yschcms/YschcmsService
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(B1): 建站权限拆分-校级可建/编辑本院系子站,顶层站仍仅超管

Browse Source 
- SiteService.save 入口换 requireSiteSavePermission 私有方法(安全边界单点):
  超管直通;无校级角色/顶层编辑/新建顶层/子站提升/跨校主站/伪造schId 全拒
- SiteServiceIT 新增10例(方案7例+伪造schId/跨校接管/同校改挂3个边界)
- mvn -o test 236/236 全绿(基线226+10)
This commit is contained in:
chenxing
2026-09-07 19:21:18 +08:00
parent dad5eedaf2
commit 52676f592a
2 changed files with 214 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/test/java/com/yunhai/cms/service/impl/SiteServiceIT.java
+168
View File
@@ -457,6 +457,174 @@ class SiteServiceIT extends CmsIntegrationTestBase {
.hasMessageContaining("不能改为院系子站");
}
// ===== B1 建站权限拆分（校级可建/编辑本院系子站，顶层站仍仅超管）=====
@Test
@DisplayName("B1: 校级用户新建院系子站成功，schId 自动继承本校主站")
void save_subSiteBySchoolAdmin_shouldSucceed() {
CmsSite main = persistSite("b1main", 9, "云海大学门户");
SiteSaveRequest req = new SiteSaveRequest();
req.setCode("b1jdx");
req.setParentSiteId(main.getId());
req.setName("机电学院");
SiteVo vo = siteService.save(TestUsers.schoolUser(9), req);
assertThat(vo.getParentSiteId()).isEqualTo(main.getId());
CmsSite saved = siteService.getByCode("b1jdx");
assertThat(saved.getSchId()).as("schId 留空自动继承主站").isEqualTo(9);
assertThat(saved.getSchName()).isEqualTo("学校-9");
}
@Test
@DisplayName("B1: 校级用户挂他校主站建子站被拒（跨校）")
void save_subSiteBySchoolAdmin_otherSchoolParent_forbidden() {
CmsSite otherMain = persistSite("b1other", 8, "他校门户");
SiteSaveRequest req = new SiteSaveRequest();
req.setCode("b1steal");
req.setParentSiteId(otherMain.getId());
req.setName("越权院系站");
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
.isInstanceOf(BizException.class)
.hasMessageContaining("无权");
}
@Test
@DisplayName("B1: 校级用户新建顶层站被拒（仅超管）")
void save_topSiteBySchoolAdmin_forbidden() {
SiteSaveRequest req = new SiteSaveRequest();
req.setCode("b1top");
req.setSchId(9);
req.setName("越权顶层站");
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
.isInstanceOf(BizException.class)
.hasMessageContaining("超管");
}
@Test
@DisplayName("B1: 校级编辑本校院系子站（改名/换肤）成功")
void save_editOwnSubSiteBySchoolAdmin_shouldSucceed() {
CmsSite main = persistSite("b1main2", 9, "云海大学门户");
persistSite("b1jdx2", 9, "机电学院", main.getId());
Integer subId = siteService.getByCode("b1jdx2").getId();
SiteSaveRequest req = new SiteSaveRequest();
req.setId(subId);
req.setCode("b1jdx2");
req.setParentSiteId(main.getId());
req.setName("机械与电气工程学院");
req.setTheme("t-demo-red");
SiteVo vo = siteService.save(TestUsers.schoolUser(9), req);
assertThat(vo.getName()).isEqualTo("机械与电气工程学院");
CmsSite saved = siteService.getByCode("b1jdx2");
assertThat(saved.getTheme()).as("换肤生效").isEqualTo("t-demo-red");
assertThat(saved.getParentSiteId()).isEqualTo(main.getId());
}
@Test
@DisplayName("B1: 校级把院系子站改挂为顶层（parentSiteId 传 0）被拒")
void save_editSubSite_promoteToTopBySchoolAdmin_forbidden() {
CmsSite main = persistSite("b1main3", 9, "云海大学门户");
