Pine
ac2df72b21
- 删 UserIdentity 模型/IdentityRepository/db.identities，账号统一单一角色(users.role) - auth.py 去 select-identity/_identity_summaries，登录恒返回 identities=[]；_login_response_for_user 按单角色签发 - 删多端口路由 rbac_government/investor/developer 及其 main 挂载 - seed 去多身份回填(_migrate_identities/_ensure_port_agents/多端身份/端口标签映射) - dependencies: require_port 去端口隔离(单角色放宽)、optional_current_user 修 identity_id 多余参数 - user_admin_service create_user 不再建端口身份；schemas 去 SelectIdentityRequest - 新增迁移 0014_drop_user_identities(drop user_identities 表) - 测试改写为单角色契约(登录空 identities、无 select-identity、账号级智能体) Co-Authored-By: Claude <noreply@anthropic.com>
46 lines
1.6 KiB
Python
46 lines
1.6 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""账号单一角色（去多身份）：登录返回空 identities、role=账号类型、按角色访问。"""
|
|
from __future__ import annotations
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
|
|
def login(client: TestClient, username: str, password: str = "123456") -> dict:
|
|
res = client.post("/auth/login", json={"username": username, "password": password})
|
|
assert res.status_code == 200, res.text
|
|
return res.json()
|
|
|
|
|
|
def auth(token: str) -> dict:
|
|
return {"Authorization": f"Bearer {token}"}
|
|
|
|
|
|
def test_single_role_login(client):
|
|
"""opc01（单角色 OPC）登录：identities 恒空、role=opc_member、可按角色访问 OPC 端口。"""
|
|
body = login(client, "opc01")
|
|
assert body["identities"] == []
|
|
assert body["role"] == "opc_member"
|
|
assert bool(body["token"])
|
|
|
|
res = client.get("/opc/dashboard", headers=auth(body["token"]))
|
|
assert res.status_code == 200, res.text
|
|
|
|
|
|
def test_operator_login_has_operator_role(client):
|
|
"""pine（平台运营方超管）登录：role=operator，具备运营端权限。"""
|
|
body = login(client, "pine")
|
|
assert body["role"] == "operator"
|
|
assert "permissions" in body and len(body["permissions"]) > 0
|
|
assert any(p.startswith("menu:") for p in body["permissions"])
|
|
|
|
|
|
def test_select_identity_endpoint_removed(client):
|
|
"""多身份选择端点已移除：/auth/select-identity 不再存在（405）。"""
|
|
body = login(client, "opc01")
|
|
res = client.post(
|
|
"/auth/select-identity",
|
|
headers=auth(body["token"]),
|
|
json={"identity_id": "whatever"},
|
|
)
|
|
assert res.status_code == 405 or res.status_code == 404
|