Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sysopsandClaude Sonnet 5
|
383da92ca8 | ||
|
sysopsandClaude Sonnet 5
|
5915a4e7b1 |
@@ -1,4 +1,2 @@
|
||||
*.log
|
||||
.env
|
||||
web/*/node_modules/
|
||||
web/*/.next/
|
||||
|
||||
@@ -64,9 +64,6 @@ Keine Änderungen ermittelbar.
|
||||
## 2026-08-27 17:28 – 17:29 (1m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** code
|
||||
## 2026-08-28 21:44 – 21:44 (0m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** nexarch
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
@@ -130,72 +127,28 @@ Keine Commits in dieser Session.
|
||||
- internal/config/config.go | 29 +++++++++++++++++++++++++++++
|
||||
- internal/db/db.go | 11 +++++++++++
|
||||
- migrations/0001_tenant_registry.sql | 10 ++++++++++
|
||||
- web/shl/README.md | 45 +++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/__tests__/Dialog.test.tsx | 38 ++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/__tests__/tokens.test.ts | 39 +++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/components/Dialog.tsx | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/components/FormElements.tsx | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/components/Shell.tsx | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/components/Table.tsx | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/components/Toast.tsx | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/i18n/i18n.tsx | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/index.ts | 25 +++++++++++++++++++++++++
|
||||
- web/shl/package.json | 23 +++++++++++++++++++++++
|
||||
- web/shl/theme/ThemeProvider.tsx | 81 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/tokens/tokens.ts | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/shl/tsconfig.json | 18 ++++++++++++++++++
|
||||
|
||||
---
|
||||
## 2026-08-28 21:51 – 21:57 (5m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** nexarch
|
||||
|
||||
### Commits
|
||||
- 3c226da SHL-01: fix — vitest jsdom-environment + jest-dom-Setup (3 Dialog-Tests schlugen ohne DOM fehl)
|
||||
|
||||
### Geänderte Dateien
|
||||
- web/shl/package.json | 2 ++
|
||||
- web/shl/vitest.config.ts | 8 ++++++++
|
||||
- web/shl/vitest.setup.ts | 1 +
|
||||
|
||||
---
|
||||
## 2026-08-28 23:37 – 23:43 (5m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** nexarch
|
||||
|
||||
### Commits
|
||||
- fbcc9db RBAC-05: web/rbac-admin next.js-frontend (rollen+gruppen-verwaltung, audit-verlauf) auf shl-01
|
||||
- bd80f0c Merge branch 'feature/shl-01-ui-shell-design-system-zentral' into feature/rbac-05-rechte-administrationsoberflaeche
|
||||
- 051af43 RBAC-05: backend — handler.go (rollen-/gruppenverwaltung, selbst-eskalationsschutz), group.go ListGroups/Members
|
||||
- 9de9005 Merge branch 'feature/iam-02-login-session-jwt-grundgeruest' into feature/rbac-05-rechte-administrationsoberflaeche
|
||||
- 1b6a159 Merge branch 'feature/rbac-03-gruppen-abteilungen' into feature/rbac-05-rechte-administrationsoberflaeche
|
||||
|
||||
### Geänderte Dateien
|
||||
- web/rbac-admin/app/groups/page.tsx | 183 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/rbac-admin/app/layout.tsx | 30 ++++++++++++++++++++++++++++++
|
||||
- web/rbac-admin/app/page.tsx | 5 +++++
|
||||
- web/rbac-admin/app/roles/page.tsx | 142 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/rbac-admin/lib/api.ts | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/rbac-admin/next.config.mjs | 5 +++++
|
||||
- web/rbac-admin/package.json | 22 ++++++++++++++++++++++
|
||||
- web/rbac-admin/tsconfig.json | 21 +++++++++++++++++++++
|
||||
|
||||
---
|
||||
## 2026-08-28 23:44 – 23:44 (0m)
|
||||
## 2026-08-27 17:53 – 17:57 (4m)
|
||||
**Beschreibung:** Claude Code Session
|
||||
**Projekt:** code
|
||||
|
||||
### Commits
|
||||
Keine Commits in dieser Session.
|
||||
- e479330 IAM-01: benutzer-datenmodell-crud
|
||||
|
||||
### Geänderte Dateien
|
||||
- web/rbac-admin/app/groups/page.tsx | 183 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/rbac-admin/app/layout.tsx | 30 ++++++++++++++++++++++++++++++
|
||||
- web/rbac-admin/app/page.tsx | 5 +++++
|
||||
- web/rbac-admin/app/roles/page.tsx | 142 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/rbac-admin/lib/api.ts | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- web/rbac-admin/next.config.mjs | 5 +++++
|
||||
- web/rbac-admin/package.json | 22 ++++++++++++++++++++++
|
||||
- web/rbac-admin/tsconfig.json | 21 +++++++++++++++++++++
|
||||
- cmd/core/main.go | 11 ++++++++++-
|
||||
- go.mod | 9 +++++++++
|
||||
- go.sum | 28 ++++++++++++++++++++++++++++
|
||||
- internal/user/handler.go | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- internal/user/store_test.go | 173 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- internal/user/superadmin_store.go | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- internal/user/tenant_store.go | 128 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
- internal/user/user.go | 42 ++++++++++++++++++++++++++++++++++++++++++
|
||||
- internal/user/user_test.go | 24 ++++++++++++++++++++++++
|
||||
- migrations/0002_superadmins.down.sql | 1 +
|
||||
- migrations/0002_superadmins.up.sql | 14 ++++++++++++++
|
||||
- migrations/tenant/0001_users.down.sql | 1 +
|
||||
- migrations/tenant/0001_users.up.sql | 16 ++++++++++++++++
|
||||
|
||||
---
|
||||
|
||||
@@ -34,6 +34,8 @@ func main() {
|
||||
registry := tenant.NewRegistry(registryPool)
|
||||
provisioner := tenant.NewProvisioner(adminPool, registry, cfg.TenantDSNTemplate)
|
||||
tenantHandler := tenant.NewHandler(provisioner)
|
||||
onboardingService := tenant.NewOnboardingService(provisioner, cfg.TenantSchemaPath)
|
||||
onboardingHandler := tenant.NewOnboardingHandler(onboardingService)
|
||||
|
||||
// Superadmin-Konten leben mandantenuebergreifend in der Registry-DB.
|
||||
// Tenant-User-CRUD (user.TenantUserStore) braucht Connection-Routing pro
|
||||
@@ -48,6 +50,7 @@ func main() {
|
||||
})
|
||||
// Vorlaeufige Pfade ohne Versionierung/Auth — werden mit API-01/IAM-02 abgeloest.
|
||||
mux.HandleFunc("/internal/tenants", tenantHandler.CreateTenant)
|
||||
mux.HandleFunc("/internal/tenants/onboard", onboardingHandler.Onboard)
|
||||
mux.HandleFunc("/internal/superadmins", userHandler.CreateSuperadmin)
|
||||
|
||||
log.Printf("nexarch-core listening on %s", cfg.ListenAddr)
|
||||
|
||||
@@ -1,68 +0,0 @@
|
||||
# QA-03 – Prüfprotokoll: Prüfgate Rechte & Policy
|
||||
|
||||
Stand: 2026-08-29. Branch `feature/qa-03-pruefgate-rechte-policy` (RBAC-05 + RBAC-04 gemergt).
|
||||
|
||||
## 1. Akzeptanzkriterien RBAC-01 bis RBAC-05 — Testabdeckung
|
||||
|
||||
| Ticket | Titel | Abdeckende Tests |
|
||||
|---|---|---|
|
||||
| RBAC-01 | Rollenmodell & Grundrechte | `internal/rbac/role_test.go`: `TestEffectivePermissions_Inheritance`, `TestHasPermission` |
|
||||
| RBAC-01 | Rollenzuweisung | `internal/rbac/store_test.go`: `TestStore_AssignAndGet`, `TestStore_RejectsSuperadminOutsideAllowedMatrix`, `TestStore_RejectsUnknownRole`, `TestStore_HistoryTracksWhoAndWhen` |
|
||||
| RBAC-02 | Policy-Enforcement-Schicht (zentral) | `internal/policy` — kein eigenes `*_test.go` in diesem Merge gefunden für `enforcer.go`/`store.go` direkt (siehe Abweichungen unten); Verhalten indirekt über `TestBypass_PolicyEnforcerItselfRespectsRevocation` (dieser Branch) nachgewiesen |
|
||||
| RBAC-03 | Gruppen & Abteilungen | `internal/rbac/group_test.go`: `TestGroup_CreateAndAddMember`, `TestGroup_RoleAffectsAllCurrentMembers`, `TestGroup_RemoveMemberRevokesRightsImmediately`, `TestGroup_DeleteGroupRevokesRightsWithoutDeletingUser`, `TestGroup_TenantIsolation` |
|
||||
| RBAC-04 | Modul-scoped Berechtigungen | `internal/policy/module_scope_test.go`: `TestAuthorizeForTenant_DeniesWhenModuleNotActivated`, `TestAuthorizeForTenant_BecomesActiveWithoutRestart`, `TestAuthorizeForTenant_CombinationsOfRoleAndModuleScope` |
|
||||
| RBAC-05 | Rechte-Administrationsoberfläche | `internal/rbac/handler_test.go`: `TestListRoles`, `TestAssignRole_RejectsSelfEscalation`, `TestAssignRole_AdminCanPromoteOtherUser`, `TestAssignRole_AdminCanDemoteOtherUser` (neu, dieser Branch), `TestRoleHistory_TracksAssignments`, `TestGroupWorkflow`, `TestRequireManageUsers_RejectsPlainUser` |
|
||||
|
||||
**Ergebnis Abschnitt 1:** alle 5 Tickets haben automatisierte Tests, die ihre dokumentierten Akzeptanzkriterien abdecken. RBAC-02 selbst hat keine eigene Testdatei im gemergten Stand — abgedeckt nur indirekt über den in diesem Branch neu geschriebenen `TestBypass_PolicyEnforcerItselfRespectsRevocation`. Als Abweichung festgehalten (Abschnitt 4).
|
||||
|
||||
## 2. Umgehungsversuch der zentralen Policy-Schicht (Akzeptanzkriterium 2 / Prüfung 1)
|
||||
|
||||
Getestet in `internal/rbac/bypass_test.go`:
|
||||
|
||||
- **`TestBypass_NoDirectWriteAPIOutsideStore`**: bestanden. `role_assignments` hat keine Schreib-API außerhalb von `Store.Assign` — Umgehungsversuch scheitert strukturell (Typsystem, kein exportierter DB-Pool).
|
||||
- **`TestBypass_PolicyEnforcerItselfRespectsRevocation`**: bestanden. RBAC-02s eigentliche Policy-Tabelle (`policy_rules`) reagiert sofort auf `Revoke` — kein Cache, keine verzögerte Wirkung.
|
||||
- **`TestBypass_HandlerIgnoresCentralPolicyRevocation`**: **deckt einen echten Fund auf**, siehe Abschnitt 4.
|
||||
|
||||
## 3. Rollenwechsel-Szenario (Akzeptanzkriterium 2 / Prüfung 2)
|
||||
|
||||
- Hochstufung (user → tenant_admin): `TestAssignRole_AdminCanPromoteOtherUser` — bestanden.
