shaw
35748d8c51
- 提升用户为管理员 / 创建管理员账号纳入敏感操作：handler 级 EnforceStepUp 门控 （admin API key 拒绝、未启用 TOTP 拒绝、无 grant 返回 STEP_UP_REQUIRED）， 目标已是管理员的日常编辑不触发 - 管理员启用/停用 2FA 一律使用密码验证（默认通知邮箱常收不到验证码）， verification-method 按用户角色返回；普通用户行为不变 - 用户编辑/创建弹窗接入 useStepUp：命中 STEP_UP_REQUIRED 弹 TOTP 验证并自动重试 - 审计日志清理入口与其他敏感操作对齐：未启用 2FA 时直接提示先启用 TOTP， 不再弹出无法完成的验证码输入框（后端强制现场 TOTP 语义不变） - 审计日志页重构：DataTable 布局、详情弹窗分区展示、时间范围改为 ops 同款 下拉（预设窗口 + 自定义起止支持时分）
87 lines
2.8 KiB
Go
87 lines
2.8 KiB
Go
package admin
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/service"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// 角色提升为管理员的 step-up 门控条件测试。
|
|
// 测试环境不注入认证上下文，因此门控一旦触发会以 401 中止；
|
|
// 借此区分「触发了 step-up 校验」与「直接放行到业务层（200）」。
|
|
func setupRoleStepUpRouter(t *testing.T) (*gin.Engine, *stubAdminService) {
|
|
t.Helper()
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
adminSvc := newStubAdminService()
|
|
// 追加一个已是管理员的目标用户，验证「目标已是 admin 不触发门控」。
|
|
adminSvc.users = append(adminSvc.users, service.User{
|
|
ID: 2,
|
|
Email: "admin@example.com",
|
|
Role: service.RoleAdmin,
|
|
Status: service.StatusActive,
|
|
})
|
|
|
|
h := NewUserHandler(adminSvc, nil, nil, nil, nil, nil)
|
|
router.POST("/api/v1/admin/users", h.Create)
|
|
router.PUT("/api/v1/admin/users/:id", h.Update)
|
|
return router, adminSvc
|
|
}
|
|
|
|
func doJSON(t *testing.T, router *gin.Engine, method, path string, payload map[string]any) *httptest.ResponseRecorder {
|
|
t.Helper()
|
|
body, err := json.Marshal(payload)
|
|
require.NoError(t, err)
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(method, path, bytes.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
router.ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
func TestUpdateUserPromoteToAdminRequiresStepUp(t *testing.T) {
|
|
router, _ := setupRoleStepUpRouter(t)
|
|
|
|
rec := doJSON(t, router, http.MethodPut, "/api/v1/admin/users/1", map[string]any{"role": "admin"})
|
|
require.Equal(t, http.StatusUnauthorized, rec.Code)
|
|
}
|
|
|
|
func TestUpdateUserKeepAdminRoleSkipsStepUp(t *testing.T) {
|
|
router, _ := setupRoleStepUpRouter(t)
|
|
|
|
rec := doJSON(t, router, http.MethodPut, "/api/v1/admin/users/2", map[string]any{"role": "admin"})
|
|
require.Equal(t, http.StatusOK, rec.Code)
|
|
}
|
|
|
|
func TestUpdateUserRegularRoleSkipsStepUp(t *testing.T) {
|
|
router, _ := setupRoleStepUpRouter(t)
|
|
|
|
rec := doJSON(t, router, http.MethodPut, "/api/v1/admin/users/1", map[string]any{"role": "user", "email": "u@example.com"})
|
|
require.Equal(t, http.StatusOK, rec.Code)
|
|
}
|
|
|
|
func TestCreateAdminUserRequiresStepUp(t *testing.T) {
|
|
router, _ := setupRoleStepUpRouter(t)
|
|
|
|
rec := doJSON(t, router, http.MethodPost, "/api/v1/admin/users", map[string]any{
|
|
"email": "new-admin@example.com", "password": "pass123", "role": "admin",
|
|
})
|
|
require.Equal(t, http.StatusUnauthorized, rec.Code)
|
|
}
|
|
|
|
func TestCreateRegularUserSkipsStepUp(t *testing.T) {
|
|
router, _ := setupRoleStepUpRouter(t)
|
|
|
|
rec := doJSON(t, router, http.MethodPost, "/api/v1/admin/users", map[string]any{
|
|
"email": "new-user@example.com", "password": "pass123", "role": "user",
|
|
})
|
|
require.Equal(t, http.StatusOK, rec.Code)
|
|
}
|