biss
bcc4d33bd5
学院管理员限制在所属学院。 辅导员通过稳定账号 ID 绑定行政班，避免重名串班。 教师只能访问本人档案、授课课程和所授课学生。 学生只能访问本人档案及所在班级课程。 教师/学生角色会自动校验并绑定工号或学号档案。 超级管理员可在用户页面调整角色、学院、工号/学号，并预览生效后的数据范围。
57 lines
1.9 KiB
C#
57 lines
1.9 KiB
C#
using System.Security.Claims;
|
|
using Jiaowu.Api.Domain.Identity;
|
|
using Jiaowu.Api.Infrastructure.Auth;
|
|
using Microsoft.AspNetCore.Http;
|
|
|
|
namespace Jiaowu.Api.Tests;
|
|
|
|
public sealed class DataScopeTests
|
|
{
|
|
[Theory]
|
|
[InlineData(SystemRoles.Student, null, DataScope.Self)]
|
|
[InlineData(SystemRoles.Counselor, SystemRoles.Teacher, DataScope.Class)]
|
|
[InlineData(SystemRoles.CollegeAdmin, SystemRoles.Counselor, DataScope.College)]
|
|
[InlineData(SystemRoles.SuperAdmin, SystemRoles.CollegeAdmin, DataScope.All)]
|
|
[InlineData(SystemRoles.AcademicAdmin, SystemRoles.Student, DataScope.All)]
|
|
public void Resolver_UsesHighestScope(
|
|
string firstRole,
|
|
string? secondRole,
|
|
DataScope expected)
|
|
{
|
|
var roles = secondRole is null
|
|
? [firstRole]
|
|
: new[] { firstRole, secondRole };
|
|
|
|
Assert.Equal(expected, EffectiveDataScopeResolver.Resolve(roles));
|
|
}
|
|
|
|
[Fact]
|
|
public void CurrentScope_ReadsIdentityAndCollegeClaims()
|
|
{
|
|
var userId = Guid.NewGuid();
|
|
var collegeId = Guid.NewGuid();
|
|
var claims = new[]
|
|
{
|
|
new Claim(ClaimTypes.NameIdentifier, userId.ToString()),
|
|
new Claim(ClaimTypes.Name, "院系管理员"),
|
|
new Claim(ClaimTypes.Role, SystemRoles.CollegeAdmin),
|
|
new Claim("college_id", collegeId.ToString())
|
|
};
|
|
var accessor = new HttpContextAccessor
|
|
{
|
|
HttpContext = new DefaultHttpContext
|
|
{
|
|
User = new ClaimsPrincipal(new ClaimsIdentity(claims, "test"))
|
|
}
|
|
};
|
|
|
|
var current = new CurrentUserDataScope(accessor).Current;
|
|
|
|
Assert.Equal(userId, current.UserId);
|
|
Assert.Equal(collegeId, current.CollegeId);
|
|
Assert.Equal(DataScope.College, current.Scope);
|
|
Assert.True(current.CanAccessCollege(collegeId));
|
|
Assert.False(current.CanAccessCollege(Guid.NewGuid()));
|
|
}
|
|
}
|