|
||||
- Rückstufung (tenant_admin → user): `TestAssignRole_AdminCanDemoteOtherUser` (neu, dieser Branch) — bestanden, inklusive Prüfung, dass `role_assignment_history` beide Richtungen (erst `tenant_admin`, dann `user`) korrekt in chronologischer Reihenfolge festhält.
|
||||
- Selbst-Eskalation bleibt weiterhin gesperrt (`TestAssignRole_RejectsSelfEscalation`, aus RBAC-05).
|
||||
|
||||
**Ergebnis Abschnitt 3:** bestanden, beide Richtungen automatisiert nachgewiesen.
|
||||
|
||||
## 4. Abweichungen (Akzeptanzkriterium 3: nicht stillschweigend ignoriert)
|
||||
|
||||
### 4.1 RBAC-05-Handler prüfen nicht gegen die zentrale Policy-Schicht (RBAC-02) — Schweregrad: Mittel
|
||||
|
||||
**Fund:** `internal/rbac/handler.go` (`requireManageUsers`) entscheidet Zugriff über `HasPermission(role, PermManageUsers)` — die **statische**, hartcodierte Rollenhierarchie aus `role.go`. Es ruft nirgends `internal/policy.Enforcer.Authorize`/`Guard` auf, die eigentliche zentrale, DB-gestützte Durchsetzungsschicht aus RBAC-02 (`policy_rules`-Tabelle, per `Store.Grant`/`Revoke` administrierbar, versioniert in `policy_rule_changes`).
|
||||
|
||||
**Konsequenz:** ein Administrator, der über die RBAC-02-Policy-Schicht das Recht `tenant.manage_users` von `tenant_admin` entzieht (`policy.Store.Revoke`), sperrt die RBAC-05-Endpunkte **nicht** aus — sie fragen `policy_rules` nie ab. Zwei parallele Enforcement-Pfade statt einer zentralen Schicht, verletzt die Ticket-Produkt-DNA "Rechte werden zentral entschieden, nicht in jedem Handler neu erfunden" (RBAC-05-Ticket) UND RBAC-02s eigenen Anspruch ("keine Tenant- oder Rechteprüfung verstreut in einzelnen Handlern").
|
||||
|
||||
**Nachweis:** `TestBypass_HandlerIgnoresCentralPolicyRevocation` in `internal/rbac/bypass_test.go`.
|
||||
|
||||
**Nicht in dieser Kachel behoben** (QA-03-Arbeitsweise: kein Umbau angrenzender Bereiche, RBAC-05 ist nicht Vorbedingung von QA-03) — Empfehlung: eigenes Folgeticket, das `requireManageUsers` auf `internal/policy.Guard`/`Enforcer.Authorize` umstellt.
|
||||
|
||||
### 4.2 RBAC-02 hat keine eigene Testdatei im gemergten Stand — Schweregrad: Niedrig
|
||||
|
||||
`internal/policy/enforcer.go` und `store.go` (RBAC-02 selbst) haben keine `enforcer_test.go`/`store_test.go` im Merge-Ergebnis dieses Branches — nur `module_scope_test.go` (RBAC-04) prüft sie indirekt über `AuthorizeForTenant`. Die in diesem Branch neu geschriebenen Bypass-Tests schließen die Lücke teilweise, ersetzen aber keine dedizierten RBAC-02-Unit-Tests. Empfehlung: bei Gelegenheit nachziehen, kein blockierender Fund.
|
||||
|
||||
## 5. RBAC-04-Zusammenspiel mit Lizenz-/Flag-Zustand (Akzeptanzkriterium 3)
|
||||
|
||||
`internal/flag` (aus RBAC-04-Merge) ist vorhanden. `internal/policy.Enforcer.AuthorizeForTenant` verknüpft eine Policy-Regel optional mit einem `flag.Service`-Eintrag (`ModuleScope.FlagKey`): eine sonst erlaubte Regel greift nicht, wenn das zugehörige Modul für den Tenant nicht aktiviert ist. `TestAuthorizeForTenant_DeniesWhenModuleNotActivated` und `TestAuthorizeForTenant_BecomesActiveWithoutRestart` beweisen das bereits (aus RBAC-04, unverändert übernommen).
|
||||
|
||||
**Ergebnis Abschnitt 5:** bestanden, Zusammenspiel vorhanden und getestet.
|
||||
|
||||
## 6. Gesamtergebnis
|
||||
|
||||
Bestanden mit einem dokumentierten Mittel-Schweregrad-Fund (4.1) und einem Niedrig-Schweregrad-Hinweis (4.2). Build-/Test-Ergebnis auf dem Testhost: siehe Abschnitt 7.
|
||||
|
||||
## 7. Build/Test-Ergebnis auf 131
|
||||
|
||||
Durchgeführt 2026-08-29 auf root@192.168.1.131 (`/root/nexarch-code-qa03`, isolierter Sync, kein Konflikt mit parallelem QA-02-Testlauf):
|
||||
|
||||
- `go mod tidy`, `go build ./...`, `go vet ./...` — alle sauber, keine Fehler.
|
||||
- `go test ./... -v -p 1` gegen frisch zurückgesetzte Testumgebung — **alle 30 Tests grün**, über alle betroffenen Pakete (`internal/auth`, `internal/policy`, `internal/rbac`, `internal/tenant`, `internal/user`), inklusive `TestBypass_HandlerIgnoresCentralPolicyRevocation` (bestätigt den Fund aus Abschnitt 4.1 als reproduzierbar, nicht nur behauptet) und `TestAssignRole_AdminCanDemoteOtherUser` (neuer Rückstufungs-Test aus Abschnitt 3).
|
||||
- Keine Regressionen in RBAC-01/02/03/04/05 durch den Merge.
|
||||
|
||||
**QA-03 Gesamtergebnis: bestanden**, mit einem dokumentierten Mittel-Schweregrad-Fund (4.1, Empfehlung: Folgeticket) und einem Niedrig-Schweregrad-Hinweis (4.2).
|
||||
@@ -2,16 +2,13 @@ module gitea.perlbach24.de/scripte/nexarch
|
||||
|
||||
go 1.22
|
||||
|
||||
require (
|
||||
github.com/golang-jwt/jwt/v5 v5.3.1
|
||||
github.com/jackc/pgx/v5 v5.6.0
|
||||
golang.org/x/crypto v0.17.0
|
||||
)
|
||||
require github.com/jackc/pgx/v5 v5.6.0
|
||||
|
||||
require (
|
||||
github.com/jackc/pgpassfile v1.0.0 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
|
||||
github.com/jackc/puddle/v2 v2.2.1 // indirect
|
||||
golang.org/x/crypto v0.17.0 // indirect
|
||||
golang.org/x/sync v0.1.0 // indirect
|
||||
golang.org/x/text v0.14.0 // indirect
|
||||
)
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
|
||||
github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
|
||||
github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
|
||||
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
|
||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
|
||||
|
||||
@@ -1,67 +0,0 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Handler stellt Login/Logout als HTTP-Endpunkte bereit. Registrierung,
|
||||
// Passwort-Reset, 2FA, SSO/LDAP und Rate-Limiting sind ausdruecklich nicht
|
||||
// Teil dieser Kachel (siehe IAM-03..07).
|
||||
type Handler struct {
|
||||
login *LoginService
|
||||
}
|
||||
|
||||
func NewHandler(login *LoginService) *Handler {
|
||||
return &Handler{login: login}
|
||||
}
|
||||
|
||||
type loginRequest struct {
|
||||
Email string `json:"email"`
|
||||
Password string `json:"password"`
|
||||
}
|
||||
|
||||
func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
|
||||
var req loginRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
token, err := h.login.Login(r.Context(), req.Email, req.Password)
|
||||
if err != nil {
|
||||
http.Error(w, ErrInvalidCredentials.Error(), http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: CookieName,
|
||||
Value: token,
|
||||
Path: "/",
|
||||
HttpOnly: true,
|
||||
Secure: true,
|
||||
SameSite: http.SameSiteStrictMode,
|
||||
MaxAge: int(AccessTokenTTL.Seconds()),
|
||||
})
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}
|
||||
|
||||
// Logout loescht das Session-Cookie. Da JWT hier bewusst zustandslos bleibt
|
||||
// (kein serverseitiger Blocklist-Speicher — das waere ueber "Grundgerüst"
|
||||
// hinaus und widerspraeche der projektweiten zustandslosen-JWT-Entscheidung),
|
||||
// bleibt ein bereits ausgestelltes Token bis zu seinem Ablauf technisch
|
||||
// gueltig, wenn es separat vom Cookie extrahiert und wiederverwendet wird.
|
||||
func (h *Handler) Logout(w http.ResponseWriter, r *http.Request) {
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: CookieName,
|
||||
Value: "",
|
||||
Path: "/",
|
||||
HttpOnly: true,
|
||||
Secure: true,
|
||||
SameSite: http.SameSiteStrictMode,
|
||||
MaxAge: -1,
|
||||
Expires: time.Unix(0, 0),
|
||||
})
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
var ErrInvalidCredentials = errors.New("auth: E-Mail oder Passwort falsch")
|
||||
|
||||
// LoginService arbeitet gegen GENAU EINE Tenant-Datenbank (uebergeben ueber
|
||||
// den TenantUserStore-Pool) — das Login ist damit strukturell auf den
|
||||
// richtigen Tenant gescopt, siehe user.TenantUserStore.GetByEmailForAuth.
|
||||
type LoginService struct {
|
||||
users *user.TenantUserStore
|
||||
issuer *TokenIssuer
|
||||
// tenantSlug identifiziert im ausgestellten Token, gegen welchen Mandanten
|
||||
// eingeloggt wurde (fuer nachgelagerte Pruefungen, z.B. Middleware-Logs).
|
||||
tenantSlug string
|
||||
}
|
||||
|
||||
func NewLoginService(users *user.TenantUserStore, issuer *TokenIssuer, tenantSlug string) *LoginService {
|
||||
return &LoginService{users: users, issuer: issuer, tenantSlug: tenantSlug}
|
||||
}
|
||||
|
||||
// Login liefert bei falscher E-Mail UND bei falschem Passwort denselben
|
||||
// Fehler (ErrInvalidCredentials), um keine Rueckschluesse auf die Existenz
|
||||
// eines Kontos zuzulassen (User-Enumeration-Schutz).
|
||||
func (s *LoginService) Login(ctx context.Context, email, password string) (string, error) {
|
||||
creds, err := s.users.GetByEmailForAuth(ctx, email)
|
||||
if err != nil {
|
||||
// Trotzdem einen bcrypt-Vergleich gegen einen Dummy-Hash ausfuehren,
|
||||
// damit die Antwortzeit bei unbekannter E-Mail nicht messbar kuerzer
|
||||
// ist als bei falschem Passwort (Timing-Seitenkanal).
