feat: show application ownership and scoped console management

internal/storage/mysql/console_scope_integration_test.go

@@ -0,0 +1,137 @@
+package mysql
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"git.yuntuo.hk/k2safe/orbit/internal/fault"
+	"git.yuntuo.hk/k2safe/orbit/internal/retention"
+	"git.yuntuo.hk/k2safe/orbit/platform/auth"
+)
+
+func TestIntegrationConsoleScope(t *testing.T) {
+	dsn := os.Getenv("ORBIT_TEST_MYSQL_DSN")
+	if dsn == "" {
+		t.Skip("requires disposable MySQL")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	db, err := Open(ctx, dsn, 8, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	if err = Migrate(ctx, db); err != nil {
+		t.Fatal(err)
+	}
+	username := "scope-" + string(testID(t))
+	password := "test-password-for-scopes-123"
+	var source, target BootstrapResult
+	for i, dest := range []*BootstrapResult{&source, &target} {
+		in := BootstrapInput{Application: string(testID(t)), Namespace: "default", Environment: "test", Queue: "scope-queue"}
+		if i == 0 {
+			in.ConsoleUsername = username
+			in.ConsolePassword = password
+		}
+		if err = Bootstrap(ctx, db, in, func(v BootstrapResult) error { *dest = v; return nil }); err != nil {
+			t.Fatal(err)
+		}
+	}
+	accounts := NewConsoleAuthStore(db)
+	login, err := accounts.Login(ctx, username, password, "scope-test", "127.0.0.1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	session, _ := auth.Parse(login.Token)
+	sdk, _ := auth.Parse(source.Token)
+	scopes := NewConsoleApplicationStore(db, username)
+	initial, err := scopes.GetScope(ctx, session, "")
+	if err != nil || initial.Entry.NamespaceID != source.NamespaceID || !initial.CanSwitch {
+		t.Fatalf("initial scope: %+v %v", initial, err)
+	}
+	if _, err = scopes.GetScope(ctx, sdk, ""); fault.Code(err) != "UNAUTHENTICATED" {
+		t.Fatalf("SDK scope metadata: %v", err)
+	}
+	// 普通账号的队列白名单使用 BINARY ID 查询，不能以字符串错误比较成空列表。
+	if _, err = db.ExecContext(ctx, `UPDATE orbit_credentials SET permissions=JSON_OBJECT('actions',JSON_ARRAY('queues:read'),'queues',JSON_ARRAY(?)) WHERE namespace_id=? AND id=?`, string(source.QueueID), source.NamespaceID, source.CredentialID); err != nil {
+		t.Fatal(err)
+	}
+	limited, err := NewConsoleApplicationStore(db, "another-admin").GetScope(ctx, session, "")
+	if err != nil || limited.CanSwitch || len(limited.Queues) != 1 || limited.Queues[0].ID != source.QueueID {
+		t.Fatalf("limited scope: %+v %v", limited, err)
+	}
+	last, err := scopes.GetScope(ctx, session, source.QueueID)
+	if err != nil || len(last.Queues) != 0 || last.Next != "" {
+		t.Fatalf("queue cursor: %+v %v", last, err)
+	}
+	if _, err = scopes.ResolveScope(ctx, sdk, target.NamespaceID); fault.Code(err) != "PERMISSION_DENIED" {
+		t.Fatalf("SDK override: %v", err)
+	}
+	for _, name := range []string{"", "another-admin"} {
+		if _, err = NewConsoleApplicationStore(db, name).ResolveScope(ctx, session, target.NamespaceID); fault.Code(err) != "PERMISSION_DENIED" {
+			t.Fatalf("unconfigured admin: %v", err)
+		}
+	}
+	scoped, err := scopes.ResolveScope(ctx, session, target.NamespaceID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tasks := NewTaskStore(db)
+	if _, err = tasks.GetQueue(ctx, scoped, target.QueueID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = tasks.GetQueue(ctx, scoped, source.QueueID); fault.Code(err) != "NOT_FOUND" {
+		t.Fatalf("foreign queue: %v", err)
+	}
+	if err = tasks.AuthorizeSubmit(ctx, scoped); fault.Code(err) != "PERMISSION_DENIED" {
+		t.Fatalf("scope must not create work: %v", err)
+	}
+	got, err := scopes.GetScope(ctx, scoped, "")
+	if err != nil || got.Entry.ApplicationID != target.ApplicationID || len(got.Queues) != 1 || got.Queues[0].ID != target.QueueID {
+		t.Fatalf("target metadata: %+v %v", got, err)
+	}
+	// 完整应用/队列名称从数据库读取，包含特殊字符也不改变授权身份。
+	policy := NewRetentionPolicyStore(db)
+	in := retention.UpdateInput{ExpectedRevision: 0, Enabled: false, IdempotencyDays: 120, TaskHistoryDays: 400, WorkflowHistoryDays: 400, EventLogDays: 180, DeliveryHistoryDays: 120, InboxHistoryDays: 120, AuditLogDays: 2555, Reason: "scope policy test"}
+	saved, err := policy.UpdateRetentionPolicy(ctx, scoped, "scope-policy", in)
+	if err != nil || saved.NamespaceID != target.NamespaceID {
+		t.Fatalf("policy: %+v %v", saved, err)
+	}
+	if _, err = policy.UpdateRetentionPolicy(ctx, scoped, "scope-policy", in); err != nil {
+		t.Fatal(err)
+	}
+	original, err := policy.GetRetentionPolicy(ctx, source.NamespaceID)
+	if err != nil || original.Revision != 0 {
+		t.Fatalf("changed original scope: %+v %v", original, err)
+	}
+	var actor string
+	if err = db.QueryRowContext(ctx, `SELECT actor_id FROM orbit_audit_events WHERE namespace_id=? AND action='retention.policy.update'`, target.NamespaceID).Scan(&actor); err != nil {
+		t.Fatal(err)
+	}
+	if actor != scoped.ActorID() {
+		t.Fatalf("audit actor: %s", actor)
+	}
+	// 解析后停用目标应用/退出会话，旧的内存范围不能继续授权。
+	if _, err = db.ExecContext(ctx, `UPDATE orbit_applications SET enabled=FALSE WHERE id=?`, target.ApplicationID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = tasks.GetQueue(ctx, scoped, target.QueueID); fault.Code(err) != "NOT_FOUND" {
+		t.Fatalf("disabled target: %v", err)
+	}
+	if _, err = db.ExecContext(ctx, `UPDATE orbit_applications SET enabled=TRUE WHERE id=?`, target.ApplicationID); err != nil {
+		t.Fatal(err)
+	}
+	if err = accounts.RevokeSession(ctx, session); err != nil {
+		t.Fatal(err)
+	}
+	in.ExpectedRevision = 1
+	if _, err = policy.UpdateRetentionPolicy(ctx, scoped, "after-logout", in); fault.Code(err) != "PERMISSION_DENIED" {
+		t.Fatalf("stale scope write: %v", err)
+	}
+	var foreignKeys int
+	if err = db.QueryRowContext(ctx, `SELECT COUNT(*) FROM information_schema.REFERENTIAL_CONSTRAINTS WHERE CONSTRAINT_SCHEMA=DATABASE()`).Scan(&foreignKeys); err != nil || foreignKeys != 0 {
+		t.Fatalf("foreign keys %d %v", foreignKeys, err)
+	}
+}