182 lines
7.0 KiB
Python
182 lines
7.0 KiB
Python
|
# -*- coding: utf-8 -*-
|
|||
|
|
"""三级 RBAC 权限模型测试（issue #62）。
|
|||
|
|
|
|||
|
|
覆盖：
|
|||
|
|
1. 三级角色权限矩阵正确（readonly/engineer/admin）；
|
|||
|
|
2. 角色继承（admin 继承 engineer 继承 readonly）；
|
|||
|
|
3. has_permission 允许/拒绝判定 + 理由可解释；
|
|||
|
|
4. 细粒度收窄（restricted_to_readonly 把写动作降级拒绝）；
|
|||
|
|
5. 便捷判定 can_publish / 用户概览。
|
|||
|
|
"""
|
|||
|
|
import os
|
|||
|
|
import sys
|
|||
|
|
import unittest
|
|||
|
|
|
|||
|
|
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
|||
|
|
import _bootstrap # noqa: F401
|
|||
|
|
|
|||
|
|
from template_console.rbac import ( # noqa: E402
|
|||
|
|
Action,
|
|||
|
|
Permission,
|
|||
|
|
Resource,
|
|||
|
|
Role,
|
|||
|
|
RoleKind,
|
|||
|
|
User,
|
|||
|
|
all_roles,
|
|||
|
|
can_publish,
|
|||
|
|
effective_permissions,
|
|||
|
|
get_role,
|
|||
|
|
has_permission,
|
|||
|
|
user_summary,
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
|
|||
|
|
class RoleRegistryTest(unittest.TestCase):
|
|||
|
|
"""三级角色注册表。"""
|
|||
|
|
|
|||
|
|
def test_three_roles_present(self):
|
|||
|
|
roles = {r.kind for r in all_roles()}
|
|||
|
|
self.assertEqual(roles, {RoleKind.READONLY, RoleKind.ENGINEER, RoleKind.ADMIN})
|
|||
|
|
|
|||
|
|
def test_role_labels_in_chinese(self):
|
|||
|
|
self.assertEqual(get_role(RoleKind.READONLY).label, "只读")
|
|||
|
|
self.assertEqual(get_role(RoleKind.ENGINEER).label, "行业工程师")
|
|||
|
|
self.assertEqual(get_role(RoleKind.ADMIN).label, "管理员")
|
|||
|
|
|
|||
|
|
def test_role_descriptions_explainable(self):
|
|||
|
|
# 可解释性：每个角色都有职责说明
|
|||
|
|
for role in all_roles():
|
|||
|
|
self.assertTrue(role.description, f"{role.kind} 缺少 description")
|
|||
|
|
|
|||
|
|
def test_inheritance_chain(self):
|
|||
|
|
self.assertEqual(get_role(RoleKind.ADMIN).inherits, RoleKind.ENGINEER)
|
|||
|
|
self.assertEqual(get_role(RoleKind.ENGINEER).inherits, RoleKind.READONLY)
|
|||
|
|
self.assertIsNone(get_role(RoleKind.READONLY).inherits)
|
|||
|
|
|
|||
|
|
def test_permission_key_format(self):
|
|||
|
|
p = Permission(RoleKind.ADMIN, Resource.USER, Action.MANAGE)
|
|||
|
|
# 匹配键为资源:动作（角色无关，便于继承）；审计键含授予角色
|
|||
|
|
self.assertEqual(p.key(), "user:manage")
|
|||
|
|
self.assertEqual(p.audit_key(), "admin:user:manage")
|
|||
|
|
|
|||
|
|
|
|||
|
|
class EffectivePermissionTest(unittest.TestCase):
|
|||
|
|
"""继承后的有效权限集合。"""
|
|||
|
|
|
|||
|
|
def test_admin_inherits_engineer_and_readonly(self):
|
|||
|
|
eff = effective_permissions(RoleKind.ADMIN)
|
|||
|
|
# 匹配键为 resource:action：admin 拥有自身的 user:manage，
|
|||
|
|
# 也继承 engineer 的 model_param:edit 与 readonly 的 layout:view
|
|||
|
|
self.assertIn("user:manage", eff)
|
|||
|
|
self.assertIn("model_param:edit", eff)
|
|||
|
|
self.assertIn("layout:view", eff)
|
|||
|
|
|
|||
|
|
def test_engineer_cannot_publish(self):
|
|||
|
|
eff = effective_permissions(RoleKind.ENGINEER)
|
|||
|
|
# 工程师不能发布/推送/管用户
|
|||
|
|
self.assertNotIn("release:publish", eff)
|
|||
|
|
self.assertNotIn("push:publish", eff)
|
|||
|
|
self.assertNotIn("user:manage", eff)
|
|||
|
|
|
|||
|
|
def test_readonly_has_no_write(self):
|
|||
|
|
eff = effective_permissions(RoleKind.READONLY)
|
|||
|
|
for key in eff:
|
|||
|
|
# 只读权限只能以 :view 结尾
|
|||
|
|
self.assertTrue(key.endswith(":view"), f"readonly 不应有写/发布权限: {key}")
|
|||
|
|
|
|||
|
|
|
|||
|
|
class HasPermissionTest(unittest.TestCase):
|
|||
|
|
"""has_permission 判定 + 理由。"""
|
|||
|
|
|
|||
|
|
def setUp(self):
|
|||
|
|
self.ro = User("viewer", RoleKind.READONLY, "查看员")
|
|||
|
|
self.eng = User("li_engineer", RoleKind.ENGINEER, "李工")
|
|||
|
|
self.admin = User("root_admin", RoleKind.ADMIN, "管理员甲")
|
|||
|
|
|
|||
|
|
def test_readonly_view_allowed(self):
