panda/qipai
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(M02-D): 完成用户与员工权限管理

Browse Source
This commit is contained in:
Codex
2026-06-18 14:45:01 +08:00
parent 46acb8422a
commit 5a300a82f6
21 changed files with 894 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/migration-contract.test.mjs
+10 -1
View File
@@ -24,6 +24,9 @@ const authVerifySql = read('database/migrations/2026061804_m02b_wechat_auth.veri
const rbacUpSql = read('database/migrations/2026061805_m02c_rbac.up.sql');
const rbacDownSql = read('database/migrations/2026061805_m02c_rbac.down.sql');
const rbacVerifySql = read('database/migrations/2026061805_m02c_rbac.verify.sql');
const userManagementUpSql = read('database/migrations/2026061806_m02d_user_management.up.sql');
const userManagementDownSql = read('database/migrations/2026061806_m02d_user_management.down.sql');
const userManagementVerifySql = read('database/migrations/2026061806_m02d_user_management.verify.sql');
const coreTables = [
'qipai_schema_migrations',
@@ -124,5 +127,11 @@ for (const table of [
assert.match(rbacVerifySql, new RegExp(`'${table}'`));
}
assert.match(rbacUpSql, /PRIMARY KEY \(tenant_id, user_id, store_id, scope_type\)/);
assert.match(userManagementUpSql, /CREATE TABLE IF NOT EXISTS qipai_user_admin_profiles/);
assert.match(userManagementDownSql, /DROP TABLE IF EXISTS qipai_user_admin_profiles/);
assert.match(userManagementVerifySql, /'qipai_user_admin_profiles'/);
for (const permission of ['user.read', 'staff.manage', 'session.reset']) {
assert.match(userManagementUpSql, new RegExp(permission.replace('.', '\\.')));
}
console.log('PASS: M01-B through M02-C migration contracts are present.');
console.log('PASS: M01-B through M02-D migration contracts are present.');
backend/tests/migration-runner.test.mjs
+2 -1
View File
@@ -16,7 +16,8 @@ assert.match(plan.file, /2026061601_m01b_core_schema\.up\.sql/);
assert.match(plan.file, /2026061802_m01c_async_tasks\.up\.sql/);
assert.match(plan.file, /2026061803_m02a_tenant_apps\.up\.sql/);
assert.match(plan.file, /2026061804_m02b_wechat_auth\.up\.sql/);
assert.match(plan.file, /2026061805_m02c_rbac\.up\.sql$/);
assert.match(plan.file, /2026061805_m02c_rbac\.up\.sql/);
assert.match(plan.file, /2026061806_m02d_user_management\.up\.sql$/);
assert.match(plan.checksum, /^[a-f0-9]{64}$/);
assert.ok(plan.statements.length >= 11);
backend/tests/mysql-migration-roundtrip.test.mjs
+76 -5
View File
@@ -12,6 +12,7 @@ import {
} from '../dist/tenancy/platform-config-repository.js';
import { AuthRepository } from '../dist/auth/auth-repository.js';
import { RbacRepository } from '../dist/auth/rbac-repository.js';
import { UserManagementRepository } from '../dist/auth/user-management-repository.js';
import {
executeMigrationPlan,
loadMigrationPlan,
@@ -38,6 +39,7 @@ const expectedTables = [
'qipai_tenant_apps',
'qipai_tenant_configs',
'qipai_tenants',
'qipai_user_admin_profiles',
'qipai_user_identities',
'qipai_user_roles',
'qipai_user_store_scopes',
@@ -62,9 +64,9 @@ async function readMigrationVersions(pool) {
const [rows] = await pool.query(
`SELECT version, name
FROM qipai_schema_migrations
WHERE version IN (?, ?, ?, ?, ?)
WHERE version IN (?, ?, ?, ?, ?, ?)
