624 lines
37 KiB
TypeScript
624 lines
37 KiB
TypeScript
// IAM U4 阶段 7 确定性浏览器切片（DR6–DR10）：真实 React/Picker 交互 +
|
||
// 完全受控的 HTTP 应答，不依赖任何账号或数据库。活体隔离产品层由
|
||
// Agent-System-RDM scripts/iam-u4-role-acceptance.sh 以真实 Backend/RDM
|
||
// 授权路径复用同一场景（live 模式不拦截路由）。
|
||
import { test, expect, type Page, type Route } from '@playwright/test'
|
||
|
||
test.skip(!process.env.PLAYWRIGHT_BASE_URL, 'set PLAYWRIGHT_BASE_URL to an isolated frontend server')
|
||
|
||
function deferred() {
|
||
let resolve!: () => void
|
||
const promise = new Promise<void>(ok => { resolve = ok })
|
||
return { promise, resolve }
|
||
}
|
||
|
||
interface Me { owner: string; name: string; auth: boolean; isAdmin?: boolean; systemActions?: string[] }
|
||
interface Perm { actionId: string; label: string; description: string; group: string; scope: 'system' | 'project'; protected: boolean }
|
||
interface RolePerm { actionId: string; allowed: boolean; capAllowed: boolean; permissionVersion: number }
|
||
interface Role { roleId: string; name: string; description: string; enabled: boolean; roleVersion: number; bindingCount: number; permissions: RolePerm[] }
|
||
interface Account {
|
||
userId: string; owner: string; profile: { name: string; phone: string; email: string; staffNo: string; department: string; notes: string }
|
||
profileVersion: number; enabled: boolean; stateVersion: number; isAdmin: boolean; passwordSet: boolean
|
||
initializationState: string; initializationGeneration: number
|
||
}
|
||
|
||
const FULL_ACTIONS = ['system.users.view', 'system.users.create', 'system.users.edit', 'system.users.disable',
|
||
'system.roles.view', 'system.roles.manage', 'system.roles.assign', 'system.permissions.view', 'system.permissions.manage']
|
||
|
||
function perm(actionId: string, label: string, group: string, scope: 'system' | 'project', extra: Partial<Perm> = {}): Perm {
|
||
return { actionId, label, description: `${label}说明`, group, scope, protected: false, ...extra }
|
||
}
|
||
|
||
const CATALOG: Perm[] = [
|
||
perm('project.create', '创建项目', '项目入口', 'system'),
|
||
perm('project.member.manage', '管理项目成员', '项目入口', 'project'),
|
||
perm('project.override.set', '设置项目覆盖', '项目入口', 'project'),
|
||
perm('document.read', '读取文档', '文档动作', 'project'),
|
||
perm('document.author', '编制文档', '文档动作', 'project'),
|
||
perm('document.approve', '批准文档', '文档动作', 'project'),
|
||
perm('export.create', '创建导出', '平台动作', 'project'),
|
||
perm('audit.read', '读取审计', '平台动作', 'project'),
|
||
perm('system.users.manage', '管理用户账号', '系统动作', 'system', { protected: true }),
|
||
]
|
||
|
||
function emptyProfile(name = '') {
|
||
return { name, phone: '', email: '', staffNo: '', department: '', notes: '' }
|
||
}
|
||
|
||
function account(userId: string, owner: string, profile = emptyProfile(), overrides: Partial<Account> = {}): Account {
|
||
return { userId, owner, profile, profileVersion: 1, enabled: true, stateVersion: 3, isAdmin: false, passwordSet: true, initializationState: 'done', initializationGeneration: 0, ...overrides }
|
||
}
|
||
|
||
function rp(actionId: string, allowed = false, capAllowed = false): RolePerm {
|
||
return { actionId, allowed, capAllowed, permissionVersion: 1 }
|
||
}
|
||
|
||
/** 可变角色/绑定状态：一个 fixture 贯穿用例内全部请求，支持版本化 409。 */
|
||
function world(me: Me) {
|
||
const roles: Role[] = [
|
||
{ roleId: 'role_eng', name: '软件工程师', description: '研发职位', enabled: true, roleVersion: 3, bindingCount: 2, permissions: [rp('project.create', true, true), rp('document.read', true, true)] },
|
||
{ roleId: 'role_ops', name: '运维工程师', description: '运维职位', enabled: true, roleVersion: 1, bindingCount: 0, permissions: [] },
|
||
{ roleId: 'role_review', name: '审核工程师', description: '质量职位', enabled: false, roleVersion: 2, bindingCount: 1, permissions: [rp('document.read', true, true), rp('document.approve', false, true)] },
|
||
]
|
||
const bindings: Record<string, string> = { u1: 'role_eng', u3: 'role_eng' }
|
||
const users: Account[] = [
|
||
account('u1', 'alice', { ...emptyProfile('张三'), phone: '13800000001', staffNo: 'A001' }),
|
||
account('u2', 'bob'),
|
||
account('u3', 'carol', { ...emptyProfile('李四'), email: 'carol@example.com' }),
|
||
]
|
||
const grants: Record<string, { actions: string[]; authorityEpoch: number }> = {}
|
||
const calls: { method: string; path: string; query: Record<string, string>; body?: Record<string, unknown> }[] = []
|
||
const holds = new Map<string, { started: ReturnType<typeof deferred>; release: ReturnType<typeof deferred> }>()
|
||
const failNext = new Map<string, number>()
|
||
let grantEpoch = 5
|
||
const PAGE = 2
|
||
|
||
