638 lines
17 KiB
JSON
638 lines
17 KiB
JSON
{
|
|
"version": 1,
|
|
"requiredClientId": "platform",
|
|
"sessionSecret": "test-platform-authorization-secret-with-enough-entropy",
|
|
"nowUnix": 150,
|
|
"cases": [
|
|
{
|
|
"name": "active user refreshes forged Cookie claims from the database",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "admin",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 7,
|
|
"accessToken": "access-token-1",
|
|
"tokenType": "bearer",
|
|
"user": {
|
|
"id": "user-1",
|
|
"subject": "forged-subject",
|
|
"username": "forged-admin",
|
|
"phone": "000000",
|
|
"displayName": "Forged Admin",
|
|
"clientId": "platform",
|
|
"organizationId": "org-forged",
|
|
"organizationName": "Forged Organization",
|
|
"role": "super_admin",
|
|
"status": "active",
|
|
"authorities": ["ROLE_SUPER_ADMIN"],
|
|
"scope": ["forged"]
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "user-1",
|
|
"phone": "13800138001",
|
|
"displayName": "普通用户",
|
|
"role": "user",
|
|
"organizationId": "org-1",
|
|
"status": "active",
|
|
"sessionVersion": 7
|
|
},
|
|
"organization": {
|
|
"id": "org-1",
|
|
"name": "第一组织",
|
|
"status": "active"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "authenticated",
|
|
"loaderCalls": 1,
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 7,
|
|
"accessToken": "access-token-1",
|
|
"tokenType": "bearer",
|
|
"user": {
|
|
"id": "user-1",
|
|
"subject": "user-1",
|
|
"username": "13800138001",
|
|
"phone": "13800138001",
|
|
"displayName": "普通用户",
|
|
"clientId": "platform",
|
|
"organizationId": "org-1",
|
|
"organizationName": "第一组织",
|
|
"role": "user",
|
|
"status": "active",
|
|
"authorities": ["ROLE_USER"],
|
|
"scope": []
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "organization administrator receives database-derived admin mode",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 3,
|
|
"user": {
|
|
"id": "org-admin-1",
|
|
"subject": "org-admin-1",
|
|
"displayName": "Old Name",
|
|
"clientId": "platform",
|
|
"authorities": ["ROLE_USER"],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "org-admin-1",
|
|
"phone": "13800138002",
|
|
"displayName": "组织管理员",
|
|
"role": "organization_admin",
|
|
"organizationId": "org-1",
|
|
"status": "active",
|
|
"sessionVersion": 3
|
|
},
|
|
"organization": {
|
|
"id": "org-1",
|
|
"name": "第一组织",
|
|
"status": "active"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "authenticated",
|
|
"loaderCalls": 1,
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "admin",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 3,
|
|
"user": {
|
|
"id": "org-admin-1",
|
|
"subject": "org-admin-1",
|
|
"username": "13800138002",
|
|
"phone": "13800138002",
|
|
"displayName": "组织管理员",
|
|
"clientId": "platform",
|
|
"organizationId": "org-1",
|
|
"organizationName": "第一组织",
|
|
"role": "organization_admin",
|
|
"status": "active",
|
|
"authorities": ["ROLE_ORGANIZATION_ADMIN", "ORGANIZATION_ADMIN"],
|
|
"scope": []
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "unbound super administrator remains valid",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "admin",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 4,
|
|
"user": {
|
|
"id": "super-1",
|
|
"subject": "super-1",
|
|
"displayName": "Old Super",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "super-1",
|
|
"phone": "13800138003",
|
|
"displayName": "平台超级管理员",
|
|
"role": "super_admin",
|
|
"status": "active",
|
|
"sessionVersion": 4
|
|
},
|
|
"organization": null
|
|
},
|
|
"expected": {
|
|
"outcome": "authenticated",
|
|
"loaderCalls": 1,
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "admin",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 4,
|
|
"user": {
|
|
"id": "super-1",
|
|
"subject": "super-1",
|
|
"username": "13800138003",
|
|
"phone": "13800138003",
|
|
"displayName": "平台超级管理员",
|
|
"clientId": "platform",
|
|
"role": "super_admin",
|
|
"status": "active",
|
|
"authorities": ["ROLE_SUPER_ADMIN", "SUPER_ADMIN"],
|
|
"scope": []
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "legacy missing session version is accepted and refreshed",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"user": {
