec := bearerRequest(h, "GET", "/api/authz/explain?action=system.users.view", "", key); rec.Code != http.StatusOK {
|
|
t.Fatalf("explain: %d %s", rec.Code, rec.Body.String())
|
|
} else {
|
|
var decision struct {
|
|
Allowed bool `json:"allowed"`
|
|
Source string `json:"source"`
|
|
}
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &decision); err != nil || !decision.Allowed || decision.Source != "system-grant" {
|
|
t.Fatalf("decision=%+v err=%v", decision, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestDelegatedUserActionsReachTransactionalStoreChecks(t *testing.T) {
|
|
srv, st := newAuthTestServer(t)
|
|
h := srv.Handler()
|
|
admin := bootSuperAdmin(t, h, st)
|
|
if err := st.CreateAccount("user-manager", "User Manager", "", false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
manager, err := st.GetAccountByOwner("user-manager")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
epoch, err := st.AuthorityEpoch()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
grant := do(h, "PUT", "/api/admin/users/"+manager.ID+"/system-grants",
|
|
`{"expectedAuthorityEpoch":`+strconv.FormatInt(epoch, 10)+`,"idempotencyKey":"grant-user-manager","actions":["system.users.view","system.users.create","system.users.edit","system.users.disable"]}`, admin)
|
|
if grant.Code != http.StatusOK {
|
|
t.Fatalf("grant: %d %s", grant.Code, grant.Body.String())
|
|
}
|
|
key, err := st.CreateAPIKey("user-manager", "user-manager-test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
created := bearerRequest(h, "POST", "/api/admin/users", `{"owner":"managed-user","profile":{"name":"Managed"}}`, key)
|
|
if created.Code != http.StatusOK {
|
|
t.Fatalf("delegated create: %d %s", created.Code, created.Body.String())
|
|
}
|
|
var target struct {
|
|
UserID string `json:"userId"`
|
|
ProfileVersion int64 `json:"profileVersion"`
|
|
StateVersion int64 `json:"stateVersion"`
|
|
}
|
|
if err := json.Unmarshal(created.Body.Bytes(), &target); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
search := bearerRequest(h, "GET", "/api/admin/users/search?query=Managed&mode=exact&status=enabled&fields=name&limit=20", "", key)
|
|
if search.Code != http.StatusOK || !strings.Contains(search.Body.String(), target.UserID) {
|
|
t.Fatalf("delegated search: %d %s", search.Code, search.Body.String())
|
|
}
|
|
patched := bearerRequest(h, "PATCH", "/api/admin/users/"+target.UserID+"/profile",
|
|
`{"expectedProfileVersion":`+strconv.FormatInt(target.ProfileVersion, 10)+`,"patch":{"department":"研发"}}`, key)
|
|
if patched.Code != http.StatusOK {
|
|
t.Fatalf("delegated edit: %d %s", patched.Code, patched.Body.String())
|
|
}
|
|
disabled := bearerRequest(h, "PUT", "/api/admin/users/"+target.UserID+"/state",
|
|
`{"expectedStateVersion":`+strconv.FormatInt(target.StateVersion, 10)+`,"enabled":false}`, key)
|
|
if disabled.Code != http.StatusOK {
|
|
t.Fatalf("delegated disable: %d %s", disabled.Code, disabled.Body.String())
|
|
}
|
|
}
|
|
|
|
// grantSystemActionsFixture creates owner with exactly the given explicit
|
|
// system grants (issued by the super administrator) and returns its API key.