const visible = (q: URLSearchParams): Role[] => roles.filter(role => {
|
||
const status = q.get('status') ?? 'all'
|
||
if (status === 'enabled' && !role.enabled) return false
|
||
if (status === 'disabled' && role.enabled) return false
|
||
const action = q.get('action') ?? ''
|
||
if (action && !role.permissions.some(item => item.actionId === action && item.allowed)) return false
|
||
const query = (q.get('query') ?? '').trim().toLocaleLowerCase()
|
||
if (!query) return true
|
||
const fields = [role.name, role.description, role.roleId].map(value => value.toLocaleLowerCase())
|
||
return (q.get('mode') ?? 'fuzzy') === 'exact' ? fields.some(value => value === query) : fields.some(value => value.includes(query))
|
||
})
|
||
|
||
const recount = () => {
|
||
for (const role of roles) role.bindingCount = Object.values(bindings).filter(roleId => roleId === role.roleId).length
|
||
}
|
||
|
||
const notFound = () => ({ status: 404, contentType: 'application/json', body: JSON.stringify({ error: 'not found' }) })
|
||
const deny = (route: Route, status: number) => route.fulfill({ status, contentType: 'application/json', body: JSON.stringify({ error: `code:${status}` }) })
|
||
const ok = (route: Route, payload: unknown) => route.fulfill({ contentType: 'application/json', body: JSON.stringify(payload) })
|
||
|
||
return {
|
||
roles, bindings, users, grants, calls,
|
||
hold(key: string) {
|
||
const pending = { started: deferred(), release: deferred() }
|
||
holds.set(key, pending)
|
||
return pending
|
||
},
|
||
failNextTimes(path: string, times: number) { failNext.set(path, times) },
|
||
async route(route: Route) {
|
||
const request = route.request()
|
||
const url = new URL(request.url())
|
||
const path = decodeURIComponent(url.pathname)
|
||
const method = request.method()
|
||
const raw = request.postData()
|
||
calls.push({ method, path, query: Object.fromEntries(url.searchParams), body: raw ? JSON.parse(raw) as Record<string, unknown> : undefined })
|
||
const hold = holds.get(`${method} ${path}`)
|
||
if (hold) { holds.delete(`${method} ${path}`); hold.started.resolve(); await hold.release.promise }
|
||
const fails = failNext.get(path) ?? 0
|
||
if (fails > 0) { failNext.set(path, fails - 1); return route.fulfill({ status: 500, contentType: 'application/json', body: JSON.stringify({ error: 'boom' }) }) }
|
||
|
||
if (path === '/api/health') return ok(route, { ok: true })
|
||
if (path === '/api/me') return ok(route, me)
|
||
if (path === '/api/projects') return ok(route, [])
|
||
if (path === '/api/settings') return ok(route, { schema: [], defaults: {}, user: {}, project: {} })
|
||
if (path === '/api/commands') return ok(route, [])
|
||
if (path === '/api/admin-zone/sections') return ok(route, [])
|
||
if (path.endsWith('/cards')) return ok(route, { cards: [] })
|
||
if (path === '/api/admin/permissions/catalog') return ok(route, { permissions: CATALOG })
|
||
if (path === '/api/admin/roles' && method === 'GET') {
|
||
const list = visible(url.searchParams)
|
||
const start = Number(url.searchParams.get('cursor') ?? 0) || 0
|
||
const page = list.slice(start, start + PAGE)
|
||
return ok(route, { roles: page, nextCursor: start + PAGE < list.length ? String(start + PAGE) : '' })
|
||
}
|
||
if (path === '/api/admin/roles' && method === 'POST') {
|
||
const body = request.postDataJSON() as { name: string; description: string }
|
||
const role: Role = { roleId: `role_${body.name}`, name: body.name, description: body.description, enabled: true, roleVersion: 1, bindingCount: 0, permissions: [] }
|
||
roles.unshift(role)
|
||
return ok(route, role)
|
||
}
|
||
const roleMatch = path.match(/^\/api\/admin\/roles\/([^/]+)(\/permissions)?$/)
|
||
if (roleMatch) {
|
||
const role = roles.find(item => item.roleId === roleMatch[1])
|
||
if (!role) return route.fulfill(notFound())
|
||
if (!roleMatch[2]) {
|
||
if (method === 'GET') return ok(route, role)
|
||
const body = request.postDataJSON() as { expectedRoleVersion: number; name?: string; description?: string; enabled?: boolean }
|
||
if (body.expectedRoleVersion !== role.roleVersion) return deny(route, 409)
|
||
if (body.name !== undefined) role.name = body.name
|
||
if (body.description !== undefined) role.description = body.description
|
||
if (body.enabled !== undefined) role.enabled = body.enabled
|
||
role.roleVersion += 1
|
||
return ok(route, role)
|
||
}
|
||
if (method === 'PUT') {
|
||
const body = request.postDataJSON() as { expectedRoleVersion: number; changes: { actionId: string; allowed: boolean; capAllowed: boolean }[] }
|
||
if (body.expectedRoleVersion !== role.roleVersion) return deny(route, 409)
