diff --git a/resx/res_interceptor_test.go b/resx/res_interceptor_test.go index cd6cd3b..f6ef7ed 100644 --- a/resx/res_interceptor_test.go +++ b/resx/res_interceptor_test.go @@ -84,14 +84,14 @@ func (t *hooksTest) TestOnBefore_RolesCondition_Cond() { // 实际生成的 SQL： // SELECT * FROM `users` AS `User` WHERE (`owned_user` = '00000000-0000-0000-0000-000000000000') - sql, _, _ := res.GetDBTable(base.GetAnonymous()).Select(db.Star()).Executor().ToSQL() + sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL() t.Contains(sql, "owned_user") t.Contains(sql, "00000000-0000-0000-0000-000000000000") mock.ExpectQuery("SELECT"). WillReturnRows(sqlmock.NewRows([]string{"id", "name"}).AddRow(1, "张三")) - rows, err := res.GetDBTable(base.GetAnonymous()).Select(db.Star()).Executor().GetRecords() + rows, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Select(db.Star()).Executor().GetRecords() t.NoError(err) t.Len(rows, 1) t.NoError(mock.ExpectationsWereMet()) @@ -111,13 +111,13 @@ func (t *hooksTest) TestOnBefore_RolesCondition_Sub() { // 实际生成的 SQL： // SELECT * FROM (SELECT * FROM `users` AS `User` WHERE (`owned_user` = '00000000-0000-0000-0000-000000000000')) AS `User` - sql, _, _ := res.GetDBTable(base.GetAnonymous()).Select(db.Star()).Executor().ToSQL() + sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL() t.Contains(sql, "owned_user") mock.ExpectQuery("SELECT"). WillReturnRows(sqlmock.NewRows([]string{"id", "name"}).AddRow(2, "李四")) - rows, err := res.GetDBTable(base.GetAnonymous()).Select(db.Star()).Executor().GetRecords() + rows, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Select(db.Star()).Executor().GetRecords() t.NoError(err) t.Len(rows, 1) t.NoError(mock.ExpectationsWereMet()) @@ -153,7 +153,7 @@ func (t *hooksTest) TestOnBefore_NeedsCapture_True() { mock.ExpectExec("UPDATE").WillReturnResult(sqlmock.NewResult(0, 1)) mock.ExpectCommit() - _, err := res.GetDBTable(base.GetAnonymous()).Update(). + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update(). Set(db.Record{"name": "新名字"}). Where(db.C("id").Eq(1)). Executor().Exec() @@ -185,7 +185,7 @@ func (t *hooksTest) TestOnBefore_NeedsCapture_False() { // 实际生成的 SQL：UPDATE `users` AS `User` SET `name`='新名字' WHERE (`id` = 1) mock.ExpectExec("UPDATE").WillReturnResult(sqlmock.NewResult(0, 1)) - _, err := res.GetDBTable(base.GetAnonymous()).Update(). + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update(). Set(db.Record{"name": "新名字"}). Where(db.C("id").Eq(1)). Executor().Exec() @@ -220,7 +220,7 @@ func (t *hooksTest) TestOnAfter_RowsContent_Insert() { mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(10, 1)) mock.ExpectCommit() - _, err := res.GetDBTable(base.GetAnonymous()).Insert(). + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert(). Rows(db.Record{"name": "张三"}). Executor().Exec() t.NoError(err) @@ -256,7 +256,7 @@ func (t *hooksTest) TestOnAfter_UnconditionalOnWrite() { // 实际生成的 SQL：DELETE FROM `users` AS `User` WHERE (`id` = 1) mock.ExpectExec("DELETE").WillReturnResult(sqlmock.NewResult(0, 3)) - _, err := res.GetDBTable(base.GetAnonymous()).Delete(). + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Delete(). Where(db.C("id").Eq(1)). Executor().Exec() t.NoError(err) @@ -300,7 +300,7 @@ func (t *hooksTest) TestInsertFromQuery_FetchesInsertedRowsAfterward() { ) mock.ExpectCommit() - _, err := res.GetDBTable(base.GetAnonymous()).Insert().FromQuery(sub).Executor().Exec() + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().FromQuery(sub).Executor().Exec() t.NoError(err) t.NoError(mock.ExpectationsWereMet()) @@ -335,7 +335,7 @@ func (t *hooksTest) TestBatchInsertIds_Mysql() { mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(100, 3)) mock.ExpectCommit() - _, err := res.GetDBTable(base.GetAnonymous()).Insert().Rows( + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().Rows( db.Record{"name": "A"}, db.Record{"name": "B"}, db.Record{"name": "C"}, ).Executor().Exec() t.NoError(err) @@ -385,7 +385,7 @@ func (t *hooksTest) TestBatchInsertIds_LocalDB() { ), ) - _, err := res.GetDBTable(base.GetAnonymous()).Insert().Rows( + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().Rows( db.Record{"name": "A"}, db.Record{"name": "B"}, db.Record{"name": "C"}, ).Executor().Exec() t.Require().NoError(err) @@ -413,7 +413,7 @@ func (t *hooksTest) TestUpdate_RolesConditionSub() { // 实际生成的 SQL： // UPDATE `users` AS `User` SET `name`='新名字' WHERE ((`id` = 1) AND (`id` IN ((SELECT `User`.`id` FROM `users` AS `User` WHERE (`owned_user` = '00000000-0000-0000-0000-000000000000'))))) - sql, _, _ := res.GetDBTable(base.GetAnonymous()).Update(). + sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update(). Set(db.Record{"name": "新名字"}). Where(db.C("id").Eq(1)). Executor().ToSQL() @@ -438,7 +438,7 @@ func (t *hooksTest) TestDelete_RolesConditionSub() { // 实际生成的 SQL： // DELETE FROM `users` AS `User` WHERE ((`id` = 1) AND (`id` IN ((SELECT `User`.`id` FROM `users` AS `User` WHERE (`owned_user` = '00000000-0000-0000-0000-000000000000'))))) - sql, _, _ := res.GetDBTable(base.GetAnonymous()).Delete(). + sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Delete(). Where(db.C("id").Eq(1)). Executor().ToSQL() @@ -474,7 +474,7 @@ func (t *hooksTest) TestDelete_CapturesSnapshot() { mock.ExpectExec("DELETE").WillReturnResult(sqlmock.NewResult(0, 1)) mock.ExpectCommit() - _, err := res.GetDBTable(base.GetAnonymous()).Delete(). + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Delete(). Where(db.C("id").Eq(5)). Executor().Exec() t.NoError(err) @@ -510,7 +510,7 @@ func (t *hooksTest) TestInsertColsVals_Capture() { mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(1, 1)) mock.ExpectCommit() - _, err := res.GetDBTable(base.GetAnonymous()).Insert().Cols("name").Vals( + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().Cols("name").Vals( db.Vals{"赵六"}, ).Executor().Exec() t.NoError(err) @@ -528,7 +528,7 @@ func (t *hooksTest) TestInsertColsVals_DoesNotStripSystemColumns() { // 实际生成的 SQL（created_user 没有被剔除/改写）： // INSERT INTO `users` (`name`, `created_user`, `owned_user`) VALUES ('赵六', 'attacker-uuid', '00000000-0000-0000-0000-000000000000') - sql, _, _ := res.GetDBTable(base.GetAnonymous()).Insert().Cols("name", "created_user").Vals( + sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().Cols("name", "created_user").Vals( db.Vals{"赵六", "attacker-uuid"}, ).Executor().ToSQL() @@ -572,7 +572,7 @@ func (t *hooksTest) TestVirtualResource_SkipsRolesConditionAndOnAfter() { // 实际生成的 SQL（虚拟资源拿子查询拼表名，且没有 owned_user 权限条件）： // UPDATE (SELECT * FROM `users`) AS `User` SET `name`='新名字' WHERE (`id` = 1) - sql, _, _ := res.GetDBTable(base.GetAnonymous()).Update(). + sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update(). Set(db.Record{"name": "新名字"}). Where(db.C("id").Eq(1)). Executor().ToSQL() @@ -580,7 +580,7 @@ func (t *hooksTest) TestVirtualResource_SkipsRolesConditionAndOnAfter() { // 没有安排 Begin：虚拟资源在 UseTx 里直接短路，不会自动开事务 