From 412c51f5f0cf466f9d1ff01a09e23dd02e116385 Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Sun, 4 Oct 2026 06:32:35 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E9=BD=90=20DNS=20=E7=AE=A1=E7=90=86?=
 =?UTF-8?q?=E8=83=BD=E5=8A=9B=E7=9A=84=E4=B8=89=E6=95=B0=E6=8D=AE=E5=BA=93?=
 =?UTF-8?q?=E7=9B=AE=E5=BD=95=E5=9B=9E=E5=BD=92?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../repository/project_directory_test.go       | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/backend/internal/repository/project_directory_test.go b/backend/internal/repository/project_directory_test.go
index cbf28ea..1530815 100644
--- a/backend/internal/repository/project_directory_test.go
+++ b/backend/internal/repository/project_directory_test.go
@@ -10,6 +10,7 @@ import (
 	"git.pcux.cn/xuans/Scert/backend/internal/database"
 	"git.pcux.cn/xuans/Scert/backend/internal/domain"
 	"git.pcux.cn/xuans/Scert/backend/internal/testsupport/mysqltest"
+	"git.pcux.cn/xuans/Scert/backend/internal/testsupport/postgrestest"
 )
 
 func TestProjectDirectorySQLite(t *testing.T) {
@@ -23,6 +24,11 @@ func TestProjectDirectoryMySQLReal(t *testing.T) {
 	checkProjectDirectory(t, server.Database(t))
 }
 
+func TestProjectDirectoryPostgresReal(t *testing.T) {
+	server := postgrestest.New(t)
+	checkProjectDirectory(t, server.Database(t))
+}
+
 func checkProjectDirectory(t *testing.T, cfg config.DatabaseConfig) {
 	t.Helper()
 	db, err := database.Open(t.Context(), cfg)
@@ -34,7 +40,7 @@ func checkProjectDirectory(t *testing.T, cfg config.DatabaseConfig) {
 		t.Fatal(err)
 	}
 	for _, user := range []struct{ id, role string }{
-		{"root", "super_admin"}, {"manager", "user"}, {"global-admin", "admin"}, {"viewer", "user"},
+		{"root", "super_admin"}, {"manager", "user"}, {"global-admin", "admin"}, {"viewer", "user"}, {"dns-admin", "user"},
 	} {
 		if _, err := db.DB.ExecContext(t.Context(), Rebind(cfg.Driver, `INSERT INTO users (id, username, password_hash, role, status)
 			VALUES (?, ?, 'test-only-no-login', ?, 'active')`), user.id, user.id, user.role); err != nil {
@@ -57,13 +63,16 @@ func checkProjectDirectory(t *testing.T, cfg config.DatabaseConfig) {
 	if err := repo.GrantProjectRole(t.Context(), "root", "visible-00", "viewer", domain.ProjectRoleReadOnly); err != nil {
 		t.Fatal(err)
 	}
+	if err := repo.GrantProjectRole(t.Context(), "root", "visible-00", "dns-admin", domain.ProjectRoleDNSAdmin); err != nil {
+		t.Fatal(err)
+	}
 	t.Run("visible_roles_and_empty_directory", func(t *testing.T) {
 		for _, tc := range []struct {
 			actor  string
 			count  int
 			manage bool
 		}{
-			{"root", 13, true}, {"manager", 12, true}, {"viewer", 1, false}, {"global-admin", 0, false},
+			{"root", 13, true}, {"manager", 12, true}, {"viewer", 1, false}, {"global-admin", 0, false}, {"dns-admin", 1, false},
 		} {
 			page, err := repo.ListVisibleProjects(t.Context(), tc.actor, "", 30)
 			if err != nil || page.Items == nil || len(page.Items) != tc.count || page.HasMore || page.NextCursor != "" {
@@ -73,6 +82,9 @@ func checkProjectDirectory(t *testing.T, cfg config.DatabaseConfig) {
 				t.Fatalf("空目录也必须返回正确创建能力：%s，%+v", tc.actor, page)
 			}
 			for _, item := range page.Items {
+				if item.CanManageDNS != (tc.manage || tc.actor == "dns-admin") {
+					t.Fatalf("DNS 管理能力错误：%s，%+v", tc.actor, item)
+				}
 				if item.CanManageProject != tc.manage || item.CanDeleteProject != (tc.manage && item.ID != domain.DefaultProjectID) {
 					t.Fatalf("生命周期能力错误：%s，%+v，%+v", tc.actor, page, item)
 				}
@@ -122,7 +134,7 @@ func checkProjectDirectory(t *testing.T, cfg config.DatabaseConfig) {
 			t.Fatal(err)
 		}
 		page, err := repo.ListVisibleProjects(t.Context(), "manager", "", 5)
-		if err != nil || len(page.Items) == 0 || page.Items[0].CanManageMembers || page.Items[0].CanManageProject || page.Items[0].CanDeleteProject || page.CanCreateProject {
+		if err != nil || len(page.Items) == 0 || page.Items[0].CanManageMembers || page.Items[0].CanManageProject || page.Items[0].CanManageDNS || page.Items[0].CanDeleteProject || page.CanCreateProject {
 			t.Fatalf("撤销管理角色未生效：%+v，%v", page, err)
 		}
 		if err := repo.RevokeProjectRole(t.Context(), "root", "visible-00", "manager", domain.ProjectRoleReadOnly); err != nil {