java-project/baiyue-firstleg
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(appointments): require canonical dispatch calendar permission

Browse Source
This commit is contained in:
ouyangxq
2026-10-20 17:02:20 +08:00
parent 6f31fa2131
commit 03a7e66fab
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java
+9 -6
View File
@@ -12,20 +12,23 @@ import static org.assertj.core.api.Assertions.*;
import static org.mockito.Mockito.*; import static org.mockito.Mockito.*;
class FleetTripAuthorizationTest { class FleetTripAuthorizationTest {
@Test void calendarRequiresTripReadPermissionThroughMethodSecurity() { /** 日历按现行排车只读权限放行，预约和旧车次权限不能替代。 */
@Test void calendarRequiresDispatchReadPermissionThroughMethodSecurity() {
try (var context = new AnnotationConfigApplicationContext(Config.class)) { try (var context = new AnnotationConfigApplicationContext(Config.class)) {
var controller = context.getBean(PlatformFleetTripController.class); var controller = context.getBean(PlatformFleetTripController.class);
var calendar = context.getBean(FleetTripCalendarService.class); var calendar = context.getBean(FleetTripCalendarService.class);
var from = java.time.Instant.parse("2026-10-01T00:00:00Z"); var from = java.time.Instant.parse("2026-10-01T00:00:00Z");
var to = from.plusSeconds(86400); var to = from.plusSeconds(86400);
var user = new com.baiyue.common.security.AuthenticatedUser(1L, 0L, 0L, 1L, var user = new com.baiyue.common.security.AuthenticatedUser(1L, 0L, 0L, 1L,
"platform", "PLATFORM", "WEB", java.util.Set.of("platform:fleet:trip:list")); "platform", "PLATFORM", "WEB", java.util.Set.of("platform:overseas-warehouse:dispatch:list"));
SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken( for (var permission : List.of("platform:appointment:list", "platform:fleet:trip:list")) {
user, "unused", List.of(new SimpleGrantedAuthority("platform:appointment:list")))); SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(
assertThatThrownBy(() -> controller.calendar(user, from, to)).isInstanceOf(AccessDeniedException.class); user, "unused", List.of(new SimpleGrantedAuthority(permission))));
assertThatThrownBy(() -> controller.calendar(user, from, to)).isInstanceOf(AccessDeniedException.class);
}
verifyNoInteractions(calendar); verifyNoInteractions(calendar);
SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken( SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(
user, "unused", List.of(new SimpleGrantedAuthority("platform:fleet:trip:list")))); user, "unused", List.of(new SimpleGrantedAuthority("platform:overseas-warehouse:dispatch:list"))));
controller.calendar(user, from, to); controller.calendar(user, from, to);
verify(calendar).calendar(from, to); verify(calendar).calendar(from, to);
} finally { SecurityContextHolder.clearContext(); } } finally { SecurityContextHolder.clearContext(); }