persistSite("b1jdx3", 9, "机电学院", main.getId());
Integer subId = siteService.getByCode("b1jdx3").getId();
SiteSaveRequest req = new SiteSaveRequest();
req.setId(subId);
req.setCode("b1jdx3");
req.setParentSiteId(0);
req.setName("机电学院");
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
.isInstanceOf(BizException.class)
.hasMessageContaining("超管");
}
@Test
@DisplayName("B1: 校级编辑顶层站（含本校主站）被拒")
void save_editTopSiteBySchoolAdmin_forbidden() {
CmsSite main = persistSite("b1main4", 9, "云海大学门户");
SiteSaveRequest req = new SiteSaveRequest();
req.setId(main.getId());
req.setCode("b1main4");
req.setParentSiteId(0);
req.setSchId(9);
req.setName("云海大学门户");
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
.isInstanceOf(BizException.class)
.hasMessageContaining("超管");
}
@Test
@DisplayName("B1: 无校级角色（schId 为空）建子站被拒")
void save_subSiteBySchoolAdmin_noSchIdRole_forbidden() {
CmsSite main = persistSite("b1main5", 9, "云海大学门户");
SiteSaveRequest req = new SiteSaveRequest();
req.setCode("b1norole");
req.setParentSiteId(main.getId());
req.setName("无角色院系站");
assertThatThrownBy(() -> siteService.save(TestUsers.plainUser(), req))
.isInstanceOf(BizException.class)
.hasMessageContaining("无权");
}
@Test
@DisplayName("B1: 校级请求体伪造 schId（与他校一致）被拒（关闭伪造通道）")
void save_subSiteBySchoolAdmin_forgedSchId_forbidden() {
CmsSite main = persistSite("b1main6", 9, "云海大学门户");
SiteSaveRequest req = new SiteSaveRequest();
req.setCode("b1forge");
req.setParentSiteId(main.getId());
req.setSchId(8);
req.setName("伪造学校院系站");
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
.isInstanceOf(BizException.class)
.hasMessageContaining("无权");
}
@Test
@DisplayName("B1: 校级编辑他校院系子站被拒（防改挂接管）")
void save_editOtherSchoolSubSiteBySchoolAdmin_forbidden() {
CmsSite ownMain = persistSite("b1main7", 9, "云海大学门户");
CmsSite otherMain = persistSite("b1main8", 8, "他校门户");
persistSite("b1otherjdx", 8, "他校机电学院", otherMain.getId());
Integer otherSubId = siteService.getByCode("b1otherjdx").getId();
SiteSaveRequest req = new SiteSaveRequest();
req.setId(otherSubId);
req.setCode("b1otherjdx");
req.setParentSiteId(ownMain.getId());
req.setName("被他校改挂");
assertThatThrownBy(() -> siteService.save(TestUsers.schoolUser(9), req))
.isInstanceOf(BizException.class)
.hasMessageContaining("无权");
}
@Test
@DisplayName("B1: 校级编辑子站改挂到另一同校主站仍放行（既有能力保留）")
void save_editSubSite_moveToAnotherSameSchoolMainBySchoolAdmin_shouldSucceed() {
CmsSite mainA = persistSite("b1maina", 9, "主站A");
CmsSite mainB = persistSite("b1mainb", 9, "主站B");
persistSite("b1jdx9", 9, "机电学院", mainA.getId());
Integer subId = siteService.getByCode("b1jdx9").getId();
SiteSaveRequest req = new SiteSaveRequest();
req.setId(subId);
req.setCode("b1jdx9");
req.setParentSiteId(mainB.getId());
req.setName("机电学院");
SiteVo vo = siteService.save(TestUsers.schoolUser(9), req);
assertThat(vo.getParentSiteId()).isEqualTo(mainB.getId());
}
@Test
@DisplayName("编辑院系子站：可改挂到另一顶层主站（同校）")
void save_collegeCanMoveToAnotherMain() {