refactor(auth): 移除 RO/RW 权限机制并完善配置历史

- 删除 GrantPermissons 与 buildPermissionCode，权限只判断超管、组管理员和应用负责人 - GetHistory 增加权限校验，避免越权读取配置历史 - 配置历史改为分页查询，前端历史弹窗增加分页并处理删除后的页码回退
2026-09-16 21:11:09 +08:00
parent af3cf2f6e6
commit 1f8cae5a8b
8 changed files with 217 additions and 54 deletions
@@ -0,0 +1,93 @@
+package service
+
+import (
+	"testing"
+
+	"kenaito-conf/server/internal/model"
+)
+
+func TestRequirePermission(t *testing.T) {
+	svc := NewPermissionService()
+	groupID := 1
+	otherGroupID := 2
+	appID := 10
+
+	tests := []struct {
+		name    string
+		user    *model.LoginUserInfo
+		groupId *int
+		appId   *int
+		wantErr bool
+	}{
+		{
+			name:    "super admin can access anything",
+			user:    &model.LoginUserInfo{Type: "superAdmin"},
+			groupId: &groupID,
+			appId:   &appID,
+		},
+		{
+			name:    "group admin can access own group",
+			user:    &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
+			groupId: &groupID,
+			appId:   &appID,
+		},
+		{
+			name:    "group admin cannot access other group",
+			user:    &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
+			groupId: &otherGroupID,
+			appId:   &appID,
+			wantErr: true,
+		},
+		{
+			name:    "owner can access app",
+			user:    &model.LoginUserInfo{Type: "user", GroupId: &groupID, GrantAppIds: []int{appID}},
+			groupId: &groupID,
+			appId:   &appID,
+		},
+		{
+			name:    "owner can access app across group",
+			user:    &model.LoginUserInfo{Type: "user", GroupId: &otherGroupID, GrantAppIds: []int{appID}},
+			groupId: &groupID,
+			appId:   &appID,
+		},
+		{
+			name:    "normal group member cannot access app without ownership",
+			user:    &model.LoginUserInfo{Type: "user", GroupId: &groupID},
+			groupId: &groupID,
+			appId:   &appID,
+			wantErr: true,
+		},
+		{
+			name:    "normal user cannot access global config",
+			user:    &model.LoginUserInfo{Type: "user", GroupId: &groupID},
+			groupId: &groupID,
+			appId:   nil,
+			wantErr: true,
+		},
+		{
+			name:    "group admin can access own global config",
+			user:    &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
+			groupId: &groupID,
+			appId:   nil,
+		},
+		{
+			name:    "group admin cannot access other global config",
+			user:    &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
+			groupId: &otherGroupID,
+			appId:   nil,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := svc.RequirePermission(tt.user, tt.groupId, tt.appId)
+			if tt.wantErr && err == nil {
+				t.Fatalf("expected an error, got nil")
+			}
+			if !tt.wantErr && err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}