ORDER BY version`,
['2026061601', '2026061802', '2026061803', '2026061804', '2026061805']
['2026061601', '2026061802', '2026061803', '2026061804', '2026061805', '2026061806']
);
return rows;
}
@@ -250,6 +252,69 @@ async function assertRevocableAuthSession(pool, context) {
assert.equal(await repository.validateSession(roleSessionId, context.tenantId, session.user.id), null);
}
async function assertUserManagement(pool, context) {
const [adminResult] = await pool.query(
`INSERT INTO qipai_users (tenant_id, user_type, nickname, phone)
VALUES (?, 'STAFF', 'Tenant Admin', '13800000001')`,
[context.tenantId]
);
const adminId = String(adminResult.insertId);
await pool.query(
`INSERT INTO qipai_user_roles (tenant_id, user_id, role_id)
SELECT ?, ?, id FROM qipai_roles WHERE tenant_id = ? AND code = 'TENANT_ADMIN'`,
[context.tenantId, adminId, context.tenantId]
);
const rbac = new RbacRepository(pool);
const access = await rbac.getAccessProfile(context.tenantId, adminId);
assert.ok(access.capabilities.includes('tenant.manage'));
assert.ok(access.capabilities.includes('staff.manage'));
const [storeResult] = await pool.query(
`INSERT INTO qipai_stores (tenant_id, name) VALUES (?, 'M02D Staff Store')`,
[context.tenantId]
);
const repository = new UserManagementRepository(pool);
const actor = {
tenantId: context.tenantId,
userId: adminId,
access,
traceId: 'm02d-live-test',
ip: '127.0.0.1',
userAgent: 'M02-D live test'
};
const created = await repository.createStaff(actor, {
nickname: 'Live Staff',
phone: '13800000002',
note: 'sanitized live test',
roles: ['STAFF'],
storeIds: [String(storeResult.insertId)]
});
const sessionId = '7197e528-f727-4c85-a490-f5ec1721594c';
await pool.query(
`INSERT INTO qipai_auth_sessions
(id, tenant_id, platform_app_id, user_id, role_version, expires_at)
SELECT ?, ?, ?, id, role_version, DATE_ADD(UTC_TIMESTAMP(3), INTERVAL 1 HOUR)
FROM qipai_users WHERE tenant_id = ? AND id = ?`,
[sessionId, context.tenantId, context.platformAppId, context.tenantId, created.userId]
);
await repository.updateUser(actor, created.userId, {
status: 'DISABLED',
roles: ['STAFF'],
storeIds: [String(storeResult.insertId)]
});
const [sessionRows] = await pool.query(
'SELECT status, revoke_reason AS revokeReason FROM qipai_auth_sessions WHERE id = ?',
[sessionId]
);
assert.deepEqual(sessionRows, [{ status: 'REVOKED', revokeReason: 'ACCESS_CHANGED' }]);
const [auditRows] = await pool.query(
`SELECT action FROM qipai_audit_logs
WHERE tenant_id = ? AND resource_type = 'USER' AND resource_id = ?
