feat: add shared backend authorization seams

2026-08-13 16:03:20 +08:00
1 parent d0207fcebe
commit 48dd5d07c8
@@ -0,0 +1,89 @@
+{
+  "version": 1,
+  "cookieName": "zhinian_session",
+  "cases": [
+    {
+      "name": "optional unconfigured application access uses the local administrator",
+      "state": { "required": false, "configured": false },
+      "requirement": "app",
+      "resolverOutcome": "not_called",
+      "expected": { "outcome": "authenticated", "status": 200, "role": "super_admin", "authMode": "admin" }
+    },
+    {
+      "name": "required unconfigured authentication fails with service unavailable",
+      "state": { "required": true, "configured": false },
+      "requirement": "app",
+      "resolverOutcome": "not_called",
+      "expected": { "outcome": "configuration_error", "status": 503 }
+    },
+    {
+      "name": "required configured request without a cookie is unauthenticated",
+      "state": { "required": true, "configured": true },
+      "requirement": "app",
+      "resolverOutcome": "not_called",
+      "expected": { "outcome": "unauthenticated", "status": 401 }
+    },
+    {
+      "name": "an invalid session falls back locally only when authentication is optional",
+      "state": { "required": false, "configured": true },
+      "requirement": "super_admin",
+      "resolverOutcome": "unauthenticated",
+      "expected": { "outcome": "authenticated", "status": 200, "role": "super_admin", "authMode": "admin" }
+    },
+    {
+      "name": "database refreshed user is allowed application access",
+      "state": { "required": true, "configured": true },
+      "requirement": "app",
+      "resolverOutcome": "authenticated",
+      "session": { "authMode": "user", "role": "user" },
+      "expected": { "outcome": "authenticated", "status": 200, "role": "user", "authMode": "user" }
+    },
+    {
+      "name": "ordinary user cannot access administration",
+      "state": { "required": true, "configured": true },
+      "requirement": "admin",
+      "resolverOutcome": "authenticated",
+      "session": { "authMode": "user", "role": "user" },
+      "expected": { "outcome": "forbidden", "status": 403 }
+    },
+    {
+      "name": "organization administrator in admin mode can access administration",
+      "state": { "required": true, "configured": true },
+      "requirement": "admin",
+      "resolverOutcome": "authenticated",
+      "session": { "authMode": "admin", "role": "organization_admin" },
+      "expected": { "outcome": "authenticated", "status": 200, "role": "organization_admin", "authMode": "admin" }
+    },
+    {
+      "name": "admin role without admin login mode cannot access administration",
+      "state": { "required": true, "configured": true },
+      "requirement": "admin",
+      "resolverOutcome": "authenticated",
+      "session": { "authMode": "user", "role": "organization_admin" },
+      "expected": { "outcome": "forbidden", "status": 403 }
+    },
+    {
+      "name": "organization administrator cannot access super administration",
+      "state": { "required": true, "configured": true },
+      "requirement": "super_admin",
+      "resolverOutcome": "authenticated",
+      "session": { "authMode": "admin", "role": "organization_admin" },
+      "expected": { "outcome": "forbidden", "status": 403 }
+    },
+    {
+      "name": "super administrator can access super administration",
+      "state": { "required": true, "configured": true },
+      "requirement": "super_admin",
+      "resolverOutcome": "authenticated",
+      "session": { "authMode": "admin", "role": "super_admin" },
+      "expected": { "outcome": "authenticated", "status": 200, "role": "super_admin", "authMode": "admin" }
+    },
+    {
+      "name": "resolver infrastructure failure is not disguised as authentication denial",
+      "state": { "required": true, "configured": true },
+      "requirement": "app",
+      "resolverOutcome": "infrastructure_error",
+      "expected": { "outcome": "infrastructure_error", "status": 500 }
+    }
+  ]
+}