feat(B1): 建站权限拆分-校级可建/编辑本院系子站,顶层站仍仅超管
- SiteService.save 入口换 requireSiteSavePermission 私有方法(安全边界单点): 超管直通;无校级角色/顶层编辑/新建顶层/子站提升/跨校主站/伪造schId 全拒 - SiteServiceIT 新增10例(方案7例+伪造schId/跨校接管/同校改挂3个边界) - mvn -o test 236/236 全绿(基线226+10)
This commit is contained in:
chenxing
@@ -106,10 +106,10 @@ public class SiteService {
|
||||
return ExtJsonUtils.getString(config, key);
|
||||
}
|
||||
|
||||
/** 站点保存（仅超管；MVP 1-2 校以初始化脚本为主，本接口为后台兜底） */
|
||||
/** 站点保存（B1 权限拆分：校级可建/编辑本院系子站，顶层站仅超管；MVP 1-2 校以初始化脚本为主） */
|
||||
@Transactional
|
||||
public SiteVo save(BoaUser user, SiteSaveRequest req) {
|
||||
requireSuperAdmin(user);
|
||||
requireSiteSavePermission(user, req);
|
||||
CmsSite site;
|
||||
if (req.getId() == null) {
|
||||
if (siteRepository.findByCode(req.getCode()).isPresent()) {
|
||||
@@ -144,6 +144,50 @@ public class SiteService {
|
||||
return SiteVo.of(site);
|
||||
}
|
||||
|
||||
/**
|
||||
* 站点保存权限（B1 建站权限拆分，安全边界收敛于本单一方法，前端按钮仅入口显性化）：
|
||||
* 超管直通；非超管仅可新建/编辑「本校主站下的院系子站」，具体拒绝项——
|
||||
* ① 新建顶层站（parentSiteId≤0）→ 拒（仅平台超管可创建学校主站）；
|
||||
* ② 编辑对象为顶层站（含本校主站）→ 拒；
|
||||
* ③ 编辑子站时 parentSiteId 传 0/null（提升为顶层）→ 拒；
|
||||
* ④ 目标主站 schId 与 currentRole.schId 不一致（跨校/改挂接管）→ 拒；
|
||||
* ⑤ 编辑对象本身跨校 → 拒（复用 canManage 同校语义）；
|
||||
* ⑥ 无校级角色（schId 为空）→ 拒；
|
||||
* ⑦ 请求体显式 schId 与本人角色不一致（伪造通道）→ 拒（留空则由 validateParent 继承主站）。
|
||||
*/
|
||||
private void requireSiteSavePermission(BoaUser user, SiteSaveRequest req) {
|
||||
if (authProperties.isSuperAdmin(user)) {
|
||||
return;
|
||||
}
|
||||
Integer schId = user.getCurrentRole() == null ? null : user.getCurrentRole().getSchId();
|
||||
if (schId == null) {
|
||||
throw new BizException(ErrorCode.FORBIDDEN, "无权管理该站点（需校级角色）");
|
||||
}
|
||||
if (req.getId() != null) {
|
||||
CmsSite target = siteRepository.findById(req.getId())
|
||||
.orElseThrow(() -> new BizException(ErrorCode.PARAM_ERROR, "站点不存在"));
|
||||
boolean targetIsTop = target.getParentSiteId() == null || target.getParentSiteId() == 0;
|
||||
if (targetIsTop) {
|
||||
throw new BizException(ErrorCode.FORBIDDEN, "仅平台超管可管理学校主站（顶层站点）");
|
||||
}
|
||||
if (!canManage(user, target)) {
|
||||
throw new BizException(ErrorCode.FORBIDDEN, "无权管理该站点");
|
||||
}
|
||||
}
|
||||
Integer parentSiteId = req.getParentSiteId() == null ? 0 : req.getParentSiteId();
|
||||
if (parentSiteId <= 0) {
|
||||
throw new BizException(ErrorCode.FORBIDDEN, "仅平台超管可创建学校主站（顶层站点）");
|
||||
}
|
||||
CmsSite parent = siteRepository.findById(parentSiteId)
|
||||
.orElseThrow(() -> new BizException(ErrorCode.PARAM_ERROR, "上级站点不存在"));
|
||||
if (parent.getSchId() == null || !schId.equals(parent.getSchId())) {
|
||||
throw new BizException(ErrorCode.FORBIDDEN, "无权管理该站点");
|
||||
}
|
||||
if (req.getSchId() != null && !schId.equals(req.getSchId())) {
|
||||
throw new BizException(ErrorCode.FORBIDDEN, "无权管理该站点（学校ID与本人角色不符）");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* themeParams 服务端合并（方案 §5.3，对应评审 R6）：仅替换 config_json.theme_params 键，
|
||||
* 保留 logo/contact/domain 等其余键；未声明 key 与非法值按所选主题 schema 丢弃（不回传错误）。
|
||||
|
||||
@@ -457,6 +457,174 @@ class SiteServiceIT extends CmsIntegrationTestBase {
|
||||
.hasMessageContaining("不能改为院系子站");
|
