mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-22 10:33:13 +00:00
zhangwenjian
7a5fc7d440
The shipped seed data left data_scope empty for the built-in administrator. That was harmless while an unrecognized scope meant "see everything"; with the previous commits it means the opposite, so a fresh install with data permission enabled would have blinded its own default account on every list endpoint. The admin short-circuit does not help here: role_key == "admin" bypasses Casbin, not the data permission scopes, which never look at role_key. The value is "1" - all data - which is the behaviour the empty string used to produce, so this restores the intent rather than tightening it. A test reads both seed files back so the pair cannot drift apart again. Claude-Session: https://claude.ai/code/session_01HPTAw8b8tAdFNFn8rKdPYx
39 lines
1.3 KiB
Go
39 lines
1.3 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"regexp"
|
|
"testing"
|
|
)
|
|
|
|
// The seed files write the built-in admin role's data_scope inline in a SQL
|
|
// INSERT, not through Go code, so nothing else in the test suite exercises
|
|
// this value. It has to be one of the five scopes actions.Permission
|
|
// recognizes: PRD 006 F14/H2 made every other value match no rows, and an
|
|
// empty string - which is what these files shipped before that fix - is one
|
|
// such value. Without this the shipped admin account would silently lose
|
|
// all visibility the moment a deployment turns EnableDP on.
|
|
func TestSeedAdminRoleHasAValidDataScope(t *testing.T) {
|
|
cases := map[string]*regexp.Regexp{
|
|
"db.sql": regexp.MustCompile(
|
|
`INSERT INTO sys_role VALUES \(1, '系统管理员', '2', 'admin', 1, '', '', true, '([^']*)'`),
|
|
"db-sqlserver.sql": regexp.MustCompile(
|
|
`\(1, '系统管理员', '2', 'admin', 1, '', '', 1, '([^']*)'`),
|
|
}
|
|
valid := map[string]bool{"1": true, "2": true, "3": true, "4": true, "5": true}
|
|
|
|
for file, pattern := range cases {
|
|
data, err := os.ReadFile(file)
|
|
if err != nil {
|
|
t.Fatalf("%s: %v", file, err)
|
|
}
|
|
m := pattern.FindSubmatch(data)
|
|
if m == nil {
|
|
t.Fatalf("%s: admin role INSERT not found; the regex may be out of date", file)
|
|
}
|
|
if scope := string(m[1]); !valid[scope] {
|
|
t.Errorf("%s: admin role data_scope = %q, want one of 1-5", file, scope)
|
|
}
|
|
}
|
|
}
|