weichen
6a3a0dc201
- FIND-SEC-01: GetUserContext requires session ownership (handler 403 + SQL/memory owner filter); in-memory HTTP + isolated-PG regressions - FIND-ARCH-01: archtest fails closed on untracked table writes (+noise exemption) and registers 50 existing writer tables in table_owners - FIND-SEC-02: Authorizer without pool denies by default; explicit NewInMemoryAuthorizer seam opt-in via ALLOW_IN_MEMORY at composition - FIND-SEC-03: swboot commands run argv-exec (no sh -c) with exact basename allowlist match; prefix-spoof and no-shell-eval tests - FIND-FLOW-01: confirm rejects validated_only plans; ExecuteClaimed hard-refuses validated_only steps (new error codes + HTTP mapping) - FIND-QUAL-01: intentflow.ValidateFlagConsistency fail-fast at Assemble
51 lines
1.7 KiB
Go
51 lines
1.7 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
"chat-agent-system/internal/authz"
|
|
"chat-agent-system/internal/docrevision"
|
|
)
|
|
|
|
func TestAuthorizeDocRevision_ReviewerAndNonMemberCannotWrite(t *testing.T) {
|
|
srv := newTestServer(t)
|
|
// 隔离写权门闩：跳过项目成员库检查，只验证 AuthorID。禁止依赖共享库或默认拒绝。
|
|
// FIND-SEC-02 后 NewAuthorizer(nil) 严格拒绝，改用显式内存授权接缝。
|
|
srv.cfg.AllowInMemory = true
|
|
srv.setOverrideAuthorizer(authz.NewInMemoryAuthorizer())
|
|
ctx := context.Background()
|
|
const (
|
|
authorID int64 = 170
|
|
reviewerID int64 = 171
|
|
strangerID int64 = 99
|
|
docID = "doc_proj_duty_write"
|
|
)
|
|
if _, err := srv.gov().CreateOrGetDocument(
|
|
ctx, docID, 6145, "intake", "摸底", "V0.1", "",
|
|
authorID, "编制人A", reviewerID, "审核人B", 0, "",
|
|
); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ref := &docRevisionRef{
|
|
Kind: "controlled", ProjectID: 6145, LifecycleState: "drafting", AuthorID: authorID,
|
|
}
|
|
|
|
author := &auth.UserAccount{ID: authorID, Name: "编制人A"}
|
|
if err := srv.authorizeDocRevision(ctx, author, ref, true); err != nil {
|
|
t.Fatalf("author write must succeed, got %v", err)
|
|
}
|
|
|
|
reviewer := &auth.UserAccount{ID: reviewerID, Name: "审核人B"}
|
|
if err := srv.authorizeDocRevision(ctx, reviewer, ref, true); !errors.Is(err, docrevision.ErrForbidden) {
|
|
t.Fatalf("reviewer write want docrevision.ErrForbidden, got %v", err)
|
|
}
|
|
|
|
stranger := &auth.UserAccount{ID: strangerID, Name: "局外人C"}
|
|
if err := srv.authorizeDocRevision(ctx, stranger, ref, true); !errors.Is(err, docrevision.ErrForbidden) {
|
|
t.Fatalf("outsider write want docrevision.ErrForbidden, got %v", err)
|
|
}
|
|
}
|