jackyu66gitandCursor
b5a05941d9
角色权限、RequirePermission、/me permissions 与 migration 000015； Reviewer Approve → Closed。Next：ECR-013B Contract Definition。 Co-authored-by: Cursor <cursoragent@cursor.com>
52 lines
1.5 KiB
Markdown
52 lines
1.5 KiB
Markdown
# TEST_REPORT — ECR-013A Admin RBAC
|
||
|
||
Date: 2026-08-07
|
||
ECR: ECR-013A · BD-2026-013A
|
||
Parent: WAVE0-FROZEN (`27f27a1`)
|
||
|
||
## Commands
|
||
|
||
```bash
|
||
export PATH="$HOME/.local/go/bin:$PATH"
|
||
cd apps/api && go test ./internal/integration/ -run 'TestAdmin(Ops|RBAC)' -count=1 -timeout 120s
|
||
cd ../.. && npm run build:admin
|
||
python3 scripts/ess-validate.py --phase review --ecr ECR-013A
|
||
```
|
||
|
||
## Results
|
||
|
||
| Check | Result |
|
||
|-------|--------|
|
||
| `TestAdminOpsPhaseA` | PASS |
|
||
| `TestAdminRBAC` | PASS |
|
||
| `build:admin` | PASS |
|
||
| `ess-validate --phase review` | PASS |
|
||
|
||
## AC mapping
|
||
|
||
| AC-ID | Evidence |
|
||
|-------|----------|
|
||
| AC-F-01 | `TestAdminRBAC` GET `/roles` 含 `super_admin` |
|
||
| AC-F-02 | PUT limited role permissions → GET 一致 |
|
||
| AC-F-03 | GET `/me` 含 `permissions[]` + `role` |
|
||
| AC-S-01 | limited admin PUT permissions → **403** + `permission.denied` audit |
|
||
| AC-S-02 | limited admin membership/grant → **403** |
|
||
| AC-S-03 | 无 Admin session GET `/roles` → **401** |
|
||
| AC-S-04 | `DELETE super_admin` 受 FK/system 约束失败；无 DeleteRole API |
|
||
| AC-P-01 | GET `/roles` 本机 < 500ms |
|
||
| AC-O-01 | AuditLog `roles.permissions.update` |
|
||
| AC-O-02 | AuditLog `permission.denied`（含 permission/path meta） |
|
||
|
||
## Scope guard
|
||
|
||
- 无 UserStatus / ECR-013B
|
||
- 无真支付 · UGC · Prompt
|
||
- AdminAuth ≠ DeviceAuth
|
||
- Migration `000015_admin_rbac`
|
||
|
||
## Notes
|
||
|
||
- admin-h5：`/me` 读 `role` + `permissions`；Shell 只读展示（最小）
|
||
- 完整角色编辑 UI 未做（API-first）
|
||
- **不自动启动 ECR-013B**
|