67 lines
2.3 KiB
Go
67 lines
2.3 KiB
Go
package setup
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"git.pcux.cn/xuans/Smail/config"
|
|
"git.pcux.cn/xuans/Smail/db"
|
|
"git.pcux.cn/xuans/Smail/models"
|
|
"git.pcux.cn/xuans/Smail/services/access"
|
|
requestcontext "git.pcux.cn/xuans/Smail/utils/context"
|
|
)
|
|
|
|
// 使用独立临时库和真实版本化迁移，不读取或改动开发服务数据库。
|
|
func TestAuditFirstAdministratorMustHaveSuperAdminRole(t *testing.T) {
|
|
oldConfig, oldSnapshot := config.Instance, config.CurrentConfig()
|
|
oldManager, oldDB := config.CurrentManager(), db.Instance
|
|
t.Setenv("SMAIL_ENABLE_LEGACY_SYNC2", "0")
|
|
config.Instance = &config.Config{
|
|
DbType: config.DBTypeSQLite,
|
|
DbDSN: filepath.Join(t.TempDir(), "first-admin.db"),
|
|
}
|
|
config.PublishConfigSnapshot(config.Instance)
|
|
config.SetRuntimeManager(nil)
|
|
db.Instance = nil
|
|
t.Cleanup(func() {
|
|
if db.Instance != nil && db.Instance != oldDB {
|
|
_ = db.Instance.Close()
|
|
}
|
|
db.Instance = oldDB
|
|
config.Instance = oldConfig
|
|
config.PublishConfigSnapshot(oldSnapshot)
|
|
config.SetRuntimeManager(oldManager)
|
|
})
|
|
if err := db.Init(""); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := SetAdminPassword(&requestcontext.Context{}, "audit-admin", "AuditPass12"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, stage := range []string{"created", "restarted"} {
|
|
if stage == "restarted" {
|
|
if err := db.Instance.Close(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
db.Instance = nil
|
|
if err := db.Init(""); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
var user models.User
|
|
found, err := db.Instance.Where("account = ?", "audit-admin").Get(&user)
|
|
if err != nil || !found {
|
|
t.Fatalf("读取初始化账户失败: found=%t err=%v", found, err)
|
|
}
|
|
canReadConfig, canManageRole := false, false
|
|
for _, capability := range access.Capabilities(user.EffectiveRole()) {
|
|
canReadConfig = canReadConfig || capability == access.CapabilityConfigRead
|
|
canManageRole = canManageRole || capability == access.CapabilityRoleManage
|
|
}
|
|
t.Logf("stage=%s is_admin=%d role=%q effective_role=%q config_read=%t role_manage=%t", stage, user.IsAdmin, user.Role, user.EffectiveRole(), canReadConfig, canManageRole)
|
|
if user.EffectiveRole() != access.RoleSuperAdmin || !canReadConfig || !canManageRole {
|
|
t.Errorf("%s: 初始化管理员必须获得超级管理员角色和管理能力", stage)
|
|
}
|
|
}
|
|
}
|