|
|
"id": "user-1",
|
|
"subject": "user-1",
|
|
"displayName": "Old Name",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "user-1",
|
|
"phone": "13800138001",
|
|
"displayName": "普通用户",
|
|
"role": "user",
|
|
"organizationId": "org-1",
|
|
"status": "active",
|
|
"sessionVersion": 7
|
|
},
|
|
"organization": {
|
|
"id": "org-1",
|
|
"name": "第一组织",
|
|
"status": "active"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "authenticated",
|
|
"loaderCalls": 1,
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 7,
|
|
"user": {
|
|
"id": "user-1",
|
|
"subject": "user-1",
|
|
"username": "13800138001",
|
|
"phone": "13800138001",
|
|
"displayName": "普通用户",
|
|
"clientId": "platform",
|
|
"organizationId": "org-1",
|
|
"organizationName": "第一组织",
|
|
"role": "user",
|
|
"status": "active",
|
|
"authorities": ["ROLE_USER"],
|
|
"scope": []
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "legacy zero session version is accepted and refreshed",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 0,
|
|
"user": {
|
|
"id": "user-1",
|
|
"subject": "user-1",
|
|
"displayName": "Old Name",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "user-1",
|
|
"phone": "13800138001",
|
|
"displayName": "普通用户",
|
|
"role": "user",
|
|
"organizationId": "org-1",
|
|
"status": "active",
|
|
"sessionVersion": 7
|
|
},
|
|
"organization": {
|
|
"id": "org-1",
|
|
"name": "第一组织",
|
|
"status": "active"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "authenticated",
|
|
"loaderCalls": 1,
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 7,
|
|
"user": {
|
|
"id": "user-1",
|
|
"subject": "user-1",
|
|
"username": "13800138001",
|
|
"phone": "13800138001",
|
|
"displayName": "普通用户",
|
|
"clientId": "platform",
|
|
"organizationId": "org-1",
|
|
"organizationName": "第一组织",
|
|
"role": "user",
|
|
"status": "active",
|
|
"authorities": ["ROLE_USER"],
|
|
"scope": []
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"name": "foreign client is rejected before database lookup",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "admin",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 7,
|
|
"user": {
|
|
"id": "user-1",
|
|
"subject": "user-1",
|
|
"displayName": "Foreign User",
|
|
"clientId": "customPC",
|
|
"authorities": ["ROLE_SUPER_ADMIN"],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": null,
|
|
"expected": {
|
|
"outcome": "unauthenticated",
|
|
"reason": "client_mismatch",
|
|
"loaderCalls": 0
|
|
}
|
|
},
|
|
{
|
|
"name": "missing account is rejected",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 1,
|
|
"user": {
|
|
"id": "missing-user",
|
|
"subject": "missing-user",
|
|
"displayName": "Missing",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": null,
|
|
"expected": {
|
|
"outcome": "unauthenticated",
|
|
"reason": "account_not_found",
|
|
"loaderCalls": 1
|
|
}
|
|
},
|
|
{
|
|
"name": "disabled account is rejected",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 7,
|
|
"user": {
|
|
"id": "user-disabled",
|
|
"subject": "user-disabled",
|
|
"displayName": "Disabled",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "user-disabled",
|
|
"phone": "13800138004",
|
|
"displayName": "停用用户",
|
|
"role": "user",
|
|
"organizationId": "org-1",
|
|
"status": "disabled",
|
|
"sessionVersion": 7
|
|
},
|
|
"organization": {
|
|
"id": "org-1",
|
|
"name": "第一组织",
|
|
"status": "active"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "unauthenticated",
|
|
"reason": "account_disabled",
|
|
"loaderCalls": 1
|
|
}
|
|
},
|
|
{
|
|
"name": "standalone unknown database role is rejected",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 7,
|
|
"user": {
|
|
"id": "user-1",
|
|
"subject": "user-1",
|
|
"displayName": "Old Name",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "user-1",
|
|
"phone": "13800138001",
|
|
"displayName": "普通用户",
|
|
"role": "auditor",
|
|
"organizationId": "org-1",
|
|
"status": "active",
|
|
"sessionVersion": 7
|
|
},
|
|
"organization": {
|
|
"id": "org-1",
|
|
"name": "第一组织",
|
|
"status": "active"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "unauthenticated",
|
|
"reason": "invalid_role",
|
|
"loaderCalls": 1
|