|
|
func grantSystemActionsFixture(t *testing.T, h http.Handler, st *store.Store, superAdmin, owner string, actions ...string) string {
|
|
t.Helper()
|
|
if err := st.CreateAccount(owner, owner, "", false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
account, err := st.GetAccountByOwner(owner)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
epoch, err := st.AuthorityEpoch()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
body, _ := json.Marshal(map[string]any{"expectedAuthorityEpoch": epoch, "idempotencyKey": "grant-" + owner, "actions": actions})
|
|
if rec := do(h, "PUT", "/api/admin/users/"+account.ID+"/system-grants", string(body), superAdmin); rec.Code != http.StatusOK {
|
|
t.Fatalf("grant %s: %d %s", owner, rec.Code, rec.Body.String())
|
|
}
|
|
key, err := st.CreateAPIKey(owner, owner+"-test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return key
|
|
}
|
|
|
|
func createAssignedRoleFixture(t *testing.T, h http.Handler, st *store.Store, superAdmin, owner, roleName string, projectAccess bool) string {
|
|
t.Helper()
|
|
roleRec := do(h, "POST", "/api/admin/roles", `{"name":"`+roleName+`"}`, superAdmin)
|
|
if roleRec.Code != http.StatusOK {
|
|
t.Fatalf("create role: %d %s", roleRec.Code, roleRec.Body.String())
|
|
}
|
|
role := decodeRoleHTTP(t, roleRec)
|
|
if projectAccess {
|
|
policy := do(h, "PUT", "/api/admin/roles/"+role.RoleID+"/permissions",
|
|
`{"expectedRoleVersion":1,"idempotencyKey":"access-`+role.RoleID+`","changes":[{"actionId":"project.create","allowed":true,"capAllowed":true}]}`, superAdmin)
|
|
if policy.Code != http.StatusOK {
|
|
t.Fatalf("set project access: %d %s", policy.Code, policy.Body.String())
|
|
}
|
|
}
|
|
account, err := st.GetAccountByOwner(owner)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
assign := do(h, "PUT", "/api/admin/users/"+account.ID+"/role",
|
|
`{"roleId":"`+role.RoleID+`","expectedStateVersion":`+strconv.FormatInt(account.StateVersion, 10)+`,"idempotencyKey":"assign-`+owner+`"}`, superAdmin)
|
|
if assign.Code != http.StatusOK {
|
|
t.Fatalf("assign %s: %d %s", owner, assign.Code, assign.Body.String())
|
|
}
|
|
return role.RoleID
|
|
}
|
|
|
|
func systemDecisionFixture(t *testing.T, rec *httptest.ResponseRecorder) (bool, string, string) {
|
|
t.Helper()
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("explain: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
var decision struct {
|
|
Allowed bool `json:"allowed"`
|
|
Source string `json:"source"`
|
|
Reason string `json:"reason"`
|
|
}
|
|
if err := json.Unmarshal(rec.Body.Bytes(), &decision); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return decision.Allowed, decision.Source, decision.Reason
|
|
}
|
|
|
|
func TestProjectAccessIgnoresAdministratorBypass(t *testing.T) {
|
|
srv, st := newAuthTestServer(t)
|
|
h := srv.Handler()
|
|
superAdmin := bootSuperAdmin(t, h, st)
|
|
ops := bootOrdinaryAdmin(t, h, st, "ops")
|
|
|
|
for name, session := range map[string]string{"super": superAdmin, "ordinary": ops} {
|
|
if rec := do(h, "POST", "/api/projects", `{"name":"管理员项目-`+name+`"}`, session); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("%s admin created project without project access: %d %s", name, rec.Code, rec.Body.String())
|
|
}
|
|
if allowed, _, reason := systemDecisionFixture(t, do(h, "GET", "/api/authz/explain?action=project.create", "", session)); allowed || reason != "not-granted" {
|
|
t.Fatalf("%s admin project.create allowed=%v reason=%s", name, allowed, reason)
|
|
}
|
|
if allowed, source, _ := systemDecisionFixture(t, do(h, "GET", "/api/authz/explain?action=system.permissions.manage", "", session)); !allowed || source != "bootstrap-admin" {
|
|
t.Fatalf("%s admin protected action allowed=%v source=%s", name, allowed, source)
|
|
}
|
|
me := do(h, "GET", "/api/me", "", session)
|
|
if me.Code != http.StatusOK || strings.Contains(me.Body.String(), `"project.create"`) || !strings.Contains(me.Body.String(), `"system.permissions.manage"`) {
|
|
t.Fatalf("%s admin system actions: %d %s", name, me.Code, me.Body.String())
|
|
}
|
|
}
|
|
|
|
if err := st.CreateAccount("engineer", "Engineer", "", false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
engineerKey, err := st.CreateAPIKey("engineer", "engineer-test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
createAssignedRoleFixture(t, h, st, superAdmin, "engineer", "工程师", true)
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"工程师项目"}`, engineerKey); rec.Code != http.StatusOK {
|
|
t.Fatalf("ordinary user with project access: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if allowed, source, _ := systemDecisionFixture(t, bearerRequest(h, "GET", "/api/authz/explain?action=project.create", "", engineerKey)); !allowed || source != "role" {
|
|
t.Fatalf("engineer project.create allowed=%v source=%s", allowed, source)
|
|
}
|
|
|
|
createAssignedRoleFixture(t, h, st, superAdmin, "admin", "管理岗位", true)
|
|
if rec := do(h, "POST", "/api/projects", `{"name":"管理员授权项目"}`, superAdmin); rec.Code != http.StatusOK {
|
|
t.Fatalf("admin with project-access role: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestProjectAccessIgnoresSystemGrantWithoutRole(t *testing.T) {
|
|
srv, st := newAuthTestServer(t)
|
|
h := srv.Handler()
|
|
superAdmin := bootSuperAdmin(t, h, st)
