feat: 实现 Admin 采购员账号管理 (#51)

2026-08-09 13:50:55 +08:00
parent 771e2ee616
commit eea0d65ef8
12 changed files with 909 additions and 20 deletions
@@ -0,0 +1,147 @@
+package service
+
+import (
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"cmautobuy/admin/model"
+	"cmautobuy/admin/repository"
+)
+
+func TestCreatePurchaser_固定角色且用户名不区分大小写唯一(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatalf("创建采购员失败: %v", err)
+	}
+	buyer, err := repository.FindUserByUsername(db, "BUYER")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if buyer.Role != model.RolePurchaser || buyer.Status != model.UserActive {
+		t.Fatalf("新账号角色或状态错误: %+v", buyer)
+	}
+	if buyer.PasswordHash == "buyer-password" ||
+		bcrypt.CompareHashAndPassword([]byte(buyer.PasswordHash), []byte("buyer-password")) != nil {
+		t.Fatal("采购员密码必须保存为可验证的 bcrypt 哈希")
+	}
+	if err := CreatePurchaser(db, admin, "BUYER", "other-password", "other-password", now); !errors.Is(err, repository.ErrUsernameExists) {
+		t.Fatalf("大小写不同的重复用户名应被拒绝，实际 %v", err)
+	}
+}
+
+func TestChangeUserStatus_禁用撤销全部Session且启用后可重新登录(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer")
+	token, _, _, err := Login(db, "buyer", "buyer-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
+		t.Fatalf("禁用后旧 Session 应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("禁用账号不应登录，实际 %v", err)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserActive, now.Add(3*time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, _, err := Login(db, "buyer", "buyer-password", now.Add(4*time.Minute)); err != nil {
+		t.Fatalf("重新启用后应可登录: %v", err)
+	}
+}
+
+func TestResetUserPassword_原子撤销Session并更换凭据(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer", "old-password", "old-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer")
+	token, _, _, _ := Login(db, "buyer", "old-password", now)
+	if err := ResetUserPassword(db, admin, buyer.UserID, "new-password", "new-password", now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
+		t.Fatalf("重置密码后旧 Session 应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "old-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("旧密码应失效，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "buyer", "new-password", now.Add(2*time.Minute)); err != nil {
+		t.Fatalf("新密码应可登录: %v", err)
+	}
+}
+
+func TestChangeUserStatus_最后管理员保护同时保留Session(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	token, _, _, err := Login(db, "admin", "admin-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = ChangeUserStatus(db, admin, admin.UserID, model.UserDisabled, now.Add(time.Minute))
+	if !errors.Is(err, repository.ErrLastActiveAdmin) {
+		t.Fatalf("禁用最后管理员应拒绝，实际 %v", err)
+	}
+	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); err != nil {
+		t.Fatalf("失败事务不能撤销管理员 Session: %v", err)
+	}
+}
+
+func TestUserManagement_采购员无权调用且搜索转义通配符(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	admin := prepareAdminUser(t, db, now)
+	if err := CreatePurchaser(db, admin, "buyer%", "buyer-password", "buyer-password", now); err != nil {
+		t.Fatal(err)
+	}
+	buyer, _ := repository.FindUserByUsername(db, "buyer%")
+	result, err := ListUsers(db, admin, "%", "", 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Total != 1 || len(result.Rows) != 1 || result.Rows[0].Username != "buyer%" {
+		t.Fatalf("搜索中的 %% 应按字面量处理: %+v", result)
+	}
+	if err := ChangeUserStatus(db, admin, buyer.UserID, model.UserDisabled, now); err != nil {
+		t.Fatal(err)
+	}
+	disabled, err := ListUsers(db, admin, "", model.UserDisabled, 1)
+	if err != nil || disabled.Total != 1 || disabled.Rows[0].Username != "buyer%" {
+		t.Fatalf("禁用状态筛选错误: result=%+v err=%v", disabled, err)
+	}
+	if _, err := ListUsers(db, buyer, "", "", 1); !errors.Is(err, ErrAdminRequired) {
+		t.Fatalf("采购员不应列出用户，实际 %v", err)
+	}
+	if err := CreatePurchaser(db, buyer, "other", "other-password", "other-password", now); !errors.Is(err, ErrAdminRequired) {
+		t.Fatalf("采购员不应创建用户，实际 %v", err)
+	}
+}
+
+func prepareAdminUser(t *testing.T, db *sql.DB, now time.Time) *model.User {
+	t.Helper()
+	if err := SetupInitialAdmin(db, "admin", "admin-password", "admin-password", now); err != nil {
+		t.Fatalf("准备管理员失败: %v", err)
+	}
+	admin, err := repository.FindUserByUsername(db, "admin")
+	if err != nil {
+		t.Fatalf("读取管理员失败: %v", err)
+	}
+	return admin
+}