package com.talentcard.server.business.admin.auth;
|
|
import static org.assertj.core.api.Assertions.assertThat;
|
import static org.mockito.ArgumentMatchers.any;
|
import static org.mockito.ArgumentMatchers.anyLong;
|
import static org.mockito.ArgumentMatchers.anyString;
|
import static org.mockito.ArgumentMatchers.eq;
|
import static org.mockito.Mockito.mock;
|
import static org.mockito.Mockito.when;
|
|
import java.util.ArrayList;
|
import java.util.List;
|
|
import com.talentcard.server.common.BusinessException;
|
import com.talentcard.server.common.ErrorCode;
|
import org.junit.jupiter.api.BeforeEach;
|
import org.junit.jupiter.api.Test;
|
import org.springframework.jdbc.core.JdbcTemplate;
|
import org.springframework.mock.web.MockHttpServletRequest;
|
import org.springframework.mock.web.MockHttpServletResponse;
|
import tools.jackson.databind.json.JsonMapper;
|
|
/**
|
* 拦截器的「接口 → 权限码」映射。
|
*
|
* <p>这层映射出过两次事故：一个接口服务多个页面时，推导出来的权限码在角色管理里根本勾不到，
|
* 于是配好权限的员工账号也进不去模块；而权限 403 又被各控制器自带的兜底 advice 改写成 500，
|
* 现场只看到「服务器内部错误」。这里不启动 Spring 上下文，直接盯住这两件事。
|
*/
|
class AdminAuthInterceptorMappingTests {
|
|
private final AdminAuthService service = mock(AdminAuthService.class);
|
private final JdbcTemplate jdbc = mock(JdbcTemplate.class);
|
private final List<List<String>> requested = new ArrayList<>();
|
private AdminAuthInterceptor interceptor;
|
|
@BeforeEach
|
void setUp() {
|
// 运行期注入的是 Jackson 3 的 ObjectMapper（tools.jackson），这里用同一套，别再用 Jackson 2 的。
|
interceptor = new AdminAuthInterceptor(service, jdbc, new JsonMapper());
|
when(service.authenticate(anyString())).thenReturn(1L);
|
when(service.operatorName(anyLong())).thenReturn("测试员工");
|
when(service.hasAnyPermission(anyLong(), any())).thenAnswer(invocation -> {
|
requested.add(invocation.getArgument(1));
|
return true;
|
});
|
}
|
|
@Test
|
void serviceApplicationRequestsAreJudgedByTheirModulePage() {
|
assertThat(pass(get("/api/admin/service-appointment-applications", "applicationType", "MEDICAL_RESERVATION")))
|
.containsExactly("admin.medical-reservations.view");
|
assertThat(pass(get("/api/admin/service-appointment-applications", "applicationType", "FUEL_SERVICE")))
|
.containsExactly("admin.fuel-services.view");
|
assertThat(pass(get("/api/admin/service-appointment-applications/export", "applicationType", "SPOUSE_EMPLOYMENT")))
|
.containsExactly("admin.spouse-employment.export");
|
assertThat(pass(patch("/api/admin/service-appointment-applications", "applicationType", "HOTEL_RESERVATION")))
|
.containsExactly("admin.hotel-reservations.audit");
|
}
|
|
/** 详情页只带 id，得回表查类型，否则又会掉回没人能勾选的 appointment-management。 */
|
@Test
|
void serviceApplicationDetailLooksUpItsTypeFromTheDatabase() {
|
when(jdbc.queryForList(anyString(), eq(String.class), any())).thenReturn(List.of("MEDICAL_APPLICATION"));
|
|
assertThat(pass(get("/api/admin/service-appointment-applications/42")))
|
.containsExactly("admin.medical-applications.view");
|
}
|
|
@Test
|
void unknownServiceApplicationTypeKeepsTheOldPermission() {
|
assertThat(pass(get("/api/admin/service-appointment-applications")))
|
.containsExactly("admin.appointment-management.view");
|
}
|
|
@Test
|
void familyCardRequestsAcceptEitherOfTheTwoPagesThatUseThem() {
