55 lines
2.4 KiB
Markdown
55 lines
2.4 KiB
Markdown
|
# 验收矩阵（菜单 × 按钮 × 接口）
|
|||
|
|
|
|||
|
|
目标：验证“菜单可见性（role_menu）”“按钮显示（v-permission）”“接口鉴权（@PreAuthorize）”三者一致，且多租户不串台。
|
|||
|
|
|
|||
|
|
## 预置条件
|
|||
|
|
- 执行 Flyway 迁移：`V32__rbac_align_all_tenants.sql`、`V33__rbac_permission_code_aliases_and_menu_fix.sql`
|
|||
|
|
- 确认每个租户至少存在角色：`tenant_admin`（以及按需：`school_admin/teacher/student/judge`）
|
|||
|
|
- 给测试用户绑定目标租户与角色（`t_auth_user_role`）
|
|||
|
|
|
|||
|
|
## 用例
|
|||
|
|
|
|||
|
|
### A. 菜单可见性（GET /api/menus/user-menus）
|
|||
|
|
- **tenant_admin**：登录后菜单应非空；不应出现“只剩空白页面/无菜单”。\n
|
|||
|
|
- **school_admin/teacher/student/judge**：登录后菜单与 tenant_id=1 模板一致（允许租户裁剪）。\n
|
|||
|
|
- **租户隔离**：同一 userId 若历史绑定了其他租户角色，仍只返回当前 token 的 tenantId 对应角色菜单。\n
|
|||
|
|
|
|||
|
|
### B. 路由访问（路由 meta.permissions）
|
|||
|
|
抽查以下路由（以实际菜单为准）：\n
|
|||
|
|
- `contests/create`：需 `contest:create`\n
|
|||
|
|
- `contests/:id`：需 `contest:read` 或 `activity:read`\n
|
|||
|
|
- `analytics/overview`：需 `contest:read`\n
|
|||
|
|
- `activities/review/:id`：需 `review:score`（兼容 `contest:review:score`）\n
|
|||
|
|
|
|||
|
|
期望：\n
|
|||
|
|
- **有权限**：可进入页面\n
|
|||
|
|
- **无权限**：跳转到 `403`\n
|
|||
|
|
|
|||
|
|
### C. 按钮显示（v-permission）
|
|||
|
|
抽查页面：\n
|
|||
|
|
- 活动列表：`contest:create`、`contest:update`、`contest:delete`、`contest:publish`\n
|
|||
|
|
- 评委管理：`judge:create/read/update/delete`\n
|
|||
|
|
- 公告管理：`notice:create/update/delete`\n
|
|||
|
|
- 系统管理：`role:*`、`menu:*`、`dict:*`、`config:*`、`tenant:*`（平台超管）\n
|
|||
|
|
|
|||
|
|
期望：\n
|
|||
|
|
- **有权限**：按钮可见且可用\n
|
|||
|
|
- **无权限**：按钮不可见（或禁用，按业务约定）\n
|
|||
|
|
|
|||
|
|
### D. 接口鉴权（后端 @PreAuthorize）
|
|||
|
|
抽查接口：\n
|
|||
|
|
- 公告：`POST/PUT/DELETE /api/contests/notices...` 需 `notice:*`（兼容 `contest:notice:*`）\n
|
|||
|
|
- 评委：`POST/PUT/DELETE /api/contests/judges...` 需 `judge:*`（兼容 `contest:judge:*`）\n
|
|||
|
|
- 评分：`POST /api/contests/reviews/score` 需 `review:score`（兼容 `contest:review:score`）\n
|
|||
|
|
|
|||
|
|
期望：\n
|
|||
|
|
- **有权限**：200\n
|
|||
|
|
- **无权限**：403\n
|
|||
|
|
|
|||
|
|
## 常用排查
|
|||
|
|
- 执行只读审计：`docs/migration/rbac-audit.sql`\n
|
|||
|
|
- 角色无菜单授权（role_menu 为空）\n
|
|||
|
|
- 菜单 permission 在租户权限表缺失\n
|
|||
|
|
- 角色有菜单但缺少对应 permission 绑定\n
|
|||
|
|
|