78 lines
3.4 KiB
Go
78 lines
3.4 KiB
Go
package logstore
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestSystemMailScopeIntersectsPermissionsAndPagination(t *testing.T) {
|
|
s := testStore(t)
|
|
now := time.Now().UTC()
|
|
for index, actor := range []string{"0", "4", "", "0"} {
|
|
if err := s.Write(context.Background(), Entry{ID: fmt.Sprint(index), Kind: "mail", ActorID: actor, CreatedAt: now.Add(-time.Duration(index) * time.Minute), Action: "投递邮件", Result: "success", Payload: []byte(`{}`)}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
for page, actor := range []string{"0", "", "0"} {
|
|
items, err := s.Query(context.Background(), Query{Kind: "mail", SystemOnly: true, Limit: 1, Offset: page})
|
|
if err != nil || len(items) != 1 || items[0].ActorID != actor {
|
|
t.Fatalf("系统邮件分页错误：%+v %v", items, err)
|
|
}
|
|
}
|
|
for _, includeUsers := range []bool{false, true} {
|
|
items, err := s.Query(context.Background(), Query{Kind: "mail", SystemOnly: true, ScopeActorID: "4", IncludeOrdinaryUsers: includeUsers})
|
|
if err != nil || len(items) != 0 {
|
|
t.Fatal("系统筛选扩大了权限范围")
|
|
}
|
|
}
|
|
items, err := s.Query(context.Background(), Query{Kind: "mail", SystemOnly: true, From: now.Add(-time.Minute), To: now})
|
|
if err != nil || len(items) != 1 {
|
|
t.Fatal("系统筛选没有遵守时间窗口")
|
|
}
|
|
if _, err := s.Query(context.Background(), Query{Kind: "operation", SystemOnly: true}); !errors.Is(err, ErrInvalid) {
|
|
t.Fatal("非邮件分类接受了系统邮件筛选")
|
|
}
|
|
}
|
|
|
|
func TestLogScopeFiltersBeforePagination(t *testing.T) {
|
|
s := testStore(t)
|
|
if _, err := s.db.Exec(`INSERT INTO "user" (id, account, name, password, role, is_admin) VALUES (1,'root','Root','hash','super_admin',1),(2,'manager','Manager','hash','admin',1),(3,'other-manager','Other','hash','admin',1),(4,'alice','Alice','hash','user',0),(5,'legacy','Legacy','hash','legacy',0),(6,'legacy-manager','Legacy admin','hash','legacy',1),(7,'user-admin-flag','User admin flag','hash','user',1)`); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ctx := context.Background()
|
|
for _, kind := range []string{"operation", "mail"} {
|
|
for id := 0; id <= 8; id++ {
|
|
if err := s.Write(ctx, Entry{ID: fmt.Sprintf("%s-%d", kind, id), Kind: kind, ActorID: fmt.Sprint(id), CreatedAt: time.Now().Add(time.Duration(-id) * time.Second), Action: "权限验证", Result: "success", Payload: []byte(`{}`)}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
for page, actor := range []string{"2", "4", "5", "7"} {
|
|
items, err := s.Query(ctx, Query{Kind: kind, ScopeActorID: "2", IncludeOrdinaryUsers: true, Limit: 1, Offset: page})
|
|
if err != nil || len(items) != 1 || items[0].ActorID != actor {
|
|
t.Fatalf("管理员分页越界：%s %d %+v %v", kind, page, items, err)
|
|
}
|
|
}
|
|
for _, actor := range []string{"0", "1", "3", "6", "8"} {
|
|
items, err := s.Query(ctx, Query{Kind: kind, ScopeActorID: "2", IncludeOrdinaryUsers: true, ActorID: actor})
|
|
if err != nil || len(items) != 0 {
|
|
t.Fatalf("伪造筛选扩大管理员范围：%s %v", actor, err)
|
|
}
|
|
}
|
|
items, err := s.Query(ctx, Query{Kind: kind, ScopeActorID: "4"})
|
|
if err != nil || len(items) != 1 || items[0].ActorID != "4" {
|
|
t.Fatal("普通用户范围不正确")
|
|
}
|
|
items, err = s.Query(ctx, Query{Kind: kind, ScopeActorID: "4", ActorID: "2"})
|
|
if err != nil || len(items) != 0 {
|
|
t.Fatal("普通用户可以伪造操作者")
|
|
}
|
|
items, err = s.Query(ctx, Query{Kind: kind})
|
|
if err != nil || len(items) != 9 {
|
|
t.Fatal("超级管理员丢失系统或历史日志")
|
|
}
|
|
}
|
|
}
|