Calcium-Ion
4aee5f7d5a
* feat: add casbin admin permissions * feat: improve audit logging to associate logs with actual operators and target users * feat: enhance admin permissions and UI interactions for sensitive actions * Refactor authz RBAC and tighten channel permissions * Split channel authz field policy * Address channel authz review findings
51 lines
2.0 KiB
Go
51 lines
2.0 KiB
Go
package router
|
|
|
|
import (
|
|
"net/http"
|
|
"reflect"
|
|
"testing"
|
|
|
|
"github.com/QuantumNous/new-api/controller"
|
|
"github.com/QuantumNous/new-api/service/authz"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestChannelStatusRoutesUseOperatePermission(t *testing.T) {
|
|
assertChannelRoutePermission(t, http.MethodPost, "/:id/status", authz.ChannelOperate, controller.UpdateChannelStatus)
|
|
assertChannelRoutePermission(t, http.MethodPost, "/status/batch", authz.ChannelOperate, controller.BatchUpdateChannelStatus)
|
|
assertChannelRoutePermission(t, http.MethodPut, "/", authz.ChannelWrite, controller.UpdateChannel)
|
|
}
|
|
|
|
func TestChannelDeleteRoutesUseSensitiveWritePermission(t *testing.T) {
|
|
assertChannelRoutePermission(t, http.MethodDelete, "/:id", authz.ChannelSensitiveWrite, controller.DeleteChannel)
|
|
assertChannelRoutePermission(t, http.MethodPost, "/batch", authz.ChannelSensitiveWrite, controller.DeleteChannelBatch)
|
|
assertChannelRoutePermission(t, http.MethodDelete, "/disabled", authz.ChannelSensitiveWrite, controller.DeleteDisabledChannel)
|
|
assertChannelRoutePermission(t, http.MethodPut, "/", authz.ChannelWrite, controller.UpdateChannel)
|
|
assertChannelRoutePermission(t, http.MethodPut, "/tag", authz.ChannelWrite, controller.EditTagChannels)
|
|
assertChannelRoutePermission(t, http.MethodPost, "/batch/tag", authz.ChannelWrite, controller.BatchSetChannelTag)
|
|
}
|
|
|
|
func TestChannelStatusRoutesRegisterWithoutConflict(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
engine := gin.New()
|
|
api := engine.Group("/api")
|
|
|
|
require.NotPanics(t, func() {
|
|
registerChannelRoutes(api)
|
|
})
|
|
}
|
|
|
|
func assertChannelRoutePermission(t *testing.T, method string, path string, permission authz.Permission, handler any) {
|
|
t.Helper()
|
|
for _, route := range channelPermissionRoutes {
|
|
if route.method == method && route.path == path {
|
|
assert.Equal(t, permission, route.permission)
|
|
assert.Equal(t, reflect.ValueOf(handler).Pointer(), reflect.ValueOf(route.handler).Pointer())
|
|
return
|
|
}
|
|
}
|
|
t.Fatalf("route %s %s not found", method, path)
|
|
}
|