|
assertThat(pass(get("/api/admin/dependent-card-applies", "management", "true")))
|
.containsExactly("admin.family-card-applications.view", "admin.family-cards.view");
|
assertThat(pass(patch("/api/admin/dependent-card-applies/15/unbind")))
|
.containsExactly("admin.family-card-applications.audit", "admin.family-cards.disable");
|
assertThat(pass(patch("/api/admin/dependent-card-applies/15/audit")))
|
.containsExactly("admin.family-card-applications.audit");
|
}
|
|
/** 权限不足必须如实回 403，而不是被控制器兜底改写成 500「服务器内部错误」。 */
|
@Test
|
void deniedPermissionIsWrittenAsFourZeroThree() throws Exception {
|
when(service.hasAnyPermission(anyLong(), any())).thenReturn(false);
|
MockHttpServletRequest request = get("/api/admin/service-appointment-applications", "applicationType", "MEDICAL_RESERVATION");
|
MockHttpServletResponse response = new MockHttpServletResponse();
|
|
assertThat(interceptor.preHandle(request, response, new Object())).isFalse();
|
assertThat(response.getStatus()).isEqualTo(403);
|
assertThat(response.getContentAsString()).contains("\"code\":403").contains("当前账号没有该操作权限");
|
}
|
|
/** 会话失效要回 401，前端才会清会话并跳登录页；以前这批接口会把它写成 500。 */
|
@Test
|
void expiredSessionIsWrittenAsFourZeroOne() throws Exception {
|
when(service.authenticate(anyString()))
|
.thenThrow(new BusinessException(ErrorCode.UNAUTHORIZED, "登录已失效，请重新登录"));
|
MockHttpServletResponse response = new MockHttpServletResponse();
|
|
assertThat(interceptor.preHandle(get("/api/admin/dependent-card-applies/15"), response, new Object())).isFalse();
|
assertThat(response.getStatus()).isEqualTo(401);
|
assertThat(response.getContentAsString()).contains("\"code\":401").contains("登录已失效");
|
}
|
|
/** 不在这两个特殊前缀里的接口沿用原来的页面映射。 */
|
@Test
|
void otherAdminRequestsKeepTheirPageMapping() {
|
assertThat(pass(get("/api/admin/business/news"))).containsExactly("admin.news.view");
|
assertThat(pass(patch("/api/admin/parking-plate-submissions/9/audit")))
|
.containsExactly("admin.parking-plates.audit");
|
assertThat(pass(get("/api/admin/management/roles"))).containsExactly("admin.roles.view");
|
}
|
|
private List<String> pass(MockHttpServletRequest request) {
|
requested.clear();
|
try {
|
interceptor.preHandle(request, new MockHttpServletResponse(), new Object());
|
} catch (Exception exception) {
|
throw new AssertionError(exception);
|
}
|
assertThat(requested).as("拦截器应该只校验一次权限").hasSize(1);
|
return requested.get(0);
|
}
|
|
private MockHttpServletRequest get(String uri) {
|
return get(uri, new String[0]);
|
}
|
|
private MockHttpServletRequest get(String uri, String... params) {
|
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
|
request.addHeader("Authorization", "Bearer test-token");
|
for (int index = 0; index + 1 < params.length; index += 2) {
|
request.setParameter(params[index], params[index + 1]);
|
}
|
return request;
|
}
|
|
private MockHttpServletRequest patch(String uri, String... params) {
|
MockHttpServletRequest request = new MockHttpServletRequest("PATCH", uri);
|
request.addHeader("Authorization", "Bearer test-token");
|
for (int index = 0; index + 1 < params.length; index += 2) {
|
request.setParameter(params[index], params[index + 1]);
|
}
|
return request;
|
}
|
}
|
