{ "version": 1, "requiredClientId": "platform", "sessionSecret": "test-platform-authorization-secret-with-enough-entropy", "nowUnix": 150, "cases": [ { "name": "active user refreshes forged Cookie claims from the database", "session": { "version": 1, "authMode": "admin", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 7, "accessToken": "access-token-1", "tokenType": "bearer", "user": { "id": "user-1", "subject": "forged-subject", "username": "forged-admin", "phone": "000000", "displayName": "Forged Admin", "clientId": "platform", "organizationId": "org-forged", "organizationName": "Forged Organization", "role": "super_admin", "status": "active", "authorities": ["ROLE_SUPER_ADMIN"], "scope": ["forged"] } }, "snapshot": { "account": { "id": "user-1", "phone": "13800138001", "displayName": "普通用户", "role": "user", "organizationId": "org-1", "status": "active", "sessionVersion": 7 }, "organization": { "id": "org-1", "name": "第一组织", "status": "active" } }, "expected": { "outcome": "authenticated", "loaderCalls": 1, "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 7, "accessToken": "access-token-1", "tokenType": "bearer", "user": { "id": "user-1", "subject": "user-1", "username": "13800138001", "phone": "13800138001", "displayName": "普通用户", "clientId": "platform", "organizationId": "org-1", "organizationName": "第一组织", "role": "user", "status": "active", "authorities": ["ROLE_USER"], "scope": [] } } } }, { "name": "organization administrator receives database-derived admin mode", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 3, "user": { "id": "org-admin-1", "subject": "org-admin-1", "displayName": "Old Name", "clientId": "platform", "authorities": ["ROLE_USER"], "scope": [] } }, "snapshot": { "account": { "id": "org-admin-1", "phone": "13800138002", "displayName": "组织管理员", "role": "organization_admin", "organizationId": "org-1", "status": "active", "sessionVersion": 3 }, "organization": { "id": "org-1", "name": "第一组织", "status": "active" } }, "expected": { "outcome": "authenticated", "loaderCalls": 1, "session": { "version": 1, "authMode": "admin", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 3, "user": { "id": "org-admin-1", "subject": "org-admin-1", "username": "13800138002", "phone": "13800138002", "displayName": "组织管理员", "clientId": "platform", "organizationId": "org-1", "organizationName": "第一组织", "role": "organization_admin", "status": "active", "authorities": ["ROLE_ORGANIZATION_ADMIN", "ORGANIZATION_ADMIN"], "scope": [] } } } }, { "name": "unbound super administrator remains valid", "session": { "version": 1, "authMode": "admin", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 4, "user": { "id": "super-1", "subject": "super-1", "displayName": "Old Super", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "super-1", "phone": "13800138003", "displayName": "平台超级管理员", "role": "super_admin", "status": "active", "sessionVersion": 4 }, "organization": null }, "expected": { "outcome": "authenticated", "loaderCalls": 1, "session": { "version": 1, "authMode": "admin", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 4, "user": { "id": "super-1", "subject": "super-1", "username": "13800138003", "phone": "13800138003", "displayName": "平台超级管理员", "clientId": "platform", "role": "super_admin", "status": "active", "authorities": ["ROLE_SUPER_ADMIN", "SUPER_ADMIN"], "scope": [] } } } }, { "name": "legacy missing session version is accepted and refreshed", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "user": { "id": "user-1", "subject": "user-1", "displayName": "Old Name", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "user-1", "phone": "13800138001", "displayName": "普通用户", "role": "user", "organizationId": "org-1", "status": "active", "sessionVersion": 7 }, "organization": { "id": "org-1", "name": "第一组织", "status": "active" } }, "expected": { "outcome": "authenticated", "loaderCalls": 1, "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 7, "user": { "id": "user-1", "subject": "user-1", "username": "13800138001", "phone": "13800138001", "displayName": "普通用户", "clientId": "platform", "organizationId": "org-1", "organizationName": "第一组织", "role": "user", "status": "active", "authorities": ["ROLE_USER"], "scope": [] } } } }, { "name": "legacy zero session version is accepted and refreshed", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 0, "user": { "id": "user-1", "subject": "user-1", "displayName": "Old Name", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "user-1", "phone": "13800138001", "displayName": "普通用户", "role": "user", "organizationId": "org-1", "status": "active", "sessionVersion": 7 }, "organization": { "id": "org-1", "name": "第一组织", "status": "active" } }, "expected": { "outcome": "authenticated", "loaderCalls": 1, "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 7, "user": { "id": "user-1", "subject": "user-1", "username": "13800138001", "phone": "13800138001", "displayName": "普通用户", "clientId": "platform", "organizationId": "org-1", "organizationName": "第一组织", "role": "user", "status": "active", "authorities": ["ROLE_USER"], "scope": [] } } } }, { "name": "foreign client is rejected before database lookup", "session": { "version": 1, "authMode": "admin", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 