优化

internal/data/permission_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"kra/internal/biz"
 	"kra/internal/conf"
 )
 
@@ -81,3 +82,41 @@ func TestPermissionSetSelectedButtonsPreservesDuplicates(t *testing.T) {
 		t.Fatalf("selected = %#v, want duplicate button IDs preserved", selected)
 	}
 }
+
+func TestSetSelectedButtonsStrictRequiresManagedRoleAndOwnedButton(t *testing.T) {
+	data := newMenuTestData(t)
+	enableStrictAuthorityTestMode(data)
+	db := data.gormDB.WithContext(context.Background())
+	rootID, actorID, childID, siblingID := uint(888), uint(6001), uint(6002), uint(7001)
+	if err := db.Create(&[]authorityPO{
+		{AuthorityID: rootID, ParentID: authorityUintPointer(0)},
+		{AuthorityID: actorID, ParentID: &rootID},
+		{AuthorityID: childID, ParentID: &actorID},
+		{AuthorityID: siblingID, ParentID: &rootID},
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&menuPO{ID: 10, Name: "managed", Path: "managed"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&[]menuButtonPO{
+		{ID: 31, MenuID: 10, Name: "owned"},
+		{ID: 32, MenuID: 10, Name: "unowned"},
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&authorityButtonPO{AuthorityID: actorID, MenuID: 10, ButtonID: 31}).Error; err != nil {
+		t.Fatal(err)
+	}
+	ctx := biz.NewActorContext(context.Background(), biz.Actor{AuthorityID: actorID})
+	repo := &permissionRepo{data: data}
+	if err := repo.SetSelectedButtons(ctx, siblingID, 10, []uint{31}); err == nil {
+		t.Fatal("SetSelectedButtons() accepted an out-of-scope authority")
+	}
+	if err := repo.SetSelectedButtons(ctx, childID, 10, []uint{32}); err == nil {
+		t.Fatal("SetSelectedButtons() accepted a button not assigned to the actor")
+	}
+	if err := repo.SetSelectedButtons(ctx, childID, 10, []uint{31}); err != nil {
+		t.Fatalf("SetSelectedButtons() rejected a managed assignment: %v", err)
+	}
+}