Merge branch 'master' into UI-09-03

2026-09-09 12:19:39 +08:00
parent 40319eea41 c1f7287331
commit 691c749f34
8 changed files with 265 additions and 7 deletions
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+require dirname(__DIR__) . '/vendor/autoload.php';
+
+use app\common\enum\AdminTerminalEnum;
+
+function adminDesktopExpect(bool $condition, string $message): void
+{
+    if (!$condition) {
+        fwrite(STDERR, "FAIL: {$message}\n");
+        exit(1);
+    }
+}
+
+adminDesktopExpect(AdminTerminalEnum::WECOM_RPA === 7, 'desktop admin terminal remains 7');
+
+$validator = file_get_contents(dirname(__DIR__) . '/app/adminapi/validate/LoginValidate.php');
+$controller = file_get_contents(dirname(__DIR__) . '/app/adminapi/controller/DesktopController.php');
+adminDesktopExpect(is_string($validator) && is_string($controller), 'desktop auth sources are readable');
+adminDesktopExpect(
+    str_contains($validator, 'AdminTerminalEnum::WECOM_RPA'),
+    'admin login accepts the dedicated desktop terminal'
+);
+adminDesktopExpect(
+    str_contains($controller, "public array \$notNeedLogin = ['session'];")
+        && str_contains($controller, "'user_id' => 'admin:'")
+        && str_contains($controller, "'account_type' => 'admin'"),
+    'desktop session verifies an admin token and namespaces its tenant identity'
+);
+
+echo "OK\n";
@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+namespace app\common\model\auth {
+    // 所有账号/角色数据在内存中，测试不连接业务数据库。
+    class Admin extends \ArrayObject
+    {
+        public static array $row = [];
+        public static function where(array $filter): self
+        {
+            if ($filter !== ['id' => 9]) { throw new \RuntimeException('wrong identity lookup'); }
+            return new self(self::$row);
+        }
+        public function field(string $fields): self { return $this; }
+        public function findOrEmpty(): self { return $this; }
+        public function isEmpty(): bool { return $this->count() === 0; }
+    }
+    class AdminRole
+    {
+        public static function where(string $field, int $id): self
+        {
+            if ($field !== 'admin_id' || $id !== 9) { throw new \RuntimeException('wrong role lookup'); }
+            return new self();
+        }
+        public function column(string $field): array { return ['3', '2', '3']; }
+    }
+}
+namespace app\adminapi\logic\auth {
+    class AuthLogic
+    {
+        public static array $permissions = ['tcm.diagnosis/lists'];
+        public static function getBtnAuthByRoleId(array $admin): array
+        {
+            if ($admin['id'] !== 9 || $admin['role_id'] !== [2, 3]) {
+                throw new \RuntimeException('wrong permission identity');
+            }
+            return $admin['root'] ? ['*'] : self::$permissions;
+        }
+    }
+}
+namespace {
+    require dirname(__DIR__) . '/vendor/autoload.php';
+    require dirname(__DIR__) . '/vendor/topthink/framework/src/helper.php';
+    use app\adminapi\controller\DesktopController;
+    use app\adminapi\http\middleware\AuthMiddleware;
+    use app\adminapi\logic\auth\AuthLogic;
+    use app\common\model\auth\Admin;
+
+    $app = new think\App();
+    final class DesktopSessionFixture extends DesktopController
+    {
+        public function __construct(think\Request $request) { $this->request = $request; }
+        protected function data($data) { return ['code' => 1, 'data' => $data]; }
+        protected function fail(string $msg = 'fail', array $data = [], int $code = 0, int $show = 1)
+        {
+            return ['code' => $code, 'msg' => $msg];
+        }
+    }
+    function desktopCheck(bool $ok, string $message): void
+    {
+        if (!$ok) { throw new RuntimeException($message); }
+    }
+    $valid = ['admin_id' => 9, 'terminal' => 7, 'expire_time' => time() + 3600,
+              'root' => 0, 'login_ip' => '198.51.100.10'];
+    $invoke = function (array $identity, string $action = 'session') use ($app) {
+        $request = (new think\Request())->withServer(['REMOTE_ADDR' => '203.0.113.20']);
+        $request->setAction($action);
+        $request->setController('Desktop');
+        $request->adminInfo = $identity;
+        $controller = new DesktopSessionFixture($request);
+        $request->controllerObject = $controller;
+        $app->instance('request', $request);
+        return (new AuthMiddleware())->handle($request, static fn() => $controller->session());
+    };
+    Admin::$row = ['id' => 9, 'account' => 'doctor9', 'name' => '医助',
+                   'avatar' => '', 'disable' => 0, 'root' => 0];
+    $result = $invoke($valid);
+    desktopCheck($result['code'] === 1, 'valid desktop session works across different IPs');
+    desktopCheck($result['data']['user_id'] === 'admin:9', 'account is namespaced');
+    desktopCheck($result['data']['role_ids'] === [2, 3], 'current roles are normalized');
+    desktopCheck($result['data']['permissions'] === ['tcm.diagnosis/lists'], 'current permissions returned');
+    desktopCheck($result['data']['root'] === false, 'ordinary account stays ordinary');
+    desktopCheck(!isset($result['data']['token']) && !isset($result['data']['login_ip']), 'minimal response');
+
+    AuthLogic::$permissions = [];
+    desktopCheck($invoke($valid)['data']['permissions'] === [], 'empty permissions remain empty');
+    Admin::$row['root'] = 1;
+    desktopCheck($invoke($valid)['data']['permissions'] === ['*'], 'current root privilege returned');
+    desktopCheck($invoke($valid)['data']['root'] === true, 'root comes from current account');
+    Admin::$row['root'] = 0;
+
+    desktopCheck($invoke([])['code'] === 0, 'missing or expired cached identity rejected');
+    desktopCheck($invoke(array_replace($valid, ['terminal' => 1]))['code'] === 0, 'web token rejected');
+    Admin::$row['disable'] = 1;
+    desktopCheck($invoke($valid)['code'] === 0, 'disabled account rejected');
+    Admin::$row = [];
+    desktopCheck($invoke($valid)['code'] === 0, 'deleted account rejected');
+
+    $webResult = $invoke($valid, 'mySelf')->getData();
+    desktopCheck($webResult['code'] === -1 && str_contains($webResult['msg'], 'ip地址'),
+                 'ordinary web requests retain IP validation');
+    echo "AdminDesktopSessionBehaviorTest passed\n";
+}