优化

2026-08-17 02:12:17 +08:00
parent 560ae46b82
commit 6a05803e08
96 changed files with 2888 additions and 685 deletions
@@ -0,0 +1,114 @@
+package data
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"kra/internal/biz"
+	"kra/internal/conf"
+)
+
+func newPolicyTestData(t *testing.T) *Data {
+	t.Helper()
+	db, err := openWithDriver("sqlite", "file:"+t.Name()+"?mode=memory&cache=shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.AutoMigrate(&apiPO{}, &casbinRulePO{}, &authorityPO{}, &authorityAPIPO{}); err != nil {
+		t.Fatal(err)
+	}
+	data := &Data{
+		gormDB: newReloadableDB(db, nil),
+		runtime: conf.NewRuntime(
+			&conf.Data{Database: &conf.Data_Database{Driver: "sqlite"}},
+			&conf.AdminBackend{System: &conf.AdminBackend_System{UseStrictAuth: true}},
+		),
+	}
+	t.Cleanup(func() { data.gormDB.close() })
+	return data
+}
+
+func apiPolicyUintPointer(value uint) *uint { return &value }
+
+func TestSetPolicyPathsStrictRootRequiresRegisteredAPI(t *testing.T) {
+	data := newPolicyTestData(t)
+	ctx := biz.NewActorContext(context.Background(), biz.Actor{AuthorityID: 888})
+	if err := data.gormDB.WithContext(ctx).Create(&[]authorityPO{
+		{AuthorityID: 888, ParentID: apiPolicyUintPointer(0)},
+		{AuthorityID: 999, ParentID: apiPolicyUintPointer(888)},
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := data.gormDB.WithContext(ctx).Create(&apiPO{Path: "/known", Method: "POST"}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	err := (&apiRepo{data: data}).SetPolicyPaths(ctx, 999, []*biz.API{{Path: "/unknown", Method: "POST"}})
+	if err == nil || !strings.Contains(err.Error(), "存在api不在权限列表中") {
+		t.Fatalf("unregistered root assignment error = %v", err)
+	}
+	if err := (&apiRepo{data: data}).SetPolicyPaths(ctx, 999, []*biz.API{{Path: "/known", Method: "POST"}}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestSetPolicyPathsStrictChildRejectsStalePolicy(t *testing.T) {
+	data := newPolicyTestData(t)
+	ctx := biz.NewActorContext(context.Background(), biz.Actor{AuthorityID: 1001})
+	if err := data.gormDB.WithContext(ctx).Create(&[]authorityPO{
+		{AuthorityID: 888, ParentID: apiPolicyUintPointer(0)},
+		{AuthorityID: 1001, ParentID: apiPolicyUintPointer(888)},
+		{AuthorityID: 1002, ParentID: apiPolicyUintPointer(1001)},
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := data.gormDB.WithContext(ctx).Create(&apiPO{Path: "/known", Method: "POST"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := data.gormDB.WithContext(ctx).Create(&[]casbinRulePO{
+		newPolicyRule(1001, "/known", "POST"),
+		newPolicyRule(1001, "/stale", "POST"),
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	err := (&apiRepo{data: data}).SetPolicyPaths(ctx, 1002, []*biz.API{{Path: "/stale", Method: "POST"}})
+	if err == nil || !strings.Contains(err.Error(), "存在api不在权限列表中") {
+		t.Fatalf("stale child assignment error = %v", err)
+	}
+	if err := (&apiRepo{data: data}).SetPolicyPaths(ctx, 1002, []*biz.API{{Path: "/known", Method: "POST"}}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestSetPolicyPathsUsesCompatibleDedupeKey(t *testing.T) {
+	data := newPolicyTestData(t)
+	ctx := biz.NewActorContext(context.Background(), biz.Actor{AuthorityID: 888})
+	if err := data.gormDB.WithContext(ctx).Create(&[]authorityPO{
+		{AuthorityID: 888, ParentID: apiPolicyUintPointer(0)},
+		{AuthorityID: 999, ParentID: apiPolicyUintPointer(888)},
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := data.gormDB.WithContext(ctx).Create(&[]apiPO{
+		{Path: "/a", Method: "BC"},
+		{Path: "/aB", Method: "C"},
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	if err := (&apiRepo{data: data}).SetPolicyPaths(ctx, 999, []*biz.API{
+		{Path: "/a", Method: "BC"},
+		{Path: "/aB", Method: "C"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	rows, err := policyRowsForAuthority(data.gormDB.WithContext(ctx), 999)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 || rows[0].V1 != "/a" || rows[0].V2 != "BC" {
+		t.Fatalf("deduplicated policies = %#v, want only the first concatenated-key match", rows)
+	}
+}