|
|||
|
|
d = has_permission(self.ro, Resource.LAYOUT, Action.VIEW)
|
|||
|
|
self.assertTrue(d.allow)
|
|||
|
|
self.assertEqual(d.source, "explicit")
|
|||
|
|
|
|||
|
|
def test_readonly_edit_denied(self):
|
|||
|
|
d = has_permission(self.ro, Resource.LAYOUT, Action.EDIT)
|
|||
|
|
self.assertFalse(d.allow)
|
|||
|
|
self.assertIn("缺少权限", d.reason)
|
|||
|
|
|
|||
|
|
def test_engineer_edit_allowed_inherited_view(self):
|
|||
|
|
# 工程师编辑是本角色权限（explicit）
|
|||
|
|
d_edit = has_permission(self.eng, Resource.LAYOUT, Action.EDIT)
|
|||
|
|
self.assertTrue(d_edit.allow)
|
|||
|
|
self.assertEqual(d_edit.source, "explicit")
|
|||
|
|
# 工程师查看布局是继承自 readonly（inherited）
|
|||
|
|
d_view = has_permission(self.eng, Resource.LAYOUT, Action.VIEW)
|
|||
|
|
self.assertTrue(d_view.allow)
|
|||
|
|
self.assertEqual(d_view.source, "inherited")
|
|||
|
|
|
|||
|
|
def test_engineer_publish_denied(self):
|
|||
|
|
d = has_permission(self.eng, Resource.RELEASE, Action.PUBLISH)
|
|||
|
|
self.assertFalse(d.allow)
|
|||
|
|
|
|||
|
|
def test_admin_publish_allowed(self):
|
|||
|
|
d = has_permission(self.admin, Resource.RELEASE, Action.PUBLISH)
|
|||
|
|
self.assertTrue(d.allow)
|
|||
|
|
self.assertEqual(d.source, "explicit")
|
|||
|
|
|
|||
|
|
def test_admin_inherited_engineer_edit(self):
|
|||
|
|
d = has_permission(self.admin, Resource.MODEL_PARAM, Action.EDIT)
|
|||
|
|
self.assertTrue(d.allow)
|
|||
|
|
self.assertEqual(d.source, "inherited")
|
|||
|
|
|
|||
|
|
def test_decision_carries_reason(self):
|
|||
|
|
# 可解释性：无论允许/拒绝，reason 非空且含用户名与资源
|
|||
|
|
for user in (self.ro, self.eng, self.admin):
|
|||
|
|
d = has_permission(user, Resource.PUSH, Action.PUBLISH)
|
|||
|
|
self.assertIn(user.username, d.reason)
|
|||
|
|
self.assertIn(Resource.PUSH.value, d.reason)
|
|||
|
|
|
|||
|
|
|
|||
|
|
class RestrictedUserTest(unittest.TestCase):
|
|||
|
|
"""细粒度收窄：restricted_to_readonly。"""
|
|||
|
|
|
|||
|
|
def test_restricted_engineer_cannot_edit_that_resource(self):
|
|||
|
|
# 工程师本可编辑布局，但被收窄为只读后应拒绝
|
|||
|
|
u = User("limited", RoleKind.ENGINEER, "受限工程师",
|
|||
|
|
restricted_to_readonly=[Resource.LAYOUT])
|
|||
|
|
d = has_permission(u, Resource.LAYOUT, Action.EDIT)
|
|||
|
|
self.assertFalse(d.allow)
|
|||
|
|
self.assertEqual(d.source, "restricted")
|
|||
|
|
|
|||
|
|
def test_restricted_engineer_can_still_view(self):
|
|||
|
|
u = User("limited", RoleKind.ENGINEER, "受限工程师",
|
|||
|
|
restricted_to_readonly=[Resource.LAYOUT])
|
|||
|
|
d = has_permission(u, Resource.LAYOUT, Action.VIEW)
|
|||
|
|
self.assertTrue(d.allow)
|
|||
|
|
|
|||
|
|
def test_restricted_only_affects_named_resource(self):
|
|||
|
|
u = User("limited", RoleKind.ENGINEER, "受限工程师",
|
|||
|
|
restricted_to_readonly=[Resource.LAYOUT])
|
|||
|
|
# 模型超参未被收窄，仍可编辑
|
|||
|
|
d = has_permission(u, Resource.MODEL_PARAM, Action.EDIT)
|
|||
|
|
self.assertTrue(d.allow)
|
|||
|
|
|
|||
|
|
|
|||
|
|
class ConvenienceTest(unittest.TestCase):
|
|||
|
|
"""便捷判定与用户概览。"""
|
|||
|
|
|
|||
|
|
def test_can_publish(self):
|
|||
|
|
self.assertFalse(can_publish(User("v", RoleKind.READONLY)))
|
|||
|
|
self.assertFalse(can_publish(User("e", RoleKind.ENGINEER)))
|
|||
|
|
self.assertTrue(can_publish(User("a", RoleKind.ADMIN)))
|
|||
|
|
|
|||
|
|
def test_user_summary(self):
|
|||
|
|
s = user_summary(User("li", RoleKind.ENGINEER, "李工"))
|
|||
|
|
self.assertEqual(s["username"], "li")
|
|||
|
|
self.assertEqual(s["role"], "engineer")
|
|||
|
|
self.assertEqual(s["role_label"], "行业工程师")
|
|||
|
|
self.assertGreater(s["effective_permission_count"], 0)
|
|||
|
|
self.assertEqual(s["restricted_to_readonly"], [])
|
|||
|
|
|
|||
|
|
|
|||
|
|
if __name__ == "__main__":
|
|||
|
|
unittest.main()
|