新增

backend/tests/test_roles_rbac.py

@@ -19,7 +19,13 @@ if str(BACKEND_DIR) not in sys.path:
 
 from models.models import Base, Role, User  # noqa: E402
 from auth.passwords import hash_password  # noqa: E402
-from auth.permissions import ACCOUNTS_WRITE, ALL_PERMISSIONS, MENU_USERS  # noqa: E402
+from auth.permissions import (  # noqa: E402
+    ACCOUNTS_WRITE,
+    ALL_PERMISSIONS,
+    MENU_USERS,
+    USERS_MANAGE,
+    expand_paired_permissions,
+)
 from auth.role_service import (  # noqa: E402
     create_role,
     delete_role,
@@ -109,8 +115,35 @@ class RolesRbacTests(unittest.IsolatedAsyncioTestCase):
         payload = await auth_router._build_user_response(self.db, user)
         self.assertEqual(payload.role_label, "运营")
         self.assertFalse(payload.is_admin)
-        self.assertIn(ACCOUNTS_WRITE, payload.permissions)
+        self.assertIn("accounts.create", payload.permissions)
         self.assertNotIn(MENU_USERS, payload.permissions)
+        self.assertNotIn("data.scope_all", payload.permissions)
+
+    async def test_legacy_accounts_write_implies_granular(self):
+        created = await create_role(
+            self.db,
+            code="legacy_ops",
+            label="旧版运营",
+            description=None,
+            permissions=[ACCOUNTS_WRITE, "menu.accounts"],
+        )
+        self.assertTrue(has_permission("legacy_ops", "accounts.start"))
+        self.assertTrue(has_permission("legacy_ops", "accounts.cookie"))
+        self.assertIn(ACCOUNTS_WRITE, created.permissions)
+
+    async def test_data_scope_all_for_custom_role(self):
+        from auth.roles import has_global_scope
+
+        await create_role(
+            self.db,
+            code="auditor",
+            label="审计",
+            description=None,
+            permissions=["menu.accounts", "data.scope_all"],
+        )
+        self.assertTrue(has_global_scope("auditor"))
+        self.assertFalse(has_global_scope("operator"))
+        self.assertTrue(has_global_scope("admin"))
 
     async def test_last_admin_cannot_be_demoted(self):
         admin = User(
@@ -128,6 +161,31 @@ class RolesRbacTests(unittest.IsolatedAsyncioTestCase):
             await guard_last_admin_change(self.db, user=admin, new_role="operator")
         self.assertEqual(caught.exception.status_code, 400)
 
+    async def test_menu_action_pairs_expand(self):
+        expanded = expand_paired_permissions([MENU_USERS])
+        self.assertIn(MENU_USERS, expanded)
+        self.assertIn(USERS_MANAGE, expanded)
+        created = await create_role(
+            self.db,
+            code="hr_desk",
+            label="人事台",
+            description=None,
+            permissions=[MENU_USERS],
+        )
+        self.assertIn(USERS_MANAGE, created.permissions)
+        self.assertNotIn("menu.roles", created.permissions)
+        self.assertNotIn("roles.manage", created.permissions)
+
+        roles_only = await create_role(
+            self.db,
+            code="role_editor",
+            label="角色编辑",
+            description=None,
+            permissions=["menu.roles"],
+        )
+        self.assertIn("roles.manage", roles_only.permissions)
+        self.assertNotIn(USERS_MANAGE, roles_only.permissions)
+
 
 if __name__ == "__main__":
     unittest.main()