|
||||
VerifyPassword(dummyHash, password)
|
||||
return "", ErrInvalidCredentials
|
||||
}
|
||||
|
||||
if creds.User.Status != user.StatusActive {
|
||||
return "", ErrInvalidCredentials
|
||||
}
|
||||
|
||||
if !VerifyPassword(creds.PasswordHash, password) {
|
||||
return "", ErrInvalidCredentials
|
||||
}
|
||||
|
||||
return s.issuer.Issue(creds.User.ID, s.tenantSlug)
|
||||
}
|
||||
|
||||
// dummyHash ist ein echter bcrypt-Hash (Kostenfaktor BcryptCost) eines
|
||||
// beliebigen Platzhalter-Klartexts — bewusst KEIN kaputtes Format, da
|
||||
// bcrypt.CompareHashAndPassword bei ungueltigem Hash sofort ohne den
|
||||
// eigentlichen Kostenfaktor-Vergleich zurueckkehrt und die
|
||||
// Timing-Angleichung damit wirkungslos waere.
|
||||
const dummyHash = "$2a$12$cmwiETrG9DK5/uTM2fg4uetngYUspKjME5P8fNpk0QYTaO64N0r3C"
|
||||
@@ -1,177 +0,0 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
const usersSchema = `
|
||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
||||
CREATE TABLE users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
password_hash TEXT NOT NULL DEFAULT '',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);`
|
||||
|
||||
func setupTenantDB(t *testing.T, dbName string) *pgxpool.Pool {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("admin pool: %v", err)
|
||||
}
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
if _, err := adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
||||
t.Fatalf("testdatenbank anlegen: %v", err)
|
||||
}
|
||||
|
||||
dsn := strings.Replace(adminDSN, "/postgres?", "/"+dbName+"?", 1)
|
||||
pool, err := pgxpool.New(ctx, dsn)
|
||||
if err != nil {
|
||||
t.Fatalf("connect testdatenbank: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, usersSchema); err != nil {
|
||||
t.Fatalf("schema anwenden: %v", err)
|
||||
}
|
||||
|
||||
t.Cleanup(func() {
|
||||
pool.Close()
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
adminPool.Close()
|
||||
})
|
||||
return pool
|
||||
}
|
||||
|
||||
func createUserWithPassword(t *testing.T, store *user.TenantUserStore, email, password string) user.User {
|
||||
t.Helper()
|
||||
ctx := context.Background()
|
||||
u, err := store.Create(ctx, email, "Test User")
|
||||
if err != nil {
|
||||
t.Fatalf("create user: %v", err)
|
||||
}
|
||||
hash, err := HashPassword(password)
|
||||
if err != nil {
|
||||
t.Fatalf("hash password: %v", err)
|
||||
}
|
||||
if err := store.SetPasswordHash(ctx, u.ID, hash); err != nil {
|
||||
t.Fatalf("set password: %v", err)
|
||||
}
|
||||
return u
|
||||
}
|
||||
|
||||
func TestLoginService_SuccessAndWrongPassword(t *testing.T) {
|
||||
pool := setupTenantDB(t, "test_iam02_login")
|
||||
store := user.NewTenantUserStore(pool)
|
||||
createUserWithPassword(t, store, "alice@example.com", "korrektes-passwort")
|
||||
|
||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
||||
login := NewLoginService(store, issuer, "acme")
|
||||
|
||||
token, err := login.Login(context.Background(), "alice@example.com", "korrektes-passwort")
|
||||
if err != nil {
|
||||
t.Fatalf("login: %v", err)
|
||||
}
|
||||
if token == "" {
|
||||
t.Fatal("erwartet nicht-leeres token")
|
||||
}
|
||||
|
||||
if _, err := login.Login(context.Background(), "alice@example.com", "falsches-passwort"); !errors.Is(err, ErrInvalidCredentials) {
|
||||
t.Fatalf("erwartet ErrInvalidCredentials, habe %v", err)
|
||||
}
|
||||
|
||||
if _, err := login.Login(context.Background(), "unbekannt@example.com", "irgendwas"); !errors.Is(err, ErrInvalidCredentials) {
|
||||
t.Fatalf("erwartet ErrInvalidCredentials bei unbekannter email, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Pruefung 1: kein Cross-Tenant-Login moeglich, obwohl dieselbe E-Mail in
|
||||
// zwei unterschiedlichen Tenant-Datenbanken mit unterschiedlichen Passwoertern
|
||||
// existiert.
|
||||
func TestLoginService_NoCrossTenantLogin(t *testing.T) {
|
||||
poolA := setupTenantDB(t, "test_iam02_tenant_a")
|
||||
poolB := setupTenantDB(t, "test_iam02_tenant_b")
|
||||
|
||||
storeA := user.NewTenantUserStore(poolA)
|
||||
storeB := user.NewTenantUserStore(poolB)
|
||||
createUserWithPassword(t, storeA, "shared@example.com", "passwort-tenant-a")
|
||||
createUserWithPassword(t, storeB, "shared@example.com", "passwort-tenant-b")
|
||||
|
||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
||||
loginA := NewLoginService(storeA, issuer, "tenant-a")
|
||||
|
||||
// Login gegen Tenant A mit dem Passwort von Tenant B darf nicht klappen,
|
||||
// obwohl die E-Mail-Adresse identisch ist — die Store-Instanz kennt
|
||||
// strukturell nur die Zeilen ihrer eigenen Datenbank.
|
||||
if _, err := loginA.Login(context.Background(), "shared@example.com", "passwort-tenant-b"); !errors.Is(err, ErrInvalidCredentials) {
|
||||
t.Fatalf("erwartet ErrInvalidCredentials fuer fremdes tenant-passwort, habe %v", err)
|
||||
}
|
||||
|
||||
token, err := loginA.Login(context.Background(), "shared@example.com", "passwort-tenant-a")
|
||||
if err != nil {
|
||||
t.Fatalf("login gegen eigenen tenant sollte klappen: %v", err)
|
||||
}
|
||||
claims, err := issuer.Verify(token)
|
||||
if err != nil {
|
||||
t.Fatalf("verify: %v", err)
|
||||
}
|
||||
if claims.TenantSlug != "tenant-a" {
|
||||
t.Fatalf("token tenant = %q, want tenant-a", claims.TenantSlug)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3: geschuetzte Route ohne gueltige Session nicht erreichbar.
|
||||
func TestRequireAuth_BlocksWithoutValidCookie(t *testing.T) {
|
||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
||||
protected := RequireAuth(issuer, func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
})
|
||||
|
||||
// Kein Cookie.
|
||||
req := httptest.NewRequest(http.MethodGet, "/geschuetzt", nil)
|
||||
rec := httptest.NewRecorder()
|
||||
protected(rec, req)
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("ohne cookie: status = %d, want 401", rec.Code)
|
||||
}
|
||||
|
||||
// Manipuliertes Cookie.
|
||||
req = httptest.NewRequest(http.MethodGet, "/geschuetzt", nil)
|
||||
req.AddCookie(&http.Cookie{Name: CookieName, Value: "kaputt.token.hier"})
|
||||
rec = httptest.NewRecorder()
|
||||
protected(rec, req)
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("mit kaputtem cookie: status = %d, want 401", rec.Code)
|
||||
}
|
||||
|
||||
// Gueltiges Token.
|
||||
token, err := issuer.Issue("user-1", "acme")
|
||||
if err != nil {
|
||||
t.Fatalf("issue: %v", err)
|
||||
}
|
||||
req = httptest.NewRequest(http.MethodGet, "/geschuetzt", nil)
|
||||
req.AddCookie(&http.Cookie{Name: CookieName, Value: token})
|
||||
rec = httptest.NewRecorder()
|
||||
protected(rec, req)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("mit gueltigem cookie: status = %d, want 200", rec.Code)
|
||||
}
|
||||
}
|
||||
@@ -1,41 +0,0 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
const CookieName = "nexarch_session"
|
||||
|
||||
type contextKey int
|
||||
|
||||
const claimsContextKey contextKey = iota
|
||||
|
||||
// RequireAuth schuetzt eine Route: ohne gueltiges, nicht abgelaufenes Token
|
||||
// im Session-Cookie wird 401 zurueckgegeben und der Handler nicht aufgerufen
|
||||
// (IAM-02 Akzeptanzkriterium 3).
|
||||
func RequireAuth(issuer *TokenIssuer, next http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
cookie, err := r.Cookie(CookieName)
|
||||
if err != nil {
|
||||
http.Error(w, "nicht angemeldet", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
claims, err := issuer.Verify(cookie.Value)
|
||||
if err != nil {
|
||||
http.Error(w, "nicht angemeldet", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
ctx := context.WithValue(r.Context(), claimsContextKey, claims)
|
||||
next(w, r.WithContext(ctx))
|
||||
}
|
||||
}
|
||||
|
||||
// ClaimsFromContext liest die Claims, die RequireAuth in den Request-Context
|
||||
// gelegt hat.
|
||||
func ClaimsFromContext(ctx context.Context) (*Claims, bool) {
|
||||
c, ok := ctx.Value(claimsContextKey).(*Claims)
|
||||
return c, ok
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
// Package auth implementiert Core IAM-02: Login/Logout, Passwort-Hashing und
|
||||
// die Middleware zum Schutz von Routen. Autorisierung (was ein Benutzer darf)
|
||||
// ist ausdruecklich NICHT Teil dieses Pakets, siehe RBAC-01 — auth prueft nur
|
||||
// "wer bin ich" (Casbin-Architekturprinzip, siehe IAM-02-Ticket).
|
||||
package auth
|
||||
|
||||
import "golang.org/x/crypto/bcrypt"
|
||||
|
||||
// BcryptCost ist bewusst explizit festgelegt statt bcrypt.DefaultCost (10)
|
||||
// unreflektiert zu uebernehmen (IAM-02 Akzeptanzkriterium 4). Kostenfaktor 12
|
||||
// wurde gegen die Ziel-Login-Latenz benchmarkt, siehe password_bench_test.go
|
||||
// und den Pruefungs-Eintrag in der Commit-Nachricht.
|
||||
const BcryptCost = 12
|
||||
|
||||
func HashPassword(plain string) (string, error) {
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(plain), BcryptCost)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return string(hash), nil
|
||||
}
|
||||
|
||||
// VerifyPassword ist timing-safe: bcrypt.CompareHashAndPassword vergleicht
|
||||
// konstant in der Zeit bzgl. des Hash-Inhalts (Referenzimplementierung fuer
|
||||
// die projektweite Timing-safe-Vergleich-Konvention aus IAM-02).
|
||||
func VerifyPassword(hash, plain string) bool {
|
||||
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain)) == nil
|
||||
}
|
||||
@@ -1,42 +0,0 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// TargetLoginLatency ist der Zielwert aus IAM-02 Akzeptanzkriterium 4: der
|
||||
// bcrypt-Vergleich allein darf die Login-Latenz nicht dominieren. 400ms ist
|
||||
// grosszuegig genug, um auf unterschiedlicher Hardware stabil zu sein, aber
|
||||
// eng genug, um eine versehentliche Kostenfaktor-Explosion (z.B. 16 statt 12)
|
||||
// zuverlaessig aufzudecken.
|
||||
const TargetLoginLatency = 400 * time.Millisecond
|
||||
|
||||
// TestBcryptCostAgainstLatencyTarget misst die tatsaechliche Dauer eines
|
||||
// Passwort-Vergleichs mit dem festgelegten BcryptCost und dokumentiert das
|
||||
// Ergebnis (IAM-02 Pruefung 4).
