feat: 完成鸽达达后台安全与审计改造

server/internal/library/casbin/casbin_test.go

@@ -1,67 +1,66 @@
-// Package casbin
-// @Link  https://github.com/bufanyun/hotgo
-// @Copyright  Copyright (c) 2023 HotGo CLI
-// @Author  Ms <133814250@qq.com>
-// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
 package casbin
 
 import (
-	"context"
 	"net/http"
 	"testing"
+
+	casbinv2 "github.com/casbin/casbin/v2"
+	"github.com/casbin/casbin/v2/model"
 )
 
-// TestNew description
-func TestNew(t *testing.T) {
+const testModel = `
+[request_definition]
+r = sub, obj, act
 
-	InitEnforcer(context.TODO())
+[policy_definition]
+p = sub, obj, act
 
-	user := "admin"
-	path := "/"
-	method := http.MethodGet
-	t.Logf("\nuser:%v\npath:%v\nmethod:%v", user, path, method)
+[role_definition]
+g = _, _
 
-	ok, err := Enforcer.DeletePermissionsForUser(user)
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, p.act)
+`
+
+func TestEnforcerPermissions(t *testing.T) {
+	m, err := model.NewModelFromString(testModel)
 	if err != nil {
-		t.Error(err)
+		t.Fatalf("创建Casbin测试模型失败: %v", err)
 	}
-	t.Logf("delete user premission:%v", ok)
-	CheckPremission(t, user, path, method)
-	AddPremission(t, user, "*", ActionAll)
-	CheckPremission(t, user, path, method)
-
-	user1 := "user1"
-	path1 := "/api/v1/*"
-	checkPathTrue := "/api/v1/user/list"
-	checkPathFalse := "/api/v2/user/list"
-	AddPremission(t, user1, path1, ActionAll)
-	CheckPremission(t, user1, checkPathTrue, ActionPost)
-	CheckPremission(t, user1, checkPathFalse, http.MethodGet)
-	CheckPremission(t, user1, checkPathTrue, http.MethodGet)
-	CheckPremission(t, user1, "/api/v1/user/list2", http.MethodGet)
-
-	ok, err = Enforcer.DeletePermissionsForUser(user1)
+	enforcer, err := casbinv2.NewEnforcer(m)
 	if err != nil {
-		t.Error(err)
+		t.Fatalf("创建Casbin测试实例失败: %v", err)
 	}
-	t.Logf("delete user premission:%v", ok)
-	CheckPremission(t, user1, "/api/v1/user1/list", http.MethodGet)
+
+	assertPermission(t, enforcer, "admin", "/", http.MethodGet, false)
+	if ok, addErr := enforcer.AddPolicy("admin", "*", ActionAll); addErr != nil || !ok {
+		t.Fatalf("添加管理员策略失败: ok=%v err=%v", ok, addErr)
+	}
+	assertPermission(t, enforcer, "admin", "/", http.MethodGet, true)
+
+	if ok, addErr := enforcer.AddPolicy("user1", "/api/v1/*", ActionAll); addErr != nil || !ok {
+		t.Fatalf("添加用户策略失败: ok=%v err=%v", ok, addErr)
+	}
+	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodPost, true)
+	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodGet, true)
+	assertPermission(t, enforcer, "user1", "/api/v2/user/list", http.MethodGet, false)
+
+	if ok, deleteErr := enforcer.DeletePermissionsForUser("user1"); deleteErr != nil || !ok {
+		t.Fatalf("删除用户策略失败: ok=%v err=%v", ok, deleteErr)
+	}
+	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodGet, false)
 }
 
-// CheckPremission description
-func CheckPremission(t *testing.T, user string, path string, method string) {
-	ok, err := Enforcer.Enforce(user, path, method)
+func assertPermission(t *testing.T, enforcer *casbinv2.Enforcer, user, path, method string, expected bool) {
+	t.Helper()
+	actual, err := enforcer.Enforce(user, path, method)
 	if err != nil {
-		t.Error(err)
+		t.Fatalf("检查权限失败: %v", err)
 	}
-	t.Logf("check \tuser[%s] \tpremission[%s] \tpath[%s] \tallow[%v]", user, method, path, ok)
-}
-
-// Add description
-func AddPremission(t *testing.T, user string, path string, method string) {
-	ok, err := Enforcer.AddPolicy(user, path, method)
-	if err != nil {
-		t.Error(err)
+	if actual != expected {
+		t.Fatalf("权限结果不符 user=%s path=%s method=%s expected=%v actual=%v", user, path, method, expected, actual)
 	}
-	t.Logf("add \tuser[%s] \tpremission[%s] \tpath[%s] \tresult[%v]", user, method, path, ok)
 }