chore: 并入 iotlcm-admin-svr 历史到 admin-svr/（原提交 49818c6）

2026-11-02 13:27:59 +08:00
parent 976980a3f5 49818c6dbe
commit 193f7393c0
1250 changed files with 154111 additions and 0 deletions
@@ -0,0 +1,48 @@
+package rolepolicy
+
+import (
+	"context"
+	"testing"
+
+	"github.com/gogf/gf/v2/frame/g"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/consts"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/contexts"
+	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model"
+)
+
+func TestUserRoleAssignmentCannotBypassDelegation(t *testing.T) {
+	for _, test := range []struct {
+		name                string
+		requested, existing []int64
+		super, denied       bool
+	}{
+		{name: "可分配的普通角色", requested: []int64{124}},
+		{name: "不能通过绑定特殊角色扩权", requested: []int64{123}, denied: true},
+		{name: "修改资料允许保留平台已有授权", requested: []int64{123}, existing: []int64{123}},
+		{name: "平台可以单独绑定特殊角色", requested: []int64{123}, super: true},
+		{name: "本地账号不能授予超级管理员角色", requested: []int64{1}, denied: true},
+		{name: "不接受其他机构角色", requested: []int64{120}, denied: true},
+		{name: "可以移除已有角色", requested: []int64{}, existing: []int64{123}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			setupAssignableTestDB(t)
+			actor := &model.Identity{BaseClaims: model.BaseClaims{ID: 162, TenantId: "000000", DeptId: 199}}
+			if test.super {
+				actor.Roles = []model.Role{{RoleId: consts.SuperAdminRoleId}}
+			}
+			ctx := contexts.Set(context.Background(), &model.Context{User: actor})
+			for _, statement := range []string{
+				"INSERT INTO sys_role VALUES(123,'000000',199,199,'0','4',NULL),(124,'000000',199,199,'0','4',NULL)",
+				"INSERT INTO sys_role_menu VALUES('000000',123,200,'0'),('000000',124,100,'0')",
+			} {
+				if _, err := g.DB().Exec(ctx, statement); err != nil {
+					t.Fatal(err)
+				}
+			}
+			err := ValidateUserRoleAssignment(ctx, "000000", 199, test.requested, test.existing)
+			if (err != nil) != test.denied {
+				t.Fatalf("denied=%v, error=%v", test.denied, err)
+			}
+		})
+	}
+}