多角色账号按 All > College > Class > Self 自动取最高权限。

学院管理员限制在所属学院。辅导员通过稳定账号 ID 绑定行政班，避免重名串班。教师只能访问本人档案、授课课程和所授课学生。学生只能访问本人档案及所在班级课程。教师/学生角色会自动校验并绑定工号或学号档案。超级管理员可在用户页面调整角色、学院、工号/学号，并预览生效后的数据范围。
2026-07-24 14:54:30 +08:00
parent 0b463fa4f2
commit bcc4d33bd5
26 changed files with 2333 additions and 88 deletions
@@ -0,0 +1,56 @@
+using System.Security.Claims;
+using Jiaowu.Api.Domain.Identity;
+using Jiaowu.Api.Infrastructure.Auth;
+using Microsoft.AspNetCore.Http;
+
+namespace Jiaowu.Api.Tests;
+
+public sealed class DataScopeTests
+{
+    [Theory]
+    [InlineData(SystemRoles.Student, null, DataScope.Self)]
+    [InlineData(SystemRoles.Counselor, SystemRoles.Teacher, DataScope.Class)]
+    [InlineData(SystemRoles.CollegeAdmin, SystemRoles.Counselor, DataScope.College)]
+    [InlineData(SystemRoles.SuperAdmin, SystemRoles.CollegeAdmin, DataScope.All)]
+    [InlineData(SystemRoles.AcademicAdmin, SystemRoles.Student, DataScope.All)]
+    public void Resolver_UsesHighestScope(
+        string firstRole,
+        string? secondRole,
+        DataScope expected)
+    {
+        var roles = secondRole is null
+            ? [firstRole]
+            : new[] { firstRole, secondRole };
+
+        Assert.Equal(expected, EffectiveDataScopeResolver.Resolve(roles));
+    }
+
+    [Fact]
+    public void CurrentScope_ReadsIdentityAndCollegeClaims()
+    {
+        var userId = Guid.NewGuid();
+        var collegeId = Guid.NewGuid();
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, userId.ToString()),
+            new Claim(ClaimTypes.Name, "院系管理员"),
+            new Claim(ClaimTypes.Role, SystemRoles.CollegeAdmin),
+            new Claim("college_id", collegeId.ToString())
+        };
+        var accessor = new HttpContextAccessor
+        {
+            HttpContext = new DefaultHttpContext
+            {
+                User = new ClaimsPrincipal(new ClaimsIdentity(claims, "test"))
+            }
+        };
+
+        var current = new CurrentUserDataScope(accessor).Current;
+
+        Assert.Equal(userId, current.UserId);
+        Assert.Equal(collegeId, current.CollegeId);
+        Assert.Equal(DataScope.College, current.Scope);
+        Assert.True(current.CanAccessCollege(collegeId));
+        Assert.False(current.CanAccessCollege(Guid.NewGuid()));
+    }
+}