7, "user": { "id": "user-1", "subject": "user-1", "displayName": "Foreign User", "clientId": "customPC", "authorities": ["ROLE_SUPER_ADMIN"], "scope": [] } }, "snapshot": null, "expected": { "outcome": "unauthenticated", "reason": "client_mismatch", "loaderCalls": 0 } }, { "name": "missing account is rejected", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 1, "user": { "id": "missing-user", "subject": "missing-user", "displayName": "Missing", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": null, "expected": { "outcome": "unauthenticated", "reason": "account_not_found", "loaderCalls": 1 } }, { "name": "disabled account is rejected", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 7, "user": { "id": "user-disabled", "subject": "user-disabled", "displayName": "Disabled", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "user-disabled", "phone": "13800138004", "displayName": "停用用户", "role": "user", "organizationId": "org-1", "status": "disabled", "sessionVersion": 7 }, "organization": { "id": "org-1", "name": "第一组织", "status": "active" } }, "expected": { "outcome": "unauthenticated", "reason": "account_disabled", "loaderCalls": 1 } }, { "name": "standalone unknown database role is rejected", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 7, "user": { "id": "user-1", "subject": "user-1", "displayName": "Old Name", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "user-1", "phone": "13800138001", "displayName": "普通用户", "role": "auditor", "organizationId": "org-1", "status": "active", "sessionVersion": 7 }, "organization": { "id": "org-1", "name": "第一组织", "status": "active" } }, "expected": { "outcome": "unauthenticated", "reason": "invalid_role", "loaderCalls": 1 } }, { "name": "non-super account without organization is rejected", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 2, "user": { "id": "unbound-user", "subject": "unbound-user", "displayName": "Unbound", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "unbound-user", "phone": "13800138005", "displayName": "无组织用户", "role": "user", "status": "active", "sessionVersion": 2 }, "organization": null }, "expected": { "outcome": "unauthenticated", "reason": "organization_required", "loaderCalls": 1 } }, { "name": "missing organization is rejected", "session": { "version": 1, "authMode": "admin", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 2, "user": { "id": "orphan-admin", "subject": "orphan-admin", "displayName": "Orphan", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "orphan-admin", "phone": "13800138006", "displayName": "孤立管理员", "role": "organization_admin", "organizationId": "org-missing", "status": "active", "sessionVersion": 2 }, "organization": null }, "expected": { "outcome": "unauthenticated", "reason": "organization_not_active", "loaderCalls": 1 } }, { "name": "disabled organization is rejected", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 2, "user": { "id": "disabled-org-user", "subject": "disabled-org-user", "displayName": "Old Name", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "disabled-org-user", "phone": "13800138007", "displayName": "停用组织用户", "role": "user", "organizationId": "org-disabled", "status": "active", "sessionVersion": 2 }, "organization": { "id": "org-disabled", "name": "停用组织", "status": "disabled" } }, "expected": { "outcome": "unauthenticated", "reason": "organization_not_active", "loaderCalls": 1 } }, { "name": "session version mismatch precedes unknown database role", "session": { "version": 1, "authMode": "admin", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 1, "user": { "id": "invalid-role-user", "subject": "invalid-role-user", "displayName": "Invalid Role", "clientId": "platform", "authorities": ["ROLE_SUPER_ADMIN"], "scope": [] } }, "snapshot": { "account": { "id": "invalid-role-user", "phone": "13800138008", "displayName": "异常角色用户", "role": "auditor", "organizationId": "org-1", "status": "active", "sessionVersion": 2 }, "organization": { "id": "org-1", "name": "第一组织", "status": "active" } }, "expected": { "outcome": "unauthenticated", "reason": "session_version_mismatch", "loaderCalls": 1 } }, { "name": "super administrator ignores disabled organization status", "session": { "version": 1, "authMode": "user", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 5, "user": { "id": "bound-super", "subject": "bound-super", "displayName": "Old Super", "clientId": "platform", "authorities": [], "scope": [] } }, "snapshot": { "account": { "id": "bound-super", "phone": "13800138009", "displayName": "绑定超级管理员", "role": "super_admin", "organizationId": "org-disabled", "status": "active", "sessionVersion": 5 }, "organization": { "id": "org-disabled", "name": "停用组织", "status": "disabled" } }, "expected": { "outcome": "authenticated", "loaderCalls": 1, "session": { "version": 1, "authMode": "admin", "issuedAt": 100, "expiresAt": 200, "sessionVersion": 5, "user": { "id": "bound-super", "subject": "bound-super", "username": "13800138009", "phone": "13800138009", "displayName": "绑定超级管理员", "clientId": "platform", "organizationId": "org-disabled", "organizationName": "停用组织", "role": "super_admin", "status": "active", "authorities": ["ROLE_SUPER_ADMIN", "SUPER_ADMIN"], "scope": [] } } } } ] }