chengcheng
c0296dbf06
修复多租户身份配置将所有人类登录都强制解释为租户上下文的问题。Web 现在提供平台与租户两个受控入口，API 严格绑定 context_type、tid、issuer、application 和 subject，并为平台用户建立独立本地投影与可刷新会话。\n\n风险：新增会话身份列保持旧会话可读，新会话一律使用严格约束；未改变租户数据隔离和 API Key 行为。\n\n验证：Go 全量测试与 go vet 通过；PostgreSQL 平台投影、会话和安全事件集成测试通过；前端 lint、141 项测试与生产 build 通过；OpenAPI 生成和迁移安全测试通过。
61 lines
1.6 KiB
Go
61 lines
1.6 KiB
Go
package store
|
|
|
|
import "testing"
|
|
|
|
func TestOIDCProjectionKindRequiresExplicitCompatibleContext(t *testing.T) {
|
|
applicationID := "11111111-1111-4111-8111-111111111111"
|
|
tests := []struct {
|
|
name string
|
|
input ResolveOrProvisionOIDCUserInput
|
|
want string
|
|
}{
|
|
{
|
|
name: "platform in multi-tenant application",
|
|
input: ResolveOrProvisionOIDCUserInput{
|
|
ContextType: "platform", TenantMode: "multi_tenant",
|
|
ApplicationID: applicationID,
|
|
},
|
|
want: "platform",
|
|
},
|
|
{
|
|
name: "tenant in multi-tenant application",
|
|
input: ResolveOrProvisionOIDCUserInput{
|
|
ContextType: "tenant", TenantMode: "multi_tenant",
|
|
ApplicationID: applicationID,
|
|
TenantID: "22222222-2222-4222-8222-222222222222",
|
|
},
|
|
want: "multi_tenant",
|
|
},
|
|
{
|
|
name: "tenant in single-tenant application",
|
|
input: ResolveOrProvisionOIDCUserInput{
|
|
ContextType: "tenant", TenantMode: "single_tenant",
|
|
TenantID: "tenant-contract-id",
|
|
},
|
|
want: "single_tenant",
|
|
},
|
|
{
|
|
name: "missing context",
|
|
input: ResolveOrProvisionOIDCUserInput{
|
|
TenantMode: "multi_tenant", ApplicationID: applicationID,
|
|
TenantID: "22222222-2222-4222-8222-222222222222",
|
|
},
|
|
},
|
|
{
|
|
name: "platform context with tenant",
|
|
input: ResolveOrProvisionOIDCUserInput{
|
|
ContextType: "platform", TenantMode: "multi_tenant",
|
|
ApplicationID: applicationID,
|
|
TenantID: "22222222-2222-4222-8222-222222222222",
|
|
},
|
|
},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
if got := oidcProjectionKind(test.input); got != test.want {
|
|
t.Fatalf("projection kind=%q, want %q", got, test.want)
|
|
}
|
|
})
|
|
}
|
|
}
|