|
}
|
|
},
|
|
{
|
|
"name": "non-super account without organization is rejected",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 2,
|
|
"user": {
|
|
"id": "unbound-user",
|
|
"subject": "unbound-user",
|
|
"displayName": "Unbound",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "unbound-user",
|
|
"phone": "13800138005",
|
|
"displayName": "无组织用户",
|
|
"role": "user",
|
|
"status": "active",
|
|
"sessionVersion": 2
|
|
},
|
|
"organization": null
|
|
},
|
|
"expected": {
|
|
"outcome": "unauthenticated",
|
|
"reason": "organization_required",
|
|
"loaderCalls": 1
|
|
}
|
|
},
|
|
{
|
|
"name": "missing organization is rejected",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "admin",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 2,
|
|
"user": {
|
|
"id": "orphan-admin",
|
|
"subject": "orphan-admin",
|
|
"displayName": "Orphan",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "orphan-admin",
|
|
"phone": "13800138006",
|
|
"displayName": "孤立管理员",
|
|
"role": "organization_admin",
|
|
"organizationId": "org-missing",
|
|
"status": "active",
|
|
"sessionVersion": 2
|
|
},
|
|
"organization": null
|
|
},
|
|
"expected": {
|
|
"outcome": "unauthenticated",
|
|
"reason": "organization_not_active",
|
|
"loaderCalls": 1
|
|
}
|
|
},
|
|
{
|
|
"name": "disabled organization is rejected",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 2,
|
|
"user": {
|
|
"id": "disabled-org-user",
|
|
"subject": "disabled-org-user",
|
|
"displayName": "Old Name",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "disabled-org-user",
|
|
"phone": "13800138007",
|
|
"displayName": "停用组织用户",
|
|
"role": "user",
|
|
"organizationId": "org-disabled",
|
|
"status": "active",
|
|
"sessionVersion": 2
|
|
},
|
|
"organization": {
|
|
"id": "org-disabled",
|
|
"name": "停用组织",
|
|
"status": "disabled"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "unauthenticated",
|
|
"reason": "organization_not_active",
|
|
"loaderCalls": 1
|
|
}
|
|
},
|
|
{
|
|
"name": "session version mismatch precedes unknown database role",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "admin",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 1,
|
|
"user": {
|
|
"id": "invalid-role-user",
|
|
"subject": "invalid-role-user",
|
|
"displayName": "Invalid Role",
|
|
"clientId": "platform",
|
|
"authorities": ["ROLE_SUPER_ADMIN"],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "invalid-role-user",
|
|
"phone": "13800138008",
|
|
"displayName": "异常角色用户",
|
|
"role": "auditor",
|
|
"organizationId": "org-1",
|
|
"status": "active",
|
|
"sessionVersion": 2
|
|
},
|
|
"organization": {
|
|
"id": "org-1",
|
|
"name": "第一组织",
|
|
"status": "active"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "unauthenticated",
|
|
"reason": "session_version_mismatch",
|
|
"loaderCalls": 1
|
|
}
|
|
},
|
|
{
|
|
"name": "super administrator ignores disabled organization status",
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "user",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 5,
|
|
"user": {
|
|
"id": "bound-super",
|
|
"subject": "bound-super",
|
|
"displayName": "Old Super",
|
|
"clientId": "platform",
|
|
"authorities": [],
|
|
"scope": []
|
|
}
|
|
},
|
|
"snapshot": {
|
|
"account": {
|
|
"id": "bound-super",
|
|
"phone": "13800138009",
|
|
"displayName": "绑定超级管理员",
|
|
"role": "super_admin",
|
|
"organizationId": "org-disabled",
|
|
"status": "active",
|
|
"sessionVersion": 5
|
|
},
|
|
"organization": {
|
|
"id": "org-disabled",
|
|
"name": "停用组织",
|
|
"status": "disabled"
|
|
}
|
|
},
|
|
"expected": {
|
|
"outcome": "authenticated",
|
|
"loaderCalls": 1,
|
|
"session": {
|
|
"version": 1,
|
|
"authMode": "admin",
|
|
"issuedAt": 100,
|
|
"expiresAt": 200,
|
|
"sessionVersion": 5,
|
|
"user": {
|
|
"id": "bound-super",
|
|
"subject": "bound-super",
|
|
"username": "13800138009",
|
|
"phone": "13800138009",
|
|
"displayName": "绑定超级管理员",
|
|
"clientId": "platform",
|
|
"organizationId": "org-disabled",
|
|
"organizationName": "停用组织",
|
|
"role": "super_admin",
|
|
"status": "active",
|
|
"authorities": ["ROLE_SUPER_ADMIN", "SUPER_ADMIN"],
|
|
"scope": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|