96 lines
4.0 KiB
Go
96 lines
4.0 KiB
Go
package system
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"kra/app/system/biz"
|
|
)
|
|
|
|
func seedStrictUserTree(t *testing.T, data *Data) (actorID, childID, siblingID uint, users []userPO) {
|
|
t.Helper()
|
|
enableStrictAuthorityTestMode(data)
|
|
db := data.gormDB.WithContext(context.Background())
|
|
rootID := uint(888)
|
|
actorID, childID, siblingID = 8001, 8002, 9001
|
|
if err := db.Create(&[]authorityPO{
|
|
{AuthorityID: rootID, ParentID: authorityUintPointer(0)},
|
|
{AuthorityID: actorID, ParentID: &rootID},
|
|
{AuthorityID: childID, ParentID: &actorID},
|
|
{AuthorityID: siblingID, ParentID: &rootID},
|
|
}).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
users = []userPO{
|
|
{Username: "actor-user", Password: "hash", AuthorityID: actorID, Enable: 1},
|
|
{Username: "managed-user", Password: "hash", AuthorityID: childID, Enable: 1},
|
|
{Username: "outside-user", Password: "hash", AuthorityID: siblingID, Enable: 1},
|
|
}
|
|
if err := db.Create(&users).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return actorID, childID, siblingID, users
|
|
}
|
|
|
|
func TestStrictUserMutationsRejectOutsideTargetAndAllowSelfPassword(t *testing.T) {
|
|
data := newTransactionTestData(t)
|
|
actorID, _, _, users := seedStrictUserTree(t, data)
|
|
ctx := biz.NewActorContext(context.Background(), biz.Actor{UserID: users[0].ID, AuthorityID: actorID})
|
|
repo := &userRepo{data: data}
|
|
|
|
if err := repo.UpdateUser(ctx, &biz.User{ID: users[2].ID, NickName: "changed"}); err == nil {
|
|
t.Fatal("UpdateUser() accepted an out-of-scope target")
|
|
}
|
|
if err := repo.DeleteUser(ctx, users[2].ID); err == nil {
|
|
t.Fatal("DeleteUser() accepted an out-of-scope target")
|
|
}
|
|
if err := repo.UpdatePassword(ctx, users[2].ID, "new-hash", false); err == nil {
|
|
t.Fatal("UpdatePassword() accepted an out-of-scope target")
|
|
}
|
|
if err := repo.UpdatePassword(ctx, users[0].ID, "self-hash", true); err != nil {
|
|
t.Fatalf("UpdatePassword() rejected the current user: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestStrictUserCreationAndRoleAssignmentRequireManagedAuthorities(t *testing.T) {
|
|
data := newTransactionTestData(t)
|
|
actorID, childID, siblingID, users := seedStrictUserTree(t, data)
|
|
ctx := biz.NewActorContext(context.Background(), biz.Actor{UserID: users[0].ID, AuthorityID: actorID})
|
|
repo := &userRepo{data: data}
|
|
|
|
if _, err := repo.CreateUserWithAuthorities(ctx, &biz.User{Username: "outside-create", Password: "hash", AuthorityID: siblingID, Enable: 1}, nil); err == nil {
|
|
t.Fatal("CreateUserWithAuthorities() accepted an out-of-scope primary authority")
|
|
}
|
|
if _, err := repo.CreateUserWithAuthorities(ctx, &biz.User{Username: "managed-create", Password: "hash", AuthorityID: childID, Enable: 1}, []uint{childID}); err != nil {
|
|
t.Fatalf("CreateUserWithAuthorities() rejected managed authorities: %v", err)
|
|
}
|
|
if err := repo.SetUserAuthorities(ctx, users[1].ID, []uint{siblingID}); err == nil {
|
|
t.Fatal("SetUserAuthorities() accepted an out-of-scope authority")
|
|
}
|
|
if err := repo.SetUserAuthorities(ctx, users[2].ID, []uint{childID}); err == nil {
|
|
t.Fatal("SetUserAuthorities() accepted an out-of-scope user target")
|
|
}
|
|
}
|
|
|
|
func TestStrictUserUpdateRejectsPrimaryAuthorityOutsideManagedTree(t *testing.T) {
|
|
data := newTransactionTestData(t)
|
|
actorID, childID, siblingID, users := seedStrictUserTree(t, data)
|
|
ctx := biz.NewActorContext(context.Background(), biz.Actor{UserID: users[0].ID, AuthorityID: actorID})
|
|
repo := &userRepo{data: data}
|
|
|
|
if err := repo.UpdateUser(ctx, &biz.User{ID: users[1].ID, NickName: "changed", AuthorityID: siblingID}); err == nil {
|
|
t.Fatal("UpdateUser() accepted a primary authority outside the managed tree")
|
|
}
|
|
if err := repo.UpdateUserWithAuthorities(ctx, &biz.User{ID: users[1].ID, NickName: "changed", AuthorityID: siblingID}, []uint{childID}); err == nil {
|
|
t.Fatal("UpdateUserWithAuthorities() accepted a primary authority outside the managed tree")
|
|
}
|
|
|
|
var stored userPO
|
|
if err := data.gormDB.WithContext(context.Background()).First(&stored, users[1].ID).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if stored.AuthorityID != childID || stored.NickName == "changed" {
|
|
t.Fatalf("rejected update changed user: %+v", stored)
|
|
}
|
|
}
|