feat: manage existing credential actions with audited replay

2026-11-01 19:10:37 +08:00
parent baa81c4923
commit 98ad60c0b8
18 changed files with 1350 additions and 53 deletions
--- a/internal/storage/mysql/console_applications_permissions_test.go
+++ b/internal/storage/mysql/console_applications_permissions_test.go
@@ -0,0 +1,65 @@
+package mysql
+
+import (
+	"context"
+	"testing"
+
+	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
+	"git.yuntuo.hk/k2safe/orbit/internal/fault"
+	"git.yuntuo.hk/k2safe/orbit/platform/auth"
+)
+
+func TestConsolePermissionInputAndFixedVersion(t *testing.T) {
+	base := consoleauth.ApplicationInput{Kind: "SET_PERMISSIONS", NamespaceID: testID(t), CredentialID: testID(t), ExpectedRevision: 4, Reason: "enable scheduled tasks", Actions: []string{"tasks:submit", "schedules:read", "schedules:manage"}}
+	if err := validateApplicationInput(base); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		name   string
+		mutate func(*consoleauth.ApplicationInput)
+	}{
+		{"missing actions", func(in *consoleauth.ApplicationInput) { in.Actions = nil }},
+		{"empty actions", func(in *consoleauth.ApplicationInput) { in.Actions = []string{} }},
+		{"duplicate", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"tasks:read", "tasks:read"} }},
+		{"unknown", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"unknown:action"} }},
+		{"wildcard", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"*"} }},
+		{"expiry", func(in *consoleauth.ApplicationInput) { in.ValidDays = 7 }},
+		{"grace", func(in *consoleauth.ApplicationInput) { in.GraceDays = 7 }},
+		{"capability", func(in *consoleauth.ApplicationInput) { in.Capabilities = []string{"schedules"} }},
+		{"queue", func(in *consoleauth.ApplicationInput) { in.Queue = "changed" }},
+		{"missing version", func(in *consoleauth.ApplicationInput) { in.ExpectedRevision = 0 }},
+		{"missing reason", func(in *consoleauth.ApplicationInput) { in.Reason = "" }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			in := base
+			tc.mutate(&in)
+			if fault.Code(validateApplicationInput(in)) != "INVALID_ARGUMENT" {
+				t.Fatal("invalid permission request accepted")
+			}
+		})
+	}
+	for _, kind := range []string{"CREATE", "ROTATE", "SET_EXPIRY", "FINALIZE"} {
+		in := base
+		in.Kind = kind
+		for _, actions := range [][]string{{"tasks:read"}, {}} {
+			in.Actions = actions
+			if fault.Code(validateApplicationInput(in)) != "INVALID_ARGUMENT" {
+				t.Fatalf("%s accepted actions", kind)
+			}
+		}
+	}
+	// 拒绝旧格式携带新语义及新格式冒充旧操作；这里不得访问数据库。
+	for _, version := range []int{0, 1, 2, 4} {
+		op := consoleauth.ApplicationOperation{Version: version, Input: base, OperationID: testID(t), ApplicationID: testID(t), NamespaceID: base.NamespaceID, CredentialID: base.CredentialID}
+		if _, err := NewConsoleApplicationStore(nil, "admin").ApplyApplication(context.Background(), auth.Token{}, op); fault.Code(err) != "INVALID_ARGUMENT" {
+			t.Fatalf("permission version %d accepted: %v", version, err)
+		}
+	}
+	in := base
+	in.Kind = "SET_EXPIRY"
+	in.Actions = nil
+	op := consoleauth.ApplicationOperation{Version: 3, Input: in, OperationID: testID(t), ApplicationID: testID(t), NamespaceID: in.NamespaceID, CredentialID: in.CredentialID}
+	if _, err := NewConsoleApplicationStore(nil, "admin").ApplyApplication(context.Background(), auth.Token{}, op); fault.Code(err) != "INVALID_ARGUMENT" {
+		t.Fatal("v3 accepted legacy action", err)
+	}
+}