szx/NewSzxcn-Email
1
0
Fork 0
Code Issues Pull Requests Actions 55 Packages Projects Releases Wiki Activity

fix(permission): 调整默认权限组与用户权限继承

Browse Source 
- 将“普通用户”权限组纳入默认权限继承，创建和更新用户时自动合并其权限。
- 放宽“普通用户”系统组的可编辑性，但仍禁止删除；继续限制超级管理员组被修改。
- 更新管理端权限组操作状态，避免对不可删除或不可编辑项提供错误入口。
- 补充相关测试，覆盖默认权限组编辑、删除与用户权限继承场景。
This commit is contained in:
LanQin_
2026-06-22 14:42:37 +08:00
parent 8cbcc22a74
commit acdf298811
5 changed files with 106 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/internal/app/app_test.go
+39 -1
View File
@@ -938,9 +938,23 @@ func TestFixedRolesProtectAdminRoutesAndDefaultAdmin(t *testing.T) {
}, &errBody); code != http.StatusForbidden {
t.Fatalf("system permission group update should be forbidden code=%d body=%v", code, errBody)
}
var regularGroup PermissionGroup
if code := admin.do("POST", "/api/admin/permission-groups/"+PermissionGroupRegular, map[string]any{
"name": "普通用户",
"description": "Default permissions for regular users",
"permissions": []string{PermissionAdminOverview},
}, &regularGroup); code != http.StatusOK {
t.Fatalf("regular user group should be editable code=%d group=%+v", code, regularGroup)
}
if !regularGroup.System || !userHasPermission(&User{Role: "user", Permissions: regularGroup.Permissions}, PermissionAdminOverview) {
t.Fatalf("regular group update did not persist permissions=%+v", regularGroup)
}
if code := admin.do("DELETE", "/api/admin/permission-groups/"+PermissionGroupSuperAdmin, nil, &errBody); code != http.StatusForbidden {
t.Fatalf("system permission group delete should be forbidden code=%d body=%v", code, errBody)
}
if code := admin.do("DELETE", "/api/admin/permission-groups/"+PermissionGroupRegular, nil, &errBody); code != http.StatusForbidden {
t.Fatalf("regular user group delete should be forbidden code=%d body=%v", code, errBody)
}
if code := admin.do("POST", "/api/admin/users", map[string]any{
"email": "invalid-group@lanqin.local",
"displayName": "Invalid Group",
@@ -997,10 +1011,25 @@ func TestFixedRolesProtectAdminRoutesAndDefaultAdmin(t *testing.T) {
}, &mailboxUser); code != http.StatusCreated {
t.Fatalf("create mailbox admin user code=%d user=%+v", code, mailboxUser)
}
if mailboxUser.Role != "user" || len(mailboxUser.PermissionGroupIDs) != 1 || mailboxUser.PermissionGroupIDs[0] != mailboxAdminGroup.ID || !userHasPermission(&mailboxUser.User, PermissionMailboxesManage) || userHasPermission(&mailboxUser.User, PermissionSystemSettings) {
if mailboxUser.Role != "user" || !containsString(mailboxUser.PermissionGroupIDs, PermissionGroupRegular) || !containsString(mailboxUser.PermissionGroupIDs, mailboxAdminGroup.ID) || !userHasPermission(&mailboxUser.User, PermissionMailboxesManage) || userHasPermission(&mailboxUser.User, PermissionSystemSettings) {
t.Fatalf("mailbox admin authorization=%+v", mailboxUser.User)
}
var plainUser AdminUser
if code := admin.do("POST", "/api/admin/users", map[string]any{
"email": "plain-user@lanqin.local",
"displayName": "Plain User",
"role": "user",
"password": "Password123!",
"disabled": false,
"permissionGroupIds": []string{},
}, &plainUser); code != http.StatusCreated {
t.Fatalf("create plain user code=%d user=%+v", code, plainUser)
}
if len(plainUser.PermissionGroupIDs) != 1 || plainUser.PermissionGroupIDs[0] != PermissionGroupRegular || !userHasPermission(&plainUser.User, PermissionAdminOverview) {
t.Fatalf("plain user should inherit regular permissions: %+v", plainUser.User)
}
var customUser AdminUser
if code := admin.do("POST", "/api/admin/users", map[string]any{
"email": "mailbox-viewer@lanqin.local",
@@ -1308,3 +1337,12 @@ func mustDefaultDomainID(t *testing.T, a *App) string {
}
return id
}
func containsString(items []string, needle string) bool {
for _, item := range items {
if item == needle {
return true
}
}
return false
}