|
||||
func TestBcryptCostAgainstLatencyTarget(t *testing.T) {
|
||||
hash, err := HashPassword("benchmark-passwort")
|
||||
if err != nil {
|
||||
t.Fatalf("hash: %v", err)
|
||||
}
|
||||
|
||||
start := time.Now()
|
||||
if !VerifyPassword(hash, "benchmark-passwort") {
|
||||
t.Fatal("verifikation haette erfolgreich sein muessen")
|
||||
}
|
||||
elapsed := time.Since(start)
|
||||
|
||||
t.Logf("bcrypt-vergleich mit cost=%d dauerte %s (ziel: unter %s)", BcryptCost, elapsed, TargetLoginLatency)
|
||||
if elapsed > TargetLoginLatency {
|
||||
t.Fatalf("bcrypt-vergleich zu langsam: %s > ziel %s", elapsed, TargetLoginLatency)
|
||||
}
|
||||
}
|
||||
|
||||
func BenchmarkVerifyPassword(b *testing.B) {
|
||||
hash, _ := HashPassword("benchmark-passwort")
|
||||
b.ResetTimer()
|
||||
for i := 0; i < b.N; i++ {
|
||||
VerifyPassword(hash, "benchmark-passwort")
|
||||
}
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
package auth
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestHashAndVerifyPassword(t *testing.T) {
|
||||
hash, err := HashPassword("s3hr-geheim!")
|
||||
if err != nil {
|
||||
t.Fatalf("hash: %v", err)
|
||||
}
|
||||
if hash == "s3hr-geheim!" {
|
||||
t.Fatal("passwort wurde nicht gehasht")
|
||||
}
|
||||
if !VerifyPassword(hash, "s3hr-geheim!") {
|
||||
t.Fatal("erwartet erfolgreiche verifikation")
|
||||
}
|
||||
if VerifyPassword(hash, "falsches-passwort") {
|
||||
t.Fatal("erwartet fehlgeschlagene verifikation")
|
||||
}
|
||||
}
|
||||
|
||||
func TestDummyHashIsValidBcryptHash(t *testing.T) {
|
||||
// Stellt sicher, dass der Timing-Angleichs-Hash in login.go tatsaechlich
|
||||
// ein gueltiges bcrypt-Format hat und den vollen Kostenfaktor durchlaeuft
|
||||
// (siehe Kommentar dort) statt sofort mit einem Format-Fehler abzubrechen.
|
||||
if VerifyPassword(dummyHash, "irgendein-text") {
|
||||
t.Fatal("dummyHash sollte fuer beliebigen text nicht passen")
|
||||
}
|
||||
}
|
||||
@@ -1,63 +0,0 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
// AccessTokenTTL ist bewusst kurz gehalten (Session-Ablauf statt langlebiger
|
||||
// Tokens), passend zur "so vertrauenswuerdig wie noetig"-Produkt-DNA.
|
||||
const AccessTokenTTL = 30 * time.Minute
|
||||
|
||||
var ErrInvalidToken = errors.New("auth: ungueltiges oder abgelaufenes token")
|
||||
|
||||
type Claims struct {
|
||||
UserID string `json:"uid"`
|
||||
TenantSlug string `json:"tenant"`
|
||||
jwt.RegisteredClaims
|
||||
}
|
||||
|
||||
// TokenIssuer signiert/verifiziert JWTs mit einem HMAC-Secret. Das
|
||||
// asymmetrische Core-weite Signaturschema (API-05, kid-Rotation) ist
|
||||
// ausdruecklich nicht Teil dieser Kachel — hier geht es nur um das
|
||||
// Login-Grundgerüst innerhalb eines einzelnen Core-Prozesses.
|
||||
type TokenIssuer struct {
|
||||
secret []byte
|
||||
}
|
||||
|
||||
func NewTokenIssuer(secret string) *TokenIssuer {
|
||||
return &TokenIssuer{secret: []byte(secret)}
|
||||
}
|
||||
|
||||
func (i *TokenIssuer) Issue(userID, tenantSlug string) (string, error) {
|
||||
now := time.Now()
|
||||
claims := Claims{
|
||||
UserID: userID,
|
||||
TenantSlug: tenantSlug,
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
IssuedAt: jwt.NewNumericDate(now),
|
||||
ExpiresAt: jwt.NewNumericDate(now.Add(AccessTokenTTL)),
|
||||
},
|
||||
}
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
||||
return token.SignedString(i.secret)
|
||||
}
|
||||
|
||||
// Verify prueft Signatur UND Ablauf (jwt.ParseWithClaims lehnt abgelaufene
|
||||
// Tokens automatisch ab) — der Signaturvergleich in golang-jwt ist
|
||||
// timing-safe (hmac.Equal).
|
||||
func (i *TokenIssuer) Verify(tokenString string) (*Claims, error) {
|
||||
claims := &Claims{}
|
||||
token, err := jwt.ParseWithClaims(tokenString, claims, func(t *jwt.Token) (interface{}, error) {
|
||||
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
|
||||
return nil, ErrInvalidToken
|
||||
}
|
||||
return i.secret, nil
|
||||
})
|
||||
if err != nil || !token.Valid {
|
||||
return nil, ErrInvalidToken
|
||||
}
|
||||
return claims, nil
|
||||
}
|
||||
@@ -1,82 +0,0 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
func TestTokenIssueAndVerify(t *testing.T) {
|
||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
||||
|
||||
token, err := issuer.Issue("user-1", "acme")
|
||||
if err != nil {
|
||||
t.Fatalf("issue: %v", err)
|
||||
}
|
||||
|
||||
claims, err := issuer.Verify(token)
|
||||
if err != nil {
|
||||
t.Fatalf("verify: %v", err)
|
||||
}
|
||||
if claims.UserID != "user-1" || claims.TenantSlug != "acme" {
|
||||
t.Fatalf("claims unerwartet: %+v", claims)
|
||||
}
|
||||
}
|
||||
|
||||
// Pruefung 2: Token-Manipulationstest.
|
||||
func TestTokenVerify_RejectsManipulatedPayload(t *testing.T) {
|
||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
||||
token, err := issuer.Issue("user-1", "acme")
|
||||
if err != nil {
|
||||
t.Fatalf("issue: %v", err)
|
||||
}
|
||||
|
||||
parts := strings.Split(token, ".")
|
||||
if len(parts) != 3 {
|
||||
t.Fatalf("unerwartetes token-format: %d teile", len(parts))
|
||||
}
|
||||
// Payload-Segment leicht veraendern (Signatur passt danach nicht mehr).
|
||||
tampered := parts[0] + "." + parts[1] + "x" + "." + parts[2]
|
||||
|
||||
if _, err := issuer.Verify(tampered); err == nil {
|
||||
t.Fatal("erwartet fehler bei manipuliertem token, habe nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestTokenVerify_RejectsWrongSecret(t *testing.T) {
|
||||
issuer := NewTokenIssuer("secret-a")
|
||||
other := NewTokenIssuer("secret-b")
|
||||
|
||||
token, err := issuer.Issue("user-1", "acme")
|
||||
if err != nil {
|
||||
t.Fatalf("issue: %v", err)
|
||||
}
|
||||
if _, err := other.Verify(token); err == nil {
|
||||
t.Fatal("erwartet fehler bei falschem secret, habe nil")
|
||||
}
|
||||
}
|
||||
|
||||
// Pruefung 3: abgelaufenes Token erzwingt Neuanmeldung.
|
||||
func TestTokenVerify_RejectsExpiredToken(t *testing.T) {
|
||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
||||
|
||||
claims := Claims{
|
||||
UserID: "user-1",
|
||||
TenantSlug: "acme",
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
IssuedAt: jwt.NewNumericDate(time.Now().Add(-2 * AccessTokenTTL)),
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(-time.Minute)),
|
||||
},
|
||||
}
|
||||
tok := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
||||
expired, err := tok.SignedString([]byte("test-secret-nur-fuer-tests"))
|
||||
if err != nil {
|
||||
t.Fatalf("signieren: %v", err)
|
||||
}
|
||||
|
||||
if _, err := issuer.Verify(expired); err == nil {
|
||||
t.Fatal("erwartet fehler bei abgelaufenem token, habe nil")
|
||||
}
|
||||
}
|
||||
@@ -19,6 +19,9 @@ type Config struct {
|
||||
// TenantDSNTemplate enthaelt genau ein "%s" als Platzhalter fuer den
|
||||
// Datenbanknamen einer neu provisionierten Tenant-Datenbank.
|
||||
TenantDSNTemplate string
|
||||
// TenantSchemaPath zeigt auf migrations/tenant/0001_users.up.sql, mit der
|
||||
// TEN-02 eine frisch provisionierte Tenant-Datenbank initialisiert.
|
||||
TenantSchemaPath string
|
||||
}
|
||||
|
||||
func Load() (Config, error) {
|
||||
@@ -37,6 +40,11 @@ func Load() (Config, error) {
|
||||
return Config{}, fmt.Errorf("NEXARCH_TENANT_DSN_TEMPLATE not set")
|
||||
}
|
||||
|
||||
schemaPath := os.Getenv("NEXARCH_TENANT_SCHEMA_PATH")
|
||||
if schemaPath == "" {
|
||||
return Config{}, fmt.Errorf("NEXARCH_TENANT_SCHEMA_PATH not set")
|
||||
}
|
||||
|
||||
addr := os.Getenv("NEXARCH_LISTEN_ADDR")
|
||||
if addr == "" {
|
||||
addr = ":8080"
|
||||
@@ -47,5 +55,6 @@ func Load() (Config, error) {
|
||||
RegistryDSN: dsn,
|
||||
AdminDSN: adminDSN,
|
||||
TenantDSNTemplate: dsnTemplate,
|
||||
TenantSchemaPath: schemaPath,
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
// Package flag implementiert Core LIC-02: einen Feature-Flag-Dienst mit
|
||||
// Strategien (global an/aus, Prozentsatz, Tenant-Zielgruppe) als Kernfunktion
|
||||
// des Core-Dienstes selbst — keine zusaetzliche Infrastruktur (Unleash-Server
|
||||
// + eigene DB), siehe "bewusst vermeiden" im LIC-02-Ticket.
|
||||
package flag
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"hash/fnv"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
var ErrNotFound = errors.New("flag: nicht gefunden")
|
||||
|
||||
// Flag ist die zentrale Definition — Auswertung (Evaluate) ist bewusst davon
|
||||
// getrennt (Unleash-Prinzip: Flag-Verwaltung vs. Flag-Auswertung).
|
||||
type Flag struct {
|
||||
Key string
|
||||
Enabled bool
|
||||
RolloutPercentage int
|
||||
TargetTenantSlugs []string
|
||||
}
|
||||
|
||||
// Store ist die Verwaltungsseite (Admin): Flags definieren/lesen.
|
||||
type Store struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewStore(pool *pgxpool.Pool) *Store {
|
||||
return &Store{pool: pool}
|
||||
}
|
||||
|
||||
func (s *Store) Set(ctx context.Context, f Flag) error {
|
||||
if f.TargetTenantSlugs == nil {
|
||||
f.TargetTenantSlugs = []string{} // pgx uebertraegt ein nil-Slice sonst als SQL NULL statt leerem Array.
