wangziqi/tiku-backend.net
1
0
Fork 0
forked from gongxuegit/tiku-backend.net
Code Pull Requests Activity

feat: harden SaaS authentication and authorization

Browse Source
This commit is contained in:
xiong
2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
Download Patch File Download Diff File Expand all files Collapse all files

98
Tiku.IntegrationTests/Api/TenantCommerceEndpointTests.cs
View File

@@ -6,6 +6,7 @@ using Microsoft.Extensions.DependencyInjection;
using Tiku.Api.Contracts;
using Tiku.Application.Auth;
using Tiku.Application.Commerce;
using Tiku.Domain.Catalog;
using Tiku.Domain.Commerce;
using Tiku.Domain.Identity;
using Tiku.Domain.Tenancy;
@@ -203,12 +204,59 @@ public sealed class TenantCommerceEndpointTests
Assert.Equal(HttpStatusCode.OK, reportResponse.StatusCode);
}
[Fact]
public async Task OrderAndRefundOperations_ApplySelfAndRestrictedScopesInSql()
{
await using var factory = new ApiTestFactory(paymentProviderGateway: new FakePaymentGateway());
var seed = await SeedLoginUserAsync(factory, TenantRole.TenantAdmin);
var allowedRegionId = Guid.NewGuid();
var otherRegionId = Guid.NewGuid();
var regionalUserId = Guid.NewGuid();
var outsideUserId = Guid.NewGuid();
var ownOrder = NewPaidOrder(seed.TenantId, seed.UserId, otherRegionId, "SELF-ORDER");
var regionalOrder = NewPaidOrder(seed.TenantId, regionalUserId, allowedRegionId, "REGION-ORDER");
var outsideOrder = NewPaidOrder(seed.TenantId, outsideUserId, otherRegionId, "OUTSIDE-ORDER");
await factory.SeedAsync(
new Region { Id = allowedRegionId, TenantId = seed.TenantId, Name = "Allowed Region" },
new Region { Id = otherRegionId, TenantId = seed.TenantId, Name = "Other Region" },
new User { Id = regionalUserId, Name = "Regional Buyer" },
new User { Id = outsideUserId, Name = "Outside Buyer" },
ownOrder,
regionalOrder,
outsideOrder);
await SetAdminDataScopeAsync(factory, seed.TenantId, new { mode = "self" });
using var client = factory.CreateClient();
await LoginAsync(client, seed);
var selfOrders = await client.GetFromJsonAsync<AdminOrderList>("/api/tenant-commerce/orders");
await SetAdminDataScopeAsync(factory, seed.TenantId, new
{
mode = "restricted",
regionIds = new[] { allowedRegionId },
includesSelf = false
});
var regionalOrders = await client.GetFromJsonAsync<AdminOrderList>("/api/tenant-commerce/orders");
using var deniedRefund = await client.PostAsJsonAsync(
"/api/tenant-commerce/refunds",
new CreateRefundRequestDto { OrderId = outsideOrder.Id, AmountCents = 100 });
using var allowedRefund = await client.PostAsJsonAsync(
"/api/tenant-commerce/refunds",
new CreateRefundRequestDto { OrderId = regionalOrder.Id, AmountCents = 100 });
Assert.NotNull(selfOrders);
Assert.Equal(["SELF-ORDER"], selfOrders.Items.Select(item => item.OrderNo));
Assert.NotNull(regionalOrders);
Assert.Equal(["REGION-ORDER"], regionalOrders.Items.Select(item => item.OrderNo));
Assert.Equal(HttpStatusCode.NotFound, deniedRefund.StatusCode);
Assert.Equal(HttpStatusCode.OK, allowedRefund.StatusCode);
}
private static async Task<LoginSeed> SeedLoginUserAsync(ApiTestFactory factory, TenantRole role)
{
var tenantId = Guid.NewGuid();
var userId = Guid.NewGuid();
var phone = "13800000000";
var passwordHash = new PasswordHasher().Hash("passw0rd!");
await factory.SeedAsync(
new Tenant
{
@@ -221,21 +269,13 @@ public sealed class TenantCommerceEndpointTests
Id = userId,
Phone = phone,
Name = "Tenant Commerce User"
},
}.WithTestPassword(),
new TenantMembership
{
TenantId = tenantId,
UserId = userId,
Role = role,
Status = MembershipStatus.Active
},
new UserIdentity
{
UserId = userId,
Provider = "password",
ProviderSubject = phone,
Phone = phone,
SecretPayload = CreateSecretPayload(passwordHash)
});
return new LoginSeed(tenantId, userId, phone);
@@ -243,28 +283,28 @@ public sealed class TenantCommerceEndpointTests
private static async Task LoginAsync(HttpClient client, LoginSeed seed)
{
var loginResponse = await client.PostAsJsonAsync(
"/api/auth/login/password",
new PasswordLoginDto
{
TenantCode = seed.TenantId.ToString("N"),
Phone = seed.Phone,
Password = "passw0rd!"
});
loginResponse.EnsureSuccessStatusCode();
using var loginJson = await JsonDocument.ParseAsync(await loginResponse.Content.ReadAsStreamAsync());
var accessToken = loginJson.RootElement
.GetProperty("tokens")
.GetProperty("accessToken")
.GetString();
client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
client.UseAccessToken(await client.LoginAsTenantAsync(seed.TenantId, seed.Phone));
}
private static JsonElement CreateSecretPayload(string passwordHash)
private static Order NewPaidOrder(Guid tenantId, Guid userId, Guid regionId, string orderNo) => new()
{
using var document = JsonDocument.Parse(
$$"""{"passwordHash":{{JsonSerializer.Serialize(passwordHash)}}}""");
return document.RootElement.Clone();
TenantId = tenantId,
UserId = userId,
RegionId = regionId,
OrderNo = orderNo,
Status = OrderStatus.Paid,
AmountCents = 1_000,
PaidAt = DateTimeOffset.UtcNow
};
private static async Task SetAdminDataScopeAsync(ApiTestFactory factory, Guid tenantId, object value)
{
using var scope = factory.CreateSystemScope();
var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
var role = await dbContext.TenantBackendRoles.SingleAsync(item =>
item.TenantId == tenantId && item.Code == "integration_test_admin");
role.DataScope = JsonSerializer.SerializeToElement(value);
await dbContext.SaveChangesAsync();
}
private sealed record LoginSeed(Guid TenantId, Guid UserId, string Phone);