weichen
a9c9a9182e
- Server no longer mirrors app.Runtime services (gov/svc/pwSvc/...): 574 call sites now use accessors in runtime_accessors.go - backgroundLoop (mutex+sync.Once) stops sweeper/publisher/reminder/wsGC goroutines race-free (baseline44161d2areproduced DATA RACE; now green under -race) - goose 00071 duplicate (dialogue merge1da17a28brought two 00071): context-conflict-adjudications renumbered to 00072; dev DB applied only through 00070 so zero data migration - task_finalize tests build minimal app.Runtime; test injection via serverTestOverrides + setOverride* (explicit-nil markers for fail-closed cases)
50 lines
1.6 KiB
Go
50 lines
1.6 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"chat-agent-system/internal/auth"
|
|
"chat-agent-system/internal/authz"
|
|
"chat-agent-system/internal/docrevision"
|
|
)
|
|
|
|
func TestAuthorizeDocRevision_ReviewerAndNonMemberCannotWrite(t *testing.T) {
|
|
srv := newTestServer(t)
|
|
// 隔离写权门闩：跳过项目成员库检查，只验证 AuthorID。禁止依赖共享库或默认拒绝。
|
|
srv.cfg.AllowInMemory = true
|
|
srv.setOverrideAuthorizer(authz.NewAuthorizer(nil))
|
|
ctx := context.Background()
|
|
const (
|
|
authorID int64 = 170
|
|
reviewerID int64 = 171
|
|
strangerID int64 = 99
|
|
docID = "doc_proj_duty_write"
|
|
)
|
|
if _, err := srv.gov().CreateOrGetDocument(
|
|
ctx, docID, 6145, "intake", "摸底", "V0.1", "",
|
|
authorID, "编制人A", reviewerID, "审核人B", 0, "",
|
|
); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ref := &docRevisionRef{
|
|
Kind: "controlled", ProjectID: 6145, LifecycleState: "drafting", AuthorID: authorID,
|
|
}
|
|
|
|
author := &auth.UserAccount{ID: authorID, Name: "编制人A"}
|
|
if err := srv.authorizeDocRevision(ctx, author, ref, true); err != nil {
|
|
t.Fatalf("author write must succeed, got %v", err)
|
|
}
|
|
|
|
reviewer := &auth.UserAccount{ID: reviewerID, Name: "审核人B"}
|
|
if err := srv.authorizeDocRevision(ctx, reviewer, ref, true); !errors.Is(err, docrevision.ErrForbidden) {
|
|
t.Fatalf("reviewer write want docrevision.ErrForbidden, got %v", err)
|
|
}
|
|
|
|
stranger := &auth.UserAccount{ID: strangerID, Name: "局外人C"}
|
|
if err := srv.authorizeDocRevision(ctx, stranger, ref, true); !errors.Is(err, docrevision.ErrForbidden) {
|
|
t.Fatalf("outsider write want docrevision.ErrForbidden, got %v", err)
|
|
}
|
|
}
|