xiaokang/lotteryLaravel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 重构管理员权限管理，移除 AdminPermission 模型，整合权限与角色管理逻辑，优化 API 接口以支持角色与权限的同步，增强数据库填充器以对齐权限配置

Browse Source
This commit is contained in:
kang
2026-05-13 10:40:07 +08:00
parent 3c92bef774
commit edd863764b
18 changed files with 1486 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files

101
tests/Feature/AdminUserPermissionApiTest.php
View File

@@ -1,10 +1,11 @@
<?php
use App\Lottery\ErrorCode;
use App\Models\AdminPermission;
use App\Models\AdminRole;
use App\Models\AdminUser;
use App\Support\AdminPermissionBridge;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
uses(RefreshDatabase::class);
@@ -24,22 +25,36 @@ function makeAdminWithPermissions(string $username, array $permissionSlugs): str
'name' => 'Role '.$username,
]);
$codes = [];
foreach ($permissionSlugs as $slug) {
$permission = AdminPermission::query()->firstOrCreate(
['slug' => $slug],
['name' => $slug],
);
$role->permissions()->syncWithoutDetaching([(int) $permission->id]);
$codes = array_merge($codes, AdminPermissionBridge::menuActionCodesForLegacy($slug));
}
$codes = array_values(array_unique($codes));
$ids = DB::table('admin_menu_actions')
->whereIn('permission_code', $codes)
->where('status', 1)
->pluck('id')
->all();
foreach ($ids as $mid) {
DB::table('admin_role_menu_actions')->insert([
'role_id' => $role->id,
'menu_action_id' => (int) $mid,
]);
}
$admin->roles()->syncWithoutDetaching([(int) $role->id]);
$siteId = AdminUser::defaultAdminSiteId();
$admin->roles()->sync([
(int) $role->id => [
'site_id' => $siteId,
'granted_at' => now(),
],
]);
return $admin->createToken('test', ['*'], now()->addDay())->plainTextToken;
}
test('admin user permission apis require rbac permission', function (): void {
AdminPermission::query()->create(['slug' => 'prd.admin_user.manage', 'name' => 'admin manage']);
$token = makeAdminWithPermissions('rbac_viewer', ['prd.report.player']);
$this->withHeader('Authorization', 'Bearer '.$token)
@@ -49,10 +64,6 @@ test('admin user permission apis require rbac permission', function (): void {
});
test('admin can list users and sync direct permissions', function (): void {
$manage = AdminPermission::query()->create(['slug' => 'prd.admin_user.manage', 'name' => 'admin manage']);
$report = AdminPermission::query()->create(['slug' => 'prd.report.player', 'name' => 'report player']);
$draw = AdminPermission::query()->create(['slug' => 'prd.draw_result.view', 'name' => 'draw view']);
$token = makeAdminWithPermissions('rbac_manager', ['prd.admin_user.manage']);
$target = AdminUser::query()->create([
@@ -63,14 +74,33 @@ test('admin can list users and sync direct permissions', function (): void {
'status' => 0,
]);
$targetRole = AdminRole::query()->create(['slug' => 'target_role', 'name' => 'Target Role']);
$targetRole->permissions()->sync([(int) $draw->id]);
$target->roles()->sync([(int) $targetRole->id]);
$drawCodes = AdminPermissionBridge::menuActionCodesForLegacy('prd.draw_result.view');
$drawIds = DB::table('admin_menu_actions')
->whereIn('permission_code', $drawCodes)
->where('status', 1)
->pluck('id')
->all();
foreach ($drawIds as $mid) {
DB::table('admin_role_menu_actions')->insert([
'role_id' => $targetRole->id,
'menu_action_id' => (int) $mid,
]);
}
$siteId = AdminUser::defaultAdminSiteId();
$target->roles()->sync([
(int) $targetRole->id => [
'site_id' => $siteId,
'granted_at' => now(),
],
]);
$this->withHeader('Authorization', 'Bearer '.$token)
->getJson('/api/v1/admin/admin-user-permission-catalog')
->assertOk()
->assertJsonPath('code', ErrorCode::Success->value)
->assertJsonPath('data.permissions.0.slug', 'prd.admin_user.manage');
->assertJsonFragment(['slug' => 'prd.admin_user.manage']);
$this->withHeader('Authorization', 'Bearer '.$token)
->getJson('/api/v1/admin/admin-users?keyword=target')
@@ -81,22 +111,45 @@ test('admin can list users and sync direct permissions', function (): void {
$this->withHeader('Authorization', 'Bearer '.$token)
->putJson('/api/v1/admin/admin-users/'.$target->id.'/permissions', [
'permission_slugs' => [$report->slug],
'permission_slugs' => ['prd.report.player'],
])
->assertOk()
->assertJsonPath('code', ErrorCode::Success->value)
->assertJsonPath('data.direct_permissions.0', 'prd.report.player');
->assertJsonFragment(['prd.report.player']);
expect(
$target->fresh()->permissions()->pluck('slug')->sort()->values()->all()
)->toBe([$report->slug]);
expect($target->fresh()->directLegacyPermissionSlugs())->toContain('prd.report.player');
$list = $this->withHeader('Authorization', 'Bearer '.$token)
->getJson('/api/v1/admin/admin-users?keyword=target')
->assertOk()
->json('data.items.0.effective_permissions');
expect($list)->toContain($draw->slug);
expect($list)->toContain($report->slug);
expect($manage->slug)->toBe('prd.admin_user.manage');
expect($list)->toContain('prd.draw_result.view');
expect($list)->toContain('prd.report.player');
});
test('admin can sync user roles for default site', function (): void {
$token = makeAdminWithPermissions('rbac_role_editor', ['prd.admin_user.manage']);
$r1 = AdminRole::query()->create(['slug' => 'role_sync_a', 'name' => 'Role A']);
$r2 = AdminRole::query()->create(['slug' => 'role_sync_b', 'name' => 'Role B']);
$target = AdminUser::query()->create([
'username' => 'role_target',
'name' => 'Role Target',
'email' => null,
'password' => Hash::make('secret-strong'),
'status' => 0,
]);
$this->withHeader('Authorization', 'Bearer '.$token)
->putJson('/api/v1/admin/admin-users/'.$target->id.'/roles', [
'role_slugs' => ['role_sync_b', 'role_sync_a'],
])
->assertOk()
->assertJsonPath('code', ErrorCode::Success->value);
$slugs = $target->fresh()->adminRoleSlugs();
sort($slugs);
expect($slugs)->toBe(['role_sync_a', 'role_sync_b']);
});