chore: 并入 iotlcm-openapi 历史到 openapi/（原提交 3b05d5a）

openapi/internal/logic/middleware/permission_test.go

@@ -0,0 +1,117 @@
+package middleware
+
+import (
+	"context"
+	"testing"
+
+	_ "github.com/gogf/gf/contrib/drivers/sqlite/v2"
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/frame/g"
+
+	"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/library/contexts"
+	"git.5iot.com/iotlcm-public/iotlcm-openapi/internal/model"
+)
+
+func TestOpenAPIPermission(t *testing.T) {
+	ctx := contexts.Set(context.Background(), &model.Context{
+		AgentUser: &model.BaseClaimsApi{ApiId: 1, AppKey: "test-key"},
+	})
+	if err := gdb.SetConfig(gdb.Config{"default": gdb.ConfigGroup{{Type: "sqlite", Link: "sqlite::@file(:memory:)", MaxOpenConnCount: 1}}}); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = g.DB().Close(ctx) })
+	if err := g.DB().GetCore().ClearTableFieldsAll(ctx); err != nil {
+		t.Fatal(err)
+	}
+	exec := func(sql string) {
+		t.Helper()
+		if _, err := g.DB().Exec(ctx, sql); err != nil {
+			t.Fatal(err)
+		}
+	}
+	exec(`CREATE TABLE t_api_resource (id INTEGER PRIMARY KEY, method TEXT, path TEXT, status INTEGER)`)
+	exec(`CREATE TABLE t_api (id INTEGER PRIMARY KEY, app_key TEXT, group_id INTEGER, status INTEGER)`)
+	exec(`CREATE TABLE t_api_group_resource (group_id INTEGER, api_id INTEGER)`)
+	exec(`INSERT INTO t_api VALUES (1, 'test-key', 7, 0)`)
+	exec(`INSERT INTO t_api_resource VALUES
+		(1, '1', '/openapi/v3/change/sim-subscribe', 0),
+		(2, 'POST', '/openapi/v3/query/sim-info', 0),
+		(3, '1', '/openapi/v3/query/sim-status', 1),
+		(4, '1', '/openapi/v3/query/sim-imei-batch', 0)`)
+	exec(`INSERT INTO t_api_group_resource VALUES (7, 1), (7, 2), (7, 3)`)
+
+	middleware := New()
+	check := func(t *testing.T, method, path string) (bool, error) {
+		t.Helper()
+		return middleware.hasOpenApiPermission(ctx, method, path)
+	}
+
+	for _, tc := range []struct {
+		name, method, path string
+		want               bool
+	}{
+		{"authorized numeric method", "POST", "/openapi/v3/change/sim-subscribe", true},
+		{"authorized text method", "POST", "/openapi/v3/query/sim-info", true},
+		{"normalized path", "post", "/openapi/v3/query/sim-info/", true},
+		{"unregistered resource", "POST", "/openapi/v3/query/batch-status", false},
+		{"legacy alias path never inherits grants", "POST", "/openapi/v3/common/sim-subscribe", false},
+		{"wrong method", "GET", "/openapi/v3/change/sim-subscribe", false},
+		{"disabled resource", "POST", "/openapi/v3/query/sim-status", false},
+		{"missing group binding", "POST", "/openapi/v3/query/sim-imei-batch", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := check(t, tc.method, tc.path)
+			if err != nil {
+				t.Fatalf("business denial must not report a system failure: %v", err)
+			}
+			if got != tc.want {
+				t.Fatalf("permission = %v, want %v", got, tc.want)
+			}
+		})
+	}
+
+	// Token endpoints are exempted by router.exceptLogin only; the middleware must not
+	// carry its own whitelist, otherwise the two lists drift apart.
+	if got, err := check(t, "POST", "/openapi/v3/query/token"); err != nil || got {
+		t.Fatalf("token path must not be whitelisted inside middleware, got=%v err=%v", got, err)
+	}
+
+	// The /common alias prefix has been removed from the router (router/common.go deleted).
+	// Keep the path-level guard anyway: if an alias is ever re-introduced, it must still be
+	// registered and granted on its own full path instead of inheriting /change permissions.
+	exec(`INSERT INTO t_api_resource VALUES (5, '1', '/openapi/v3/common/sim-subscribe', 0)`)
+	if got, err := check(t, "POST", "/openapi/v3/common/sim-subscribe"); err != nil || got {
+		t.Fatalf("registered compatibility route without grant must be denied, got=%v err=%v", got, err)
+	}
+	exec(`INSERT INTO t_api_group_resource VALUES (7, 5)`)
+	if got, err := check(t, "POST", "/openapi/v3/common/sim-subscribe"); err != nil || !got {
+		t.Fatalf("explicitly granted compatibility route must be allowed, got=%v err=%v", got, err)
+	}
+
+	// Unusable accounts are a business denial, not a system failure.
+	for _, sql := range []string{
+		`UPDATE t_api SET status = 1`,
+		`UPDATE t_api SET status = 0, group_id = 0`,
+		`DELETE FROM t_api`,
+	} {
+		exec(sql)
+		got, err := check(t, "POST", "/openapi/v3/query/sim-info")
+		if err != nil {
+			t.Fatalf("account rejection must not be reported as a system failure after %s: %v", sql, err)
+		}
+		if got {
+			t.Fatalf("invalid account allowed after %s", sql)
+		}
+	}
+
+	// A broken permission lookup is a system failure: it must deny AND surface the error,
+	// so callers can answer 10016 instead of misreporting it as 10014 no-permission.
+	exec(`DROP TABLE t_api_resource`)
+	got, err := check(t, "POST", "/openapi/v3/query/sim-info")
+	if err == nil {
+		t.Fatal("resource lookup failure must return an error")
+	}
+	if got {
+		t.Fatal("resource lookup failure must deny access")
+	}
+}