90 lines
3.2 KiB
Python
90 lines
3.2 KiB
Python
"""造 RBAC 测试数据，验证真实链路身份加载与越权拦截。
|
|
|
|
数据使用 9001/9002 号段，便于清理，不影响业务数据。
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
from datetime import UTC, datetime
|
|
|
|
from sqlalchemy import text
|
|
|
|
from app.core.contracts import RequestContext
|
|
from app.infrastructure.db import SessionFactory
|
|
from app.service.identity_service import IdentityService
|
|
|
|
CUSTOMER_USER = "9001"
|
|
RISK_USER = "9002"
|
|
|
|
|
|
async def seed() -> None:
|
|
now = datetime.now(UTC).replace(tzinfo=None)
|
|
async with SessionFactory() as session:
|
|
await session.execute(text("DELETE FROM sys_role_permission WHERE role_id IN (9001,9002)"))
|
|
await session.execute(text("DELETE FROM sys_user_role WHERE user_id IN (9001,9002)"))
|
|
await session.execute(text("DELETE FROM sys_permission WHERE id=9001"))
|
|
await session.execute(text("DELETE FROM sys_role WHERE id IN (9001,9002)"))
|
|
await session.execute(text("DELETE FROM sys_user WHERE id IN (9001,9002)"))
|
|
await session.execute(
|
|
text(
|
|
"INSERT INTO sys_user (id, user_no, username, password_hash, user_type,"
|
|
" professional_investor_status, fund_account_status, status, created_at, updated_at)"
|
|
" VALUES (9001,'T-CUST','cust_t','x','customer','none','closed','正常',:now,:now),"
|
|
" (9002,'T-RISK','risk_t','x','employee','none','closed','正常',:now,:now)"
|
|
),
|
|
{"now": now},
|
|
)
|
|
await session.execute(
|
|
text(
|
|
"INSERT INTO sys_role (id, role_code, role_name, status, created_at, updated_at)"
|
|
" VALUES (9001,'customer','客户','active',:now,:now),"
|
|
" (9002,'risk_operator','风控专员','active',:now,:now)"
|
|
),
|
|
{"now": now},
|
|
)
|
|
await session.execute(
|
|
text(
|
|
"INSERT INTO sys_permission"
|
|
" (id, permission_code, resource, action, data_scope, created_at, updated_at)"
|
|
" VALUES (9001,'agent:run','agent','run','self',:now,:now)"
|
|
),
|
|
{"now": now},
|
|
)
|
|
await session.execute(
|
|
text(
|
|
"INSERT INTO sys_user_role (user_id, role_id, assigned_at)"
|
|
" VALUES (9001,9001,:now),(9002,9002,:now)"
|
|
),
|
|
{"now": now},
|
|
)
|
|
await session.execute(
|
|
text(
|
|
"INSERT INTO sys_role_permission (role_id, permission_id, created_at)"
|
|
" VALUES (9001,9001,:now),(9002,9001,:now)"
|
|
),
|
|
{"now": now},
|
|
)
|
|
await session.commit()
|
|
|
|
|
|
async def verify() -> None:
|
|
service = IdentityService()
|
|
for label, user_id in (("customer", CUSTOMER_USER), ("risk_operator", RISK_USER)):
|
|
context = await service.resolve(
|
|
RequestContext(user_id=user_id, trace_id="verify-trace")
|
|
)
|
|
print(
|
|
f"{label:14s} roles={context.roles} permissions={context.permissions} "
|
|
f"portal={context.portal} data_scope={context.data_scope}"
|
|
)
|
|
|
|
|
|
async def main() -> None:
|
|
await seed()
|
|
await verify()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
asyncio.run(main())
|