odboy
1f8cae5a8b
- 删除 GrantPermissons 与 buildPermissionCode，权限只判断超管、组管理员和应用负责人 - GetHistory 增加权限校验，避免越权读取配置历史 - 配置历史改为分页查询，前端历史弹窗增加分页并处理删除后的页码回退
94 lines
2.3 KiB
Go
94 lines
2.3 KiB
Go
package service
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"kenaito-conf/server/internal/model"
|
|
)
|
|
|
|
func TestRequirePermission(t *testing.T) {
|
|
svc := NewPermissionService()
|
|
groupID := 1
|
|
otherGroupID := 2
|
|
appID := 10
|
|
|
|
tests := []struct {
|
|
name string
|
|
user *model.LoginUserInfo
|
|
groupId *int
|
|
appId *int
|
|
wantErr bool
|
|
}{
|
|
{
|
|
name: "super admin can access anything",
|
|
user: &model.LoginUserInfo{Type: "superAdmin"},
|
|
groupId: &groupID,
|
|
appId: &appID,
|
|
},
|
|
{
|
|
name: "group admin can access own group",
|
|
user: &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
|
|
groupId: &groupID,
|
|
appId: &appID,
|
|
},
|
|
{
|
|
name: "group admin cannot access other group",
|
|
user: &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
|
|
groupId: &otherGroupID,
|
|
appId: &appID,
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "owner can access app",
|
|
user: &model.LoginUserInfo{Type: "user", GroupId: &groupID, GrantAppIds: []int{appID}},
|
|
groupId: &groupID,
|
|
appId: &appID,
|
|
},
|
|
{
|
|
name: "owner can access app across group",
|
|
user: &model.LoginUserInfo{Type: "user", GroupId: &otherGroupID, GrantAppIds: []int{appID}},
|
|
groupId: &groupID,
|
|
appId: &appID,
|
|
},
|
|
{
|
|
name: "normal group member cannot access app without ownership",
|
|
user: &model.LoginUserInfo{Type: "user", GroupId: &groupID},
|
|
groupId: &groupID,
|
|
appId: &appID,
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "normal user cannot access global config",
|
|
user: &model.LoginUserInfo{Type: "user", GroupId: &groupID},
|
|
groupId: &groupID,
|
|
appId: nil,
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "group admin can access own global config",
|
|
user: &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
|
|
groupId: &groupID,
|
|
appId: nil,
|
|
},
|
|
{
|
|
name: "group admin cannot access other global config",
|
|
user: &model.LoginUserInfo{Type: "groupAdmin", GroupId: &groupID},
|
|
groupId: &otherGroupID,
|
|
appId: nil,
|
|
wantErr: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
err := svc.RequirePermission(tt.user, tt.groupId, tt.appId)
|
|
if tt.wantErr && err == nil {
|
|
t.Fatalf("expected an error, got nil")
|
|
}
|
|
if !tt.wantErr && err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|