mock.ExpectExec("UPDATE").WillReturnResult(sqlmock.NewResult(0, 1)) - _, err = res.GetDBTable(base.GetAnonymous()).Update(). + _, err = res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update(). Set(db.Record{"name": "新名字"}). Where(db.C("id").Eq(1)). Executor().Exec() @@ -620,7 +620,7 @@ func (t *hooksTest) TestBuildChanges_ResolvesNonPlaceholderLiteral() { mock.ExpectExec("UPDATE").WillReturnResult(sqlmock.NewResult(0, 1)) mock.ExpectCommit() - _, err := res.GetDBTable(base.GetAnonymous()).Update(). + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update(). Set(db.Record{"name": db.L("NOW()")}). Where(db.C("id").Eq(1)). Executor().Exec() @@ -650,7 +650,7 @@ func (t *hooksTest) TestUseTx_RollsBackOnChangeError() { mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(1, 1)) mock.ExpectRollback() - _, err := res.GetDBTable(base.GetAnonymous()).Insert(). + _, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert(). Rows(db.Record{"name": "赵六"}). Executor().Exec() @@ -684,7 +684,7 @@ func (t *hooksTest) TestUseTx_ReusesCallerProvidedTx() { // 这里不再有第二次 ExpectBegin：证明 UseTx 发现 dp.tx 已经非 nil 就不会再自己开一个 mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(1, 1)) - _, err = res.GetDBTable(base.GetAnonymous(), req.WithTx(tx)).Insert(). + _, err = res.GetDBTable(base.GetAnonymous(), req.WithTx(tx), req.WithPermission(req.ResAll)).Insert(). Rows(db.Record{"name": "赵六"}). Executor().Exec() t.NoError(err) diff --git a/resx/res_mask_field_test.go b/resx/res_mask_field_test.go index 5428dec..b4c1f73 100644 --- a/resx/res_mask_field_test.go +++ b/resx/res_mask_field_test.go @@ -178,7 +178,7 @@ func (t *maskFieldTest) newStarJoinApp() (user, dept, manager req.Resource) { func (t *maskFieldTest) TestDefaultSelect_MasksRestrictedField() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}).Select(db.Star()).Executor().ToSQL() + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL() t.Contains(sql, "`name`") t.Contains(sql, "-999999999 AS `salary`", "受限字段应该被替换成内置的数字哨兵值，而不是裸列") @@ -188,7 +188,7 @@ func (t *maskFieldTest) TestDefaultSelect_MasksRestrictedField() { func (t *maskFieldTest) TestDefaultSelect_RoleMatchShowsRealColumn() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{roles: []string{"hr"}}).Select(db.Star()).Executor().ToSQL() + sql, _, _ := res.GetDBTable(testUser{roles: []string{"hr"}}, req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL() // 没有字段需要脱敏，直接维持原来的 SELECT *，不会被改写成展开的列表 t.Contains(sql, "SELECT *") @@ -199,7 +199,7 @@ func (t *maskFieldTest) TestDefaultSelect_RoleMatchShowsRealColumn() { func (t *maskFieldTest) TestDefaultSelect_NoRestrictedFieldsLeavesWildcard() { res, _ := t.newResource(nameField) - sql, _, _ := res.GetDBTable(testUser{}).Select(db.Star()).Executor().ToSQL() + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL() t.Contains(sql, "SELECT *") } @@ -210,7 +210,7 @@ func (t *maskFieldTest) TestDefaultSelect_NoRestrictedFieldsLeavesWildcard() { func (t *maskFieldTest) TestExplicitColumn_MaskFieldMarkedColumnGetsMasked() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(db.C("name"), resx.MaskField("salary").As("salary")). Executor().ToSQL() @@ -223,7 +223,7 @@ func (t *maskFieldTest) TestExplicitColumn_MaskFieldMarkedColumnGetsMasked() { func (t *maskFieldTest) TestExplicitColumn_UnmarkedColumnNeverMasked() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(db.C("salary")). Executor().ToSQL() @@ -237,7 +237,7 @@ func (t *maskFieldTest) TestExplicitColumn_UnmarkedColumnNeverMasked() { func (t *maskFieldTest) TestQualifiedWildcard_OwnAliasExpandsAndMasks() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(db.T("User").All()). Executor().ToSQL() @@ -251,7 +251,7 @@ func (t *maskFieldTest) TestQualifiedWildcard_OwnAliasExpandsAndMasks() { func (t *maskFieldTest) TestQualifiedWildcard_OtherAliasNeverMasked() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(db.T("Department").All()). Executor().ToSQL() @@ -263,7 +263,7 @@ func (t *maskFieldTest) TestQualifiedWildcard_OtherAliasNeverMasked() { func (t *maskFieldTest) TestExplicitColumn_CustomAliasPreserved() { res, _ := t.newResource(salaryField) - sql, _, _ := res.GetDBTable(testUser{}). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(resx.MaskField("salary").As("employee_salary")). Executor().ToSQL() @@ -279,7 +279,7 @@ func (t *maskFieldTest) TestExplicitColumn_CustomAliasPreserved() { func (t *maskFieldTest) TestExplicitColumn_JoinedResourceFieldMasked() { user, dept := t.newJoinedApp() - sql, _, _ := user.GetDBTable(testUser{}). + sql, _, _ := user.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). LeftJoin(dept.GetTableExpr().As("Department"), db.On(db.I("User.dept_id").Eq(db.I("Department.id")))). Select(db.C("name"), resx.MaskField("Department.budget").As("budget")). Executor().ToSQL() @@ -294,7 +294,7 @@ func (t *maskFieldTest) TestExplicitColumn_JoinedResourceFieldMasked() { func (t *maskFieldTest) TestExplicitColumn_JoinedResourceFieldRoleMatchNotMasked() { user, dept := t.newJoinedApp() - sql, _, _ := user.GetDBTable(testUser{roles: []string{"finance"}}). + sql, _, _ := user.GetDBTable(testUser{roles: []string{"finance"}}, req.WithPermission(req.ResAll)). LeftJoin(dept.GetTableExpr().As("Department"), db.On(db.I("User.dept_id").Eq(db.I("Department.id")))). Select(db.C("name"), resx.MaskField("Department.budget").As("budget")). Executor().ToSQL() @@ -310,7 +310,7 @@ func (t *maskFieldTest) TestExplicitColumn_JoinedResourceFieldRoleMatchNotMasked func (t *maskFieldTest) TestExplicitColumn_DirectIdentifierAliasJoinResolves() { user, _ := t.newJoinedApp() - sql, _, _ := user.GetDBTable(testUser{}). + sql, _, _ := user.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). LeftJoin(db.T("departments").As("Department"), db.On(db.I("User.dept_id").Eq(db.I("Department.id")))). Select(db.C("name"), resx.MaskField("Department.budget").As("budget")). Executor().ToSQL() @@ -331,7 +331,7 @@ func (t *maskFieldTest) TestExplicitColumn_SelfJoinDifferentAliasesResolveIndepe ) register(category) - sql, _, _ := category.GetDBTable(testUser{}, req.WithAlias("Child")). + sql, _, _ := category.GetDBTable(testUser{}, req.WithAlias("Child"), req.WithPermission(req.ResAll)). LeftJoin(category.GetTableExpr().As("Parent"), db.On(db.I("Child.pid").Eq(db.I("Parent.id")))). Select( resx.MaskField("Child.secret").As("child_secret"), @@ -349,7 +349,7 @@ func (t *maskFieldTest) TestExplicitColumn_SelfJoinDifferentAliasesResolveIndepe func (t *maskFieldTest) TestExplicitColumn_ChainedJoinResolvesThirdTable() { user, dept, company := t.newChainedJoinApp() - sql, _, _ := user.GetDBTable(testUser{}). + sql, _, _ := user.