|
|
key := grantSystemActionsFixture(t, h, st, superAdmin, "granted", "project.create")
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"系统授权项目"}`, key); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("system grant conferred project access: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestProjectCreateFailsClosedWithoutRoleProvider(t *testing.T) {
|
|
srv, st := newAuthTestServer(t)
|
|
h := srv.Handler()
|
|
superAdmin := bootSuperAdmin(t, h, st)
|
|
if err := st.CreateAccount("engineer", "Engineer", "", false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
key, err := st.CreateAPIKey("engineer", "engineer-test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"无职位项目"}`, key); rec.Code != http.StatusForbidden ||
|
|
!strings.Contains(rec.Body.String(), "not-granted") {
|
|
t.Fatalf("project created without role: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if allowed, _, reason := systemDecisionFixture(t, bearerRequest(h, "GET", "/api/authz/explain?action=project.create", "", key)); allowed || reason != "not-granted" {
|
|
t.Fatalf("missing role project.create allowed=%v reason=%s", allowed, reason)
|
|
}
|
|
|
|
createAssignedRoleFixture(t, h, st, superAdmin, "engineer", "工程师", true)
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"职位授权项目"}`, key); rec.Code != http.StatusOK {
|
|
t.Fatalf("role project create: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
|
|
if _, err := st.DB().Exec(`DROP TABLE role_permissions`); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"职位不可用项目"}`, key); rec.Code != http.StatusForbidden ||
|
|
!strings.Contains(rec.Body.String(), "authority-unavailable") {
|
|
t.Fatalf("project created with unavailable role provider: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if allowed, source, reason := systemDecisionFixture(t, bearerRequest(h, "GET", "/api/authz/explain?action=project.create", "", key)); allowed || source != "" || reason != "authority-unavailable" {
|
|
t.Fatalf("unavailable role project.create allowed=%v source=%s reason=%s", allowed, source, reason)
|
|
}
|
|
}
|
|
|
|
func TestLegacyRoleRowsDoNotAuthorizeSystemActionsOrAccess(t *testing.T) {
|
|
srv, st := newAuthTestServer(t)
|
|
h := srv.Handler()
|
|
superAdmin := bootSuperAdmin(t, h, st)
|
|
if err := st.CreateAccount("engineer", "Engineer", "", false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
key, err := st.CreateAPIKey("engineer", "engineer-test")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
roleID := createAssignedRoleFixture(t, h, st, superAdmin, "engineer", "旧模型职位", false)
|
|
admin, err := st.GetAccountByOwner("admin")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
legacy := func(actionID string, allowed, capAllowed bool) {
|
|
t.Helper()
|
|
if _, err := st.DB().Exec(`INSERT INTO role_permissions(role_id,action_id,allowed,cap_allowed,permission_version,updated_by,updated_at)
|
|
VALUES(?,?,?,?,1,?,'2026-01-01T00:00:00Z') ON CONFLICT(role_id,action_id) DO UPDATE SET allowed=excluded.allowed,cap_allowed=excluded.cap_allowed`,
|
|
roleID, actionID, allowed, capAllowed, admin.ID); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
for _, actionID := range []string{"system.settings.read", "system.settings.write", "system.users.view", "system.users.create", "system.roles.view", "document.read"} {
|
|
legacy(actionID, true, true)
|
|
}
|
|
legacy("project.create", false, true)
|
|
|
|
if rec := bearerRequest(h, "GET", "/api/admin/users", "", key); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("legacy role row granted users.view: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec := bearerRequest(h, "GET", "/api/admin/roles", "", key); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("legacy role row granted roles.view: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
for _, actionID := range []string{"system.settings.read", "system.users.view", "project.create"} {
|
|
if allowed, _, _ := systemDecisionFixture(t, bearerRequest(h, "GET", "/api/authz/explain?action="+actionID, "", key)); allowed {
|
|
t.Fatalf("legacy role row authorized %s", actionID)
|
|
}
|
|
}
|
|
if rec := bearerRequest(h, "GET", "/api/me", "", key); rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), `"systemActions":[]`) {
|
|
t.Fatalf("legacy role system actions: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"仅上限项目"}`, key); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("cap-only legacy row granted project access: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
roleRec := do(h, "GET", "/api/admin/roles/"+roleID, "", superAdmin)
|
|
requireRoleProjectAccess(t, roleRec, 1, false)
|
|
list := do(h, "GET", "/api/admin/roles", "", superAdmin)
|
|
for _, body := range []string{roleRec.Body.String(), list.Body.String()} {
|
|
for _, actionID := range []string{"system.settings", "system.users", "system.roles", "document.read"} {
|
|
if strings.Contains(body, actionID) {
|
|
t.Fatalf("role API exposed legacy %s: %s", actionID, body)
|
|
}
|
|
}
|
|
}
|
|
|
|
legacy("project.create", true, true)
|
|
if rec := bearerRequest(h, "POST", "/api/projects", `{"name":"旧行允许项目"}`, key); rec.Code != http.StatusOK {
|
|
t.Fatalf("legacy true,true row denied project access: %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
}
|