65 lines
2.5 KiB
Go
65 lines
2.5 KiB
Go
package httpapi
|
||
|
||
import (
|
||
"net/http"
|
||
"strings"
|
||
"testing"
|
||
|
||
"git.pcux.cn/xuans/Scert/backend/internal/repository"
|
||
)
|
||
|
||
func TestSettingsReadScope(t *testing.T) {
|
||
f, secrets := newDNSAccountScopeFixture(t)
|
||
f.server.config.Notification.SMTPUsername = "system-only-notification-account"
|
||
for _, item := range []struct {
|
||
actor string
|
||
want int
|
||
}{
|
||
{"", http.StatusUnauthorized},
|
||
{"global-admin", http.StatusForbidden},
|
||
{"manager", http.StatusForbidden},
|
||
{"viewer", http.StatusForbidden},
|
||
{"target", http.StatusForbidden},
|
||
{"primary-super-admin", http.StatusOK},
|
||
} {
|
||
t.Run(item.actor, func(t *testing.T) {
|
||
response := serveUserRequest(f.server, f.cookies[item.actor], http.MethodGet, "/api/v1/settings", "")
|
||
if response.Code != item.want {
|
||
t.Fatalf("系统设置读取范围错误：%s，状态=%d", item.actor, response.Code)
|
||
}
|
||
if response.Header().Get("Cache-Control") != "private, no-store" || response.Header().Get("Vary") != "Cookie" {
|
||
t.Error("系统设置响应缺少身份缓存隔离")
|
||
}
|
||
if item.want != http.StatusOK {
|
||
for _, forbidden := range []string{"project-a", "system-only-notification-account", "account_email", "credential_configured"} {
|
||
if strings.Contains(response.Body.String(), forbidden) {
|
||
t.Fatal("被拒绝的请求泄露系统元数据")
|
||
}
|
||
}
|
||
} else if !strings.Contains(response.Body.String(), "system-only-notification-account") {
|
||
t.Fatal("超级管理员读取丢失设置内容")
|
||
}
|
||
if secrets.getCalls != 0 {
|
||
t.Fatal("读取设置不应读取密钥明文")
|
||
}
|
||
})
|
||
}
|
||
}
|
||
|
||
func TestSettingsReadRejectsChangedAccountSession(t *testing.T) {
|
||
f := newProjectMemberAPIFixture(t)
|
||
cookie := httpUserSessionCookie(f.server, "temporary-super-admin", repository.UserRoleSuperAdmin)
|
||
response := serveUserRequest(f.server, cookie, http.MethodGet, "/api/v1/settings", "")
|
||
if response.Code != http.StatusOK {
|
||
t.Fatal("初始超级管理员不可读")
|
||
}
|
||
// 修改隔离数据库的角色，原 cookie 不得继续继承曾经的系统读取权限。
|
||
if _, err := f.db.ExecContext(t.Context(), "UPDATE users SET role = ? WHERE id = ?", repository.UserRoleAdmin, "temporary-super-admin"); err != nil {
|
||
t.Fatal(err)
|
||
}
|
||
response = serveUserRequest(f.server, cookie, http.MethodGet, "/api/v1/settings", "")
|
||
if response.Code != http.StatusUnauthorized || response.Header().Get("Cache-Control") != "private, no-store" {
|
||
t.Fatalf("降权后的旧会话未失效或可被缓存：%d", response.Code)
|
||
}
|
||
}
|