yml2213
cb8aceb433
- 路由权限支持：新增 RequireAnyPermission 中间件，允许持有 qrcode:view 或 distribution:site_view 的管理员调用 GET /admin/distribution/sites 获取分站列表 - 服务层站点穿透：ListSitesForAdmin 允许持有 qrcode:view 权限的管理员（客服）获取全部可用分销站点用于码池维护；站长/分销商等站点成员仍按其绑定站点收窄 - 前端交互与权限分组：分站二维码池 loadSites 补充异常捕获，分配权限弹窗补充「分销管理」分组展示名 - 权限来源：cs 角色的 qrcode:view/manage 由既有迁移 000016 提供，故本次不新增数据库迁移 - 权限边界：不采用 distribution:all_view 实现该需求——它是跨站写操作的总开关（改站/删站/重置站长密码），而该权限依赖的 ops 角色同时是分站站长，授予后会击穿多租户隔离；并补充回归断言锁定该边界 - 验证方式：全量门禁 ./scripts/check.sh 通过（SQL 约束检查、Go 单测与覆盖率、路由测试、前端类型检查、单测与生产构建）
95 lines
2.2 KiB
Go
95 lines
2.2 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/redis/go-redis/v9"
|
|
)
|
|
|
|
func TestRequireAnyPermission(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
rdb := redis.NewClient(&redis.Options{
|
|
Addr: "127.0.0.1:16379",
|
|
DB: 14,
|
|
})
|
|
ctx := t.Context()
|
|
if err := rdb.Ping(ctx).Err(); err != nil {
|
|
t.Skipf("跳过测试：未检测到测试 Redis: %v", err)
|
|
}
|
|
t.Cleanup(func() {
|
|
_ = rdb.FlushDB(context.Background()).Err()
|
|
_ = rdb.Close()
|
|
})
|
|
_ = rdb.FlushDB(ctx)
|
|
|
|
adminID := uint64(101)
|
|
permKey := fmt.Sprintf("admin:perms:%d", adminID)
|
|
|
|
setPerms := func(perms []string) {
|
|
raw, err := json.Marshal(perms)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := rdb.Set(ctx, permKey, string(raw), time.Minute).Err(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
setupRouter := func() *gin.Engine {
|
|
r := gin.New()
|
|
r.Use(func(c *gin.Context) {
|
|
c.Set(ContextAdminID, adminID)
|
|
c.Next()
|
|
})
|
|
r.GET("/test-any", RequireAnyPermission(rdb, "distribution:site_view", "qrcode:view"), func(c *gin.Context) {
|
|
c.JSON(http.StatusOK, gin.H{"ok": true})
|
|
})
|
|
return r
|
|
}
|
|
|
|
router := setupRouter()
|
|
|
|
// 1. 无任何权限 -> 403
|
|
setPerms([]string{"dashboard:view"})
|
|
req := httptest.NewRequest(http.MethodGet, "/test-any", nil)
|
|
w := httptest.NewRecorder()
|
|
router.ServeHTTP(w, req)
|
|
if w.Code != http.StatusForbidden {
|
|
t.Fatalf("expected 403, got %d", w.Code)
|
|
}
|
|
|
|
// 2. 具备 qrcode:view -> 200
|
|
setPerms([]string{"qrcode:view"})
|
|
req = httptest.NewRequest(http.MethodGet, "/test-any", nil)
|
|
w = httptest.NewRecorder()
|
|
router.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
|
|
// 3. 具备 distribution:site_view -> 200
|
|
setPerms([]string{"distribution:site_view"})
|
|
req = httptest.NewRequest(http.MethodGet, "/test-any", nil)
|
|
w = httptest.NewRecorder()
|
|
router.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
|
|
// 4. 超管通配符 * -> 200
|
|
setPerms([]string{"*"})
|
|
req = httptest.NewRequest(http.MethodGet, "/test-any", nil)
|
|
w = httptest.NewRecorder()
|
|
router.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
}
|