|
||
role.permissions = body.changes.map(change => ({ ...change, permissionVersion: 1 }))
|
||
role.roleVersion += 1
|
||
return ok(route, { receiptId: 'r1', roleVersion: role.roleVersion, authorityEpoch: 6 })
|
||
}
|
||
}
|
||
if (path === '/api/admin/users/search' && method === 'GET') {
|
||
const q = url.searchParams
|
||
const query = (q.get('query') ?? '').trim().toLocaleLowerCase()
|
||
const fields = (q.get('fields') ?? 'owner,name,userId').split(',')
|
||
const status = q.get('status') ?? 'all'
|
||
const list = users.filter(item => {
|
||
if (status === 'enabled' && !item.enabled) return false
|
||
if (status === 'disabled' && item.enabled) return false
|
||
if (!query) return true
|
||
const values = (fields.includes('default') ? ['owner', 'name', 'userId'] : fields)
|
||
.map(field => field === 'userId' ? item.userId : field === 'owner' ? item.owner : item.profile[field as 'name'] ?? '')
|
||
return (q.get('mode') ?? 'fuzzy') === 'exact' ? values.some(value => value.toLowerCase() === query) : values.some(value => value.toLowerCase().includes(query))
|
||
})
|
||
return ok(route, { accounts: list, nextCursor: '', directoryVersion: 'd1' })
|
||
}
|
||
if (path === '/api/admin/users' && method === 'POST') {
|
||
const body = request.postDataJSON() as { owner: string; profile: Account['profile'] }
|
||
if (users.some(item => item.owner === body.owner)) return deny(route, 409)
|
||
const created = account(`u-${body.owner}`, body.owner, { ...emptyProfile(), ...body.profile })
|
||
users.push(created)
|
||
return ok(route, created)
|
||
}
|
||
const userMatch = path.match(/^\/api\/admin\/users\/([^/]+)(\/role|\/profile|\/state|\/system-grants)?$/)
|
||
if (userMatch) {
|
||
const user = users.find(item => item.userId === userMatch[1])
|
||
if (!user) return route.fulfill(notFound())
|
||
const sub = userMatch[2] ?? ''
|
||
if (sub === '' && method === 'GET') return ok(route, user)
|
||
if (sub === '/profile' && method === 'PATCH') {
|
||
const body = request.postDataJSON() as { expectedProfileVersion: number; patch: Record<string, string> }
|
||
if (body.expectedProfileVersion !== user.profileVersion) return deny(route, 409)
|
||
user.profile = { ...user.profile, ...body.patch }
|
||
user.profileVersion += 1
|
||
return ok(route, user)
|
||
}
|
||
if (sub === '/state' && method === 'PUT') {
|
||
const body = request.postDataJSON() as { expectedStateVersion: number; enabled: boolean }
|
||
if (body.expectedStateVersion !== user.stateVersion) return deny(route, 409)
|
||
user.enabled = body.enabled
|
||
user.stateVersion += 1
|
||
return ok(route, user)
|
||
}
|
||
if (sub === '/role' && method === 'GET') {
|
||
const role = roles.find(item => item.roleId === bindings[user.userId])
|
||
return ok(route, role ? {
|
||
binding: { bindingId: `b-${user.userId}`, userId: user.userId, roleId: role.roleId, active: true, bindingVersion: 1, assignedBy: 'root', assignedAt: '', userStateVersion: user.stateVersion, authorityEpoch: grantEpoch },
|
||
role,
|
||
} : {})
|
||
}
|
||
if (sub === '/role' && method === 'PUT') {
|
||
const body = request.postDataJSON() as { roleId: string; expectedStateVersion: number }
|
||
if (body.expectedStateVersion !== user.stateVersion) return deny(route, 409)
|
||
bindings[user.userId] = body.roleId
|
||
recount()
|
||
return ok(route, { bindingId: `b-${user.userId}`, userId: user.userId, roleId: body.roleId, active: true, bindingVersion: 2, assignedBy: 'root', assignedAt: '', userStateVersion: user.stateVersion, authorityEpoch: grantEpoch })
|
||
}
|
||
if (sub === '/system-grants' && method === 'GET') {
|
||
return ok(route, grants[user.userId] ?? { actions: [], authorityEpoch: grantEpoch })
|
||
}
|
||
if (sub === '/system-grants' && method === 'PUT') {
|
||
const body = request.postDataJSON() as { actions: string[]; expectedAuthorityEpoch: number }
|
||
if (body.expectedAuthorityEpoch !== (grants[user.userId]?.authorityEpoch ?? grantEpoch)) return deny(route, 409)
|
||
const hadManage = (grants[user.userId]?.actions ?? []).includes('system.permissions.manage')
|
||
if (hadManage && !body.actions.includes('system.permissions.manage')) {
|
||
return route.fulfill({ status: 400, contentType: 'application/json', body: JSON.stringify({ error: 'cannot remove the final permission manager' }) })
|
||
}
|
||
grants[user.userId] = { actions: body.actions, authorityEpoch: ++grantEpoch }
|
||
return ok(route, { receiptId: 'g1', authorityEpoch: grantEpoch })
|
||
}
|
||
}
|
||
// 未点名端点（profiles/plugins/conversations/workspaces 等启动探测）按空列表兜底。
|
||
return route.fulfill({ contentType: 'application/json', body: '[]' })
