xiaoxia-saas/tests/unit/test_permissions.py

"""
权限验证辅助函数测试
"""

from unittest.mock import Mock

import pytest

from packages.domain.entities import WorkspaceMember, WorkspaceMemberRole
from packages.domain.permissions import Permission, PermissionChecker, has_permission


class TestPermissionChecker:
    """权限检查器测试"""

    @pytest.fixture
    def mock_member_repo(self):
        repo = Mock()
        repo.find_by_workspace_and_user = Mock(return_value=None)
        return repo

    @pytest.fixture
    def checker(self, mock_member_repo):
        return PermissionChecker(workspace_member_repository=mock_member_repo)

    def test_check_workspace_access_has_access(self, checker, mock_member_repo):
        """测试有访问权限"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.MEMBER,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        has_access, role = checker.check_workspace_access("workspace-123", "user-123")

        assert has_access is True
        assert role == "member"

    def test_check_workspace_access_no_access(self, checker, mock_member_repo):
        """测试无访问权限"""
        mock_member_repo.find_by_workspace_and_user.return_value = None

        has_access, role = checker.check_workspace_access("workspace-123", "user-123")

        assert has_access is False
        assert role is None

    def test_check_is_owner_true(self, checker, mock_member_repo):
        """测试是 Owner"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.OWNER,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        is_owner = checker.check_is_owner("workspace-123", "user-123")

        assert is_owner is True

    def test_check_is_owner_false(self, checker, mock_member_repo):
        """测试不是 Owner"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.ADMIN,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        is_owner = checker.check_is_owner("workspace-123", "user-123")

        assert is_owner is False

    def test_check_is_admin_or_owner_admin(self, checker, mock_member_repo):
        """测试是 Admin"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.ADMIN,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        is_admin_or_owner = checker.check_is_admin_or_owner("workspace-123", "user-123")

        assert is_admin_or_owner is True

    def test_check_is_admin_or_owner_owner(self, checker, mock_member_repo):
        """测试是 Owner"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.OWNER,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        is_admin_or_owner = checker.check_is_admin_or_owner("workspace-123", "user-123")

        assert is_admin_or_owner is True

    def test_check_is_admin_or_owner_member(self, checker, mock_member_repo):
        """测试是普通成员"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.MEMBER,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        is_admin_or_owner = checker.check_is_admin_or_owner("workspace-123", "user-123")

        assert is_admin_or_owner is False

    def test_check_can_create_project_member(self, checker, mock_member_repo):
        """测试 Member 可以创建项目"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.MEMBER,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        can_create = checker.check_can_create_project("workspace-123", "user-123")

        assert can_create is True

    def test_check_can_create_project_viewer(self, checker, mock_member_repo):
        """测试 Viewer 不能创建项目"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.VIEWER,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        can_create = checker.check_can_create_project("workspace-123", "user-123")

        assert can_create is False

    def test_check_can_delete_project_member(self, checker, mock_member_repo):
        """测试 Member 不能删除项目"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.MEMBER,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        can_delete = checker.check_can_delete_project("workspace-123", "user-123")

        assert can_delete is False

    def test_check_can_delete_project_admin(self, checker, mock_member_repo):
        """测试 Admin 可以删除项目"""
        member = WorkspaceMember(
            id="member-1",
            workspace_id="workspace-123",
            user_id="user-123",
            role=WorkspaceMemberRole.ADMIN,
        )
        mock_member_repo.find_by_workspace_and_user.return_value = member

        can_delete = checker.check_can_delete_project("workspace-123", "user-123")

        assert can_delete is True


class TestPermissionFunctions:
    """权限函数测试"""

    def test_has_permission_owner(self):
        """测试 Owner 权限"""
        assert has_permission(WorkspaceMemberRole.OWNER, Permission.WORKSPACE_DELETE) is True
        assert has_permission(WorkspaceMemberRole.OWNER, Permission.MEMBER_REMOVE) is True
        assert has_permission(WorkspaceMemberRole.OWNER, Permission.PROJECT_CREATE) is True

    def test_has_permission_admin(self):
        """测试 Admin 权限"""
        assert has_permission(WorkspaceMemberRole.ADMIN, Permission.WORKSPACE_EDIT) is True
        assert has_permission(WorkspaceMemberRole.ADMIN, Permission.MEMBER_REMOVE) is True
        assert has_permission(WorkspaceMemberRole.ADMIN, Permission.WORKSPACE_DELETE) is False

    def test_has_permission_member(self):
        """测试 Member 权限"""
        assert has_permission(WorkspaceMemberRole.MEMBER, Permission.PROJECT_CREATE) is True
        assert has_permission(WorkspaceMemberRole.MEMBER, Permission.PROJECT_DELETE) is False
        assert has_permission(WorkspaceMemberRole.MEMBER, Permission.MEMBER_INVITE) is False

    def test_has_permission_viewer(self):
        """测试 Viewer 权限"""
        assert has_permission(WorkspaceMemberRole.VIEWER, Permission.WORKSPACE_VIEW) is True
        assert has_permission(WorkspaceMemberRole.VIEWER, Permission.PROJECT_VIEW) is True
        assert has_permission(WorkspaceMemberRole.VIEWER, Permission.PROJECT_CREATE) is False
        assert has_permission(WorkspaceMemberRole.VIEWER, Permission.ASSET_UPLOAD) is False