||||
}
|
||||
|
||||
// ===== B1 建站权限拆分（校级可建/编辑本院系子站，顶层站仍仅超管）=====
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级用户新建院系子站成功，schId 自动继承本校主站")
|
||||
void save_subSiteBySchoolAdmin_shouldSucceed() {
|
||||
CmsSite main = persistSite("b1main", 9, "云海大学门户");
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setCode("b1jdx");
|
||||
req.setParentSiteId(main.getId());
|
||||
req.setName("机电学院");
|
||||
|
||||
SiteVo vo = siteService.save(TestUsers.schoolUser(9), req);
|
||||
|
||||
assertThat(vo.getParentSiteId()).isEqualTo(main.getId());
|
||||
CmsSite saved = siteService.getByCode("b1jdx");
|
||||
assertThat(saved.getSchId()).as("schId 留空自动继承主站").isEqualTo(9);
|
||||
assertThat(saved.getSchName()).isEqualTo("学校-9");
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级用户挂他校主站建子站被拒（跨校）")
|
||||
void save_subSiteBySchoolAdmin_otherSchoolParent_forbidden() {
|
||||
CmsSite otherMain = persistSite("b1other", 8, "他校门户");
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setCode("b1steal");
|
||||
req.setParentSiteId(otherMain.getId());
|
||||
req.setName("越权院系站");
|
||||
|
||||
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
|
||||
.isInstanceOf(BizException.class)
|
||||
.hasMessageContaining("无权");
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级用户新建顶层站被拒（仅超管）")
|
||||
void save_topSiteBySchoolAdmin_forbidden() {
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setCode("b1top");
|
||||
req.setSchId(9);
|
||||
req.setName("越权顶层站");
|
||||
|
||||
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
|
||||
.isInstanceOf(BizException.class)
|
||||
.hasMessageContaining("超管");
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级编辑本校院系子站（改名/换肤）成功")
|
||||
void save_editOwnSubSiteBySchoolAdmin_shouldSucceed() {
|
||||
CmsSite main = persistSite("b1main2", 9, "云海大学门户");
|
||||
persistSite("b1jdx2", 9, "机电学院", main.getId());
|
||||
Integer subId = siteService.getByCode("b1jdx2").getId();
|
||||
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setId(subId);
|
||||
req.setCode("b1jdx2");
|
||||
req.setParentSiteId(main.getId());
|
||||
req.setName("机械与电气工程学院");
|
||||
req.setTheme("t-demo-red");
|
||||
|
||||
SiteVo vo = siteService.save(TestUsers.schoolUser(9), req);
|
||||
|
||||
assertThat(vo.getName()).isEqualTo("机械与电气工程学院");
|
||||
CmsSite saved = siteService.getByCode("b1jdx2");
|
||||
assertThat(saved.getTheme()).as("换肤生效").isEqualTo("t-demo-red");
|
||||
assertThat(saved.getParentSiteId()).isEqualTo(main.getId());
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级把院系子站改挂为顶层（parentSiteId 传 0）被拒")
|
||||
void save_editSubSite_promoteToTopBySchoolAdmin_forbidden() {
|
||||
CmsSite main = persistSite("b1main3", 9, "云海大学门户");
|
||||
persistSite("b1jdx3", 9, "机电学院", main.getId());
|
||||
Integer subId = siteService.getByCode("b1jdx3").getId();
|
||||
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setId(subId);
|
||||
req.setCode("b1jdx3");
|
||||
req.setParentSiteId(0);
|
||||
req.setName("机电学院");
|
||||
|
||||
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
|
||||
.isInstanceOf(BizException.class)
|
||||
.hasMessageContaining("超管");