|
||||
}
|
||||
_, err := s.pool.Exec(ctx, `
|
||||
INSERT INTO feature_flags (key, enabled, rollout_percentage, target_tenant_slugs, updated_at)
|
||||
VALUES ($1, $2, $3, $4, now())
|
||||
ON CONFLICT (key) DO UPDATE SET
|
||||
enabled = $2, rollout_percentage = $3, target_tenant_slugs = $4, updated_at = now()
|
||||
`, f.Key, f.Enabled, f.RolloutPercentage, f.TargetTenantSlugs)
|
||||
if err != nil {
|
||||
return fmt.Errorf("flag speichern: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *Store) Get(ctx context.Context, key string) (Flag, error) {
|
||||
var f Flag
|
||||
row := s.pool.QueryRow(ctx, `
|
||||
SELECT key, enabled, rollout_percentage, target_tenant_slugs
|
||||
FROM feature_flags WHERE key = $1
|
||||
`, key)
|
||||
if err := row.Scan(&f.Key, &f.Enabled, &f.RolloutPercentage, &f.TargetTenantSlugs); err != nil {
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return Flag{}, ErrNotFound
|
||||
}
|
||||
return Flag{}, fmt.Errorf("flag lesen: %w", err)
|
||||
}
|
||||
return f, nil
|
||||
}
|
||||
|
||||
// evaluate wendet die Strategien in fester Reihenfolge an: globaler
|
||||
// An/Aus-Schalter zuerst, dann Tenant-Zielgruppe, dann Prozentsatz-Rollout.
|
||||
// Ein unbekannter/nicht getroffener Fall ergibt false — Fail-Safe-Default,
|
||||
// kein Feature wird versehentlich aktiv.
|
||||
func evaluate(f Flag, tenantSlug string) bool {
|
||||
if f.Enabled {
|
||||
return true
|
||||
}
|
||||
for _, target := range f.TargetTenantSlugs {
|
||||
if target == tenantSlug {
|
||||
return true
|
||||
}
|
||||
}
|
||||
if f.RolloutPercentage > 0 {
|
||||
h := fnv.New32a()
|
||||
_, _ = h.Write([]byte(f.Key + "|" + tenantSlug))
|
||||
return int(h.Sum32()%100) < f.RolloutPercentage
|
||||
}
|
||||
return false
|
||||
}
|
||||
@@ -1,87 +0,0 @@
|
||||
package flag
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// DefaultCacheTTL ist die dokumentierte Cache-Invalidierungszeit
|
||||
// (Akzeptanzkriterium 2/3): eine Aenderung wirkt spaetestens nach dieser
|
||||
// Zeit auf allen Core-Instanzen, ohne dass ein Dienst neu gestartet werden
|
||||
// muss (Akzeptanzkriterium 3).
|
||||
const DefaultCacheTTL = 5 * time.Second
|
||||
|
||||
type cacheEntry struct {
|
||||
flag Flag
|
||||
expiresAt time.Time
|
||||
}
|
||||
|
||||
// Service ist die Auswertungsseite (SDK/Client-Analogon zu Unleash) mit
|
||||
// lokalem TTL-Cache. Bewusst getrennt von Store (Verwaltung).
|
||||
type Service struct {
|
||||
store *Store
|
||||
ttl time.Duration
|
||||
|
||||
mu sync.RWMutex
|
||||
cache map[string]cacheEntry
|
||||
}
|
||||
|
||||
func NewService(store *Store, ttl time.Duration) *Service {
|
||||
if ttl <= 0 {
|
||||
ttl = DefaultCacheTTL
|
||||
}
|
||||
return &Service{store: store, ttl: ttl, cache: make(map[string]cacheEntry)}
|
||||
}
|
||||
|
||||
// IsEnabled wertet ein Flag fuer einen Tenant aus. Liefert IMMER einen
|
||||
// bool ohne Fehlerwert — ein nicht erreichbarer Flag-Dienst darf abhaengige
|
||||
// Aufrufer nicht zum Absturz bringen oder zu Fehlerbehandlungscode zwingen,
|
||||
// der leicht vergessen wird (Akzeptanzkriterium 3 / Pruefung 3: dokumentiertes
|
||||
// Fallback-Verhalten = false, ggf. aus dem zuletzt bekannten Zwischenspeicher).
|
||||
func (s *Service) IsEnabled(ctx context.Context, tenantSlug, key string) bool {
|
||||
f, ok := s.resolve(ctx, key)
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
return evaluate(f, tenantSlug)
|
||||
}
|
||||
|
||||
func (s *Service) resolve(ctx context.Context, key string) (Flag, bool) {
|
||||
s.mu.RLock()
|
||||
entry, exists := s.cache[key]
|
||||
fresh := exists && time.Now().Before(entry.expiresAt)
|
||||
s.mu.RUnlock()
|
||||
if fresh {
|
||||
return entry.flag, true
|
||||
}
|
||||
|
||||
f, err := s.store.Get(ctx, key)
|
||||
if err != nil {
|
||||
if exists {
|
||||
slog.Warn("feature-flag-dienst nicht erreichbar, nutze zwischengespeicherten stand",
|
||||
"flag_key", key, "error", err)
|
||||
return entry.flag, true
|
||||
}
|
||||
slog.Warn("feature-flag-dienst nicht erreichbar, kein zwischengespeicherter stand vorhanden, fallback: deaktiviert",
|
||||
"flag_key", key, "error", err)
|
||||
return Flag{}, false
|
||||
}
|
||||
|
||||
s.mu.Lock()
|
||||
s.cache[key] = cacheEntry{flag: f, expiresAt: time.Now().Add(s.ttl)}
|
||||
s.mu.Unlock()
|
||||
return f, true
|
||||
}
|
||||
|
||||
// Invalidate erzwingt beim naechsten IsEnabled-Aufruf ein sofortiges Neuladen
|
||||
// aus der Datenbank statt auf den TTL-Ablauf zu warten — wird nach Store.Set
|
||||
// auf derselben Instanz aufgerufen, damit der Schreiber die eigene Aenderung
|
||||
// ohne Wartezeit sieht. Andere Core-Instanzen sehen sie spaetestens nach
|
||||
// DefaultCacheTTL (siehe Akzeptanzkriterium 3).
|
||||
func (s *Service) Invalidate(key string) {
|
||||
s.mu.Lock()
|
||||
delete(s.cache, key)
|
||||
s.mu.Unlock()
|
||||
}
|
||||
@@ -1,67 +0,0 @@
|
||||
package policy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
||||
)
|
||||
|
||||
// ErrDenied wird geliefert, wenn keine Regel role+permission erlaubt —
|
||||
// Default-Deny (Akzeptanzkriterium 2).
|
||||
var ErrDenied = errors.New("policy: zugriff verweigert")
|
||||
|
||||
// Enforcer ist die EINE zentrale Entscheidungs- und Durchsetzungsschicht
|
||||
// (Akzeptanzkriterium 1). Repository-/Query-Code ruft ausschliesslich Guard
|
||||
// bzw. GuardTenantScoped auf, nie eine Rohabfrage direkt.
|
||||
type Enforcer struct {
|
||||
store *Store
|
||||
}
|
||||
|
||||
func NewEnforcer(store *Store) *Enforcer {
|
||||
return &Enforcer{store: store}
|
||||
}
|
||||
|
||||
// Authorize entscheidet erlaubt/verboten — unabhaengig von jeder konkreten
|
||||
// Query, rein anhand der deklarativen Regeln (Akzeptanzkriterium 2: fuer
|
||||
// sich genommen testbar, ohne Anwendungslogik).
|
||||
func (e *Enforcer) Authorize(ctx context.Context, role rbac.Role, perm rbac.Permission) error {
|
||||
allowed, err := e.store.IsAllowed(ctx, role, perm)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !allowed {
|
||||
return fmt.Errorf("%w: rolle %q hat kein recht %q", ErrDenied, role, perm)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Guard ist die zentrale Enforcement-Funktion (Akzeptanzkriterium 1): query
|
||||
// wird NUR aufgerufen, wenn Authorize zustimmt. Es gibt keinen Weg, query
|
||||
// ausserhalb von Guard aufzurufen und trotzdem den Aufrufer als autorisiert
|
||||
// zu behandeln — die Autorisierungsentscheidung steht immer VOR dem
|
||||
// Datenzugriff, nie danach.
|
||||
func Guard[T any](ctx context.Context, e *Enforcer, role rbac.Role, perm rbac.Permission, query func(ctx context.Context) (T, error)) (T, error) {
|
||||
var zero T
|
||||
if err := e.Authorize(ctx, role, perm); err != nil {
|
||||
return zero, err
|
||||
}
|
||||
return query(ctx)
|
||||
}
|
||||
|
||||
// GuardTenantScoped erzwingt zusaetzlich, dass tenantSlug TEIL der Query-
|
||||
// Funktion selbst ist (Akzeptanzkriterium 3): der Funktionstyp verlangt,
|
||||
// dass die Repository-Implementierung tenantSlug in ihre eigene WHERE-
|
||||
// Klausel einbaut — ein nachgelagerter Filter auf dem Ergebnis (der
|
||||
// archivmail-Fehler aus "Bekannte Fehler vermeiden") ist mit dieser
|
||||
// Signatur nicht moeglich, da die Query-Funktion tenantSlug selbst
|
||||
// entgegennimmt und dafuer verantwortlich ist, statt ihn hinterher
|
||||
// anzuwenden.
|
||||
func GuardTenantScoped[T any](ctx context.Context, e *Enforcer, role rbac.Role, perm rbac.Permission, tenantSlug string, query func(ctx context.Context, tenantSlug string) (T, error)) (T, error) {
|
||||
var zero T
|
||||
if err := e.Authorize(ctx, role, perm); err != nil {
|
||||
return zero, err
|
||||
}
|
||||
return query(ctx, tenantSlug)
|
||||
}
|
||||
@@ -1,90 +0,0 @@
|
||||
package policy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/flag"
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
||||
)
|
||||
|
||||
// ModuleScope verknuepft eine Policy-Regel mit einem Feature-Flag: existiert
|
||||
// ein ModuleScope fuer (role, permission), gilt die Regel nur zusaetzlich zur
|
||||
// Grundberechtigung, wenn FlagKey fuer den jeweiligen Tenant aktiv ist
|
||||
// (Akzeptanzkriterium 1: Rechte folgen der Lizenz).
|
||||
type ModuleScope struct {
|
||||
Role rbac.Role
|
||||
Permission rbac.Permission
|
||||
Module string
|
||||
FlagKey string
|
||||
}
|
||||
|
||||
// SetModuleScope verknuepft eine bestehende Policy-Regel mit einem Modul/
|
||||
// Feature-Flag. Die Regel selbst (Store.Grant) muss unabhaengig davon
|
||||
// existieren — ModuleScope schraenkt sie nur zusaetzlich ein.
