rogee/quyun-v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce content visibility and tenant login

Browse Source
This commit is contained in:
Rogee
2026-01-13 09:28:45 +08:00
parent ca7c799344
commit 342987334a
4 changed files with 231 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
backend/app/services/user_test.go
View File

@@ -3,9 +3,11 @@ package services
import (
"context"
"database/sql"
"errors"
"testing"
"quyun/v2/app/commands/testx"
"quyun/v2/app/errorx"
user_dto "quyun/v2/app/http/v1/dto"
"quyun/v2/database"
"quyun/v2/database/models"
@@ -14,6 +16,7 @@ import (
. "github.com/smartystreets/goconvey/convey"
"github.com/stretchr/testify/suite"
"go.ipao.vip/atom/contracts"
"go.ipao.vip/gen/types"
"go.uber.org/dig"
)
@@ -40,12 +43,19 @@ func Test_User(t *testing.T) {
func (s *UserTestSuite) Test_LoginWithOTP() {
Convey("LoginWithOTP", s.T(), func() {
ctx := s.T().Context()
tenantID := int64(1)
database.Truncate(ctx, s.DB, models.TableNameUser)
database.Truncate(ctx, s.DB, models.TableNameTenantUser, models.TableNameTenant, models.TableNameUser)
Convey("should create user and login success with correct OTP", func() {
tenant := &models.Tenant{
UserID: 1000,
Name: "Tenant A",
Code: "tenant_a",
Status: consts.TenantStatusVerified,
}
models.TenantQuery.WithContext(ctx).Create(tenant)
Convey("should create user and login success without tenant", func() {
phone := "13800138000"
resp, err := User.LoginWithOTP(ctx, tenantID, phone, "1234")
resp, err := User.LoginWithOTP(ctx, 0, phone, "1234")
So(err, ShouldBeNil)
So(resp, ShouldNotBeNil)
So(resp.Token, ShouldNotBeEmpty)
@@ -53,20 +63,35 @@ func (s *UserTestSuite) Test_LoginWithOTP() {
So(resp.User.Nickname, ShouldStartWith, "User_")
})
Convey("should login existing user", func() {
Convey("should reject login when not tenant member", func() {
phone := "13800138001"
// Pre-create user
_, err := User.LoginWithOTP(ctx, tenantID, phone, "1234")
_, err := User.LoginWithOTP(ctx, tenant.ID, phone, "1234")
So(err, ShouldNotBeNil)
var appErr *errorx.AppError
So(errors.As(err, &appErr), ShouldBeTrue)
So(appErr.Code, ShouldEqual, errorx.ErrForbidden.Code)
})
Convey("should login existing tenant member", func() {
phone := "13800138002"
resp, err := User.LoginWithOTP(ctx, 0, phone, "1234")
So(err, ShouldBeNil)
// Login again
resp, err := User.LoginWithOTP(ctx, tenantID, phone, "1234")
models.TenantUserQuery.WithContext(ctx).Create(&models.TenantUser{
TenantID: tenant.ID,
UserID: resp.User.ID,
Role: types.Array[consts.TenantUserRole]{consts.TenantUserRoleMember},
Status: consts.UserStatusVerified,
})
resp2, err := User.LoginWithOTP(ctx, tenant.ID, phone, "1234")
So(err, ShouldBeNil)
So(resp.User.Phone, ShouldEqual, phone)
So(resp2.User.Phone, ShouldEqual, phone)
})
Convey("should fail with incorrect OTP", func() {
resp, err := User.LoginWithOTP(ctx, tenantID, "13800138002", "000000")
resp, err := User.LoginWithOTP(ctx, 0, "13800138003", "000000")
So(err, ShouldNotBeNil)
So(resp, ShouldBeNil)
})
@@ -76,7 +101,7 @@ func (s *UserTestSuite) Test_LoginWithOTP() {
func (s *UserTestSuite) Test_Me() {
Convey("Me", s.T(), func() {
ctx := s.T().Context()
tenantID := int64(1)
tenantID := int64(0)
database.Truncate(ctx, s.DB, models.TableNameUser)
// Create user
@@ -106,7 +131,7 @@ func (s *UserTestSuite) Test_Me() {
func (s *UserTestSuite) Test_Update() {
Convey("Update", s.T(), func() {
ctx := s.T().Context()
tenantID := int64(1)
tenantID := int64(0)
database.Truncate(ctx, s.DB, models.TableNameUser)
phone := "13800138004"
@@ -135,7 +160,7 @@ func (s *UserTestSuite) Test_Update() {
func (s *UserTestSuite) Test_RealName() {
Convey("RealName", s.T(), func() {
ctx := s.T().Context()
tenantID := int64(1)
tenantID := int64(0)
database.Truncate(ctx, s.DB, models.TableNameUser)
phone := "13800138005"
@@ -161,7 +186,7 @@ func (s *UserTestSuite) Test_RealName() {
func (s *UserTestSuite) Test_GetNotifications() {
Convey("GetNotifications", s.T(), func() {
ctx := s.T().Context()
tenantID := int64(1)
tenantID := int64(0)
database.Truncate(ctx, s.DB, models.TableNameUser, models.TableNameNotification)
phone := "13800138006"