优化

internal/data/api_policy_test.go

@@ -126,3 +126,40 @@ func TestCheckPolicyStore(t *testing.T) {
 		t.Fatal("CheckPolicyStore succeeded after casbin_rule was dropped")
 	}
 }
+
+func TestSetAPIRolesStrictOnlyChangesManagedAuthorities(t *testing.T) {
+	data := newPolicyTestData(t)
+	db := data.gormDB.WithContext(context.Background())
+	rootID, actorID, childID, siblingID := uint(888), uint(2001), uint(2002), uint(3001)
+	if err := db.Create(&[]authorityPO{
+		{AuthorityID: rootID, ParentID: apiPolicyUintPointer(0)},
+		{AuthorityID: actorID, ParentID: &rootID},
+		{AuthorityID: childID, ParentID: &actorID},
+		{AuthorityID: siblingID, ParentID: &rootID},
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&apiPO{Path: "/known", Method: "POST"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&[]casbinRulePO{
+		newPolicyRule(actorID, "/known", "POST"),
+		newPolicyRule(siblingID, "/known", "POST"),
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	ctx := biz.NewActorContext(context.Background(), biz.Actor{AuthorityID: actorID})
+	repo := &apiRepo{data: data}
+	if err := repo.SetAPIRoles(ctx, "/known", "POST", []uint{siblingID}); err == nil {
+		t.Fatal("SetAPIRoles() accepted an out-of-scope authority")
+	}
+	if err := repo.SetAPIRoles(ctx, "/known", "POST", []uint{childID}); err != nil {
+		t.Fatalf("SetAPIRoles() rejected a managed authority: %v", err)
+	}
+	if exists, err := policyExists(db, siblingID, "/known", "POST"); err != nil || !exists {
+		t.Fatalf("out-of-scope policy exists=%v err=%v, want preserved", exists, err)
+	}
+	if exists, err := policyExists(db, childID, "/known", "POST"); err != nil || !exists {
+		t.Fatalf("managed policy exists=%v err=%v, want added", exists, err)
+	}
+}