|
||||
func (s *Store) SetModuleScope(ctx context.Context, role rbac.Role, perm rbac.Permission, module, flagKey string) error {
|
||||
_, err := s.pool.Exec(ctx, `
|
||||
INSERT INTO policy_module_scopes (role, permission, module, flag_key)
|
||||
VALUES ($1, $2, $3, $4)
|
||||
ON CONFLICT (role, permission) DO UPDATE SET module = $3, flag_key = $4
|
||||
`, string(role), string(perm), module, flagKey)
|
||||
if err != nil {
|
||||
return fmt.Errorf("modul-scope setzen: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *Store) GetModuleScope(ctx context.Context, role rbac.Role, perm rbac.Permission) (ModuleScope, bool, error) {
|
||||
var ms ModuleScope
|
||||
ms.Role, ms.Permission = role, perm
|
||||
err := s.pool.QueryRow(ctx, `
|
||||
SELECT module, flag_key FROM policy_module_scopes WHERE role = $1 AND permission = $2
|
||||
`, string(role), string(perm)).Scan(&ms.Module, &ms.FlagKey)
|
||||
if err != nil {
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return ModuleScope{}, false, nil
|
||||
}
|
||||
return ModuleScope{}, false, fmt.Errorf("modul-scope lesen: %w", err)
|
||||
}
|
||||
return ms, true, nil
|
||||
}
|
||||
|
||||
// AuthorizeForTenant ist dieselbe zentrale Entscheidungsfunktion wie
|
||||
// Authorize (Akzeptanzkriterium 3: keine zweite Enforcement-Schicht),
|
||||
// erweitert um die Modul-Scoping-Pruefung: eine sonst passende Regel greift
|
||||
// NICHT, wenn das zugehoerige Modul fuer den Tenant nicht aktiviert ist
|
||||
// (Akzeptanzkriterium 1). Feature-Flag-Aenderungen wirken ohne Neustart
|
||||
// (Akzeptanzkriterium 2), da flag.Service dieselbe TTL-Cache-Instanz der
|
||||
// aufrufenden Core-Instanz nutzt.
|
||||
func (e *Enforcer) AuthorizeForTenant(ctx context.Context, flags *flag.Service, tenantSlug string, role rbac.Role, perm rbac.Permission) error {
|
||||
if err := e.Authorize(ctx, role, perm); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
scope, found, err := e.store.GetModuleScope(ctx, role, perm)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !found {
|
||||
return nil // keine Modul-Bindung fuer diese Regel — Grundberechtigung reicht.
|
||||
}
|
||||
|
||||
if !flags.IsEnabled(ctx, tenantSlug, scope.FlagKey) {
|
||||
return fmt.Errorf("%w: modul %q ist fuer diesen mandanten nicht aktiviert", ErrDenied, scope.Module)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GuardModuleScoped ist Guard mit zusaetzlicher Modul-Scoping-Pruefung —
|
||||
// dieselbe zentrale Enforcement-Funktion, kein paralleler Mechanismus
|
||||
// (Akzeptanzkriterium 3).
|
||||
func GuardModuleScoped[T any](ctx context.Context, e *Enforcer, flags *flag.Service, tenantSlug string, role rbac.Role, perm rbac.Permission, query func(ctx context.Context) (T, error)) (T, error) {
|
||||
var zero T
|
||||
if err := e.AuthorizeForTenant(ctx, flags, tenantSlug, role, perm); err != nil {
|
||||
return zero, err
|
||||
}
|
||||
return query(ctx)
|
||||
}
|
||||
@@ -1,170 +0,0 @@
|
||||
package policy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/flag"
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
||||
)
|
||||
|
||||
func setupModuleScopeTest(t *testing.T) (*Store, *Enforcer, *flag.Store, *flag.Service, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
pool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("pool: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS policy_rules (
|
||||
role TEXT NOT NULL, permission TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
PRIMARY KEY (role, permission)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS policy_rule_changes (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), role TEXT NOT NULL, permission TEXT NOT NULL,
|
||||
action TEXT NOT NULL CHECK (action IN ('grant','revoke')), actor TEXT NOT NULL,
|
||||
version INT NOT NULL, changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS policy_module_scopes (
|
||||
role TEXT NOT NULL, permission TEXT NOT NULL, module TEXT NOT NULL, flag_key TEXT NOT NULL,
|
||||
PRIMARY KEY (role, permission)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS feature_flags (
|
||||
key TEXT PRIMARY KEY, enabled BOOLEAN NOT NULL DEFAULT false,
|
||||
rollout_percentage INT NOT NULL DEFAULT 0, target_tenant_slugs TEXT[] NOT NULL DEFAULT '{}',
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
`); err != nil {
|
||||
t.Fatalf("schema: %v", err)
|
||||
}
|
||||
|
||||
store := NewStore(pool)
|
||||
flagStore := flag.NewStore(pool)
|
||||
flagService := flag.NewService(flagStore, 10*time.Millisecond) // kurze TTL fuer testbare invalidierung
|
||||
|
||||
cleanup := func() {
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_module_scopes WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_rule_changes WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_rules WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM feature_flags WHERE key LIKE 'test\_%' ESCAPE '\'`)
|
||||
pool.Close()
|
||||
}
|
||||
return store, NewEnforcer(store), flagStore, flagService, cleanup
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1 + Pruefung 1: Berechtigung fuer nicht aktiviertes
|
||||
// Modul greift nicht, selbst bei sonst passender Rolle.
|
||||
func TestAuthorizeForTenant_DeniesWhenModuleNotActivated(t *testing.T) {
|
||||
store, enforcer, _, flagService, cleanup := setupModuleScopeTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
role := rbac.Role("test_dms_nutzer")
|
||||
perm := rbac.Permission("test_dokumente_lesen")
|
||||
if err := store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant: %v", err)
|
||||
}
|
||||
if err := store.SetModuleScope(ctx, role, perm, "dms", "test_dms_enabled"); err != nil {
|
||||
t.Fatalf("set module scope: %v", err)
|
||||
}
|
||||
// Flag existiert nicht/ist nicht gesetzt -> IsEnabled liefert false (Fail-Safe-Default).
|
||||
|
||||
queryCalled := false
|
||||
_, err := GuardModuleScoped(ctx, enforcer, flagService, "acme", role, perm, func(ctx context.Context) (string, error) {
|
||||
queryCalled = true
|
||||
return "daten", nil
|
||||
})
|
||||
if !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("erwartet ErrDenied bei deaktiviertem modul, habe %v", err)
|
||||
}
|
||||
if queryCalled {
|
||||
t.Fatal("query haette bei deaktiviertem modul nicht aufgerufen werden duerfen")
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 2: Aktivierung des Moduls macht die
|
||||
// Berechtigung ohne Neustart wirksam.
|
||||
func TestAuthorizeForTenant_BecomesActiveWithoutRestart(t *testing.T) {
|
||||
store, enforcer, flagStore, flagService, cleanup := setupModuleScopeTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
role := rbac.Role("test_dms_nutzer2")
|
||||
perm := rbac.Permission("test_dokumente_schreiben")
|
||||
if err := store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant: %v", err)
|
||||
}
|
||||
if err := store.SetModuleScope(ctx, role, perm, "dms", "test_dms_enabled2"); err != nil {
|
||||
t.Fatalf("set module scope: %v", err)
|
||||
}
|
||||
|
||||
if err := enforcer.AuthorizeForTenant(ctx, flagService, "acme", role, perm); !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("vor aktivierung: erwartet ErrDenied, habe %v", err)
|
||||
}
|
||||
|
||||
// Modul "im laufenden Betrieb" aktivieren — derselbe Prozess, kein Neustart.
|
||||
if err := flagStore.Set(ctx, flag.Flag{Key: "test_dms_enabled2", Enabled: true}); err != nil {
|
||||
t.Fatalf("flag setzen: %v", err)
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond) // TTL abwarten statt Neustart
|
||||
|
||||
if err := enforcer.AuthorizeForTenant(ctx, flagService, "acme", role, perm); err != nil {
|
||||
t.Fatalf("nach aktivierung sollte erlaubt sein: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3 + Pruefung 3: Zusammenspiel Modul-Scope + Rollenscope
|
||||
// in Kombinationsfaellen.
|
||||
func TestAuthorizeForTenant_CombinationsOfRoleAndModuleScope(t *testing.T) {
|
||||
store, enforcer, flagStore, flagService, cleanup := setupModuleScopeTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
scopedRole := rbac.Role("test_scoped_rolle")
|
||||
unscopedRole := rbac.Role("test_unscoped_rolle")
|
||||
perm := rbac.Permission("test_kombiniert")
|
||||
|
||||
// Fall 1: Rolle ohne jegliche Regel -> verboten, unabhaengig vom Flag.
|
||||
if err := enforcer.AuthorizeForTenant(ctx, flagService, "acme", rbac.Role("test_unbekannt"), perm); !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("fall 1: erwartet ErrDenied (keine regel), habe %v", err)
|
||||
}
|
||||
|
||||
// Fall 2: Regel vorhanden, KEIN Modul-Scope -> immer erlaubt (Grundrecht ohne Lizenzbindung).
|
||||
if err := store.Grant(ctx, unscopedRole, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant unscoped: %v", err)
|
||||
}
|
||||
if err := enforcer.AuthorizeForTenant(ctx, flagService, "acme", unscopedRole, perm); err != nil {
|
||||
t.Fatalf("fall 2: erwartet erlaubt ohne modul-scope, habe %v", err)
|
||||
}
|
||||
|
||||
// Fall 3: Regel + Modul-Scope, Flag aus -> verboten.
|
||||
if err := store.Grant(ctx, scopedRole, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant scoped: %v", err)
|
||||
}
|
||||
if err := store.SetModuleScope(ctx, scopedRole, perm, "mail", "test_mail_enabled"); err != nil {
|
||||
t.Fatalf("set module scope: %v", err)
|
||||
}
|
||||
if err := enforcer.AuthorizeForTenant(ctx, flagService, "acme", scopedRole, perm); !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("fall 3: erwartet ErrDenied (modul aus), habe %v", err)
|
||||
}
|
||||
|
||||
// Fall 4: Regel + Modul-Scope, Flag an -> erlaubt.
|
||||
if err := flagStore.Set(ctx, flag.Flag{Key: "test_mail_enabled", Enabled: true}); err != nil {
|
||||
t.Fatalf("flag setzen: %v", err)
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
if err := enforcer.AuthorizeForTenant(ctx, flagService, "acme", scopedRole, perm); err != nil {
|
||||
t.Fatalf("fall 4: erwartet erlaubt (modul an), habe %v", err)
|
||||
}
|
||||
}
|
||||
@@ -1,187 +0,0 @@
|
||||
package policy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
||||
)
|
||||
|
||||
func setupTest(t *testing.T) (*Store, *Enforcer, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
pool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("pool: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS policy_rules (
|
||||
role TEXT NOT NULL, permission TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
PRIMARY KEY (role, permission)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS policy_rule_changes (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), role TEXT NOT NULL, permission TEXT NOT NULL,
|
||||
action TEXT NOT NULL CHECK (action IN ('grant','revoke')), actor TEXT NOT NULL,
|
||||
version INT NOT NULL, changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
`); err != nil {
|
||||
t.Fatalf("schema: %v", err)
|
||||
}
|
||||
|
||||
store := NewStore(pool)
|
||||
cleanup := func() {
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_rule_changes WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_rules WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
||||
pool.Close()
|
||||
}
|
||||
return store, NewEnforcer(store), cleanup
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 2: Anfrage ohne passende Policy wird
|
||||
// zuverlaessig abgewiesen (Default-Deny), nicht standardmaessig erlaubt.
|
||||
func TestAuthorize_DefaultDeny(t *testing.T) {
|
||||
_, enforcer, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
err := enforcer.Authorize(ctx, rbac.Role("test_niemand"), rbac.Permission("test_irgendwas"))
|
||||
if !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("erwartet ErrDenied ohne konfigurierte regel, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1 + Pruefung 1: Guard ruft query NUR bei Autorisierung
|
||||
// auf — kein Datenzugriffs-Pfad umgeht die Enforcement-Schicht.
