feat: 增强代理和玩家管理功能

- 在多个控制器中更新权限检查逻辑，确保管理员能够更灵活地管理代理和玩家。 - 在 AdminPlayerStoreController 中引入对玩家创建能力的验证，确保只有具备相应权限的管理员能够创建玩家。 - 更新请求验证逻辑，新增 credit_limit、rebate_rate 和 extra_rebate_rate 字段，以支持更细粒度的玩家管理。 - 在 AgentNodeProfileController 中添加对父代理能力授予的验证，确保子代理的权限在父代理范围内。 - 引入 AgentProfileFieldRules 以简化代理资料更新请求的规则定义，提升代码复用性。
2026-06-04 18:00:50 +08:00
parent 96545f87f6
commit a44679665d
183 changed files with 10054 additions and 857 deletions
--- a/tests/Feature/PlatformSystemRolesTest.php
+++ b/tests/Feature/PlatformSystemRolesTest.php
@@ -0,0 +1,100 @@
+<?php
+
+use App\Models\AdminRole;
+use App\Models\AdminUser;
+use App\Support\PlatformSystemRoles;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function (): void {
+    $this->artisan('lottery:admin-auth-sync')->assertExitCode(0);
+});
+
+function platformRolesApiToken(string $username): string
+{
+    $admin = AdminUser::query()->create([
+        'username' => $username,
+        'name' => 'Tester',
+        'email' => null,
+        'password' => Hash::make('secret-strong'),
+        'status' => 0,
+    ]);
+    grantSuperAdminRole($admin);
+
+    return $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
+}
+
+test('platform role index only lists fixed super_admin and agent roles', function (): void {
+    AdminRole::query()->create([
+        'slug' => 'legacy_custom_ops',
+        'code' => 'legacy_custom_ops',
+        'name' => 'Legacy Ops',
+        'scope_type' => AdminRole::SCOPE_SYSTEM,
+        'status' => 1,
+        'is_system' => false,
+        'sort_order' => 99,
+    ]);
+
+    PlatformSystemRoles::ensureAll();
+
+    $token = platformRolesApiToken('platform_role_index');
+
+    $slugs = collect($this->withHeader('Authorization', 'Bearer '.$token)
+        ->getJson('/api/v1/admin/admin-roles')
+        ->assertOk()
+        ->json('data.items'))
+        ->pluck('slug')
+        ->all();
+
+    expect($slugs)->toBe(['super_admin', 'agent']);
+});
+
+test('platform roles cannot be created and super_admin permissions are full catalog', function (): void {
+    PlatformSystemRoles::ensureAll();
+
+    $token = platformRolesApiToken('platform_role_guard');
+    $menuActionCount = (int) DB::table('admin_menu_actions')->where('status', 1)->count();
+
+    $super = AdminRole::query()->where('slug', 'super_admin')->firstOrFail();
+    expect($super->is_system)->toBeTrue();
+    expect((int) DB::table('admin_role_menu_actions')->where('role_id', $super->id)->count())
+        ->toBe($menuActionCount);
+    expect($super->legacyPermissionSlugs())->not->toBeEmpty();
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->postJson('/api/v1/admin/admin-roles', [
+            'slug' => 'new_ops',
+            'name' => 'New Ops',
+        ])
+        ->assertStatus(422);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/admin-roles/'.$super->id.'/permissions', [
+            'permission_slugs' => ['prd.dashboard.view'],
+        ])
+        ->assertStatus(422);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->putJson('/api/v1/admin/admin-roles/'.$super->id, [
+            'name' => 'Renamed Super',
+        ])
+        ->assertStatus(422);
+
+    $this->withHeader('Authorization', 'Bearer '.$token)
+        ->deleteJson('/api/v1/admin/admin-roles/'.$super->id)
+        ->assertStatus(422);
+});
+
+test('admin-auth-sync grants super_admin the full permission catalog', function (): void {
+    $this->artisan('lottery:admin-auth-sync')->assertExitCode(0);
+
+    $super = AdminRole::query()->where('slug', 'super_admin')->firstOrFail();
+
+    $menuActionCount = (int) DB::table('admin_menu_actions')->where('status', 1)->count();
+
+    expect((int) DB::table('admin_role_menu_actions')->where('role_id', $super->id)->count())
+        ->toBe($menuActionCount);
+});