67 lines
2.0 KiB
Go
67 lines
2.0 KiB
Go
package casbin
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
casbinv2 "github.com/casbin/casbin/v2"
|
|
"github.com/casbin/casbin/v2/model"
|
|
)
|
|
|
|
const testModel = `
|
|
[request_definition]
|
|
r = sub, obj, act
|
|
|
|
[policy_definition]
|
|
p = sub, obj, act
|
|
|
|
[role_definition]
|
|
g = _, _
|
|
|
|
[policy_effect]
|
|
e = some(where (p.eft == allow))
|
|
|
|
[matchers]
|
|
m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, p.act)
|
|
`
|
|
|
|
func TestEnforcerPermissions(t *testing.T) {
|
|
m, err := model.NewModelFromString(testModel)
|
|
if err != nil {
|
|
t.Fatalf("创建Casbin测试模型失败: %v", err)
|
|
}
|
|
enforcer, err := casbinv2.NewEnforcer(m)
|
|
if err != nil {
|
|
t.Fatalf("创建Casbin测试实例失败: %v", err)
|
|
}
|
|
|
|
assertPermission(t, enforcer, "admin", "/", http.MethodGet, false)
|
|
if ok, addErr := enforcer.AddPolicy("admin", "*", ActionAll); addErr != nil || !ok {
|
|
t.Fatalf("添加管理员策略失败: ok=%v err=%v", ok, addErr)
|
|
}
|
|
assertPermission(t, enforcer, "admin", "/", http.MethodGet, true)
|
|
|
|
if ok, addErr := enforcer.AddPolicy("user1", "/api/v1/*", ActionAll); addErr != nil || !ok {
|
|
t.Fatalf("添加用户策略失败: ok=%v err=%v", ok, addErr)
|
|
}
|
|
assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodPost, true)
|
|
assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodGet, true)
|
|
assertPermission(t, enforcer, "user1", "/api/v2/user/list", http.MethodGet, false)
|
|
|
|
if ok, deleteErr := enforcer.DeletePermissionsForUser("user1"); deleteErr != nil || !ok {
|
|
t.Fatalf("删除用户策略失败: ok=%v err=%v", ok, deleteErr)
|
|
}
|
|
assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodGet, false)
|
|
}
|
|
|
|
func assertPermission(t *testing.T, enforcer *casbinv2.Enforcer, user, path, method string, expected bool) {
|
|
t.Helper()
|
|
actual, err := enforcer.Enforce(user, path, method)
|
|
if err != nil {
|
|
t.Fatalf("检查权限失败: %v", err)
|
|
}
|
|
if actual != expected {
|
|
t.Fatalf("权限结果不符 user=%s path=%s method=%s expected=%v actual=%v", user, path, method, expected, actual)
|
|
}
|
|
}
|