152 lines
7.3 KiB
Go
152 lines
7.3 KiB
Go
package externaladmin
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"hyapp-admin-server/internal/appctx"
|
|
"hyapp-admin-server/internal/config"
|
|
"hyapp-admin-server/internal/integration/userclient"
|
|
"hyapp-admin-server/internal/integration/walletclient"
|
|
adminmiddleware "hyapp-admin-server/internal/middleware"
|
|
"hyapp-admin-server/internal/modules/appuser"
|
|
"hyapp-admin-server/internal/modules/hostorg"
|
|
"hyapp-admin-server/internal/modules/vipconfig"
|
|
walletv1 "hyapp.local/api/proto/wallet/v1"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func TestExternalBusinessRoutesKeepIndependentPermissionBoundaries(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
engine := gin.New()
|
|
engine.Use(func(c *gin.Context) {
|
|
// Each request gets exactly one product capability. Allowed reads reach an
|
|
// intentionally unconfigured handler and return 500; denied routes must stop
|
|
// at the permission middleware with 403 before any dependency is touched.
|
|
c.Set(adminmiddleware.ContextPermissions, []string{c.GetHeader("X-Test-Permission")})
|
|
c.Next()
|
|
})
|
|
registerBusinessWhitelist(engine.Group(""), &Handler{}, BusinessHandlers{
|
|
AppUser: appuser.New(nil, nil, nil, nil, nil, config.Config{}, nil),
|
|
HostOrg: hostorg.New(nil, nil, nil, nil, nil, nil),
|
|
})
|
|
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
path string
|
|
permission string
|
|
allowed bool
|
|
}{
|
|
{name: "external SuperAdmin list accepts its capability", method: http.MethodGet, path: "/admin/external-super-admins", permission: "external-super-admin:list", allowed: true},
|
|
{name: "external SuperAdmin list rejects retired capability", method: http.MethodGet, path: "/admin/external-super-admins", permission: "super-admin:list"},
|
|
{name: "user update can read support list", method: http.MethodGet, path: "/app/users", permission: "user:update", allowed: true},
|
|
{name: "user update cannot ban", method: http.MethodPost, path: "/app/users/9001/ban", permission: "user:update"},
|
|
{name: "user unban can read ban support list", method: http.MethodGet, path: "/app/users/bans", permission: "user:unban", allowed: true},
|
|
}
|
|
for _, testCase := range tests {
|
|
t.Run(testCase.name, func(t *testing.T) {
|
|
request := httptest.NewRequest(testCase.method, testCase.path, nil)
|
|
request.Header.Set("X-Test-Permission", testCase.permission)
|
|
recorder := httptest.NewRecorder()
|
|
engine.ServeHTTP(recorder, request)
|
|
if testCase.allowed && recorder.Code == http.StatusForbidden {
|
|
t.Fatalf("permission %s was rejected for %s %s: %s", testCase.permission, testCase.method, testCase.path, recorder.Body.String())
|
|
}
|
|
if !testCase.allowed && recorder.Code != http.StatusForbidden {
|
|
t.Fatalf("permission %s unexpectedly reached %s %s: status=%d body=%s", testCase.permission, testCase.method, testCase.path, recorder.Code, recorder.Body.String())
|
|
}
|
|
})
|
|
}
|
|
for _, retiredPath := range []string{"/admin/managers", "/admin/bd-leaders", "/admin/my-team/agencies"} {
|
|
request := httptest.NewRequest(http.MethodGet, retiredPath, nil)
|
|
request.Header.Set("X-Test-Permission", "external-super-admin:list")
|
|
recorder := httptest.NewRecorder()
|
|
engine.ServeHTTP(recorder, request)
|
|
if recorder.Code != http.StatusNotFound {
|
|
t.Fatalf("retired external route %s status=%d body=%s", retiredPath, recorder.Code, recorder.Body.String())
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestExternalVIPRoutesExposeOnlyManagerCenterTrialCards(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
wallet := &externalVIPRouteWallet{}
|
|
engine := gin.New()
|
|
engine.Use(func(c *gin.Context) {
|
|
ctx := appctx.WithContext(c.Request.Context(), "fami")
|
|
ctx = appctx.WithExternalScope(ctx, appctx.ExternalScope{AccountID: 1, LinkedAppUserID: 77, RegionID: 9, OwnerUserIDs: []int64{77}})
