功能：优化账号分层与管理员初始化

2026-08-13 13:18:41 +08:00
parent ac44fda08b
commit 1f85add5e0
12 changed files with 270 additions and 25 deletions
@@ -224,3 +224,57 @@ func TestUserServiceCannotDeleteOrDisableLastAdmin(t *testing.T) {
 		t.Fatal("should not delete the last enabled admin")
 	}
 }
+
+func TestUserServicePromotesMerchantAccountToPlatformAdmin(t *testing.T) {
+	db := newServiceTestDB(t)
+	var merchant model.Merchant
+	if err := db.Where("code = ?", model.MerchantCodeSelfOperated).First(&merchant).Error; err != nil {
+		t.Fatalf("load self-operated merchant: %v", err)
+	}
+	svc := NewUserService(db, NewTenantService(db))
+	actor, err := svc.Create("existing-admin", "password123", "现有管理员", model.RoleAdmin, 0)
+	if err != nil {
+		t.Fatalf("create actor: %v", err)
+	}
+	member, err := svc.Create("skin_nh_admin", "password123", "新管理员", model.RoleMerchant, 0)
+	if err != nil {
+		t.Fatalf("create merchant user: %v", err)
+	}
+	if err := svc.UpdateRole(member.ID, model.RoleAdmin, actor.ID); err != nil {
+		t.Fatalf("promote account: %v", err)
+	}
+	var promoted model.User
+	if err := db.First(&promoted, member.ID).Error; err != nil || promoted.Role != model.RoleAdmin {
+		t.Fatalf("account should be admin, user=%+v err=%v", promoted, err)
+	}
+	var membership model.MerchantMember
+	if err := db.Where("merchant_id = ? AND user_id = ?", merchant.ID, member.ID).First(&membership).Error; err != nil {
+		t.Fatalf("promoted account should join self-operated merchant: %v", err)
+	}
+	if membership.Role != model.MemberRoleOwner || !membership.IsDefault {
+		t.Fatalf("unexpected promoted membership: %+v", membership)
+	}
+}
+
+func TestEnsureAdminUsesConfiguredCredentialsOnlyForEmptyDatabase(t *testing.T) {
+	db := newServiceTestDB(t)
+	tenant := NewTenantService(db)
+	auth := NewAuthService(db, nil, tenant)
+	if err := auth.EnsureAdmin("skin_nh_admin", "secure-password"); err != nil {
+		t.Fatalf("create configured admin: %v", err)
+	}
+	var created model.User
+	if err := db.Where("username = ?", "skin_nh_admin").First(&created).Error; err != nil {
+		t.Fatalf("configured admin should exist: %v", err)
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(created.PasswordHash), []byte("secure-password")); err != nil {
+		t.Fatalf("configured password should match: %v", err)
+	}
+	if err := auth.EnsureAdmin("replacement-admin", "another-password"); err != nil {
+		t.Fatalf("existing admin should not be replaced: %v", err)
+	}
+	var count int64
+	if err := db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count).Error; err != nil || count != 1 {
+		t.Fatalf("existing admin should remain unchanged, count=%d err=%v", count, err)
+	}
+}