|
||
},
|
||
}
|
||
}
|
||
|
||
type World = ReturnType<typeof world>
|
||
|
||
async function openAdmin(page: Page, me: Me): Promise<World> {
|
||
const w = world(me)
|
||
await page.route('**/api/**', route => { void w.route(route) })
|
||
await page.goto('/')
|
||
await page.locator('.tsb-user').click()
|
||
await page.getByRole('button', { name: '系统管理…' }).click()
|
||
await expect(page.getByRole('dialog', { name: '系统管理' })).toBeVisible()
|
||
return w
|
||
}
|
||
|
||
const openAdminAsAdmin = (page: Page) => openAdmin(page, { owner: 'root', name: '管理员', auth: true, isAdmin: true, systemActions: [...FULL_ACTIONS] })
|
||
|
||
async function openRolesSection(page: Page) {
|
||
await page.getByRole('button', { name: '角色与权限', exact: true }).click()
|
||
// 面板加载带 180ms 防抖，等待首笔角色清单返回后再交互。
|
||
await expect(page.locator('.rp-role-list button', { hasText: '软件工程师' })).toBeVisible({ timeout: 10_000 })
|
||
await page.getByRole('button', { name: '搜索与过滤' }).click()
|
||
}
|
||
|
||
async function openUsersSection(page: Page) {
|
||
await page.getByRole('button', { name: '用户管理', exact: true }).click()
|
||
await expect(page.locator('tr', { hasText: 'alice' })).toBeVisible({ timeout: 10_000 })
|
||
}
|
||
|
||
const engRow = (page: Page) => page.locator('.rp-role-list button', { hasText: '软件工程师' })
|
||
const reviewRow = (page: Page) => page.locator('.rp-role-list button', { hasText: '审核工程师' })
|
||
|
||
test('DR10 细粒度管理员：仅用户查看权时看不到角色分区，也不发出角色请求', async ({ page }) => {
|
||
const w = await openAdmin(page, { owner: 'mgr', name: '用户管理员', auth: true, isAdmin: false, systemActions: ['system.users.view'] })
|
||
await expect(page.getByRole('button', { name: '用户管理', exact: true })).toBeVisible()
|
||
await expect(page.getByRole('button', { name: '角色与权限', exact: true })).toHaveCount(0)
|
||
await openUsersSection(page)
|
||
await page.locator('tr', { hasText: 'alice' }).getByRole('button', { name: '查看与管理' }).click()
|
||
await expect(page.getByText(/当前角色 无角色查看权限/)).toBeVisible()
|
||
await expect(page.getByLabel('用户生效角色')).toHaveCount(0)
|
||
expect(w.calls.filter(call => call.path.endsWith('/role'))).toEqual([])
|
||
expect(w.calls.filter(call => call.path === '/api/admin/permissions/catalog')).toEqual([])
|
||
})
|
||
|
||
test('DR10 权限管理者无查看权：出现守护提示且不拉取目录', async ({ page }) => {
|
||
const w = await openAdmin(page, { owner: 'mgr', name: '权限管理者', auth: true, isAdmin: false, systemActions: ['system.users.view', 'system.permissions.manage'] })
|
||
await openUsersSection(page)
|
||
await page.locator('tr', { hasText: 'alice' }).getByRole('button', { name: '查看与管理' }).click()
|
||
await expect(page.getByText('需要同时具备系统权限查看权，才能安全编辑现有授权')).toBeVisible()
|
||
await expect(page.getByRole('button', { name: '明确系统权限' })).toHaveCount(0)
|
||
expect(w.calls.filter(call => call.path === '/api/admin/permissions/catalog')).toEqual([])
|
||
})
|
||
|
||
test('DR6 创建带描述的角色，后续修改保持稳定 roleId', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
await openRolesSection(page)
|
||
await page.getByLabel('新角色名称').fill('数据工程师')
|
||
await page.getByLabel('新角色描述').fill('数据管道职位')
|
||
await page.getByRole('button', { name: '创建角色', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('已创建角色 数据工程师')
|
||
await page.getByLabel('角色描述', { exact: true }).fill('数据管道与质量职位')
|
||
await page.getByRole('button', { name: '保存资料', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('角色资料已保存')
|
||
expect(w.calls.filter(call => call.method === 'POST' && call.path === '/api/admin/roles')).toHaveLength(1)
|
||
const patches = w.calls.filter(call => call.method === 'PATCH' && call.path.startsWith('/api/admin/roles/'))
|
||
expect(patches).toHaveLength(1)
|
||
expect(patches[0].path).toBe('/api/admin/roles/role_数据工程师')
|
||
})
|
||
|
||
test('DR6 停用角色需显式确认；取消不发出任何请求', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
await openRolesSection(page)
|
||
await engRow(page).click()
|
||
await page.getByRole('button', { name: '停用角色', exact: true }).click()
|
||
const dialog = page.getByRole('alertdialog', { name: '确认停用角色 软件工程师' })
|
||
await expect(dialog).toContainText('软件工程师')
|
||
await expect(dialog).toContainText('2 个用户绑定')
|
||
await expect(dialog).toContainText('不再授予权限')
|
||
await dialog.getByRole('button', { name: '取消', exact: true }).click()
|
||
await expect(dialog).toHaveCount(0)
|
||
expect(w.calls.filter(call => call.method === 'PATCH' && call.path === '/api/admin/roles/role_eng')).toEqual([])
|
||
await page.getByRole('button', { name: '停用角色', exact: true }).click()
|
||
await page.getByRole('alertdialog').getByRole('button', { name: '确认停用', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('角色已停用，现有绑定不再授予权限')