|
||||
func TestGuard_NeverCallsQueryWithoutAuthorization(t *testing.T) {
|
||||
store, enforcer, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
role := rbac.Role("test_rolle_guard")
|
||||
perm := rbac.Permission("test_lesen")
|
||||
|
||||
queryCalled := false
|
||||
_, err := Guard(ctx, enforcer, role, perm, func(ctx context.Context) (string, error) {
|
||||
queryCalled = true
|
||||
return "geheime-daten", nil
|
||||
})
|
||||
if !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("erwartet ErrDenied, habe %v", err)
|
||||
}
|
||||
if queryCalled {
|
||||
t.Fatal("query haette bei fehlender autorisierung NICHT aufgerufen werden duerfen")
|
||||
}
|
||||
|
||||
if err := store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant: %v", err)
|
||||
}
|
||||
|
||||
result, err := Guard(ctx, enforcer, role, perm, func(ctx context.Context) (string, error) {
|
||||
queryCalled = true
|
||||
return "geheime-daten", nil
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("guard nach grant: %v", err)
|
||||
}
|
||||
if !queryCalled || result != "geheime-daten" {
|
||||
t.Fatalf("erwartet query-aufruf mit ergebnis nach autorisierung, habe queryCalled=%v result=%q", queryCalled, result)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + 3: Policy-Entscheidungen deklarativ und unabhaengig
|
||||
// von Anwendungslogik testbar — Regelwechsel wirkt ohne Codeaenderung,
|
||||
// Historie ist versioniert nachvollziehbar.
|
||||
func TestGrantRevoke_ChangesBehaviorWithoutCodeChange(t *testing.T) {
|
||||
store, enforcer, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
role := rbac.Role("test_rolle_history")
|
||||
perm := rbac.Permission("test_schreiben")
|
||||
|
||||
allowed, err := store.IsAllowed(ctx, role, perm)
|
||||
if err != nil {
|
||||
t.Fatalf("is allowed (vorher): %v", err)
|
||||
}
|
||||
if allowed {
|
||||
t.Fatal("erwartet nicht erlaubt vor grant")
|
||||
}
|
||||
|
||||
if err := store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant: %v", err)
|
||||
}
|
||||
if err := enforcer.Authorize(ctx, role, perm); err != nil {
|
||||
t.Fatalf("authorize nach grant sollte erlauben: %v", err)
|
||||
}
|
||||
|
||||
if err := store.Revoke(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("revoke: %v", err)
|
||||
}
|
||||
if err := enforcer.Authorize(ctx, role, perm); !errors.Is(err, ErrDenied) {
|
||||
t.Fatalf("authorize nach revoke sollte verweigern, habe %v", err)
|
||||
}
|
||||
|
||||
history, err := store.History(ctx, role, perm)
|
||||
if err != nil {
|
||||
t.Fatalf("history: %v", err)
|
||||
}
|
||||
if len(history) != 2 {
|
||||
t.Fatalf("erwartet 2 historieneintraege (grant, revoke), habe %d", len(history))
|
||||
}
|
||||
if history[0].Action != "grant" || history[0].Version != 1 {
|
||||
t.Fatalf("history[0] unerwartet: %+v", history[0])
|
||||
}
|
||||
if history[1].Action != "revoke" || history[1].Version != 2 {
|
||||
t.Fatalf("history[1] unerwartet: %+v", history[1])
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3 + Pruefung 3 (Tenant-Scoping): GuardTenantScoped
|
||||
// zwingt tenantSlug in die Query-Funktion selbst, kein Post-Filter moeglich.
|
||||
func TestGuardTenantScoped_IsolatesDataBetweenTenants(t *testing.T) {
|
||||
_, enforcer, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
// Simuliertes Repository: die WHERE-Klausel (hier: Map-Lookup) liegt
|
||||
// INNERHALB der Query-Funktion, nicht als nachgelagerter Filter.
|
||||
data := map[string][]string{
|
||||
"acme": {"dokument-a1", "dokument-a2"},
|
||||
"globex": {"dokument-b1"},
|
||||
}
|
||||
repoQuery := func(ctx context.Context, tenantSlug string) ([]string, error) {
|
||||
return data[tenantSlug], nil
|
||||
}
|
||||
|
||||
role := rbac.Role("test_tenant_rolle")
|
||||
perm := rbac.Permission("test_dokumente_lesen")
|
||||
if err := enforcer.store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
||||
t.Fatalf("grant: %v", err)
|
||||
}
|
||||
|
||||
gotAcme, err := GuardTenantScoped(ctx, enforcer, role, perm, "acme", repoQuery)
|
||||
if err != nil {
|
||||
t.Fatalf("guard tenant scoped (acme): %v", err)
|
||||
}
|
||||
if len(gotAcme) != 2 {
|
||||
t.Fatalf("erwartet 2 dokumente fuer acme, habe %d", len(gotAcme))
|
||||
}
|
||||
|
||||
gotGlobex, err := GuardTenantScoped(ctx, enforcer, role, perm, "globex", repoQuery)
|
||||
if err != nil {
|
||||
t.Fatalf("guard tenant scoped (globex): %v", err)
|
||||
}
|
||||
if len(gotGlobex) != 1 {
|
||||
t.Fatalf("erwartet 1 dokument fuer globex, habe %d", len(gotGlobex))
|
||||
}
|
||||
}
|
||||
@@ -1,124 +0,0 @@
|
||||
// Package policy implementiert Core RBAC-02: die zentrale Policy-
|
||||
// Entscheidungs- und Durchsetzungsschicht. Regeln liegen deklarativ in der
|
||||
// Datenbank (Casbin-Prinzip: Policy als Modell+Regeln getrennt vom Code),
|
||||
// versioniert und auditierbar — anders als Casbin-Dateien im Dateisystem
|
||||
// (siehe "bewusst vermeiden" im Ticket).
|
||||
package policy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
||||
)
|
||||
|
||||
// Rule ist eine gewaehrte Regel: role darf permission.
|
||||
type Rule struct {
|
||||
Role rbac.Role
|
||||
Permission rbac.Permission
|
||||
}
|
||||
|
||||
// RuleChange ist ein Eintrag der Aenderungshistorie (Akzeptanzkriterium 3).
|
||||
type RuleChange struct {
|
||||
Role rbac.Role
|
||||
Permission rbac.Permission
|
||||
Action string // "grant" oder "revoke"
|
||||
Actor string
|
||||
Version int
|
||||
}
|
||||
|
||||
// Store verwaltet den deklarativen Regelsatz. IsAllowed schaut NUR in die
|
||||
// Datenbank — es gibt keinen hartcodierten Go-Fallback, ein Regelwechsel
|
||||
// wirkt sich ohne Codeaenderung sofort aus (Akzeptanzkriterium 2 / 3).
|
||||
type Store struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewStore(pool *pgxpool.Pool) *Store {
|
||||
return &Store{pool: pool}
|
||||
}
|
||||
|
||||
// IsAllowed prueft, ob role das Recht permission besitzt. Default-Deny:
|
||||
// existiert keine passende Regel, ist der Zugriff verboten
|
||||
// (Akzeptanzkriterium 2 / Pruefung 2) — es gibt keinen impliziten
|
||||
// "erlaubt, wenn nichts anderes gesagt"-Pfad.
|
||||
func (s *Store) IsAllowed(ctx context.Context, role rbac.Role, perm rbac.Permission) (bool, error) {
|
||||
var exists bool
|
||||
err := s.pool.QueryRow(ctx, `
|
||||
SELECT EXISTS(SELECT 1 FROM policy_rules WHERE role = $1 AND permission = $2)
|
||||
`, string(role), string(perm)).Scan(&exists)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("policy pruefen: %w", err)
|
||||
}
|
||||
return exists, nil
|
||||
}
|
||||
|
||||
// Grant gewaehrt role das Recht permission — deklarativ, ohne Codeaenderung
|
||||
// wirksam. actor wird fuer die Aenderungshistorie festgehalten.
|
||||
func (s *Store) Grant(ctx context.Context, role rbac.Role, perm rbac.Permission, actor string) error {
|
||||
return s.change(ctx, role, perm, "grant", actor, `
|
||||
INSERT INTO policy_rules (role, permission, granted_by, granted_at)
|
||||
VALUES ($1, $2, $3, now())
|
||||
ON CONFLICT (role, permission) DO UPDATE SET granted_by = $3, granted_at = now()
|
||||
`, string(role), string(perm), actor)
|
||||
}
|
||||
|
||||
// Revoke entzieht role das Recht permission.
|
||||
func (s *Store) Revoke(ctx context.Context, role rbac.Role, perm rbac.Permission, actor string) error {
|
||||
return s.change(ctx, role, perm, "revoke", actor, `
|
||||
DELETE FROM policy_rules WHERE role = $1 AND permission = $2
|
||||
`, string(role), string(perm))
|
||||
}
|
||||
|
||||
func (s *Store) change(ctx context.Context, role rbac.Role, perm rbac.Permission, action, actor, sql string, args ...any) error {
|
||||
tx, err := s.pool.Begin(ctx)
|
||||
if err != nil {
|
||||
return fmt.Errorf("transaktion starten: %w", err)
|
||||
}
|
||||
defer func() { _ = tx.Rollback(ctx) }()
|
||||
|
||||
if _, err := tx.Exec(ctx, sql, args...); err != nil {
|
||||
return fmt.Errorf("regel aendern: %w", err)
|
||||
}
|
||||
|
||||
var version int
|
||||
if err := tx.QueryRow(ctx, `
|
||||
SELECT COALESCE(MAX(version), 0) + 1 FROM policy_rule_changes WHERE role = $1 AND permission = $2
|
||||
`, string(role), string(perm)).Scan(&version); err != nil {
|
||||
return fmt.Errorf("naechste version ermitteln: %w", err)
|
||||
}
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO policy_rule_changes (role, permission, action, actor, version, changed_at)
|
||||
VALUES ($1, $2, $3, $4, $5, now())
|
||||
`, string(role), string(perm), action, actor, version); err != nil {
|
||||
return fmt.Errorf("historie schreiben: %w", err)
|
||||
}
|
||||
|
||||
return tx.Commit(ctx)
|
||||
}
|
||||
|
||||
// History liefert die vollstaendige, versionierte Aenderungshistorie einer
|
||||
// Regel (Akzeptanzkriterium 3).
|
||||
func (s *Store) History(ctx context.Context, role rbac.Role, perm rbac.Permission) ([]RuleChange, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT action, actor, version FROM policy_rule_changes
|
||||
WHERE role = $1 AND permission = $2 ORDER BY version
|
||||
`, string(role), string(perm))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("historie abfragen: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []RuleChange
|
||||
for rows.Next() {
|
||||
c := RuleChange{Role: role, Permission: perm}
|
||||
if err := rows.Scan(&c.Action, &c.Actor, &c.Version); err != nil {
|
||||
return nil, fmt.Errorf("historieneintrag lesen: %w", err)
|
||||
}
|
||||
out = append(out, c)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
@@ -1,125 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// QA-03 Akzeptanzkriterium 2 / Pruefung 1: gezielter Umgehungsversuch der
|
||||
// zentralen Policy-Schicht (RBAC-02, internal/policy.Enforcer) — direkter
|
||||
// Zugriff auf role_assignments ohne den Store/Handler-Umweg.
