维护权限：注册教师与学员安全删除按钮权限

2026-09-20 16:42:46 +08:00
1 parent 225f58481a
commit 18c5ff5914
@@ -132,6 +132,61 @@ public class RbacPermissionMigrationContractTest
                "select 5, 2240");
    }

+    @Test
+    public void teacherAndStudentSafeDeletePermissionsRegisteredInSqlAndContractProtected() throws Exception
+    {
+        // 1. 验证权威初始化 SQL (005) 包含教师与学员安全删除按钮权限注册
+        String sql005 = new String(Files.readAllBytes(findMigration("005_training_roles_permissions.sql")), StandardCharsets.UTF_8).toLowerCase();
+        assertContains(sql005,
+                "train:teacher:remove",
+                "train:student:remove",
+                "2245",
+                "2246",
+                "教师删除",
+                "学员删除");
+
+        // 2. 验证增量 V2 migration (011) 包含幂等安全删除注册
+        Path incrementalMigrationPath = findMigration("011_teacher_student_remove_permissions.sql");
+        String sql011 = new String(Files.readAllBytes(incrementalMigrationPath), StandardCharsets.UTF_8).toLowerCase();
+        assertContains(sql011,
+                "train:teacher:remove",
+                "train:student:remove",
+                "2245",
+                "2246",
+                "where not exists",
+                "train_admin");
+
+        // 3. 严格断言并未向 train_admin 授予教师/学员删除权限
+        assertFalse("train_admin 绝不能被授予教师删除权限", sql005.contains("select 3, 2245"));
+        assertFalse("train_admin 绝不能被授予学员删除权限", sql005.contains("select 3, 2246"));
+        assertFalse("011迁移绝不能向sys_role_menu赋予train_admin删除权限", sql011.contains("insert into public.sys_role_menu (role_id, menu_id) values (3"));
+
+        // 4. 验证后端 Controller 注解与权限树完全对齐
+        boolean teacherRemoveFound = false;
+        for (Method method : TrainTeacherController.class.getDeclaredMethods())
+        {
+            if (method.isAnnotationPresent(PreAuthorize.class)
+                    && method.getAnnotation(PreAuthorize.class).value().contains("train:teacher:remove"))
+            {
+                teacherRemoveFound = true;
+                break;
+            }
+        }
+        assertTrue("TrainTeacherController 必须配置 train:teacher:remove", teacherRemoveFound);
+
+        boolean studentRemoveFound = false;
+        for (Method method : TrainStudentController.class.getDeclaredMethods())
+        {
+            if (method.isAnnotationPresent(PreAuthorize.class)
+                    && method.getAnnotation(PreAuthorize.class).value().contains("train:student:remove"))
+            {
+                studentRemoveFound = true;
+                break;
+            }
+        }
+        assertTrue("TrainStudentController 必须配置 train:student:remove", studentRemoveFound);
+    }
+
    private Path findMigration(String filename)
    {
        for (Path path = Paths.get("").toAbsolutePath(); path != null; path = path.getParent())