iotlcm/server/internal/logic/app/app_access_test.go

package app

import "testing"

func TestAppAccessCodesMatchExpression(t *testing.T) {
	accessCodes := []string{
		"cpm:iot:tSimCardInfo:edit",
		"cpm:agent:dept:list",
	}

	if !appAccessCodesMatchExpression(accessCodes, "cpm:iot:tSimCardInfo:edit&cpm:agent:dept:list") {
		t.Fatal("expected AND expression to match when all permissions are granted")
	}

	if appAccessCodesMatchExpression(accessCodes, "cpm:iot:tSimCardInfo:edit&cpm:agent:tAgentEnterprise:list") {
		t.Fatal("expected AND expression to fail when one permission is missing")
	}
}

func TestNormalizeFeatureDoesNotGrantLegacyAppPermission(t *testing.T) {
	if got := appNormalizeFeatureKey("cpm:app:*"); got == "*" {
		t.Fatal("legacy cpm:app:* must not be normalized to wildcard access")
	}
	if got := appNormalizeFeatureKey("app:card:list"); got == "card:list" {
		t.Fatal("legacy app: feature prefix must not be stripped")
	}
}

func TestRestartFeatureUsesDedicatedConsolePermission(t *testing.T) {
	if appAccessCodesMatchExpression(
		[]string{"cpm:iot:tSimCardInfo:edit"},
		appFeaturePermissionCandidates("card:restart")[0],
	) {
		t.Fatal("card edit permission must not grant restart feature")
	}

	if !appAccessCodesMatchExpression(
		[]string{"cpm:iot:tSimCardRestart:input:submit"},
		appFeaturePermissionCandidates("card:restart")[0],
	) {
		t.Fatal("restart submit permission should grant restart feature")
	}
}

func TestRenewAndChangeFeaturesUseSubmitPermissions(t *testing.T) {
	if appAccessCodesMatchExpression(
		[]string{"cpm:iot:tSimCardRenew:input:prepare"},
		appFeaturePermissionCandidates("card:renew")[0],
	) {
		t.Fatal("renew prepare permission must not grant mini app renew entry")
	}
	if !appAccessCodesMatchExpression(
		[]string{"cpm:iot:tSimCardRenew:batch:confirm"},
		appFeaturePermissionCandidates("card:renew")[0],
	) {
		t.Fatal("renew batch confirm permission should grant renew entry")
	}
	if appAccessCodesMatchExpression(
		[]string{"cpm:iot:tSimCardChange:input:prepare", "cpm:iot:tSimCardBindPkg:getChangePkg"},
		appFeaturePermissionCandidates("card:change")[0],
	) {
		t.Fatal("change prepare permission must not grant mini app change entry")
	}
	if !appAccessCodesMatchExpression(
		[]string{"cpm:iot:tSimCardChange:batch:submit"},
		appFeaturePermissionCandidates("card:change")[0],
	) {
		t.Fatal("change batch submit permission should grant change entry")
	}
}

func TestAllocateFeatureUsesDedicatedConsolePermissions(t *testing.T) {
	if appAccessCodesMatchExpression(
		[]string{"cpm:iot:tSimCardInfo:edit", "cpm:agent:dept:list"},
		appFeaturePermissionCandidates("card:allocate")[0],
	) {
		t.Fatal("card edit and customer list permissions must not grant mini app allocate entry")
	}
	if !appAccessCodesMatchExpression(
		[]string{
			"cpm:iot:tSimCardAllocate:targets",
			"cpm:iot:tSimCardAllocate:input:prepare",
			"cpm:iot:tSimCardAllocate:batch:submit",
		},
		appFeaturePermissionCandidates("card:allocate")[0],
	) {
		t.Fatal("complete allocate permissions should grant allocate entry")
	}
	if appAccessCodesMatchExpression(
		[]string{"cpm:iot:tSimCardAllocate:batch:submit"},
		appFeaturePermissionCandidates("card:allocate")[0],
	) {
		t.Fatal("single allocate submit permission must not grant full allocate entry")
	}
}

func TestDataServiceFeaturesUseConsolePermissions(t *testing.T) {
	tests := []struct {
		feature    string
		permission string
	}{
		{feature: "card:dataStart", permission: "cpm:iot:tSimCardDataStart:input:submit"},
		{feature: "card:dataStop", permission: "cpm:iot:tSimCardDataStop:input:submit"},
	}
	for _, tt := range tests {
		candidates := appFeaturePermissionCandidates(tt.feature)
		if len(candidates) != 1 || !appAccessCodesMatchExpression([]string{tt.permission}, candidates[0]) {
			t.Fatalf("%s should use %s", tt.feature, tt.permission)
		}
	}
}