fix: close inbound hold bypass paths

2026-09-07 12:10:11 +08:00
parent 6b479d1a68
commit 41582fe17b
28 changed files with 899 additions and 11 deletions
@@ -4,6 +4,8 @@ import org.junit.jupiter.api.Test;
 import org.springframework.core.io.ClassPathResource;

 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;

 import static org.assertj.core.api.Assertions.assertThat;

@@ -60,8 +62,29 @@ class InboundHoldPermissionSqlContractTest {
                ") <> 1 THEN");
    }

+    @Test
+    void unifiedIncrementContainsTheSameMigrationBody() throws Exception {
+        String marker = "DROP PROCEDURE IF EXISTS migrate_inbound_hold_permission;";
+
+        assertThat(migrationBody(unifiedSql(), marker)).isEqualTo(migrationBody(sql(), marker));
+    }
+
    private static String sql() throws Exception {
        return new ClassPathResource("db/inbound-hold-permission.sql")
                .getContentAsString(StandardCharsets.UTF_8);
    }
+
+    private static String unifiedSql() throws Exception {
+        Path direct = Path.of("deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+        Path path = Files.exists(direct) ? direct : Path.of("..", "deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+        return Files.readString(path.normalize(), StandardCharsets.UTF_8);
+    }
+
+    private static String migrationBody(String sql, String marker) {
+        int start = sql.indexOf(marker);
+        int end = sql.indexOf(marker, start + marker.length());
+        assertThat(start).isGreaterThanOrEqualTo(0);
+        assertThat(end).isGreaterThan(start);
+        return sql.substring(start, end + marker.length()).replaceAll("\\s+", " ").trim();
+    }
 }
@@ -0,0 +1,149 @@
+package com.baiyue.iam.repository;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.Statement;
+import java.util.UUID;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class InboundHoldPermissionSqlExecutionTest {
+    @Test
+    void replayKeepsOneResourceAndOnePlatformAdminGrant() throws Exception {
+        try (Connection connection = database()) {
+            insertRole(connection, 11L, "PLATFORM_ADMIN", "ACTIVE", 0);
+
+            executeMigrationDml(connection);
+            executeMigrationDml(connection);
+
+            assertThat(count(connection, "SELECT COUNT(*) FROM iam_permission WHERE permission_code=?",
+                    "platform:firstleg:inbound:hold")).isOne();
+            assertThat(grantCount(connection, 11L)).isOne();
+            assertThat(count(connection, "SELECT COUNT(*) FROM iam_role_permission", null)).isOne();
+        }
+    }
+
+    @Test
+    void ordinaryAndInactiveRolesDoNotReceiveTheWritePermission() throws Exception {
+        try (Connection connection = database()) {
+            insertRole(connection, 11L, "PLATFORM_ADMIN", "ACTIVE", 0);
+            insertRole(connection, 12L, "ORDER_OPERATOR", "ACTIVE", 0);
+            insertRole(connection, 13L, "WAREHOUSE_OPERATOR", "ACTIVE", 0);
+            insertRole(connection, 14L, "WAREHOUSE_TALLY", "ACTIVE", 0);
+            insertRole(connection, 15L, "PLATFORM_CUSTOM_ADMIN", "ACTIVE", 0);
+            insertRole(connection, 16L, "PLATFORM_ADMIN", "DISABLED", 0);
+            insertRole(connection, 17L, "PLATFORM_ADMIN", "ACTIVE", 1);
+
+            executeMigrationDml(connection);
+
+            assertThat(grantCount(connection, 11L)).isOne();
+            for (long roleId = 12L; roleId <= 17L; roleId++) {
+                assertThat(grantCount(connection, roleId)).as("role %s", roleId).isZero();
+            }
+        }
+    }
+
+    private static Connection database() throws Exception {
+        Connection connection = DriverManager.getConnection(
+                "jdbc:h2:mem:inbound_hold_" + UUID.randomUUID() + ";MODE=MySQL;DATABASE_TO_LOWER=TRUE");
+        try (Statement statement = connection.createStatement()) {
+            statement.execute("""
+                    CREATE TABLE iam_role (
+                      id BIGINT PRIMARY KEY,