|
|
c.Request = c.Request.WithContext(ctx)
|
|
c.Set(contextScope, RequestScope{AccountID: 1, LinkedAppUserID: 77, RegionID: 9, OwnerUserIDs: []int64{77}})
|
|
c.Set(adminmiddleware.ContextPermissions, []string{"user-level:grant"})
|
|
c.Set(adminmiddleware.ContextRequestID, "external-vip-route-test")
|
|
c.Set(adminmiddleware.ContextUserID, uint(77))
|
|
c.Next()
|
|
})
|
|
teamClient := &externalVIPRouteUserClient{}
|
|
registerBusinessWhitelist(engine.Group(""), &Handler{}, BusinessHandlers{
|
|
AppUser: appuser.New(teamClient, nil, nil, nil, nil, config.Config{}, nil),
|
|
VIPConfig: vipconfig.New(wallet, nil),
|
|
})
|
|
|
|
vipRequest := httptest.NewRequest(http.MethodPost, "/admin/activity/vip-grants", strings.NewReader(`{"targetUserId":"9001","level":5,"reason":"manual"}`))
|
|
vipRequest.Header.Set("Content-Type", "application/json")
|
|
vipRecorder := httptest.NewRecorder()
|
|
engine.ServeHTTP(vipRecorder, vipRequest)
|
|
if vipRecorder.Code != http.StatusNotFound || wallet.vipRequest != nil {
|
|
t.Fatalf("direct external VIP route must be absent: status=%d request=%+v body=%s", vipRecorder.Code, wallet.vipRequest, vipRecorder.Body.String())
|
|
}
|
|
|
|
trialRequest := httptest.NewRequest(http.MethodPost, "/admin/activity/vip-trial-card-grants", strings.NewReader(`{"targetUserId":"9001","level":5,"durationMs":86400000,"resourceId":99,"reason":"manual"}`))
|
|
trialRequest.Header.Set("Content-Type", "application/json")
|
|
trialRecorder := httptest.NewRecorder()
|
|
engine.ServeHTTP(trialRecorder, trialRequest)
|
|
if trialRecorder.Code != http.StatusCreated || wallet.trialRequest == nil || wallet.trialRequest.GetGrantSource() != "manager_center" {
|
|
t.Fatalf("external trial route source: status=%d request=%+v body=%s", trialRecorder.Code, wallet.trialRequest, trialRecorder.Body.String())
|
|
}
|
|
}
|
|
|
|
type externalVIPRouteUserClient struct {
|
|
userclient.Client
|
|
}
|
|
|
|
func (client *externalVIPRouteUserClient) ListExternalTeamUsers(_ context.Context, request userclient.ListExternalTeamUsersRequest) (*userclient.ListExternalTeamUsersResult, error) {
|
|
return &userclient.ListExternalTeamUsersResult{
|
|
Users: []userclient.ExternalTeamUser{{UserID: 9001, RegionID: request.RegionID, Status: request.Status}},
|
|
Total: 1, Page: request.Page, PageSize: request.PageSize,
|
|
}, nil
|
|
}
|
|
|
|
func (client *externalVIPRouteUserClient) ExternalInviteBD(context.Context, userclient.ExternalInviteBDRequest) (*userclient.ExternalRoleInvitation, error) {
|
|
return nil, nil
|
|
}
|
|
func (client *externalVIPRouteUserClient) ExternalInviteAgency(context.Context, userclient.ExternalInviteAgencyRequest) (*userclient.ExternalRoleInvitation, error) {
|
|
return nil, nil
|
|
}
|
|
func (client *externalVIPRouteUserClient) ExternalInviteHost(context.Context, userclient.ExternalInviteHostRequest) (*userclient.ExternalRoleInvitation, error) {
|
|
return nil, nil
|
|
}
|
|
func (client *externalVIPRouteUserClient) SearchExternalInvitationCandidate(context.Context, userclient.SearchExternalInvitationCandidateRequest) (*userclient.ExternalTeamUser, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
type externalVIPRouteWallet struct {
|
|
walletclient.Client
|
|
vipRequest *walletv1.GrantVipRequest
|
|
trialRequest *walletv1.GrantVipTrialCardRequest
|
|
}
|
|
|
|
func (wallet *externalVIPRouteWallet) GrantVip(_ context.Context, request *walletv1.GrantVipRequest) (*walletv1.GrantVipResponse, error) {
|
|
wallet.vipRequest = request
|
|
return &walletv1.GrantVipResponse{TransactionId: "vip-route"}, nil
|
|
}
|
|
|
|
func (wallet *externalVIPRouteWallet) GrantVipTrialCard(_ context.Context, request *walletv1.GrantVipTrialCardRequest) (*walletv1.GrantVipTrialCardResponse, error) {
|
|
wallet.trialRequest = request
|
|
return &walletv1.GrantVipTrialCardResponse{TrialCard: &walletv1.VipTrialCard{TrialCardId: "trial-route"}}, nil
|
|
}
|