feat: harden SaaS authentication and authorization

2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
--- a/Tiku.IntegrationTests/Api/DatabasePermissionServiceAuthorizationTests.cs
+++ b/Tiku.IntegrationTests/Api/DatabasePermissionServiceAuthorizationTests.cs
@@ -0,0 +1,85 @@
+using System.Net;
+using System.Text.Json;
+using Tiku.Application.Security;
+using Tiku.Domain.Common;
+using Tiku.Domain.Identity;
+using Tiku.Domain.Operations;
+using Tiku.Domain.Tenancy;
+using Tiku.Infrastructure.Auth;
+
+namespace Tiku.IntegrationTests.Api;
+
+public sealed class DatabasePermissionServiceAuthorizationTests
+{
+    [Fact]
+    public async Task BusinessMembershipRoleDoesNotOverrideCommissionAndCrmPermissions()
+    {
+        await using var factory = new ApiTestFactory();
+        var tenantId = Guid.NewGuid();
+        var userId = Guid.NewGuid();
+        var roleId = Guid.NewGuid();
+        var phone = "13720000000";
+        await factory.SeedAsync(
+            new Tenant
+            {
+                Id = tenantId,
+                Slug = tenantId.ToString("N"),
+                Name = "Permission Tenant",
+                Status = TenantStatus.Active,
+                Metadata = JsonDefaults.Object()
+            },
+            new User { Id = userId, Phone = phone, Name = "Permission Operator" }.WithTestPassword(),
+            new TenantMembership
+            {
+                TenantId = tenantId,
+                UserId = userId,
+                Role = TenantRole.Student,
+                Status = MembershipStatus.Active
+            },
+            new BackendPermission
+            {
+                Code = BackendPermissions.TenantCommissionManage,
+                Name = "Commission",
+                Area = BackendPermissionArea.Tenant,
+                Module = "commission"
+            },
+            new BackendPermission
+            {
+                Code = BackendPermissions.TenantCrmManage,
+                Name = "CRM",
+                Area = BackendPermissionArea.Tenant,
+                Module = "crm"
+            },
+            new TenantBackendRole
+            {
+                Id = roleId,
+                TenantId = tenantId,
+                Code = "growth_operator",
+                Name = "Growth Operator",
+                Status = BackendRoleStatus.Active,
+                DataScope = JsonSerializer.SerializeToElement(new { mode = "all" })
+            },
+            new TenantBackendRolePermission
+            {
+                TenantId = tenantId,
+                RoleId = roleId,
+                PermissionCode = BackendPermissions.TenantCommissionManage
+            },
+            new TenantBackendRolePermission
+            {
+                TenantId = tenantId,
+                RoleId = roleId,
+                PermissionCode = BackendPermissions.TenantCrmManage
+            },
+            new TenantBackendUserRole { TenantId = tenantId, UserId = userId, RoleId = roleId });
+
+        using var client = factory.CreateClient();
+        client.UseAccessToken(await client.LoginAsTenantAsync(tenantId, phone));
+
+        using var commission = await client.GetAsync("/api/commission/settings");
+        using var referral = await client.GetAsync("/api/referral/stats");
+
+        Assert.Equal(HttpStatusCode.OK, commission.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, referral.StatusCode);
+    }
+}