|
||
const patches = w.calls.filter(call => call.method === 'PATCH' && call.path === '/api/admin/roles/role_eng')
|
||
expect(patches).toHaveLength(1)
|
||
expect(patches[0].body).toMatchObject({ expectedRoleVersion: 3, enabled: false })
|
||
})
|
||
|
||
test('DR6 停用版本冲突：刷新最新状态并保留重试上下文', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
await openRolesSection(page)
|
||
await engRow(page).click()
|
||
// 并发方先推进版本，首次确认停用必然 409。
|
||
w.roles.find(role => role.roleId === 'role_eng')!.roleVersion = 4
|
||
await page.getByRole('button', { name: '停用角色', exact: true }).click()
|
||
await page.getByRole('alertdialog').getByRole('button', { name: '确认停用', exact: true }).click()
|
||
await expect(page.getByRole('alert')).toContainText('角色状态版本冲突')
|
||
await page.getByRole('button', { name: '停用角色', exact: true }).click()
|
||
await page.getByRole('alertdialog').getByRole('button', { name: '确认停用', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('角色已停用')
|
||
const patches = w.calls.filter(call => call.method === 'PATCH' && call.path === '/api/admin/roles/role_eng')
|
||
expect(patches).toHaveLength(2)
|
||
expect(patches[0].body).toMatchObject({ expectedRoleVersion: 3 })
|
||
expect(patches[1].body).toMatchObject({ expectedRoleVersion: 4 })
|
||
expect(w.calls.some(call => call.method === 'GET' && call.path === '/api/admin/roles/role_eng')).toBe(true)
|
||
})
|
||
|
||
test('DR9 过滤、翻页与视图切换按 roleId 保留草稿且永不串角色', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
await openRolesSection(page)
|
||
await engRow(page).click()
|
||
await page.getByLabel('编制文档 默认允许').check()
|
||
await expect(page.getByText('变更预览（1）')).toBeVisible()
|
||
// 切到第二页的审核工程师：不带走软件工程师的草稿。
|
||
await page.getByRole('button', { name: '下一页角色', exact: true }).click()
|
||
await reviewRow(page).click()
|
||
await expect(page.getByText('变更预览（0）')).toBeVisible()
|
||
await expect(page.getByLabel('编制文档 默认允许')).not.toBeChecked()
|
||
// 切回软件工程师：草稿原样保留。
|
||
await page.getByRole('button', { name: '上一页角色', exact: true }).click()
|
||
await engRow(page).click()
|
||
await expect(page.getByText('变更预览（1）')).toBeVisible()
|
||
await expect(page.getByLabel('编制文档 默认允许')).toBeChecked()
|
||
// 状态过滤触发重载：草稿仍在。
|
||
await page.getByLabel('角色状态').selectOption('disabled')
|
||
await expect(reviewRow(page)).toBeVisible()
|
||
await page.getByLabel('角色状态').selectOption('all')
|
||
await engRow(page).click()
|
||
await expect(page.getByLabel('编制文档 默认允许')).toBeChecked()
|
||
// 单角色 ↔ 矩阵切换保留；矩阵中当前角色的勾选状态一致。
|
||
await page.getByRole('button', { name: '角色矩阵', exact: true }).click()
|
||
await expect(page.getByLabel('软件工程师 编制文档 默认允许')).toBeChecked()
|
||
await page.getByRole('button', { name: '单角色配置', exact: true }).click()
|
||
await expect(page.getByLabel('编制文档 默认允许')).toBeChecked()
|
||
expect(w.calls.filter(call => call.path === '/api/admin/roles/role_ops')).toEqual([])
|
||
})
|
||
|
||
test('DR9 离开管理区须显式决定；确认离开后草稿被放弃', async ({ page }) => {
|
||
await openAdminAsAdmin(page)
|
||
await openRolesSection(page)
|
||
await engRow(page).click()
|
||
await page.getByLabel('编制文档 默认允许').check()
|
||
const dialogs: string[] = []
|
||
let leave = false
|
||
page.on('dialog', async dialog => {
|
||
dialogs.push(dialog.message())
|
||
if (dialog.type() === 'confirm') leave ? await dialog.accept() : await dialog.dismiss()
|
||
else await dialog.accept()
|
||
})
|
||
await page.getByRole('button', { name: '返回工作台' }).click()
|
||
expect(dialogs).toHaveLength(1)
|
||
expect(dialogs[0]).toContain('软件工程师')
|
||
await expect(page.getByRole('dialog', { name: '系统管理' })).toBeVisible()
|
||
leave = true
|
||
await page.getByRole('button', { name: '返回工作台' }).click()
|
||
await expect(page.getByRole('dialog', { name: '系统管理' })).toHaveCount(0)
|
||
// 重新进入后草稿不复存在（离开即放弃）。
|
||
await page.locator('.tsb-user').click()
|
||
await page.getByRole('button', { name: '系统管理…' }).click()
|
||
await openRolesSection(page)
|
||
await engRow(page).click()
|
||
await expect(page.getByText('变更预览（0）')).toBeVisible()
|
||
})
|
||
|
||
test('DR9 409 只重放同一角色草稿；另一角色草稿不受影响', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
await openRolesSection(page)
|
||
await engRow(page).click()
|
||
await page.getByLabel('编制文档 默认允许').check()
|
||
await page.getByRole('button', { name: '下一页角色', exact: true }).click()
|
||
await reviewRow(page).click()
|
||
await page.getByLabel('批准文档 默认允许').check()
|
||
// 切回软件工程师再保存：并发方已推进版本并改变服务端基线，保存触发 409 rebase。
|
||
await page.getByRole('button', { name: '上一页角色', exact: true }).click()
|
||
await engRow(page).click()
|
||
const eng = w.roles.find(role => role.roleId === 'role_eng')!