ORDER BY id`,
[context.tenantId, created.userId]
);
assert.deepEqual(auditRows.map((row) => row.action), ['STAFF_CREATED', 'USER_UPDATED']);
}
const config = loadConfig();
assert.equal(config.mysql.passwordConfigured, true, 'Live migration test requires a temporary password.');
assert.match(
@@ -278,11 +343,13 @@ try {
{ version: '2026061802', name: 'm01c_async_tasks' },
{ version: '2026061803', name: 'm02a_tenant_apps' },
{ version: '2026061804', name: 'm02b_wechat_auth' },
{ version: '2026061805', name: 'm02c_rbac' }
{ version: '2026061805', name: 'm02c_rbac' },
{ version: '2026061806', name: 'm02d_user_management' }
]);
await assertTaskDurability(pool);
const loginContext = await assertPlatformTenantIsolation(pool);
await assertRevocableAuthSession(pool, loginContext);
await assertUserManagement(pool, loginContext);
await assertLegacyCompatibility(pool);
console.log('PASS: first up, verify, tenant isolation and revocable auth checks completed.');
@@ -299,7 +366,8 @@ try {
{ version: '2026061802', name: 'm01c_async_tasks' },
{ version: '2026061803', name: 'm02a_tenant_apps' },
{ version: '2026061804', name: 'm02b_wechat_auth' },
{ version: '2026061805', name: 'm02c_rbac' }
{ version: '2026061805', name: 'm02c_rbac' },
{ version: '2026061806', name: 'm02d_user_management' }
]);
await assertLegacyCompatibility(pool);
console.log('PASS: second up and verify restored the schema.');
@@ -332,7 +400,10 @@ try {
'session revocation',
'role-version invalidation',
'customer capabilities',
'cross-tenant store grant rejection'
'cross-tenant store grant rejection',
'staff creation and store assignment',
'access-change session revocation',
'user-management audit log'
]
}, null, 2));
} finally {
backend/tests/user-management.test.mjs
+104
View File
@@ -0,0 +1,104 @@
import assert from 'node:assert/strict';
import { buildApp } from '../dist/app.js';
import { signAccessToken } from '../dist/auth/jwt.js';
import { maskIp, maskPhone, UserManagementRepository } from '../dist/auth/user-management-repository.js';
assert.equal(maskPhone('13800138000'), '138****8000');
assert.equal(maskIp('192.168.10.22'), '192.168.*.*');
const calls = [];
const connection = {
async beginTransaction() { calls.push('begin'); },
async commit() { calls.push('commit'); },
async rollback() { calls.push('rollback'); },
release() { calls.push('release'); },
async execute(sql) {
calls.push(sql);
if (sql.includes('SELECT u.id')) return [[{ id: '22' }], []];
return [{ affectedRows: 1, insertId: 22 }, []];
}
};
const repository = new UserManagementRepository({
async getConnection() { return connection; },
async execute() { return [[], []]; }
});
const actor = {
tenantId: '7',
userId: '21',
access: { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] },
traceId: 'trace-test',
ip: '127.0.0.1',
userAgent: 'test'
};
await repository.updateUser(actor, '22', {
status: 'DISABLED',
roles: ['STAFF'],
storeIds: ['11'],
note: '离职'
});
assert.ok(calls.some((sql) => typeof sql === 'string' && sql.includes('qipai_audit_logs')));
assert.ok(calls.some((sql) => typeof sql === 'string' && sql.includes("revoke_reason = 'ACCESS_CHANGED'")));
assert.ok(calls.includes('commit'));
const secret = 'test-only-jwt-secret-with-at-least-32-characters';
const token = signAccessToken({
sub: '21',
sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
tid: '7',
aid: '9',
rv: 1
}, secret, 900);
let createdInput;
const app = await buildApp({
userManagement: {
jwtSecret: secret,
authRepository: {
async validateSession() {
return {
id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
tenantId: '7',
platformAppId: '9',
expiresAt: new Date(Date.now() + 60_000),
user: {
id: '21', tenantId: '7', userType: 'STAFF', status: 'ACTIVE',
roleVersion: 1, nickname: '管理员', avatarUrl: '', phone: '13800138000'
}
};
}
},
accessControl: {
async getAccessProfile() {
return { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] };
}
},
repository: {
async listUsers() { return { items: [], total: 0 }; },
async createStaff(_actor, input) {
createdInput = input;
return { userId: '22' };
},
async updateUser() { return { userId: '22' }; },
async resetSessions() { return { userId: '22', revokedSessions: 2 }; }
}
}
});
const created = await app.inject({
method: 'POST',
url: '/admin-api/staff',
headers: { authorization: `Bearer ${token}` },
payload: {
nickname: '测试员工',
phone: '13800138001',
roles: ['STAFF'],
storeIds: ['11']
}
});
assert.equal(created.statusCode, 201);
assert.equal(created.json().data.userId, '22');
assert.deepEqual(createdInput.storeIds, ['11']);
const unauthenticated = await app.inject({ method: 'GET', url: '/admin-api/users' });
assert.equal(unauthenticated.statusCode, 401);
await app.close();
console.log('PASS: M02-D staff management, session revocation, audit and masked fields are present.');