优化

iam/src/test/java/com/baiyue/iam/service/AuthorizationSnapshotServiceTest.java

@@ -93,4 +93,21 @@ class AuthorizationSnapshotServiceTest {
         assertThat(result).isEmpty();
     }
 
+    @Test
+    void newLoginPermissionsDisappearWhileRoleDisabledAndReturnAfterReenable() {
+        when(mapper.countActiveIdentity(42L, 7L, 9L)).thenReturn(1);
+        when(mapper.findRoles(42L, 7L, 9L, "MERCHANT"))
+                .thenReturn(List.of("ORDER_VIEWER"), List.of(), List.of("ORDER_VIEWER"));
+        when(mapper.findPermissions(42L, 7L, 9L, "MERCHANT"))
+                .thenReturn(List.of("merchant:order:list", "merchant:order:view"), List.of(),
+                        List.of("merchant:order:list", "merchant:order:view"));
+        SnapshotRequest request = new SnapshotRequest(42L, 7L, 9L, "MERCHANT");
+
+        assertThat(service.load(request).getPermissions())
+                .containsExactlyInAnyOrder("merchant:order:list", "merchant:order:view");
+        assertThat(service.load(request).getPermissions()).isEmpty();
+        assertThat(service.load(request).getPermissions())
+                .containsExactlyInAnyOrder("merchant:order:list", "merchant:order:view");
+    }
+
 }

iam/src/test/java/com/baiyue/iam/service/RbacServiceTest.java

@@ -1,7 +1,9 @@
 package com.baiyue.iam.service;
 
+import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
+import com.baiyue.iam.client.AuthAccountClient;
 import com.baiyue.iam.dto.RbacDtos.AssignRolesRequest;
 import com.baiyue.iam.dto.RbacDtos.GrantPermissionsRequest;
 import com.baiyue.iam.dto.RbacDtos.CreateRoleRequest;
@@ -19,6 +21,7 @@ import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentCaptor;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
+import org.springframework.test.context.TestPropertySource;
 
 import jakarta.annotation.Resource;
 
@@ -30,9 +33,11 @@ import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.*;
 
 @SpringJUnitConfig(RbacService.class)
+@TestPropertySource(properties = "baiyue.security.internal-service-token=test-internal-token")
 class RbacServiceTest {
     @MockBean private RbacRepository repository;
     @MockBean private MemberRepository memberRepository;
+    @MockBean private AuthAccountClient authClient;
     @Resource private RbacService service;
 
     @Test
@@ -311,6 +316,53 @@ class RbacServiceTest {
         verify(repository).deletePermission(custom);
     }
 
+    @Test
+    void roleDisableAndEnableRevokeAllAssignedAccountSessions() {
+        IamRole role = role(11L, 100L, "MERCHANT", "CUSTOM");
+        when(repository.findRole(11L, 100L, "MERCHANT")).thenReturn(role);
+        when(repository.findRolePermissionIds(100L, 11L)).thenReturn(Set.of(21L));
+        when(repository.findAssignedAuthUserIds(100L, 11L)).thenReturn(List.of(501L, 502L));
+        when(authClient.revokeSessions(any(), any())).thenReturn(ApiResponse.success(null));
+
+        service.changeStatus(100L, "MERCHANT", 11L, new ChangeRoleStatusRequest("DISABLED"));
+        service.changeStatus(100L, "MERCHANT", 11L, new ChangeRoleStatusRequest("ACTIVE"));
+
+        ArgumentCaptor<AuthAccountClient.RevokeAccountSessionsRequest> captor =
+            ArgumentCaptor.forClass(AuthAccountClient.RevokeAccountSessionsRequest.class);
+        verify(authClient, times(2)).revokeSessions(eq("test-internal-token"), captor.capture());
+        assertEquals(Set.of(501L, 502L), captor.getAllValues().get(0).accountIds());
+        assertEquals(Set.of(501L, 502L), captor.getAllValues().get(1).accountIds());
+    }
+
+    @Test
+    void rolePermissionReplacementRevokesAllAssignedAccountSessions() {
+        when(repository.findRole(11L, 100L, "MERCHANT"))
+            .thenReturn(role(11L, 100L, "MERCHANT", "CUSTOM"));
+        when(repository.findAssignedAuthUserIds(100L, 11L)).thenReturn(List.of(501L));
+        when(authClient.revokeSessions(any(), any())).thenReturn(ApiResponse.success(null));
+
+        service.grantPermissions(100L, "MERCHANT", new GrantPermissionsRequest(11L, Set.of()));
+
+        verify(repository).replaceRolePermissions(100L, 11L, Set.of());
+        verify(authClient).revokeSessions(eq("test-internal-token"),
+            eq(new AuthAccountClient.RevokeAccountSessionsRequest(Set.of(501L))));
+    }
+
+    @Test
+    void authFailureRejectsRoleStatusChangeSoIamTransactionCanRollBack() {
+        IamRole role = role(11L, 100L, "MERCHANT", "CUSTOM");
+        when(repository.findRole(11L, 100L, "MERCHANT")).thenReturn(role);
+        when(repository.findAssignedAuthUserIds(100L, 11L)).thenReturn(List.of(501L));
+        when(authClient.revokeSessions(any(), any())).thenReturn(ApiResponse.failure(
+            ResultCode.SERVICE_UNAVAILABLE, "auth unavailable", null, null));
+
+        BizException exception = assertThrows(BizException.class, () -> service.changeStatus(
+            100L, "MERCHANT", 11L, new ChangeRoleStatusRequest("DISABLED")));
+
+        assertEquals(ResultCode.SERVICE_UNAVAILABLE, exception.getResultCode());
+        assertEquals("认证会话撤销失败，角色变更未生效", exception.getMessage());
+    }
+
     private IamRole role(Long id, Long tenantId, String appCode, String roleType) {
         IamRole role = new IamRole();
         role.setId(id);

iam/src/test/java/com/baiyue/iam/service/TenantCustomerExportTest.java

@@ -3,6 +3,7 @@ package com.baiyue.iam.service;
 import com.baiyue.iam.client.AuthAccountClient;
 import com.baiyue.iam.entity.IamTenant;
 import com.baiyue.iam.repository.ProfileResourceRepository;
+import com.baiyue.iam.repository.MemberRepository;
 import com.baiyue.iam.repository.TenantRepository;
 import org.junit.jupiter.api.Test;
 import org.springframework.boot.test.mock.mockito.MockBean;
@@ -21,6 +22,7 @@ import static org.mockito.Mockito.when;
 class TenantCustomerExportTest {
     @MockBean private TenantRepository repository;
     @MockBean private ProfileResourceRepository profileRepository;
+    @MockBean private MemberRepository memberRepository;
     @MockBean private AuthAccountClient authAccountClient;
     @MockBean private TenantApprovalInitializationCoordinator approvalInitialization;
     @MockBean private CustomerDimensionRuleInitializationService dimensionRuleInitialization;