R524809
50 lines
1.9 KiB
TypeScript
50 lines
1.9 KiB
TypeScript
import assert from 'node:assert/strict';
|
|
import type { Database } from '@atlas/database';
|
|
import { describe, it } from 'vitest';
|
|
import {
|
|
parseInput,
|
|
sourceInputSchema,
|
|
syncInputSchema,
|
|
} from '../src/platform-catalog-admin/platform-catalog-admin.models.js';
|
|
import { hasSystemAdminGrant } from '../src/platform-catalog-admin/system-admin.guard.js';
|
|
|
|
describe('平台目录系统管理员边界', () => {
|
|
it('只有未撤销且用户有效的数据库授权才被视为系统管理员', async () => {
|
|
const queries: Array<{ sql: string; parameters: unknown[] }> = [];
|
|
const database = {
|
|
query: async (sql: string, parameters: unknown[]) => {
|
|
queries.push({ sql, parameters });
|
|
return { rowCount: 1, rows: [{ '?column?': 1 }] };
|
|
},
|
|
} as unknown as Database;
|
|
|
|
assert.equal(await hasSystemAdminGrant(database, 'user-1'), true);
|
|
assert.deepEqual(queries[0].parameters, ['user-1']);
|
|
assert.match(queries[0].sql, /revoked_at IS NULL/);
|
|
assert.match(queries[0].sql, /user_row\.status = 'active'/);
|
|
});
|
|
|
|
it('同步请求不能混入其他作用域字段', () => {
|
|
assert.throws(() => parseInput(syncInputSchema, {
|
|
scope: 'tree',
|
|
category_id: '3f7e8462-c23c-4a38-ae86-0f3d78503870',
|
|
}));
|
|
assert.throws(() => parseInput(syncInputSchema, {
|
|
scope: 'dictionary',
|
|
attribute_id: 'not-a-uuid',
|
|
}));
|
|
});
|
|
|
|
it('同步来源仅接受 Client-Id 与 Api-Key', () => {
|
|
assert.deepEqual(parseInput(sourceInputSchema, {
|
|
client_id: ' 12345 ',
|
|
api_key: ' secret ',
|
|
}), { client_id: '12345', api_key: 'secret' });
|
|
assert.throws(() => parseInput(sourceInputSchema, {
|
|
client_id: '12345',
|
|
api_key: 'secret',
|
|
workspace_id: 'forbidden',
|
|
}));
|
|
});
|
|
});
|