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级编辑顶层站（含本校主站）被拒")
|
||||
void save_editTopSiteBySchoolAdmin_forbidden() {
|
||||
CmsSite main = persistSite("b1main4", 9, "云海大学门户");
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setId(main.getId());
|
||||
req.setCode("b1main4");
|
||||
req.setParentSiteId(0);
|
||||
req.setSchId(9);
|
||||
req.setName("云海大学门户");
|
||||
|
||||
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
|
||||
.isInstanceOf(BizException.class)
|
||||
.hasMessageContaining("超管");
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 无校级角色（schId 为空）建子站被拒")
|
||||
void save_subSiteBySchoolAdmin_noSchIdRole_forbidden() {
|
||||
CmsSite main = persistSite("b1main5", 9, "云海大学门户");
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setCode("b1norole");
|
||||
req.setParentSiteId(main.getId());
|
||||
req.setName("无角色院系站");
|
||||
|
||||
assertThatThrownBy(() -> siteService.save(TestUsers.plainUser(), req))
|
||||
.isInstanceOf(BizException.class)
|
||||
.hasMessageContaining("无权");
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级请求体伪造 schId（与他校一致）被拒（关闭伪造通道）")
|
||||
void save_subSiteBySchoolAdmin_forgedSchId_forbidden() {
|
||||
CmsSite main = persistSite("b1main6", 9, "云海大学门户");
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setCode("b1forge");
|
||||
req.setParentSiteId(main.getId());
|
||||
req.setSchId(8);
|
||||
req.setName("伪造学校院系站");
|
||||
|
||||
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
|
||||
.isInstanceOf(BizException.class)
|
||||
.hasMessageContaining("无权");
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级编辑他校院系子站被拒（防改挂接管）")
|
||||
void save_editOtherSchoolSubSiteBySchoolAdmin_forbidden() {
|
||||
CmsSite ownMain = persistSite("b1main7", 9, "云海大学门户");
|
||||
CmsSite otherMain = persistSite("b1main8", 8, "他校门户");
|
||||
persistSite("b1otherjdx", 8, "他校机电学院", otherMain.getId());
|
||||
Integer otherSubId = siteService.getByCode("b1otherjdx").getId();
|
||||
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setId(otherSubId);
|
||||
req.setCode("b1otherjdx");
|
||||
req.setParentSiteId(ownMain.getId());
|
||||
req.setName("被他校改挂");
|
||||
|
||||
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
|
||||
.isInstanceOf(BizException.class)
|
||||
.hasMessageContaining("无权");
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("B1: 校级编辑子站改挂到另一同校主站仍放行（既有能力保留）")
|
||||
void save_editSubSite_moveToAnotherSameSchoolMainBySchoolAdmin_shouldSucceed() {
|
||||
CmsSite mainA = persistSite("b1maina", 9, "主站A");
|
||||
CmsSite mainB = persistSite("b1mainb", 9, "主站B");
|
||||
persistSite("b1jdx9", 9, "机电学院", mainA.getId());
|
||||
Integer subId = siteService.getByCode("b1jdx9").getId();
|
||||
|
||||
SiteSaveRequest req = new SiteSaveRequest();
|
||||
req.setId(subId);
|
||||
req.setCode("b1jdx9");
|
||||
req.setParentSiteId(mainB.getId());
|
||||
req.setName("机电学院");
|
||||
|
||||
SiteVo vo = siteService.save(TestUsers.schoolUser(9), req);
|
||||
assertThat(vo.getParentSiteId()).isEqualTo(mainB.getId());
|
||||
}
|
||||
|
||||
@Test
|
||||
@DisplayName("编辑院系子站：可改挂到另一顶层主站（同校）")
|
||||
void save_collegeCanMoveToAnotherMain() {
|
||||
|
||||
Reference in New Issue
Block a user