refac: debt on role backend

test/roles_content_scope_support_test.go

@@ -0,0 +1,70 @@
+package test
+
+import (
+	"RenewCMS/api/pkg/access"
+	"RenewCMS/api/pkg/claims"
+	"RenewCMS/internal/domain/role"
+	"RenewCMS/internal/infrastructure/useCases"
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+)
+
+func grantRows(rows ...string) []role.Grant {
+	grants := make([]role.Grant, 0, len(rows))
+	for _, row := range rows {
+		key, scope, found := strings.Cut(row, "=")
+		if !found {
+			panic("grant row without a scope: " + row)
+		}
+		grants = append(grants, role.Grant{Key: key, Scope: role.Scope(scope)})
+	}
+	return grants
+}
+
+func unlockedGrantSet(rows ...string) role.GrantSet {
+	return role.Role{Grants: grantRows(rows...)}.GrantSet()
+}
+
+func requireMissingKey(t *testing.T, err error, key string) {
+	t.Helper()
+	if !errors.Is(err, role.ErrMissingPermission) || missingKeyOf(t, err) != key {
+		t.Fatalf("expected missing permission %q, got %v", key, err)
+	}
+}
+
+func readTestFile(t *testing.T, path string) string {
+	t.Helper()
+	content, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(content)
+}
+
+func ownerCaller(userID uint32) useCases.ContentCaller {
+	return useCases.ContentCaller{UserID: userID, Grants: role.BuiltInRoles()[0].GrantSet()}
+}
+
+func callerWith(userID uint32, rows ...string) useCases.ContentCaller {
+	return useCases.ContentCaller{UserID: userID, Grants: unlockedGrantSet(rows...)}
+}
+
+func contentAccess(getUser *useCases.GetUserUseCase) func(http.Handler) http.Handler {
+	adminGrants := role.BuiltInRoles()[1].GrantSet()
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			r = access.WithCurrentUser(r)
+			if userID, ok := claims.UserId(r); ok {
+				account, err := access.LoadUser(getUser, r, userID)
+				version, hasVersion := claims.TokenVersion(r)
+				if err == nil && account.IsVerified && (!hasVersion || version == account.TokenVersion) {
+					r = r.WithContext(access.WithCaller(r.Context(), access.Caller{UserID: userID, Grants: adminGrants}))
+				}
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}