chore: establish local platform baseline

2026-08-26 06:41:54 +08:00
commit 29bdf4900f
575 changed files with 95644 additions and 0 deletions
@@ -0,0 +1,123 @@
+package opsconfig
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+	"time"
+
+	"data-terminal-cloud/internal/audit"
+	"data-terminal-cloud/internal/identity"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func TestResourceReferencesAndDeviceGroupsLifecycle(t *testing.T) {
+	databaseURL := os.Getenv("TEST_DATABASE_URL")
+	if databaseURL == "" {
+		t.Skip("TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, databaseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pool.Close()
+	service, err := NewService(pool, audit.NewRepository())
+	if err != nil {
+		t.Fatal(err)
+	}
+	admin := identity.Principal{Issuer: "http://localhost:58180/realms/voice-local", Subject: "00000000-0000-0000-0000-000000000101"}
+	outsider := identity.Principal{Issuer: admin.Issuer, Subject: "00000000-0000-0000-0000-000000000103"}
+	tenantID := "10000000-0000-0000-0000-000000000010"
+	deviceID := "10000000-0000-0000-0000-000000000511"
+	resourceKey := "ops-gates-core-resource-" + uuid.NewString()
+	groupKey := "ops-gates-core-group-" + uuid.NewString()
+	deniedKey := "ops-gates-core-denied-" + uuid.NewString()
+	referenceName := "vault://certificates/core-" + uuid.NewString()
+	groupName := "核心灰度组-" + uuid.NewString()
+	requestPrefix := "ops-gates-core-"
+	defer func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM audit_event WHERE request_id LIKE $1`, requestPrefix+"%")
+		_, _ = pool.Exec(ctx, `DELETE FROM idempotency_record WHERE idempotency_key=ANY($1::text[])`, []string{resourceKey, groupKey, deniedKey})
+		_, _ = pool.Exec(ctx, `DELETE FROM ops_device_group_member WHERE group_id IN (SELECT id FROM ops_device_group WHERE name=$1)`, groupName)
+		_, _ = pool.Exec(ctx, `DELETE FROM ops_device_group WHERE name=$1`, groupName)
+		_, _ = pool.Exec(ctx, `DELETE FROM ops_resource_reference WHERE reference_name=$1`, referenceName)
+	}()
+
+	verifiedAt := time.Now().UTC().Add(-time.Hour)
+	expiresAt := time.Now().UTC().Add(30 * 24 * time.Hour)
+	if _, _, err := service.CreateResourceReference(ctx, admin, tenantID, "bad", requestPrefix+"invalid-certificate", "CERTIFICATE", referenceName, "缺少到期时间", verifiedAt, nil); !errors.Is(err, ErrInvalid) {
+		t.Fatalf("invalid certificate error=%v", err)
+	}
+	resource, created, err := service.CreateResourceReference(ctx, admin, tenantID, resourceKey, requestPrefix+"resource-create", " certificate ", referenceName, "核心测试证书", verifiedAt, &expiresAt)
+	if err != nil || !created || resource.Status != "ACTIVE" || resource.RowVersion != 1 || resource.ResourceType != "CERTIFICATE" {
+		t.Fatalf("resource=%+v created=%t err=%v", resource, created, err)
+	}
+	replayed, createdAgain, err := service.CreateResourceReference(ctx, admin, tenantID, resourceKey, requestPrefix+"resource-replay", "CERTIFICATE", referenceName, "核心测试证书", verifiedAt, &expiresAt)
+	if err != nil || createdAgain || replayed.ID != resource.ID {
+		t.Fatalf("resource replay=%+v created=%t err=%v", replayed, createdAgain, err)
+	}
+	resources, err := service.ListResourceReferences(ctx, admin, tenantID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, item := range resources {
+		if item.ID == resource.ID {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("resource %s missing from list", resource.ID)
+	}
+	if _, err := service.ListResourceReferences(ctx, outsider, tenantID); !errors.Is(err, ErrAccessDenied) {
+		t.Fatalf("outsider list resources error=%v", err)
+	}
+	if _, err := service.RevokeResourceReference(ctx, admin, tenantID, resource.ID, requestPrefix+"empty-reason", "", 1); !errors.Is(err, ErrInvalid) {
+		t.Fatalf("empty revoke reason error=%v", err)
+	}
+	if _, err := service.RevokeResourceReference(ctx, admin, tenantID, resource.ID, requestPrefix+"wrong-version", "错误版本", 99); !errors.Is(err, ErrVersionConflict) {
+		t.Fatalf("wrong resource version error=%v", err)
+	}
+	revoked, err := service.RevokeResourceReference(ctx, admin, tenantID, resource.ID, requestPrefix+"resource-revoke", "证书轮换完成", 1)
+	if err != nil || revoked.Status != "REVOKED" || revoked.RowVersion != 2 {
+		t.Fatalf("revoked=%+v err=%v", revoked, err)
+	}
+	if _, err := service.RevokeResourceReference(ctx, admin, tenantID, resource.ID, requestPrefix+"resource-repeat", "重复撤销", 2); !errors.Is(err, ErrStateConflict) {
+		t.Fatalf("repeat revoke error=%v", err)
+	}
+
+	if _, _, err := service.CreateDeviceGroup(ctx, admin, tenantID, "bad", requestPrefix+"invalid-group", "", nil, nil); !errors.Is(err, ErrInvalid) {
+		t.Fatalf("invalid group error=%v", err)
+	}
+	group, created, err := service.CreateDeviceGroup(ctx, admin, tenantID, groupKey, requestPrefix+"group-create", groupName, map[string]any{"purpose": "core-coverage"}, []string{deviceID, deviceID})
+	if err != nil || !created || group.Status != "ACTIVE" || group.RowVersion != 1 || len(group.DeviceIDs) != 1 || group.DeviceIDs[0] != deviceID {
+		t.Fatalf("group=%+v created=%t err=%v", group, created, err)
+	}
+	replayedGroup, createdAgain, err := service.CreateDeviceGroup(ctx, admin, tenantID, groupKey, requestPrefix+"group-replay", groupName, map[string]any{"purpose": "core-coverage"}, []string{deviceID, deviceID})
+	if err != nil || createdAgain || replayedGroup.ID != group.ID {
+		t.Fatalf("group replay=%+v created=%t err=%v", replayedGroup, createdAgain, err)
+	}
+	groups, err := service.ListDeviceGroups(ctx, admin, tenantID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found = false
+	for _, item := range groups {
+		if item.ID == group.ID && len(item.DeviceIDs) == 1 && item.DeviceIDs[0] == deviceID {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("device group %s missing from list", group.ID)
+	}
+	if _, _, err := service.CreateDeviceGroup(ctx, admin, tenantID, deniedKey, requestPrefix+"group-denied", groupName+"-denied", map[string]any{}, []string{uuid.NewString()}); !errors.Is(err, ErrAccessDenied) {
+		t.Fatalf("unknown device group error=%v", err)
+	}
+	if _, err := service.ListRollouts(ctx, admin, tenantID, "INVALID KEY"); !errors.Is(err, ErrInvalid) {
+		t.Fatalf("invalid rollout filter error=%v", err)
+	}
+}