30 lines
1.1 KiB
Python
30 lines
1.1 KiB
Python
"""RBAC 权限号段一致性（只读，不连库）。
|
|
|
|
规则与动机见 `tools/check_rbac_seed_consistency.py` 的模块说明：权限码的定义源是
|
|
`tools/seed_test_rbac.py` 的 `PERMISSIONS`，各 `grant_*.py` 只能补种子里缺的，
|
|
且 id 必须与种子逐条一致 —— 2026-09-12 曾因两套 id→code 映射并存，
|
|
让 `advisor` 角色在种子重建后静默拿到语义错误的权限。
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
from pathlib import Path
|
|
from types import ModuleType
|
|
|
|
PROJECT_ROOT = Path(__file__).resolve().parents[3]
|
|
|
|
|
|
def _load_tool_module() -> ModuleType:
|
|
path = PROJECT_ROOT / "tools" / "check_rbac_seed_consistency.py"
|
|
spec = importlib.util.spec_from_file_location("check_rbac_seed_consistency", path)
|
|
assert spec is not None and spec.loader is not None
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def test_permission_ids_are_consistent_between_seed_and_grant_scripts() -> None:
|
|
problems = _load_tool_module().collect_findings()
|
|
assert problems == [], "权限号段不一致：\n" + "\n".join(problems)
|