@stackonward/cli 0.0.1 → 1.0.1

package/dist/resources/templates/go-backend/internal/common/iamscope/scope_filter_test.go

@@ -0,0 +1,279 @@
+package iamscope
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+// scopeFilterTestPrincipalID 测试用主体 ID（断言 self 谓词时核对 col = <该值>）。
+const scopeFilterTestPrincipalID int64 = 4277
+
+// fakeOrderBinding 模拟 order 域的 ScopeBinding：维度→order 表列。
+//
+// product→product_code、facility→store_id、assigned_to_self→assigned_operator_id；
+// 其余维度无对应列（ok=false），驱动 applier fail loudly。
+type fakeOrderBinding struct{}
+
+func (fakeOrderBinding) Column(dim ScopeDimension) (string, bool) {
+	switch dim {
+	case ScopeDimensionProduct:
+		return "product_code", true
+	case ScopeDimensionFacility:
+		return "store_id", true
+	case ScopeDimensionAssignedToSelf:
+		return "assigned_operator_id", true
+	default:
+		return "", false
+	}
+}
+
+// emptyColumnBinding 返回空列名的异常绑定，验证 applier 对空列名 fail loudly。
+type emptyColumnBinding struct{}
+
+func (emptyColumnBinding) Column(_ ScopeDimension) (string, bool) {
+	return "", true
+}
+
+// newDryRunDB 构造 DryRun 模式的 GORM DB（postgres dialector，不连接真实库）。
+//
+// 与既有 persistence_test 的 DryRun 约定一致：DryRun + DisableAutomaticPing，
+// 经 db.ToSQL 断言生成的 SQL 文本，无需真实数据库。
+func newDryRunDB(t *testing.T) *gorm.DB {
+	t.Helper()
+	db, err := gorm.Open(postgres.New(postgres.Config{
+		DSN: "host=localhost user=postgres dbname=postgres port=5432 sslmode=disable",
+	}), &gorm.Config{
+		DryRun:               true,
+		DisableAutomaticPing: true,
+	})
+	require.NoError(t, err, "open dry-run gorm db")
+	return db
+}
+
+// orderRow list 查询的目标行（仅供 DryRun 推断表名，无需真实表）。
+type orderRow struct {
+	ID int64
+}
+
+func (orderRow) TableName() string { return "p_order_orders" }
+
+// applyToSQL 在 DryRun 下执行 ApplyScope 并返回生成的 SQL（失败由调用方断言 error）。
+func applyToSQL(t *testing.T, sc ScopeConstraint) (string, error) {
+	t.Helper()
+	db := newDryRunDB(t)
+	var applyErr error
+	sql := db.ToSQL(func(tx *gorm.DB) *gorm.DB {
+		var rows []orderRow
+		scoped, err := ApplyScope(tx.Model(&orderRow{}), sc, fakeOrderBinding{}, scopeFilterTestPrincipalID)
+		if err != nil {
+			applyErr = err
+			return tx
+		}
+		return scoped.Find(&rows)
+	})
+	return sql, applyErr
+}
+
+// facilityGroup 构造单 facility_in 维度组。
+func facilityGroup(stores ...string) []DimPredicate {
+	return []DimPredicate{{
+		Dimension: ScopeDimensionFacility,
+		Operator:  ScopeOpIn,
+		Values:    stores,
+	}}
+}
+
+func TestApplyScope_Success(t *testing.T) {
+	tests := []struct {
+		name string
+		// 约束输入
+		sc ScopeConstraint
+		// SQL 中必须出现的片段
+		wantFragments []string
+		// SQL 中禁止出现的片段（空串表示不检查）
+		notWantFragment string
+	}{
+		{
+			name:            "unbounded super scope 无 WHERE 短路放行",
+			sc:              NewUnboundedScope(),
+			wantFragments:   []string{`SELECT`, `FROM "p_order_orders"`},
+			notWantFragment: "WHERE",
+		},
+		{
+			name:          "empty scope 拒绝全部 1 = 0",
+			sc:            ScopeConstraint{},
+			wantFragments: []string{"WHERE", "1 = 0"},
+		},
+		{
+			name: "单 AllowGroup facility_in 注入 store_id IN",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{facilityGroup("STORE-001", "STORE-002")},
+			},
+			wantFragments:   []string{"store_id IN", "STORE-001", "STORE-002"},
+			notWantFragment: " OR ",
+		},
+		{
+			name: "多 AllowGroup 组间 OR",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{
+					facilityGroup("STORE-001"),
+					facilityGroup("STORE-009"),
+				},
+			},
+			// 组间 OR：(store_id IN (...)) OR (store_id IN (...))
+			wantFragments: []string{"OR", "STORE-001", "STORE-009"},
+		},
+		{
+			name: "AllowGroup + DenyGroup 注入 AND NOT",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{facilityGroup("STORE-001", "STORE-002")},
+				DenyGroups:  [][]DimPredicate{facilityGroup("STORE-002")},
+			},
+			wantFragments: []string{"NOT", "store_id IN"},
+		},
+		{
+			name: "assigned_to_self 注入 col = principalID",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{{
+					{Dimension: ScopeDimensionAssignedToSelf, Operator: ScopeOpSelf},
+				}},
+			},
+			wantFragments: []string{"assigned_operator_id =", "4277"},
+		},
+		{
+			name: "组内多维度 AND（product equals + facility in）",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{{
+					{Dimension: ScopeDimensionProduct, Operator: ScopeOpEquals, Values: []string{"catalog"}},
+					{Dimension: ScopeDimensionFacility, Operator: ScopeOpIn, Values: []string{"STORE-001"}},
+				}},
+			},
