weichenandCursor
f189ce9ff9
Do not ignore role promotion errors when ensuring the configured admin account holds role-admin; cover success and failure with unit tests. Co-authored-by: Cursor <cursoragent@cursor.com>
95 lines
2.7 KiB
Go
95 lines
2.7 KiB
Go
package auth_test
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
"chat-agent-system/internal/config"
|
|
)
|
|
|
|
// failRoleStore wraps MemoryStore and forces UpdateUserRole to fail.
|
|
type failRoleStore struct {
|
|
*auth.MemoryStore
|
|
failRole bool
|
|
}
|
|
|
|
func (s *failRoleStore) UpdateUserRole(ctx context.Context, id int64, roleID, position string) (*auth.UserAccount, error) {
|
|
if s.failRole {
|
|
return nil, errors.New("forced UpdateUserRole failure")
|
|
}
|
|
return s.MemoryStore.UpdateUserRole(ctx, id, roleID, position)
|
|
}
|
|
|
|
func TestBootstrapAdminFromConfig_PromotesExistingUserToAdmin(t *testing.T) {
|
|
cfg := &config.Config{
|
|
AdminUsername: "opsadmin",
|
|
AdminPassword: "bootstrap-pass-999",
|
|
Env: "dev",
|
|
}
|
|
base := auth.NewMemoryStore(&config.Config{Env: "dev", AdminUsername: "other", AdminPassword: "x"})
|
|
ctx := context.Background()
|
|
created, err := base.CreateUser(ctx, &auth.UserAccount{
|
|
Username: "opsadmin",
|
|
Name: "临时账号",
|
|
PasswordHash: "hash",
|
|
Status: auth.StatusActive,
|
|
RoleID: "role-guest",
|
|
Position: "访客/待指派",
|
|
EmployeeID: "TMP-1",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("CreateUser: %v", err)
|
|
}
|
|
if created.RoleID == "role-admin" {
|
|
t.Fatal("precondition: seed must not already be role-admin")
|
|
}
|
|
|
|
if err := auth.BootstrapAdminFromConfig(ctx, base, cfg); err != nil {
|
|
t.Fatalf("BootstrapAdminFromConfig: %v", err)
|
|
}
|
|
got, err := base.GetUserByUsername(ctx, "opsadmin")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got.RoleID != "role-admin" {
|
|
t.Fatalf("want role-admin after bootstrap, got %s", got.RoleID)
|
|
}
|
|
if got.Position != "系统管理员" {
|
|
t.Fatalf("want 系统管理员 position, got %s", got.Position)
|
|
}
|
|
}
|
|
|
|
func TestBootstrapAdminFromConfig_UpdateUserRoleErrorNotSwallowed(t *testing.T) {
|
|
cfg := &config.Config{
|
|
AdminUsername: "opsadmin2",
|
|
AdminPassword: "bootstrap-pass-999",
|
|
Env: "dev",
|
|
}
|
|
base := auth.NewMemoryStore(&config.Config{Env: "dev", AdminUsername: "other", AdminPassword: "x"})
|
|
ctx := context.Background()
|
|
_, err := base.CreateUser(ctx, &auth.UserAccount{
|
|
Username: "opsadmin2",
|
|
Name: "临时账号",
|
|
PasswordHash: "hash",
|
|
Status: auth.StatusActive,
|
|
RoleID: "role-guest",
|
|
Position: "访客/待指派",
|
|
EmployeeID: "TMP-2",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("CreateUser: %v", err)
|
|
}
|
|
|
|
wrapped := &failRoleStore{MemoryStore: base, failRole: true}
|
|
err = auth.BootstrapAdminFromConfig(ctx, wrapped, cfg)
|
|
if err == nil {
|
|
t.Fatal("expected BootstrapAdminFromConfig to surface UpdateUserRole error")
|
|
}
|
|
if !strings.Contains(err.Error(), "UpdateUserRole") {
|
|
t.Fatalf("error should mention UpdateUserRole, got %v", err)
|
|
}
|
|
}
|