weichenandCursor
4512132b20
Omit project_role no longer defaults to member. Exclusive duty writes take an advisory lock and retry conflicts so last-writer wins without dual reviewers. Author write tests require err==nil. Co-authored-by: Cursor <cursoragent@cursor.com>
50 lines
1.6 KiB
Go
50 lines
1.6 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
"chat-agent-system/internal/authz"
|
|
"chat-agent-system/internal/docrevision"
|
|
)
|
|
|
|
func TestAuthorizeDocRevision_ReviewerAndNonMemberCannotWrite(t *testing.T) {
|
|
srv := newTestServer(t)
|
|
// 隔离写权门闩：跳过项目成员库检查，只验证 AuthorID。禁止依赖共享库或默认拒绝。
|
|
srv.cfg.AllowInMemory = true
|
|
srv.authorizer = authz.NewAuthorizer(nil)
|
|
ctx := context.Background()
|
|
const (
|
|
authorID int64 = 170
|
|
reviewerID int64 = 171
|
|
strangerID int64 = 99
|
|
docID = "doc_proj_duty_write"
|
|
)
|
|
if _, err := srv.svc.DocGov().CreateOrGetDocument(
|
|
ctx, docID, 6145, "intake", "摸底", "V0.1", "",
|
|
authorID, "编制人A", reviewerID, "审核人B", 0, "",
|
|
); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ref := &docRevisionRef{
|
|
Kind: "controlled", ProjectID: 6145, LifecycleState: "drafting", AuthorID: authorID,
|
|
}
|
|
|
|
author := &auth.UserAccount{ID: authorID, Name: "编制人A"}
|
|
if err := srv.authorizeDocRevision(ctx, author, ref, true); err != nil {
|
|
t.Fatalf("author write must succeed, got %v", err)
|
|
}
|
|
|
|
reviewer := &auth.UserAccount{ID: reviewerID, Name: "审核人B"}
|
|
if err := srv.authorizeDocRevision(ctx, reviewer, ref, true); !errors.Is(err, docrevision.ErrForbidden) {
|
|
t.Fatalf("reviewer write want docrevision.ErrForbidden, got %v", err)
|
|
}
|
|
|
|
stranger := &auth.UserAccount{ID: strangerID, Name: "局外人C"}
|
|
if err := srv.authorizeDocRevision(ctx, stranger, ref, true); !errors.Is(err, docrevision.ErrForbidden) {
|
|
t.Fatalf("outsider write want docrevision.ErrForbidden, got %v", err)
|
|
}
|
|
}
|