feat(M02-D): 完成用户与员工权限管理

2026-06-18 14:45:01 +08:00
parent 46acb8422a
commit 5a300a82f6
21 changed files with 894 additions and 40 deletions
@@ -0,0 +1,104 @@
+import assert from 'node:assert/strict';
+import { buildApp } from '../dist/app.js';
+import { signAccessToken } from '../dist/auth/jwt.js';
+import { maskIp, maskPhone, UserManagementRepository } from '../dist/auth/user-management-repository.js';
+
+assert.equal(maskPhone('13800138000'), '138****8000');
+assert.equal(maskIp('192.168.10.22'), '192.168.*.*');
+
+const calls = [];
+const connection = {
+  async beginTransaction() { calls.push('begin'); },
+  async commit() { calls.push('commit'); },
+  async rollback() { calls.push('rollback'); },
+  release() { calls.push('release'); },
+  async execute(sql) {
+    calls.push(sql);
+    if (sql.includes('SELECT u.id')) return [[{ id: '22' }], []];
+    return [{ affectedRows: 1, insertId: 22 }, []];
+  }
+};
+const repository = new UserManagementRepository({
+  async getConnection() { return connection; },
+  async execute() { return [[], []]; }
+});
+const actor = {
+  tenantId: '7',
+  userId: '21',
+  access: { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] },
+  traceId: 'trace-test',
+  ip: '127.0.0.1',
+  userAgent: 'test'
+};
+await repository.updateUser(actor, '22', {
+  status: 'DISABLED',
+  roles: ['STAFF'],
+  storeIds: ['11'],
+  note: '离职'
+});
+assert.ok(calls.some((sql) => typeof sql === 'string' && sql.includes('qipai_audit_logs')));
+assert.ok(calls.some((sql) => typeof sql === 'string' && sql.includes("revoke_reason = 'ACCESS_CHANGED'")));
+assert.ok(calls.includes('commit'));
+
+const secret = 'test-only-jwt-secret-with-at-least-32-characters';
+const token = signAccessToken({
+  sub: '21',
+  sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
+  tid: '7',
+  aid: '9',
+  rv: 1
+}, secret, 900);
+let createdInput;
+const app = await buildApp({
+  userManagement: {
+    jwtSecret: secret,
+    authRepository: {
+      async validateSession() {
+        return {
+          id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
+          tenantId: '7',
+          platformAppId: '9',
+          expiresAt: new Date(Date.now() + 60_000),
+          user: {
+            id: '21', tenantId: '7', userType: 'STAFF', status: 'ACTIVE',
+            roleVersion: 1, nickname: '管理员', avatarUrl: '', phone: '13800138000'
+          }
+        };
+      }
+    },
+    accessControl: {
+      async getAccessProfile() {
+        return { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] };
+      }
+    },
+    repository: {
+      async listUsers() { return { items: [], total: 0 }; },
+      async createStaff(_actor, input) {
+        createdInput = input;
+        return { userId: '22' };
+      },
+      async updateUser() { return { userId: '22' }; },
+      async resetSessions() { return { userId: '22', revokedSessions: 2 }; }
+    }
+  }
+});
+const created = await app.inject({
+  method: 'POST',
+  url: '/admin-api/staff',
+  headers: { authorization: `Bearer ${token}` },
+  payload: {
+    nickname: '测试员工',
+    phone: '13800138001',
+    roles: ['STAFF'],
+    storeIds: ['11']
+  }
+});
+assert.equal(created.statusCode, 201);
+assert.equal(created.json().data.userId, '22');
+assert.deepEqual(createdInput.storeIds, ['11']);
+
+const unauthenticated = await app.inject({ method: 'GET', url: '/admin-api/users' });
+assert.equal(unauthenticated.statusCode, 401);
+await app.close();
+
+console.log('PASS: M02-D staff management, session revocation, audit and masked fields are present.');