go/req
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

测试: GetDBTable 显式传 WithPermission，补充权限组合覆盖

Browse Source 
Permission 不传时按零值处理，行级过滤和字段脱敏都会跳过（见 options.go 里
Permission 字段的注释），这是既有设计，不是这次改的。但 resx 包自己的测试
之前几乎都没传 WithPermission，实际上一直跑在"权限检查关闭"的状态下——
字段脱敏、写权限过滤、行级过滤相关的断言全部失效但没有暴露出来。

给 res_mask_field_test.go/res_interceptor_test.go 里所有 GetDBTable 调用
显式加上 WithPermission(ResAll)，让这些测试真正跑在权限检查打开的状态下。
另外新增 res_permission_test.go，单独验证 WithPermission 各个取值（不传/
显式传 0/单独 ResRow/单独 ResMask/ResAll/按位组合）分别独立生效，作为这个
默认行为的回归防护。
This commit is contained in:
what
2026-08-20 15:59:24 +08:00
parent 5cdf1cc00d
commit f39adfa46c
3 changed files with 177 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resx/res_interceptor_test.go
+21 -21
View File
@@ -84,14 +84,14 @@ func (t *hooksTest) TestOnBefore_RolesCondition_Cond() {
// 实际生成的 SQL：
// SELECT * FROM `users` AS `User` WHERE (`owned_user` = '00000000-0000-0000-0000-000000000000')
sql, _, _ := res.GetDBTable(base.GetAnonymous()).Select(db.Star()).Executor().ToSQL()
sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL()
t.Contains(sql, "owned_user")
t.Contains(sql, "00000000-0000-0000-0000-000000000000")
mock.ExpectQuery("SELECT").
WillReturnRows(sqlmock.NewRows([]string{"id", "name"}).AddRow(1, "张三"))
rows, err := res.GetDBTable(base.GetAnonymous()).Select(db.Star()).Executor().GetRecords()
rows, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Select(db.Star()).Executor().GetRecords()
t.NoError(err)
t.Len(rows, 1)
t.NoError(mock.ExpectationsWereMet())
@@ -111,13 +111,13 @@ func (t *hooksTest) TestOnBefore_RolesCondition_Sub() {
// 实际生成的 SQL：
// SELECT * FROM (SELECT * FROM `users` AS `User` WHERE (`owned_user` = '00000000-0000-0000-0000-000000000000')) AS `User`
sql, _, _ := res.GetDBTable(base.GetAnonymous()).Select(db.Star()).Executor().ToSQL()
sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Select(db.Star()).Executor().ToSQL()
t.Contains(sql, "owned_user")
mock.ExpectQuery("SELECT").
WillReturnRows(sqlmock.NewRows([]string{"id", "name"}).AddRow(2, "李四"))
rows, err := res.GetDBTable(base.GetAnonymous()).Select(db.Star()).Executor().GetRecords()
rows, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Select(db.Star()).Executor().GetRecords()
t.NoError(err)
t.Len(rows, 1)
t.NoError(mock.ExpectationsWereMet())
@@ -153,7 +153,7 @@ func (t *hooksTest) TestOnBefore_NeedsCapture_True() {
mock.ExpectExec("UPDATE").WillReturnResult(sqlmock.NewResult(0, 1))
mock.ExpectCommit()
_, err := res.GetDBTable(base.GetAnonymous()).Update().
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update().
Set(db.Record{"name": "新名字"}).
Where(db.C("id").Eq(1)).
Executor().Exec()
@@ -185,7 +185,7 @@ func (t *hooksTest) TestOnBefore_NeedsCapture_False() {
// 实际生成的 SQL：UPDATE `users` AS `User` SET `name`='新名字' WHERE (`id` = 1)
mock.ExpectExec("UPDATE").WillReturnResult(sqlmock.NewResult(0, 1))
_, err := res.GetDBTable(base.GetAnonymous()).Update().
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update().
Set(db.Record{"name": "新名字"}).
Where(db.C("id").Eq(1)).
Executor().Exec()
@@ -220,7 +220,7 @@ func (t *hooksTest) TestOnAfter_RowsContent_Insert() {
mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(10, 1))
mock.ExpectCommit()
_, err := res.GetDBTable(base.GetAnonymous()).Insert().
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().
Rows(db.Record{"name": "张三"}).
Executor().Exec()
t.NoError(err)
@@ -256,7 +256,7 @@ func (t *hooksTest) TestOnAfter_UnconditionalOnWrite() {
// 实际生成的 SQL：DELETE FROM `users` AS `User` WHERE (`id` = 1)
mock.ExpectExec("DELETE").WillReturnResult(sqlmock.NewResult(0, 3))
_, err := res.GetDBTable(base.GetAnonymous()).Delete().
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Delete().
Where(db.C("id").Eq(1)).
Executor().Exec()
t.NoError(err)
@@ -300,7 +300,7 @@ func (t *hooksTest) TestInsertFromQuery_FetchesInsertedRowsAfterward() {
)
mock.ExpectCommit()
_, err := res.GetDBTable(base.GetAnonymous()).Insert().FromQuery(sub).Executor().Exec()
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().FromQuery(sub).Executor().Exec()
t.NoError(err)
t.NoError(mock.ExpectationsWereMet())
@@ -335,7 +335,7 @@ func (t *hooksTest) TestBatchInsertIds_Mysql() {
mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(100, 3))
mock.ExpectCommit()
_, err := res.GetDBTable(base.GetAnonymous()).Insert().Rows(
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().Rows(
db.Record{"name": "A"}, db.Record{"name": "B"}, db.Record{"name": "C"},