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). LeftJoin(dept.GetTableExpr().As("Department"), db.On(db.I("User.dept_id").Eq(db.I("Department.id")))). LeftJoin(company.GetTableExpr().As("Company"), db.On(db.I("Department.company_id").Eq(db.I("Company.id")))). Select(db.C("name"), resx.MaskField("Company.budget").As("budget")). @@ -366,7 +366,7 @@ func (t *maskFieldTest) TestExplicitColumn_ChainedJoinResolvesThirdTable() { func (t *maskFieldTest) TestExplicitColumn_StarJoinResolvesEachBranchIndependently() { user, dept, manager := t.newStarJoinApp() - sql, _, _ := user.GetDBTable(testUser{roles: []string{"finance"}}). + sql, _, _ := user.GetDBTable(testUser{roles: []string{"finance"}}, req.WithPermission(req.ResAll)). LeftJoin(dept.GetTableExpr().As("Department"), db.On(db.I("User.dept_id").Eq(db.I("Department.id")))). LeftJoin(manager.GetTableExpr().As("Manager"), db.On(db.I("User.manager_id").Eq(db.I("Manager.id")))). Select( @@ -386,7 +386,7 @@ func (t *maskFieldTest) TestExplicitColumn_StarJoinResolvesEachBranchIndependent func (t *maskFieldTest) TestExplicitColumn_FieldNotFoundOnResourceErrors() { user, dept := t.newJoinedApp() - _, _, err := user.GetDBTable(testUser{}). + _, _, err := user.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). LeftJoin(dept.GetTableExpr().As("Department"), db.On(db.I("User.dept_id").Eq(db.I("Department.id")))). Select(db.C("name"), resx.MaskField("Department.no_such_field").As("x")). Executor().ToSQL() @@ -399,7 +399,7 @@ func (t *maskFieldTest) TestExplicitColumn_FieldNotFoundOnResourceErrors() { func (t *maskFieldTest) TestExplicitColumn_UnresolvableAliasErrors() { res, _ := t.newResource(nameField, salaryField) - _, _, err := res.GetDBTable(testUser{}). + _, _, err := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(db.C("name"), resx.MaskField("NoSuchResource.budget").As("budget")). Executor().ToSQL() @@ -427,7 +427,7 @@ func (t *maskFieldTest) TestExplicitColumn_GetResourceUnavailableErrors() { resx.WithFields(nameField), ) - _, _, sqlErr := res.GetDBTable(testUser{}). + _, _, sqlErr := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). LeftJoin(db.T("departments").As("Department"), db.On(db.I("User.dept_id").Eq(db.I("Department.id")))). Select(db.C("name"), resx.MaskField("Department.budget").As("budget")). Executor().ToSQL() @@ -459,7 +459,7 @@ func (t *maskFieldTest) TestExplicitColumn_OwnAliasSkipsGetResourceEntirely() { resx.WithFields(nameField, salaryField), ) - sql, _, sqlErr := res.GetDBTable(testUser{}). + sql, _, sqlErr := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(resx.MaskField("User.name").As("name"), resx.MaskField("User.salary").As("salary")). Executor().ToSQL() @@ -477,7 +477,7 @@ func (t *maskFieldTest) TestExplicitColumn_OwnAliasSkipsGetResourceEntirely() { func (t *maskFieldTest) TestExplicitColumn_MaskFieldInsideFuncArgGetsMasked() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(db.Func("CONCAT", resx.MaskField("salary"), db.L("' extra'")).As("computed")). Executor().ToSQL() @@ -489,7 +489,7 @@ func (t *maskFieldTest) TestExplicitColumn_MaskFieldInsideFuncArgGetsMasked() { func (t *maskFieldTest) TestExplicitColumn_MaskFieldInsideFuncArgRoleMatchNotMasked() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{roles: []string{"hr"}}). + sql, _, _ := res.GetDBTable(testUser{roles: []string{"hr"}}, req.WithPermission(req.ResAll)). Select(db.Func("CONCAT", resx.MaskField("salary"), db.L("' extra'")).As("computed")). Executor().ToSQL() @@ -503,7 +503,7 @@ func (t *maskFieldTest) TestExplicitColumn_MaskFieldInsideFuncArgRoleMatchNotMas func (t *maskFieldTest) TestExplicitColumn_MaskFieldInsideNestedFuncArgGetsMasked() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). Select(db.Func("UPPER", db.Func("CONCAT", resx.MaskField("salary"), db.L("' extra'"))).As("computed")). Executor().ToSQL() @@ -515,7 +515,7 @@ func (t *maskFieldTest) TestExplicitColumn_MaskFieldInsideNestedFuncArgGetsMaske func (t *maskFieldTest) TestExplicitColumn_MaskFieldInsideJoinedFuncArgGetsMasked() { user, dept := t.newJoinedApp() - sql, _, _ := user.GetDBTable(testUser{}). + sql, _, _ := user.GetDBTable(testUser{}, req.WithPermission(req.ResAll)). LeftJoin(dept.GetTableExpr().As("Department"), db.On(db.I("User.dept_id").Eq(db.I("Department.id")))). Select(db.Func("CONCAT", resx.MaskField("Department.budget"), db.L("' extra'")).As("computed")). Executor().ToSQL() @@ -545,7 +545,7 @@ func (t *maskFieldTest) TestCustomMaskFunc_Override() { resx.WithFields(salaryField), ) - sql, _, _ := customRes.GetDBTable(testUser{}).Select(db.Star()).Executor().ToSQL() + sql, _, _ := customRes.GetDBTable(testUser{}, req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL() t.Contains(sql, "REDACTED") t.NotContains(sql, "-999999999") @@ -557,7 +557,7 @@ func (t *maskFieldTest) TestCustomMaskFunc_Override() { func (t *maskFieldTest) TestInsert_DropsFieldWithoutWriteAccess() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}).Insert(). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)).Insert(). Rows(db.Record{"name": "张三", "salary": 999999}). Executor().ToSQL() @@ -569,7 +569,7 @@ func (t *maskFieldTest) TestInsert_DropsFieldWithoutWriteAccess() { func (t *maskFieldTest) TestInsert_KeepsFieldWithWriteAccess() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{roles: []string{"hr"}}).Insert(). + sql, _, _ := res.GetDBTable(testUser{roles: []string{"hr"}}, req.WithPermission(req.ResAll)).Insert(). Rows(db.Record{"name": "张三", "salary": 999999}). Executor().ToSQL() @@ -580,7 +580,7 @@ func (t *maskFieldTest) TestInsert_KeepsFieldWithWriteAccess() { func (t *maskFieldTest) TestUpdate_DropsFieldWithoutWriteAccess() { res, _ := t.newResource(nameField, salaryField) - sql, _, _ := res.GetDBTable(testUser{}).Update(). + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)).Update(). Set(db.Record{"name": "李四", "salary": 888888}). Where(db.C("id").Eq(1)). Executor().ToSQL() diff --git a/resx/res_permission_test.go b/resx/res_permission_test.go new file mode 100644 index 0000000..df5bf9d --- /dev/null +++ b/resx/res_permission_test.go @@ -0,0 +1,130 @@ +package resx_test + +import ( + "testing" + + "github.com/DATA-DOG/go-sqlmock" + "github.com/samber/do/v2" + "github.com/stretchr/testify/suite" + + "git.fsdpf.net/go/db" + "git.fsdpf.net/go/db/engine" + "git.fsdpf.net/go/req" + "git.fsdpf.net/go/req/resx" + + _ "git.fsdpf.net/go/db/dialect/mysql" +) + +// permissionTest 验证 req.WithPermission(req.ResFlags) 各个取值（不传/传 0/单独 ResRow/单独 +// ResMask/ResAll）分别独立生效：ResRow 控制行级过滤条件要不要拼进查询，ResMask 控制字段级脱敏 +// 要不要生效，两者互不影响彼此。GetDBTable 不传 WithPermission 时按文档约定的零值处理（两者都 +// 跳过），这里也显式测出来，作为这个默认行为的回归防护——之后如果谁想改这个默认值，这些测试会 +// 先失败提醒。 +type permissionTest struct { + suite.Suite +} + +func TestPermission(t *testing.T) { + suite.Run(t, new(permissionTest)) +} + +// newPermissionResource 构造一个既配置了受限字段（salary，Roles=hr）、又注册了行级过滤条件 +// （owned_user = 当前用户）的资源，用同一份数据分别验证 ResRow/ResMask 两个开关。 +func (t *permissionTest) newPermissionResource() (req.Resource, sqlmock.Sqlmock) { + mockDB, mock, err := sqlmock.New() + t.Require().NoError(err) + + app := do.New() + do.Provide(app, func(i do.Injector) (engine.Engine, error) { + return engine.Mock(map[string]engine.MockDBConfig{ + "default": {Driver: "mysql", Mock: mockDB}, + }), nil + }) + do.Provide(app, func(i do.Injector) (resx.DataInterceptor, error) { + return func(res req.Resource, u req.User, category resx.ResEventType) (*db.SelectDataset, db.Expression, resx.ResChangeRowFunc) { + return nil, db.C("owned_user").Eq(u.Uuid()), nil + }, nil + }) + + res := resx.New(app, "User", "users", + resx.WithConn("default"), + resx.WithFields(nameField, salaryField), + ) + + return res, mock +} + +// TestNoPermissionOption_SkipsBothRowFilterAndMask 不传 WithPermission：Permission 零值，行级 +// 过滤和字段脱敏都跳过——这是 options.go 里 Permission 字段注释明确写的默认行为 +func (t *permissionTest) TestNoPermissionOption_SkipsBothRowFilterAndMask() { + res, _ := t.newPermissionResource() + + sql, _, _ := res.GetDBTable(testUser{}).Select(db.Star()).Executor().ToSQL() + + t.NotContains(sql, "owned_user", "不传 WithPermission 时行级过滤应该被跳过") + t.NotContains(sql, "-999999999", "不传 WithPermission 时字段脱敏应该被跳过") +} + +// TestExplicitZeroPermission_SkipsBothRowFilterAndMask 显式传 WithPermission(0)，效果跟不传一样 +func (t *permissionTest) TestExplicitZeroPermission_SkipsBothRowFilterAndMask() { + res, _ := t.newPermissionResource() + + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(0)).Select(db.Star()).Executor().ToSQL() + + t.NotContains(sql, "owned_user") + t.NotContains(sql, "-999999999") +} + +// TestResRowOnly_EnablesRowFilterOnlyNotMask 只传 ResRow：行级过滤生效，字段脱敏依旧跳过——两个 +// 开关相互独立，不是绑在一起的 +func (t *permissionTest) TestResRowOnly_EnablesRowFilterOnlyNotMask() { + res, _ := t.newPermissionResource() + + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResRow)).Select(db.Star()).Executor().ToSQL() + + t.Contains(sql, "owned_user", "传了 ResRow，行级过滤应该生效") + t.NotContains(sql, "-999999999", "没传 ResMask，字段脱敏不该生效") +} + +// TestResMaskOnly_EnablesMaskOnlyNotRowFilter 只传 ResMask：字段脱敏生效，行级过滤依旧跳过 +func (t *permissionTest) TestResMaskOnly_EnablesMaskOnlyNotRowFilter() { + res, _ := t.newPermissionResource() + + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResMask)).Select(db.Star()).Executor().ToSQL() + + t.Contains(sql, "-999999999 AS `salary`", "传了 ResMask，字段脱敏应该生效") + t.NotContains(sql, "owned_user", "没传 ResRow，行级过滤不该生效") +} + +// TestResAll_EnablesBothRowFilterAndMask 传 ResAll：行级过滤和字段脱敏都生效 +func (t *permissionTest) TestResAll_EnablesBothRowFilterAndMask() { + res, _ := t.newPermissionResource() + + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL() + + t.Contains(sql, "owned_user") + t.Contains(sql, "-999999999 AS `salary`") +} + +// TestResRowOrResMaskBitwiseCombo_SameAsResAll 手动按位组合 ResRow|ResMask，效果跟直接传 ResAll +// 一样——ResAll 只是这个组合的一个别名，不是什么特殊值 +func (t *permissionTest) TestResRowOrResMaskBitwiseCombo_SameAsResAll() { + res, _ := t.newPermissionResource() + + sql, _, _ := res.GetDBTable(testUser{}, req.WithPermission(req.ResRow|req.ResMask)).Select(db.Star()).Executor().ToSQL() + + t.Contains(sql, "owned_user") + t.Contains(sql, "-999999999 AS `salary`") +} + +// TestUserHasRole_ResMaskStillOnButFieldPassesThrough ResMask 开启时，用户角色命中字段 Roles 的话 +// 字段本身按真实值查询——ResMask 只是"开启检查"，不是"无条件脱敏"，命中权限时检查结果是放行 +func (t *permissionTest) TestUserHasRole_ResMaskStillOnButFieldPassesThrough() { + res, _ := t.newPermissionResource() + + sql, _, _ := res.GetDBTable(testUser{roles: []string{"hr"}}, req.WithPermission(req.ResMask)). + Select(db.Star()).Executor().ToSQL() + + t.Contains(sql, "SELECT *", "没有字段需要脱敏时不会展开成显式列表") + t.NotContains(sql, "-999999999") +}