MiFaZhan
49 lines
1.9 KiB
Go
49 lines
1.9 KiB
Go
package rolepolicy
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/gogf/gf/v2/frame/g"
|
|
"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/consts"
|
|
"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/contexts"
|
|
"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model"
|
|
)
|
|
|
|
func TestUserRoleAssignmentCannotBypassDelegation(t *testing.T) {
|
|
for _, test := range []struct {
|
|
name string
|
|
requested, existing []int64
|
|
super, denied bool
|
|
}{
|
|
{name: "可分配的普通角色", requested: []int64{124}},
|
|
{name: "不能通过绑定特殊角色扩权", requested: []int64{123}, denied: true},
|
|
{name: "修改资料允许保留平台已有授权", requested: []int64{123}, existing: []int64{123}},
|
|
{name: "平台可以单独绑定特殊角色", requested: []int64{123}, super: true},
|
|
{name: "本地账号不能授予超级管理员角色", requested: []int64{1}, denied: true},
|
|
{name: "不接受其他机构角色", requested: []int64{120}, denied: true},
|
|
{name: "可以移除已有角色", requested: []int64{}, existing: []int64{123}},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
setupAssignableTestDB(t)
|
|
actor := &model.Identity{BaseClaims: model.BaseClaims{ID: 162, TenantId: "000000", DeptId: 199}}
|
|
if test.super {
|
|
actor.Roles = []model.Role{{RoleId: consts.SuperAdminRoleId}}
|
|
}
|
|
ctx := contexts.Set(context.Background(), &model.Context{User: actor})
|
|
for _, statement := range []string{
|
|
"INSERT INTO sys_role VALUES(123,'000000',199,199,'0','4',NULL),(124,'000000',199,199,'0','4',NULL)",
|
|
"INSERT INTO sys_role_menu VALUES('000000',123,200,'0'),('000000',124,100,'0')",
|
|
} {
|
|
if _, err := g.DB().Exec(ctx, statement); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
err := ValidateUserRoleAssignment(ctx, "000000", 199, test.requested, test.existing)
|
|
if (err != nil) != test.denied {
|
|
t.Fatalf("denied=%v, error=%v", test.denied, err)
|
|
}
|
|
})
|
|
}
|
|
}
|