+                      tenant_id BIGINT NOT NULL,
+                      app_code VARCHAR(32) NOT NULL,
+                      role_code VARCHAR(64) NOT NULL,
+                      status VARCHAR(16) NOT NULL,
+                      deleted INT NOT NULL
+                    )
+                    """);
+            statement.execute("""
+                    CREATE TABLE iam_permission (
+                      id BIGINT PRIMARY KEY,
+                      tenant_id BIGINT NOT NULL,
+                      app_code VARCHAR(32) NOT NULL,
+                      permission_type VARCHAR(16) NOT NULL,
+                      parent_id BIGINT,
+                      permission_code VARCHAR(160) NOT NULL UNIQUE,
+                      permission_name VARCHAR(128) NOT NULL,
+                      route_path VARCHAR(255),
+                      http_method VARCHAR(16),
+                      sort_no INT NOT NULL,
+                      status VARCHAR(16) NOT NULL,
+                      built_in INT NOT NULL,
+                      deleted INT NOT NULL
+                    )
+                    """);
+            statement.execute("""
+                    CREATE TABLE iam_role_permission (
+                      tenant_id BIGINT NOT NULL,
+                      role_id BIGINT NOT NULL,
+                      permission_id BIGINT NOT NULL,
+                      created_at TIMESTAMP NOT NULL,
+                      PRIMARY KEY (tenant_id, role_id, permission_id)
+                    )
+                    """);
+        }
+        return connection;
+    }
+
+    private static void insertRole(Connection connection, long id, String roleCode, String status, int deleted)
+            throws Exception {
+        try (PreparedStatement insert = connection.prepareStatement(
+                "INSERT INTO iam_role VALUES (?,0,'PLATFORM',?,?,?)")) {
+            insert.setLong(1, id);
+            insert.setString(2, roleCode);
+            insert.setString(3, status);
+            insert.setInt(4, deleted);
+            insert.executeUpdate();
+        }
+    }
+
+    private static void executeMigrationDml(Connection connection) throws Exception {
+        String sql = sql();
+        try (Statement statement = connection.createStatement()) {
+            statement.executeUpdate(statement(sql, "INSERT INTO iam_permission", "INSERT IGNORE INTO iam_role_permission"));
+            statement.executeUpdate(statement(sql, "INSERT IGNORE INTO iam_role_permission", "  IF (SELECT COUNT(*)"));
+        }
+    }
+
+    private static String statement(String sql, String startMarker, String endMarker) {
+        int start = sql.indexOf(startMarker);
+        int end = sql.indexOf(endMarker, start + startMarker.length());
+        assertThat(start).isGreaterThanOrEqualTo(0);
+        assertThat(end).isGreaterThan(start);
+        return sql.substring(start, end).trim().replaceFirst(";$", "");
+    }
+
+    private static int grantCount(Connection connection, long roleId) throws Exception {
+        try (PreparedStatement query = connection.prepareStatement(
+                "SELECT COUNT(*) FROM iam_role_permission WHERE tenant_id=0 AND role_id=?")) {
+            query.setLong(1, roleId);
+            try (ResultSet result = query.executeQuery()) {
+                result.next();
+                return result.getInt(1);
+            }
+        }
+    }
+
+    private static int count(Connection connection, String sql, String permissionCode) throws Exception {
+        try (PreparedStatement query = connection.prepareStatement(sql)) {
+            if (permissionCode != null) query.setString(1, permissionCode);
+            try (ResultSet result = query.executeQuery()) {
+                result.next();
+                return result.getInt(1);
+            }
+        }
+    }
+
+    private static String sql() throws Exception {
+        return new ClassPathResource("db/inbound-hold-permission.sql")
+                .getContentAsString(StandardCharsets.UTF_8);
+    }
+}