feat(identity): 支持用户和用户组批量管理

增加原子批量启用、禁用和删除接口及管理端多选操作，目标缺失时整批回滚。\n\n拆分管理端与 API Key 权限缓存并在弹窗保存后刷新候选；补齐失效规则一键清理样式、固定右侧操作列和 OpenAPI 契约。
2026-08-03 15:43:49 +08:00
parent 7376d6fab6
commit ad8cdd525b
19 changed files with 1167 additions and 74 deletions
@@ -0,0 +1,140 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+func TestNormalizeIdentityBatchInput(t *testing.T) {
+	id := uuid.NewString()
+	input, err := normalizeIdentityBatchInput(IdentityBatchInput{
+		Action: " DISABLE ",
+		IDs:    []string{id, " " + id + " "},
+	})
+	if err != nil {
+		t.Fatalf("normalize identity batch: %v", err)
+	}
+	if input.Action != "disable" || len(input.IDs) != 1 || input.IDs[0] != id {
+		t.Fatalf("unexpected normalized batch: %+v", input)
+	}
+	for _, invalid := range []IdentityBatchInput{
+		{Action: "archive", IDs: []string{id}},
+		{Action: "enable", IDs: nil},
+		{Action: "delete", IDs: []string{"not-a-uuid"}},
+	} {
+		if _, err := normalizeIdentityBatchInput(invalid); !errors.Is(err, ErrInvalidIdentityBatch) {
+			t.Fatalf("invalid batch %+v error=%v", invalid, err)
+		}
+	}
+}
+
+func TestIdentityBatchOperationsAreAtomic(t *testing.T) {
+	databaseURL := strings.TrimSpace(os.Getenv("AI_GATEWAY_TEST_DATABASE_URL"))
+	if databaseURL == "" {
+		t.Skip("set AI_GATEWAY_TEST_DATABASE_URL to run identity batch PostgreSQL integration tests")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
+	defer cancel()
+	applyOIDCJITTestMigrations(t, ctx, databaseURL)
+	db, err := Connect(ctx, databaseURL)
+	if err != nil {
+		t.Fatalf("connect identity batch test database: %v", err)
+	}
+	defer db.Close()
+
+	suffix := strings.ReplaceAll(time.Now().UTC().Format("20060102150405.000000000"), ".", "")
+	groupA, err := db.CreateUserGroup(ctx, UserGroupInput{GroupKey: "batch-a-" + suffix, Name: "Batch A", Source: "gateway", Status: "active"})
+	if err != nil {
+		t.Fatalf("create group A: %v", err)
+	}
+	groupB, err := db.CreateUserGroup(ctx, UserGroupInput{GroupKey: "batch-b-" + suffix, Name: "Batch B", Source: "gateway", Status: "active"})
+	if err != nil {
+		t.Fatalf("create group B: %v", err)
+	}
+	userA, err := db.CreateGatewayUser(ctx, GatewayUserInput{UserKey: "batch-user-a-" + suffix, Username: "batch-user-a-" + suffix, Source: "gateway", DefaultUserGroupID: groupA.ID, Status: "active"})
+	if err != nil {
+		t.Fatalf("create user A: %v", err)
+	}
+	userB, err := db.CreateGatewayUser(ctx, GatewayUserInput{UserKey: "batch-user-b-" + suffix, Username: "batch-user-b-" + suffix, Source: "gateway", DefaultUserGroupID: groupB.ID, Status: "active"})
+	if err != nil {
+		t.Fatalf("create user B: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = db.pool.Exec(context.Background(), `DELETE FROM gateway_access_rules WHERE subject_id = ANY($1::uuid[])`, []string{groupA.ID, groupB.ID})
+		_, _ = db.pool.Exec(context.Background(), `DELETE FROM gateway_users WHERE id = ANY($1::uuid[])`, []string{userA.ID, userB.ID})
+		_, _ = db.pool.Exec(context.Background(), `DELETE FROM gateway_user_groups WHERE id = ANY($1::uuid[])`, []string{groupA.ID, groupB.ID})
+	})
+
+	if _, err := db.CreateAccessRule(ctx, AccessRuleInput{
+		SubjectType: "user_group", SubjectID: groupA.ID,
+		ResourceType: "platform_model", ResourceID: uuid.NewString(), Effect: "deny", Status: "active",
+	}); err != nil {
+		t.Fatalf("create group access rule: %v", err)
+	}
+
