jackyu66gitandCursor
b5a05941d9
角色权限、RequirePermission、/me permissions 与 migration 000015； Reviewer Approve → Closed。Next：ECR-013B Contract Definition。 Co-authored-by: Cursor <cursoragent@cursor.com>
1.5 KiB
1.5 KiB
TEST_REPORT — ECR-013A Admin RBAC
Date: 2026-08-07
ECR: ECR-013A · BD-2026-013A
Parent: WAVE0-FROZEN (27f27a1)
Commands
export PATH="$HOME/.local/go/bin:$PATH"
cd apps/api && go test ./internal/integration/ -run 'TestAdmin(Ops|RBAC)' -count=1 -timeout 120s
cd ../.. && npm run build:admin
python3 scripts/ess-validate.py --phase review --ecr ECR-013A
Results
| Check | Result |
|---|---|
TestAdminOpsPhaseA |
PASS |
TestAdminRBAC |
PASS |
build:admin |
PASS |
ess-validate --phase review |
PASS |
AC mapping
| AC-ID | Evidence |
|---|---|
| AC-F-01 | TestAdminRBAC GET /roles 含 super_admin |
| AC-F-02 | PUT limited role permissions → GET 一致 |
| AC-F-03 | GET /me 含 permissions[] + role |
| AC-S-01 | limited admin PUT permissions → 403 + permission.denied audit |
| AC-S-02 | limited admin membership/grant → 403 |
| AC-S-03 | 无 Admin session GET /roles → 401 |
| AC-S-04 | DELETE super_admin 受 FK/system 约束失败；无 DeleteRole API |
| AC-P-01 | GET /roles 本机 < 500ms |
| AC-O-01 | AuditLog roles.permissions.update |
| AC-O-02 | AuditLog permission.denied（含 permission/path meta） |
Scope guard
- 无 UserStatus / ECR-013B
- 无真支付 · UGC · Prompt
- AdminAuth ≠ DeviceAuth
- Migration
000015_admin_rbac
Notes
- admin-h5：
/me读role+permissions；Shell 只读展示（最小） - 完整角色编辑 UI 未做（API-first）
- 不自动启动 ECR-013B