|
||
eng.roleVersion = 4
|
||
eng.permissions = [rp('project.create', false, false), rp('document.read', true, true)]
|
||
await page.getByRole('button', { name: '保存权限', exact: true }).click()
|
||
await expect(page.getByRole('alert')).toContainText('权限版本冲突；已基于最新版本重放本地草稿')
|
||
expect(w.calls.filter(call => call.method === 'GET' && call.path === '/api/admin/roles/role_review')).toEqual([])
|
||
// 重放后：本地对编制文档的修改保留；再次保存基于最新版本成功。
|
||
await expect(page.getByLabel('编制文档 默认允许')).toBeChecked()
|
||
await page.getByRole('button', { name: '保存权限', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('角色权限已保存')
|
||
const puts = w.calls.filter(call => call.method === 'PUT' && call.path === '/api/admin/roles/role_eng/permissions')
|
||
expect(puts).toHaveLength(2)
|
||
expect(puts[0].body).toMatchObject({ expectedRoleVersion: 3 })
|
||
expect(puts[1].body).toMatchObject({ expectedRoleVersion: 4 })
|
||
expect((puts[1].body!.changes as { actionId: string; allowed: boolean }[]).find(change => change.actionId === 'document.author')).toMatchObject({ allowed: true, capAllowed: true })
|
||
// 审核工程师的草稿未被动过：切回后仍在。
|
||
await page.getByRole('button', { name: '下一页角色', exact: true }).click()
|
||
await reviewRow(page).click()
|
||
await expect(page.getByLabel('批准文档 默认允许')).toBeChecked()
|
||
})
|
||
|
||
test('DR9 矩阵批量编辑只作用于当前可见页', async ({ page }) => {
|
||
await openAdminAsAdmin(page)
|
||
await openRolesSection(page)
|
||
await page.getByRole('button', { name: '角色矩阵', exact: true }).click()
|
||
await page.locator('.rp-matrix button', { hasText: '软件工程师' }).click()
|
||
await page.getByRole('button', { name: '当前页默认全选', exact: true }).click()
|
||
for (const label of ['创建项目', '管理项目成员', '设置项目覆盖', '读取文档', '编制文档', '批准文档']) {
|
||
await expect(page.getByLabel(`软件工程师 ${label} 默认允许`)).toBeChecked()
|
||
}
|
||
await page.getByRole('button', { name: '下一组', exact: true }).click()
|
||
await expect(page.getByLabel('软件工程师 创建导出 默认允许')).not.toBeChecked()
|
||
await page.getByRole('button', { name: '上一组', exact: true }).click()
|
||
await page.getByRole('button', { name: '当前页上限关闭', exact: true }).click()
|
||
await expect(page.getByLabel('软件工程师 创建项目 默认允许')).not.toBeChecked()
|
||
// 变更预览在单角色视图：批量编辑按 roleId 保留，切回可见 2 项相对基线变化。
|
||
await page.getByRole('button', { name: '单角色配置', exact: true }).click()
|
||
await expect(page.getByText('变更预览（2）')).toBeVisible()
|
||
})
|
||
|
||
test('DR10 角色清单失败不拖垮目录加载，可经检索重试恢复', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
w.failNextTimes('/api/admin/roles', 1)
|
||
await page.getByRole('button', { name: '角色与权限', exact: true }).click()
|
||
await expect(page.getByRole('alert')).toContainText('500')
|
||
// 目录请求独立发出并成功（互不拖垮）。
|
||
expect(w.calls.some(call => call.path === '/api/admin/permissions/catalog')).toBe(true)
|
||
await page.getByRole('button', { name: '搜索与过滤' }).click()
|
||
await page.getByLabel('搜索角色').fill('软件')
|
||
await expect(page.locator('.rp-role-list button', { hasText: '软件工程师' })).toBeVisible({ timeout: 10_000 })
|
||
await expect(page.getByRole('alert')).toHaveCount(0)
|
||
})
|
||
|
||
test('DR10 权限目录失败不影响角色列表呈现', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
w.failNextTimes('/api/admin/permissions/catalog', 1)
|
||
await page.getByRole('button', { name: '角色与权限', exact: true }).click()
|
||
await expect(page.getByRole('alert')).toContainText('权限目录加载失败')
|
||
await expect(page.locator('.rp-role-list button', { hasText: '软件工程师' })).toBeVisible()
|
||
expect(w.calls.some(call => call.path === '/api/admin/roles')).toBe(true)
|
||
})
|
||
|
||
test('DR10 键盘完成核心流程，保存后焦点稳定且状态可被播报', async ({ page }) => {
|
||
await openAdminAsAdmin(page)
|
||
await openRolesSection(page)
|
||
await engRow(page).focus()
|
||
await page.keyboard.press('Enter')
|
||
await expect(page.getByLabel('角色名称', { exact: true })).toHaveValue('软件工程师')
|
||
await page.getByLabel('编制文档 默认允许').focus()
|
||
await page.keyboard.press('Space')
|
||
await expect(page.getByLabel('编制文档 默认允许')).toBeChecked()
|
||