+	result, err := db.BatchGatewayUsers(ctx, IdentityBatchInput{IDs: []string{userA.ID, userA.ID, userB.ID}, Action: "disable"})
+	if err != nil || result.AffectedCount != 2 || result.RequestedCount != 2 {
+		t.Fatalf("disable users result=%+v err=%v", result, err)
+	}
+	assertIdentityStatuses(t, ctx, db, "gateway_users", []string{userA.ID, userB.ID}, "disabled")
+	if _, err := db.BatchGatewayUsers(ctx, IdentityBatchInput{IDs: []string{userA.ID, userB.ID}, Action: "enable"}); err != nil {
+		t.Fatalf("enable users: %v", err)
+	}
+	assertIdentityStatuses(t, ctx, db, "gateway_users", []string{userA.ID, userB.ID}, "active")
+
+	if _, err := db.BatchUserGroups(ctx, IdentityBatchInput{IDs: []string{groupA.ID, uuid.NewString()}, Action: "disable"}); !errors.Is(err, ErrIdentityBatchTargetNotFound) {
+		t.Fatalf("missing group batch error=%v", err)
+	}
+	assertIdentityStatuses(t, ctx, db, "gateway_user_groups", []string{groupA.ID}, "active")
+
+	if _, err := db.BatchUserGroups(ctx, IdentityBatchInput{IDs: []string{groupA.ID, groupB.ID}, Action: "disable"}); err != nil {
+		t.Fatalf("disable groups: %v", err)
+	}
+	assertIdentityStatuses(t, ctx, db, "gateway_user_groups", []string{groupA.ID, groupB.ID}, "disabled")
+	if _, err := db.BatchUserGroups(ctx, IdentityBatchInput{IDs: []string{groupA.ID, groupB.ID}, Action: "delete"}); err != nil {
+		t.Fatalf("delete groups: %v", err)
+	}
+
+	var groupCount, groupRuleCount, usersWithDeletedGroup int
+	if err := db.pool.QueryRow(ctx, `SELECT COUNT(*) FROM gateway_user_groups WHERE id = ANY($1::uuid[])`, []string{groupA.ID, groupB.ID}).Scan(&groupCount); err != nil {
+		t.Fatalf("count deleted groups: %v", err)
+	}
+	if err := db.pool.QueryRow(ctx, `SELECT COUNT(*) FROM gateway_access_rules WHERE subject_type = 'user_group' AND subject_id = ANY($1::uuid[])`, []string{groupA.ID, groupB.ID}).Scan(&groupRuleCount); err != nil {
+		t.Fatalf("count deleted group rules: %v", err)
+	}
+	if err := db.pool.QueryRow(ctx, `SELECT COUNT(*) FROM gateway_users WHERE id = ANY($1::uuid[]) AND default_user_group_id IS NOT NULL`, []string{userA.ID, userB.ID}).Scan(&usersWithDeletedGroup); err != nil {
+		t.Fatalf("count stale default groups: %v", err)
+	}
+	if groupCount != 0 || groupRuleCount != 0 || usersWithDeletedGroup != 0 {
+		t.Fatalf("group batch delete left data: groups=%d rules=%d userRefs=%d", groupCount, groupRuleCount, usersWithDeletedGroup)
+	}
+
+	if _, err := db.BatchGatewayUsers(ctx, IdentityBatchInput{IDs: []string{userA.ID, userB.ID}, Action: "delete"}); err != nil {
+		t.Fatalf("delete users: %v", err)
+	}
+	var deletedUsers int
+	if err := db.pool.QueryRow(ctx, `SELECT COUNT(*) FROM gateway_users WHERE id = ANY($1::uuid[]) AND status = 'deleted' AND deleted_at IS NOT NULL`, []string{userA.ID, userB.ID}).Scan(&deletedUsers); err != nil {
+		t.Fatalf("count deleted users: %v", err)
+	}
+	if deletedUsers != 2 {
+		t.Fatalf("soft-deleted users=%d, want 2", deletedUsers)
+	}
+}
+
+func assertIdentityStatuses(t *testing.T, ctx context.Context, db *Store, table string, ids []string, want string) {
+	t.Helper()
+	query := `SELECT COUNT(*) FROM ` + table + ` WHERE id = ANY($1::uuid[]) AND status = $2`
+	var count int
+	if err := db.pool.QueryRow(ctx, query, ids, want).Scan(&count); err != nil {
+		t.Fatalf("read %s statuses: %v", table, err)
+	}
+	if count != len(ids) {
+		t.Fatalf("%s status %s count=%d, want %d", table, want, count, len(ids))
+	}
+}