优化

2026-08-11 19:35:18 +08:00
parent 4d49d7a2e4
commit 3809d2a028
4 changed files with 301 additions and 2 deletions
@@ -0,0 +1,87 @@
+package com.baiyue.iam.repository;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class FinanceG1G2PermissionSqlContractTest {
+    @Test
+    void declaresTheFourControllerPermissionsUnderFinanceWithoutDefaultRoleGrants() throws Exception {
+        String sql = new ClassPathResource("db/finance-g1-g2-permissions.sql")
+                .getContentAsString(StandardCharsets.UTF_8);
+
+        assertThat(sql)
+                .contains("(5105022, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:account:view'")
+                .contains("(5105023, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:fee-source:view'")
+                .contains("(5105024, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:fee-source:review'")
+                .contains("(5105025, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:fee-source:settlement'")
+                .contains("NULL, 'GET', 130, 'ACTIVE', 1, 0")
+                .contains("NULL, 'GET', 140, 'ACTIVE', 1, 0")
+                .contains("NULL, 'POST', 150, 'ACTIVE', 1, 0")
+                .contains("NULL, 'PUT', 160, 'ACTIVE', 1, 0")
+                .contains("ON DUPLICATE KEY UPDATE")
+                .contains("CALL migrate_finance_g1_g2_permissions()")
+                .contains("DROP PROCEDURE IF EXISTS migrate_finance_g1_g2_permissions")
+                .doesNotContain("INSERT INTO iam_role_permission");
+    }
+
+    @Test
+    void failsClosedOnPermissionIdentityConflictsAndAssertsCatalogCompleteness() throws Exception {
+        String sql = new ClassPathResource("db/finance-g1-g2-permissions.sql")
+                .getContentAsString(StandardCharsets.UTF_8);
+
+        assertThat(sql)
+                .contains("SIGNAL SQLSTATE '45000'")
+                .contains("id = 5105022 AND permission_code <> 'platform:finance:account:view'")
+                .contains("permission_code = 'platform:finance:fee-source:settlement' AND id <> 5105025")
+                .contains("tenant_id <> 0 OR app_code <> 'PLATFORM'")
+                .contains("parent_id = 5105000")
+                .contains("permission_type = 'MENU'")
+                .contains("built_in = 1")
+                .contains("finance permission parent is invalid")
+                .contains("permission catalog is incomplete");
+    }
+
+    @Test
+    void unifiedSqlMirrorsCatalogButDoesNotAutoGrantTheNewPermissions() throws Exception {
+        String sql = Files.readString(resolveUnifiedSql(), StandardCharsets.UTF_8);
+        String financeSection = sql.substring(sql.indexOf("-- Finance F1 人工财务权限"),
+                sql.indexOf("CALL assert_unified_final_schema()"));
+        String platformAdminGrant = financeSection.substring(
+                financeSection.indexOf("SELECT 4000001, id, 0 FROM baiyue_iam.iam_permission"),
+                financeSection.indexOf("ON DUPLICATE KEY UPDATE tenant_id=VALUES(tenant_id);"));
+
+        assertThat(financeSection)
+                .contains("(5105022, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:account:view'")
+                .contains("(5105023, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:fee-source:view'")
+                .contains("(5105024, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:fee-source:review'")
+                .contains("(5105025, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:fee-source:settlement'")
+                .contains("NULL, 'GET', 130, 'ACTIVE', 1, 0")
+                .contains("NULL, 'GET', 140, 'ACTIVE', 1, 0")
+                .contains("NULL, 'POST', 150, 'ACTIVE', 1, 0")
+                .contains("NULL, 'PUT', 160, 'ACTIVE', 1, 0")
+                .contains("permission_code IN (\n   'platform:finance',")
+                .contains("permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 16")
+                .contains("p.permission_code IN ('platform:finance:account:view','platform:finance:fee-source:view','platform:finance:fee-source:review','platform:finance:fee-source:settlement')) <> 0")
+                .contains("平台管理员 Finance 授权不完整")
+                .contains("Finance G1/G2 新权限不得默认授予平台管理员");
+        assertThat(platformAdminGrant)
+                .contains("'platform:finance'")
+                .contains("'platform:finance:customer-terms:update'")
+                .doesNotContain("LIKE 'platform:finance:%'")
+                .doesNotContain("platform:finance:account:view")
+                .doesNotContain("platform:finance:fee-source:view")
+                .doesNotContain("platform:finance:fee-source:review")
+                .doesNotContain("platform:finance:fee-source:settlement");
+    }
+
+    private static Path resolveUnifiedSql() {
+        Path direct = Path.of("deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+        return Files.exists(direct) ? direct : Path.of("..", "deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+    }
+}