await page.getByRole('button', { name: '保存权限', exact: true }).focus()
|
||
await page.keyboard.press('Enter')
|
||
await expect(page.getByRole('status')).toContainText('角色权限已保存')
|
||
const focused = await page.evaluate(() => (document.activeElement as HTMLElement | null)?.textContent ?? '')
|
||
expect(focused).toContain('保存权限')
|
||
})
|
||
|
||
test('DR10 窄屏矩阵横向可导航且可操作', async ({ page }) => {
|
||
await openAdminAsAdmin(page)
|
||
await page.setViewportSize({ width: 480, height: 800 })
|
||
await openRolesSection(page)
|
||
// 窄屏下视图切换按钮存在持续的布局微抖动，Playwright 稳定性检查无法通过；
|
||
// 用 DOM 事件切换视图，随后的横向滚动与勾选仍是真实交互。
|
||
await page.getByRole('button', { name: '角色矩阵', exact: true }).dispatchEvent('click')
|
||
const wrap = page.locator('.rp-matrix-wrap')
|
||
await expect(wrap).toBeVisible()
|
||
const scroll = await wrap.evaluate(el => ({ sw: el.scrollWidth, cw: el.clientWidth }))
|
||
expect(scroll.sw).toBeGreaterThan(scroll.cw)
|
||
await page.getByLabel('软件工程师 创建项目 默认允许').check()
|
||
await expect(page.getByLabel('软件工程师 创建项目 默认允许')).toBeChecked()
|
||
})
|
||
|
||
test('DR7 两人共享同一角色；换绑后仅一个生效角色且计数随之变化', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
await openUsersSection(page)
|
||
const openUser = async (owner: string) => {
|
||
await page.locator('tr', { hasText: owner }).getByRole('button', { name: '查看与管理' }).click()
|
||
await expect(page.getByRole('button', { name: '返回列表' })).toBeVisible()
|
||
}
|
||
await openUser('bob')
|
||
await page.getByLabel('用户生效角色').selectOption({ label: '软件工程师' })
|
||
await page.getByRole('button', { name: '替换角色', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('用户角色已替换')
|
||
expect(w.bindings.u2).toBe('role_eng')
|
||
await page.getByRole('button', { name: '返回列表', exact: true }).click()
|
||
await openUser('alice')
|
||
await expect(page.getByText(/当前角色 软件工程师/)).toBeVisible()
|
||
await page.getByLabel('用户生效角色').selectOption({ label: '运维工程师' })
|
||
await page.getByRole('button', { name: '替换角色', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('用户角色已替换')
|
||
expect(w.bindings.u1).toBe('role_ops')
|
||
expect(w.roles.find(role => role.roleId === 'role_eng')!.bindingCount).toBe(2) // bob + carol
|
||
// 用户角色视图始终单角色：GET /role 只返回一个 binding。
|
||
expect(w.calls.filter(call => call.method === 'GET' && call.path === '/api/admin/users/u1/role').length).toBeGreaterThan(0)
|
||
})
|
||
|
||
test('DR8 资料可全空创建，并支持按电话等字段检索', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
await openUsersSection(page)
|
||
await page.getByLabel('新用户登录名').fill('dave')
|
||
await page.getByRole('button', { name: '创建用户', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('已创建 dave')
|
||
const created = w.calls.find(call => call.method === 'POST' && call.path === '/api/admin/users')
|
||
expect(created!.body!.profile).toEqual(emptyProfile())
|
||
await page.getByRole('button', { name: '返回列表', exact: true }).click()
|
||
await page.getByLabel('用户搜索字段').selectOption({ label: '电话' })
|
||
await page.getByLabel('搜索用户').fill('13800000001')
|
||
await expect(page.locator('tr', { hasText: 'alice' })).toBeVisible({ timeout: 10_000 })
|
||
await expect(page.locator('tr', { hasText: 'carol' })).toHaveCount(0)
|
||
const searches = w.calls.filter(call => call.method === 'GET' && call.path === '/api/admin/users/search')
|
||
expect(searches.at(-1)!.query.fields).toContain('phone')
|
||
})
|
||
|
||
test('DR10 加载与空态：加载期间无结果无报错，过滤为空给出选择提示', async ({ page }) => {
|
||
const w = await openAdminAsAdmin(page)
|
||
await page.getByRole('button', { name: '角色与权限', exact: true }).click()
|
||
await expect(page.locator('.rp-role-list button', { hasText: '软件工程师' })).toBeVisible({ timeout: 10_000 })
|
||
await page.getByRole('button', { name: '搜索与过滤' }).click()
|
||
const pending = w.hold('GET /api/admin/roles')
|
||
await page.getByLabel('搜索角色').fill('不存在的角色')
|
||
await pending.started.promise
|
||
await expect(page.locator('.rp-role-list button').first()).toBeDisabled()
|
||
await expect(page.getByRole('alert')).toHaveCount(0)