+			// 组内 AND：product_code = 'catalog' AND store_id IN (...)
+			wantFragments: []string{"product_code =", "AND", "store_id IN", "catalog", "STORE-001"},
+		},
+		{
+			name: "ScopeOpIn 空候选值 fail-closed 1 = 0",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{facilityGroup()},
+			},
+			wantFragments: []string{"1 = 0"},
+		},
+		{
+			name: "空 Allow 子组恒真放行 1 = 1",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{{}},
+			},
+			wantFragments: []string{"1 = 1"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sql, err := applyToSQL(t, tt.sc)
+			require.NoError(t, err, "ApplyScope should not error: %s", sql)
+			for _, frag := range tt.wantFragments {
+				assert.Contains(t, sql, frag, "sql should contain %q: %s", frag, sql)
+			}
+			if tt.notWantFragment != "" {
+				assert.NotContains(t, sql, tt.notWantFragment, "sql should not contain %q: %s", tt.notWantFragment, sql)
+			}
+		})
+	}
+}
+
+func TestApplyScope_FailLoudly(t *testing.T) {
+	tests := []struct {
+		name      string
+		sc        ScopeConstraint
+		binding   ScopeBinding
+		wantErrIn string
+	}{
+		{
+			name: "维度无对应列返回 error",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{{
+					// merchant 维度 fakeOrderBinding 不支持。
+					{Dimension: ScopeDimensionMerchant, Operator: ScopeOpEquals, Values: []string{"M-1"}},
+				}},
+			},
+			binding:   fakeOrderBinding{},
+			wantErrIn: "unsupported by binding",
+		},
+		{
+			name: "未支持算子返回 error",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{{
+					{Dimension: ScopeDimensionFacility, Operator: "starts_with", Values: []string{"S"}},
+				}},
+			},
+			binding:   fakeOrderBinding{},
+			wantErrIn: "unsupported operator",
+		},
+		{
+			name: "equals 非单值返回 error",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{{
+					{Dimension: ScopeDimensionProduct, Operator: ScopeOpEquals, Values: []string{"catalog", "bread"}},
+				}},
+			},
+			binding:   fakeOrderBinding{},
+			wantErrIn: "requires exactly one value",
+		},
+		{
+			name: "DenyGroup 维度无对应列返回 error",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{facilityGroup("STORE-001")},
+				DenyGroups: [][]DimPredicate{{
+					{Dimension: ScopeDimensionTenant, Operator: ScopeOpEquals, Values: []string{"1"}},
+				}},
+			},
+			binding:   fakeOrderBinding{},
+			wantErrIn: "unsupported by binding",
+		},
+		{
+			name: "绑定返回空列名返回 error",
+			sc: ScopeConstraint{
+				AllowGroups: [][]DimPredicate{facilityGroup("STORE-001")},
+			},
+			binding:   emptyColumnBinding{},
+			wantErrIn: "empty column",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db := newDryRunDB(t)
+			_, err := ApplyScope(db.Model(&orderRow{}), tt.sc, tt.binding, scopeFilterTestPrincipalID)
+			require.Error(t, err, "ApplyScope should fail loudly")
+			assert.Contains(t, err.Error(), tt.wantErrIn, "error message mismatch: %v", err)
+		})
+	}
+}
+
+// TestApplyScope_ParenthesizationCorrectness 断言「组间 OR + AND NOT」括号边界正确，
+// 防止 OR 与 Deny 的 AND 优先级串扰（§6.3 翻译正确性的核心保证）。
+func TestApplyScope_ParenthesizationCorrectness(t *testing.T) {
+	sc := ScopeConstraint{
+		AllowGroups: [][]DimPredicate{
+			facilityGroup("STORE-001"),
+			facilityGroup("STORE-002"),
+		},
+		DenyGroups: [][]DimPredicate{facilityGroup("STORE-009")},
+	}
+	sql, err := applyToSQL(t, sc)
+	require.NoError(t, err)
+
+	// 期望形如：WHERE ((store_id IN (...)) OR (store_id IN (...))) AND NOT (store_id IN (...))
+	// 校验 OR 出现在 NOT 之前，且整体 Allow 被一对括号包裹（OR 不裸露在顶层 AND 旁）。
+	orIdx := strings.Index(sql, " OR ")
+	notIdx := strings.Index(sql, "NOT")
+	require.GreaterOrEqual(t, orIdx, 0, "sql should contain OR: %s", sql)
+	require.GreaterOrEqual(t, notIdx, 0, "sql should contain NOT: %s", sql)
+	assert.Less(t, orIdx, notIdx, "OR (allow groups) must appear before NOT (deny): %s", sql)
+	assert.Contains(t, sql, "AND NOT", "deny must be joined by AND NOT: %s", sql)
+}

package/dist/resources/templates/go-backend/internal/common/internalapi/authorization_details.go

@@ -0,0 +1,10 @@
+package internalapi
+
+const (
+	// AuthorizationDetailTypeOrganizationTransition 标识只能用于 Organization 状态转换的细粒度授权。
+	AuthorizationDetailTypeOrganizationTransition = "onex_organization_transition"
+
+	OrganizationTransitionActionEnrollProduct           = "organization:product_enrollment:create"
+	OrganizationTransitionActionResumeOrganization      = "organization:organization:update"
+	OrganizationTransitionActionResumeProductEnrollment = "organization:product_enrollment:update"
+)