feat: add local access control and managed point clouds

server/permissions.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+import type { User } from "../drizzle/schema";
+import type { TrpcContext } from "./_core/context";
+import { protectedProcedure, router, superAdminProcedure } from "./_core/trpc";
+
+const testRouter = router({
+  read: protectedProcedure.query(() => "read-ok"),
+  write: protectedProcedure.mutation(() => "write-ok"),
+  manageUsers: superAdminProcedure.query(() => "users-ok"),
+});
+
+function user(role: User["role"], mustChangePassword = 0): User {
+  const now = new Date();
+  return {
+    id: 1,
+    username: `${role}-account`,
+    passwordHash: "unused",
+    name: role,
+    email: null,
+    role,
+    isActive: 1,
+    mustChangePassword,
+    sessionVersion: 0,
+    createdAt: now,
+    updatedAt: now,
+    lastLoginAt: null,
+  };
+}
+
+function context(currentUser: User | null): TrpcContext {
+  return { user: currentUser, req: {} as TrpcContext["req"], res: {} as TrpcContext["res"] };
+}
+
+describe("三角色权限矩阵", () => {
+  it("未登录不能读取", async () => {
+    await expect(testRouter.createCaller(context(null)).read()).rejects.toMatchObject({ code: "UNAUTHORIZED" });
+  });
+
+  it("首次改密前不能读取业务数据", async () => {
+    await expect(testRouter.createCaller(context(user("super_admin", 1))).read()).rejects.toMatchObject({ code: "FORBIDDEN" });
+  });
+
+  it("普通用户可读但不可写，也不可管理用户", async () => {
+    const caller = testRouter.createCaller(context(user("user")));
+    await expect(caller.read()).resolves.toBe("read-ok");
+    await expect(caller.write()).rejects.toMatchObject({ code: "FORBIDDEN" });
+    await expect(caller.manageUsers()).rejects.toMatchObject({ code: "FORBIDDEN" });
+  });
+
+  it("管理员可读写但不可管理用户", async () => {
+    const caller = testRouter.createCaller(context(user("admin")));
+    await expect(caller.read()).resolves.toBe("read-ok");
+    await expect(caller.write()).resolves.toBe("write-ok");
+    await expect(caller.manageUsers()).rejects.toMatchObject({ code: "FORBIDDEN" });
+  });
+
+  it("超级管理员拥有全部权限", async () => {
+    const caller = testRouter.createCaller(context(user("super_admin")));
+    await expect(caller.read()).resolves.toBe("read-ok");
+    await expect(caller.write()).resolves.toBe("write-ok");
+    await expect(caller.manageUsers()).resolves.toBe("users-ok");
+  });
+});