|
||
pending.release.resolve()
|
||
await expect(page.locator('.rp-role-list button')).toHaveCount(0)
|
||
await expect(page.getByText('请选择角色')).toBeVisible()
|
||
})
|
||
|
||
// ── 活体层（IAM_E2E_LIVE=1）：同一文件在真实 Backend/RDM 组合上运行真实授权路径。
|
||
// 由 Agent-System-RDM scripts/iam-u4-role-acceptance.sh 物化冻结候选源码、
|
||
// 构建内嵌产品、全新 SQLite 数据根与随机回环端口后驱动；不拦截任何路由。
|
||
const LIVE = process.env.IAM_E2E_LIVE === '1'
|
||
|
||
async function liveLogin(page: Page) {
|
||
await page.goto('/')
|
||
await page.getByPlaceholder('由管理员分配').fill(process.env.IAM_E2E_OWNER ?? '')
|
||
await page.getByPlaceholder('初始密码或常用密码').fill(process.env.IAM_E2E_PASSWORD ?? '')
|
||
await page.getByRole('button', { name: '登录', exact: true }).click()
|
||
await expect(page.locator('.tsb-user')).toBeVisible({ timeout: 15_000 })
|
||
}
|
||
|
||
async function openAdminZoneLive(page: Page) {
|
||
await page.locator('.tsb-user').click()
|
||
await page.getByRole('button', { name: '系统管理…' }).click()
|
||
await expect(page.getByRole('dialog', { name: '系统管理' })).toBeVisible()
|
||
}
|
||
|
||
test('LIVE 真实登录加载真实权限目录，创建、配置并停用角色', async ({ page }) => {
|
||
test.skip(!LIVE, 'live 层由 iam-u4-role-acceptance.sh 驱动')
|
||
test.setTimeout(90_000)
|
||
await liveLogin(page)
|
||
await openAdminZoneLive(page)
|
||
await page.getByRole('button', { name: '角色与权限', exact: true }).click()
|
||
await page.getByRole('button', { name: '搜索与过滤' }).click()
|
||
await expect(page.getByLabel('新角色名称')).toBeVisible({ timeout: 15_000 })
|
||
// 真实空库无角色：先经真实 Backend 创建，选中后权限表才渲染真实目录。
|
||
await page.getByLabel('新角色名称').fill('数据工程师')
|
||
await page.getByLabel('新角色描述').fill('活体验收职位')
|
||
await page.getByRole('button', { name: '创建角色', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('已创建角色 数据工程师', { timeout: 15_000 })
|
||
// 真实目录的首页可能全是受保护系统授权（复选框禁用）：逐组翻到可编辑动作。
|
||
const firstDefault = page.locator('input[aria-label$="默认允许"]:not([disabled])').first()
|
||
for (let pageIdx = 0; (await firstDefault.count()) === 0 && pageIdx < 15; pageIdx++) {
|
||
await page.getByRole('button', { name: '下一组', exact: true }).click()
|
||
await page.waitForTimeout(150)
|
||
}
|
||
await expect(firstDefault).toBeVisible({ timeout: 15_000 })
|
||
await firstDefault.check()
|
||
await page.getByRole('button', { name: '保存权限', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('角色权限已保存', { timeout: 15_000 })
|
||
await page.getByRole('button', { name: '停用角色', exact: true }).click()
|
||
await expect(page.getByRole('alertdialog')).toContainText('数据工程师')
|
||
await page.getByRole('alertdialog').getByRole('button', { name: '确认停用', exact: true }).click()
|
||
await expect(page.getByRole('status')).toContainText('角色已停用，现有绑定不再授予权限', { timeout: 15_000 })
|
||
})
|
||
|
||
test('LIVE DR13 非成员账号被拒读取项目业务内容；创建者放行', async ({ request }) => {
|
||
test.skip(!LIVE, 'live 层由 iam-u4-role-acceptance.sh 驱动')
|
||
const base = process.env.PLAYWRIGHT_BASE_URL!
|
||
const projectId = process.env.IAM_E2E_PROJECT_ID
|
||
test.expect(projectId).toBeTruthy()
|
||
const memberList = async (owner: string, password: string) => {
|
||
await request.post(`${base}/api/auth/login`, { data: { owner, password } })
|
||
const res = await request.post(`${base}/api/commands/rdm.project.member.list`, {
|
||
data: { params: { projectId } },
|
||
})
|
||
const body = await res.json().catch(() => null)
|
||
return { ok: res.ok(), body }
|
||
}
|
||
const observer = await memberList(process.env.IAM_E2E_OBSERVER_OWNER ?? '', process.env.IAM_E2E_OBSERVER_PASSWORD ?? '')
|
||
const denied = !observer.ok || observer.body?.receipt?.state === 'rejected'
|
||
expect(denied, `observer 应被拒绝：${JSON.stringify(observer.body).slice(0, 240)}`).toBe(true)
|
||
const creator = await memberList(process.env.IAM_E2E_OWNER ?? '', process.env.IAM_E2E_PASSWORD ?? '')
|
||
const allowed = creator.ok && creator.body?.receipt?.state !== 'rejected'
|
||
expect(allowed, `创建者应放行：${JSON.stringify(creator.body).slice(0, 240)}`).toBe(true)
|
||
})
|