).Executor().Exec()
t.NoError(err)
@@ -385,7 +385,7 @@ func (t *hooksTest) TestBatchInsertIds_LocalDB() {
),
)
_, err := res.GetDBTable(base.GetAnonymous()).Insert().Rows(
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().Rows(
db.Record{"name": "A"}, db.Record{"name": "B"}, db.Record{"name": "C"},
).Executor().Exec()
t.Require().NoError(err)
@@ -413,7 +413,7 @@ func (t *hooksTest) TestUpdate_RolesConditionSub() {
// 实际生成的 SQL：
// UPDATE `users` AS `User` SET `name`='新名字' WHERE ((`id` = 1) AND (`id` IN ((SELECT `User`.`id` FROM `users` AS `User` WHERE (`owned_user` = '00000000-0000-0000-0000-000000000000')))))
sql, _, _ := res.GetDBTable(base.GetAnonymous()).Update().
sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update().
Set(db.Record{"name": "新名字"}).
Where(db.C("id").Eq(1)).
Executor().ToSQL()
@@ -438,7 +438,7 @@ func (t *hooksTest) TestDelete_RolesConditionSub() {
// 实际生成的 SQL：
// DELETE FROM `users` AS `User` WHERE ((`id` = 1) AND (`id` IN ((SELECT `User`.`id` FROM `users` AS `User` WHERE (`owned_user` = '00000000-0000-0000-0000-000000000000')))))
sql, _, _ := res.GetDBTable(base.GetAnonymous()).Delete().
sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Delete().
Where(db.C("id").Eq(1)).
Executor().ToSQL()
@@ -474,7 +474,7 @@ func (t *hooksTest) TestDelete_CapturesSnapshot() {
mock.ExpectExec("DELETE").WillReturnResult(sqlmock.NewResult(0, 1))
mock.ExpectCommit()
_, err := res.GetDBTable(base.GetAnonymous()).Delete().
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Delete().
Where(db.C("id").Eq(5)).
Executor().Exec()
t.NoError(err)
@@ -510,7 +510,7 @@ func (t *hooksTest) TestInsertColsVals_Capture() {
mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(1, 1))
mock.ExpectCommit()
_, err := res.GetDBTable(base.GetAnonymous()).Insert().Cols("name").Vals(
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().Cols("name").Vals(
db.Vals{"赵六"},
).Executor().Exec()
t.NoError(err)
@@ -528,7 +528,7 @@ func (t *hooksTest) TestInsertColsVals_DoesNotStripSystemColumns() {
// 实际生成的 SQL（created_user 没有被剔除/改写）：
// INSERT INTO `users` (`name`, `created_user`, `owned_user`) VALUES ('赵六', 'attacker-uuid', '00000000-0000-0000-0000-000000000000')
sql, _, _ := res.GetDBTable(base.GetAnonymous()).Insert().Cols("name", "created_user").Vals(
sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().Cols("name", "created_user").Vals(
db.Vals{"赵六", "attacker-uuid"},
).Executor().ToSQL()
@@ -572,7 +572,7 @@ func (t *hooksTest) TestVirtualResource_SkipsRolesConditionAndOnAfter() {
// 实际生成的 SQL（虚拟资源拿子查询拼表名，且没有 owned_user 权限条件）：
// UPDATE (SELECT * FROM `users`) AS `User` SET `name`='新名字' WHERE (`id` = 1)
sql, _, _ := res.GetDBTable(base.GetAnonymous()).Update().
sql, _, _ := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update().
Set(db.Record{"name": "新名字"}).
Where(db.C("id").Eq(1)).
Executor().ToSQL()
@@ -580,7 +580,7 @@ func (t *hooksTest) TestVirtualResource_SkipsRolesConditionAndOnAfter() {
// 没有安排 Begin：虚拟资源在 UseTx 里直接短路，不会自动开事务
mock.ExpectExec("UPDATE").WillReturnResult(sqlmock.NewResult(0, 1))
_, err = res.GetDBTable(base.GetAnonymous()).Update().
_, err = res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update().
Set(db.Record{"name": "新名字"}).
Where(db.C("id").Eq(1)).
Executor().Exec()
@@ -620,7 +620,7 @@ func (t *hooksTest) TestBuildChanges_ResolvesNonPlaceholderLiteral() {
mock.ExpectExec("UPDATE").WillReturnResult(sqlmock.NewResult(0, 1))
mock.ExpectCommit()
_, err := res.GetDBTable(base.GetAnonymous()).Update().
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Update().
Set(db.Record{"name": db.L("NOW()")}).
Where(db.C("id").Eq(1)).
Executor().Exec()
@@ -650,7 +650,7 @@ func (t *hooksTest) TestUseTx_RollsBackOnChangeError() {
mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(1, 1))
mock.ExpectRollback()
_, err := res.GetDBTable(base.GetAnonymous()).Insert().
_, err := res.GetDBTable(base.GetAnonymous(), req.WithPermission(req.ResAll)).Insert().
Rows(db.Record{"name": "赵六"}).
Executor().Exec()
@@ -684,7 +684,7 @@ func (t *hooksTest) TestUseTx_ReusesCallerProvidedTx() {
// 这里不再有第二次 ExpectBegin：证明 UseTx 发现 dp.tx 已经非 nil 就不会再自己开一个
mock.ExpectExec("INSERT").WillReturnResult(sqlmock.NewResult(1, 1))
_, err = res.GetDBTable(base.GetAnonymous(), req.WithTx(tx)).Insert().
_, err = res.GetDBTable(base.GetAnonymous(), req.WithTx(tx), req.WithPermission(req.ResAll)).Insert().
Rows(db.Record{"name": "赵六"}).
Executor().Exec()
t.NoError(err)