66 lines
3.3 KiB
Python
66 lines
3.3 KiB
Python
|
from uuid import uuid4
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
from sqlalchemy import text
|
||
|
|
|
||
|
|
from app.core.contracts import RequestContext
|
||
|
|
from app.core.errors import UnauthorizedAgentError
|
||
|
|
from app.infrastructure.db import SessionFactory
|
||
|
|
from app.repository.identity_repository import IdentityRepository
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.integration
|
||
|
|
async def test_roles_revocation_expiry_account_status_and_assignments():
|
||
|
|
user_id = uuid4().int % 10**15 + 10**15
|
||
|
|
role_id, permission_id = user_id + 1, user_id + 2
|
||
|
|
async with SessionFactory() as session:
|
||
|
|
try:
|
||
|
|
await session.execute(text("""
|
||
|
|
INSERT INTO sys_user
|
||
|
|
(id,user_no,username,password_hash,user_type,professional_investor_status,
|
||
|
|
fund_account_status,status,created_at,updated_at)
|
||
|
|
VALUES (:id,:name,:name,'test-only','员工','未申请','未开户','正常',UTC_TIMESTAMP(),
|
||
|
|
UTC_TIMESTAMP())
|
||
|
|
"""), {"id": user_id, "name": f"auth-{user_id}"})
|
||
|
|
await session.execute(text("""
|
||
|
|
INSERT INTO sys_role VALUES
|
||
|
|
(:id,:code,'test','active',UTC_TIMESTAMP(),UTC_TIMESTAMP())
|
||
|
|
"""), {"id": role_id, "code": f"role-{role_id}"})
|
||
|
|
await session.execute(text("""
|
||
|
|
INSERT INTO sys_user_role (user_id,role_id,assigned_at)
|
||
|
|
VALUES (:uid,:rid,UTC_TIMESTAMP()-INTERVAL 1 SECOND)
|
||
|
|
"""), {"uid": user_id, "rid": role_id})
|
||
|
|
await session.execute(text("""
|
||
|
|
INSERT INTO sys_permission VALUES
|
||
|
|
(:id,:code,'test','read','own_customers',NULL,UTC_TIMESTAMP(),UTC_TIMESTAMP())
|
||
|
|
"""), {"id": permission_id, "code": f"test:{permission_id}"})
|
||
|
|
await session.execute(text("""
|
||
|
|
INSERT INTO sys_role_permission(role_id,permission_id,created_at)
|
||
|
|
VALUES (:rid,:pid,UTC_TIMESTAMP())
|
||
|
|
"""), {"rid": role_id, "pid": permission_id})
|
||
|
|
await session.execute(text("""
|
||
|
|
INSERT INTO sys_customer_assignment VALUES
|
||
|
|
(:id,:customer,:employee,:role,UTC_TIMESTAMP()-INTERVAL 1 SECOND,NULL)
|
||
|
|
"""), {"id": user_id, "customer": user_id + 100, "employee": user_id,
|
||
|
|
"role": f"test-{user_id}"})
|
||
|
|
identity = RequestContext(user_id=str(user_id), trace_id="test", roles=("admin",),
|
||
|
|
permissions=("forged",), portal="forged")
|
||
|
|
repo = IdentityRepository(session)
|
||
|
|
current = await repo.load_context(identity)
|
||
|
|
assert current.roles == (f"role-{role_id}",)
|
||
|
|
assert current.permissions == (f"test:{permission_id}",)
|
||
|
|
assert current.permission_scopes[f"test:{permission_id}"] == "own_customers"
|
||
|
|
assert current.customer_ids == (str(user_id + 100),)
|
||
|
|
assert current.portal == "api"
|
||
|
|
await session.execute(text("""
|
||
|
|
UPDATE sys_user_role SET expires_at=UTC_TIMESTAMP()-INTERVAL 1 SECOND
|
||
|
|
WHERE user_id=:id
|
||
|
|
"""), {"id": user_id})
|
||
|
|
assert (await repo.load_context(identity)).roles == ()
|
||
|
|
await session.execute(text("UPDATE sys_user SET status='禁用' WHERE id=:id"),
|
||
|
|
{"id": user_id})
|
||
|
|
with pytest.raises(UnauthorizedAgentError):
|
||
|
|
await repo.load_context(identity)
|
||
|
|
finally:
|
||
|
|
await session.rollback()
|