feat(ECR-013A): Admin RBAC 实现并 Closed
角色权限、RequirePermission、/me permissions 与 migration 000015; Reviewer Approve → Closed。Next:ECR-013B Contract Definition。 Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
@@ -21,7 +21,22 @@ test('admin login users grant and audit with mocked API', async ({ page }) => {
|
||||
await ok({
|
||||
token: 'adm_e2e_token',
|
||||
expires_at: new Date(Date.now() + 3600_000).toISOString(),
|
||||
admin: { id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', username: 'admin' },
|
||||
admin: {
|
||||
id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
|
||||
username: 'admin',
|
||||
role: 'super_admin',
|
||||
permissions: [
|
||||
'admin.users.read',
|
||||
'admin.users.membership.grant',
|
||||
'admin.users.ask_quota.grant',
|
||||
'admin.orders.read',
|
||||
'admin.audit.read',
|
||||
'admin.analytics.read',
|
||||
'admin.content.write',
|
||||
'admin.roles.read',
|
||||
'admin.roles.write',
|
||||
],
|
||||
},
|
||||
})
|
||||
return
|
||||
}
|
||||
@@ -55,7 +70,22 @@ test('admin login users grant and audit with mocked API', async ({ page }) => {
|
||||
return
|
||||
}
|
||||
if (url.endsWith('/me') || url.includes('/me?')) {
|
||||
await ok({ id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', username: 'admin' })
|
||||
await ok({
|
||||
id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
|
||||
username: 'admin',
|
||||
role: 'super_admin',
|
||||
permissions: [
|
||||
'admin.users.read',
|
||||
'admin.users.membership.grant',
|
||||
'admin.users.ask_quota.grant',
|
||||
'admin.orders.read',
|
||||
'admin.audit.read',
|
||||
'admin.analytics.read',
|
||||
'admin.content.write',
|
||||
'admin.roles.read',
|
||||
'admin.roles.write',
|
||||
],
|
||||
})
|
||||
return
|
||||
}
|
||||
if (url.includes(`/users/${userId}/ask-quota/grant`) && method === 'POST') {
|
||||
|
||||
Reference in New Issue
Block a user