|
||||
//
|
||||
// Ergebnis: erfolglos abgewiesen. Store.Assign ist die einzige Schreib-API,
|
||||
// es gibt keine andere exportierte Funktion, die role_assignments direkt
|
||||
// beschreibt — ein Aufrufer ausserhalb dieses Packages kann die Tabelle
|
||||
// nicht ohne SQL-Zugriff auf den Pool selbst manipulieren, und dieser Pool
|
||||
// ist nicht exportiert (Store.pool ist ein unexportiertes Feld).
|
||||
func TestBypass_NoDirectWriteAPIOutsideStore(t *testing.T) {
|
||||
// Kompilierzeit-Beleg: es gibt keinen Weg, role_assignments ausserhalb
|
||||
// dieser Datei zu schreiben, ohne *Store zu benutzen — der Test dient
|
||||
// als dokumentierter Nachweis, dass dieser Umgehungsversuch bereits am
|
||||
// Typsystem scheitert, nicht erst zur Laufzeit.
|
||||
var _ = (*Store)(nil)
|
||||
}
|
||||
|
||||
// QA-03 Akzeptanzkriterium 2 (Kern-Fund, siehe docs/QA-03-PRUEFPROTOKOLL.md
|
||||
// "Abweichungen"): internal/rbac/handler.go (RBAC-05) entscheidet
|
||||
// Zugriffsrechte ueber requireManageUsers() -> HasPermission() — die
|
||||
// STATISCHE, hartcodierte Rollenhierarchie aus role.go. Es ruft NICHT
|
||||
// internal/policy.Enforcer.Authorize()/Guard() auf, die eigentliche
|
||||
// zentrale, DB-gestuetzte Policy-Durchsetzungsschicht aus RBAC-02
|
||||
// (policy_rules-Tabelle, per Store.Grant/Revoke administrierbar).
|
||||
//
|
||||
// Konsequenz: ein Tenant-Admin, der ueber policy.Store.Revoke() das Recht
|
||||
// tenant.manage_users von der Rolle tenant_admin entzieht, sperrt die
|
||||
// RBAC-05-Handler NICHT aus — sie fragen diese Tabelle nie ab. Dieser Test
|
||||
// beweist die tatsaechliche (fehlerhafte) Realitaet, NICHT das gewuenschte
|
||||
// Verhalten — siehe Pruefprotokoll fuer die Einordnung als Abweichung statt
|
||||
// stillschweigend behoben (Arbeitsweise-Regel: kein Umbau angrenzender
|
||||
// Bereiche in dieser Kachel, RBAC-05 gehoert nicht zu QA-03s Vorbedingungen).
|
||||
func TestBypass_HandlerIgnoresCentralPolicyRevocation(t *testing.T) {
|
||||
_, roles, users, _ := setupHandlerTest(t, "qa03_bypass_policy_ignored")
|
||||
ctx := context.Background()
|
||||
|
||||
admin, err := users.Create(ctx, "admin-bypass@acme.example", "Admin")
|
||||
if err != nil {
|
||||
t.Fatalf("admin anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
||||
t.Fatalf("admin-rolle setzen: %v", err)
|
||||
}
|
||||
|
||||
// Simuliert: ueber die zentrale Policy-Schicht (RBAC-02) wuerde
|
||||
// tenant.manage_users der Rolle tenant_admin entzogen. Da RBAC-05s
|
||||
// Handler diese Tabelle nie liest, hat der Entzug HIER keine Wirkung —
|
||||
// requireManageUsers() erlaubt weiterhin, weil es nur HasPermission()
|
||||
// (statische Hierarchie) fragt, nicht policy.Store.IsAllowed()
|
||||
// (dynamische, gerade entzogene Regel).
|
||||
stillAllowedByStaticHierarchy := HasPermission(RoleTenantAdmin, PermManageUsers)
|
||||
if !stillAllowedByStaticHierarchy {
|
||||
t.Fatal("erwartungsgemaess (fuer den Beweis): statische Hierarchie erlaubt weiterhin tenant.manage_users fuer tenant_admin")
|
||||
}
|
||||
|
||||
// requireManageUsers() nutzt ausschliesslich diese statische Pruefung —
|
||||
// ein Entzug ueber policy.Store haette hier KEINE Wirkung. Das ist der
|
||||
// dokumentierte Fund: zwei parallele Enforcement-Pfade statt einer
|
||||
// zentralen Schicht (verletzt die Ticket-Produkt-DNA "Rechte werden
|
||||
// zentral entschieden, nicht in jedem Handler neu erfunden").
|
||||
t.Log("FUND: internal/rbac/handler.go prueft HasPermission() (statisch), nicht internal/policy.Enforcer (RBAC-02, dynamisch) — ein Entzug ueber policy.Store.Revoke() wuerde RBAC-05-Endpunkte nicht sperren. Siehe docs/QA-03-PRUEFPROTOKOLL.md.")
|
||||
}
|
||||
|
||||
// Gegenprobe: RBAC-02s eigene Enforcer/Guard-Schicht IST korrekt
|
||||
// zentralisiert und respektiert Revoke sofort — der Fund oben betrifft
|
||||
// ausschliesslich RBAC-05s Handler, nicht RBAC-02 selbst.
|
||||
func TestBypass_PolicyEnforcerItselfRespectsRevocation(t *testing.T) {
|
||||
_, roles, users, pool := setupHandlerTest(t, "qa03_bypass_enforcer_ok")
|
||||
ctx := context.Background()
|
||||
_ = roles
|
||||
_ = users
|
||||
|
||||
if _, err := pool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS policy_rules (
|
||||
role TEXT NOT NULL, permission TEXT NOT NULL, granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now(), PRIMARY KEY (role, permission)
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS policy_rule_changes (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), role TEXT NOT NULL, permission TEXT NOT NULL,
|
||||
action TEXT NOT NULL, actor TEXT NOT NULL, version INT NOT NULL, changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
`); err != nil {
|
||||
t.Fatalf("policy-schema: %v", err)
|
||||
}
|
||||
|
||||
// Diese Tabellen/Typen leben im Package internal/policy — hier nur
|
||||
// strukturell nachgebaut, um den Unterschied zu belegen, ohne einen
|
||||
// Importzyklus zu riskieren (internal/policy importiert bereits
|
||||
// internal/rbac, nicht umgekehrt).
|
||||
if _, err := pool.Exec(ctx, `
|
||||
INSERT INTO policy_rules (role, permission, granted_by) VALUES ('tenant_admin', 'tenant.manage_users', 'system')
|
||||
`); err != nil {
|
||||
t.Fatalf("regel gewaehren: %v", err)
|
||||
}
|
||||
|
||||
var allowedBefore bool
|
||||
if err := pool.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM policy_rules WHERE role='tenant_admin' AND permission='tenant.manage_users')`).Scan(&allowedBefore); err != nil {
|
||||
t.Fatalf("pruefen vor entzug: %v", err)
|
||||
}
|
||||
if !allowedBefore {
|
||||
t.Fatal("erwartet: regel ist zunaechst gewaehrt")
|
||||
}
|
||||
|
||||
if _, err := pool.Exec(ctx, `DELETE FROM policy_rules WHERE role='tenant_admin' AND permission='tenant.manage_users'`); err != nil {
|
||||
t.Fatalf("regel entziehen: %v", err)
|
||||
}
|
||||
|
||||
var allowedAfter bool
|
||||
if err := pool.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM policy_rules WHERE role='tenant_admin' AND permission='tenant.manage_users')`).Scan(&allowedAfter); err != nil {
|
||||
t.Fatalf("pruefen nach entzug: %v", err)
|
||||
}
|
||||
if allowedAfter {
|
||||
t.Fatal("regel haette nach entzug nicht mehr existieren duerfen")
|
||||
}
|
||||
// RBAC-02s Enforcer.Authorize fragt exakt diese Tabelle live ab (siehe
|
||||
// internal/policy/store.go IsAllowed) — der Entzug wirkt dort sofort,
|
||||
// im Gegensatz zu RBAC-05s Handler (siehe Test oben).
|
||||
}
|
||||
@@ -1,200 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
var ErrGroupNotFound = errors.New("rbac: gruppe nicht gefunden")
|
||||
|
||||
type Group struct {
|
||||
ID string
|
||||
Name string
|
||||
Role Role // leer, wenn der Gruppe noch keine Rolle zugewiesen wurde
|
||||
}
|
||||
|
||||
// GroupStore verwaltet Gruppen/Abteilungen innerhalb GENAU EINER Tenant-
|
||||
// Datenbank (Modell C, wie Store fuer direkte Rollenzuweisungen) —
|
||||
// Akzeptanzkriterium 3 (tenant-isoliert) ist damit strukturell erfuellt.
|
||||
type GroupStore struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewGroupStore(pool *pgxpool.Pool) *GroupStore {
|
||||
return &GroupStore{pool: pool}
|
||||
}
|
||||
|
||||
// CreateGroup legt eine neue, noch rollenlose Gruppe an (Akzeptanzkriterium 1).
|
||||
func (s *GroupStore) CreateGroup(ctx context.Context, name string) (Group, error) {
|
||||
if name == "" {
|
||||
return Group{}, errors.New("rbac: gruppenname darf nicht leer sein")
|
||||
}
|
||||
var g Group
|
||||
g.Name = name
|
||||
if err := s.pool.QueryRow(ctx, `
|
||||
INSERT INTO groups (name) VALUES ($1) RETURNING id
|
||||
`, name).Scan(&g.ID); err != nil {
|
||||
return Group{}, fmt.Errorf("gruppe anlegen: %w", err)
|
||||
}
|
||||
return g, nil
|
||||
}
|
||||
|
||||
// SetGroupRole weist der Gruppe eine Rolle zu (Akzeptanzkriterium 2) — nur
|
||||
// 'user'/'tenant_admin' sind auf Gruppenebene zuweisbar, dieselbe erlaubte
|
||||
// Matrix wie in Store.Assign (superadmin bleibt mandantenuebergreifend und
|
||||
// ausserhalb jeder Gruppenlogik).
|
||||
func (s *GroupStore) SetGroupRole(ctx context.Context, groupID string, role Role) error {
|
||||
if !assignableRoles[role] {
|
||||
return ErrRoleNotAssignableInTenantScope
|
||||
}
|
||||
tag, err := s.pool.Exec(ctx, `UPDATE groups SET role = $2 WHERE id = $1`, groupID, string(role))
|
||||
if err != nil {
|
||||
return fmt.Errorf("gruppenrolle setzen: %w", err)
|
||||
}
|
||||
if tag.RowsAffected() == 0 {
|
||||
return ErrGroupNotFound
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// AddMember nimmt einen Benutzer in die Gruppe auf.
|
||||
func (s *GroupStore) AddMember(ctx context.Context, groupID, userID string) error {
|
||||
_, err := s.pool.Exec(ctx, `
|
||||
INSERT INTO group_members (group_id, user_id) VALUES ($1, $2)
|
||||
ON CONFLICT (group_id, user_id) DO NOTHING
|
||||
`, groupID, userID)
|
||||
if err != nil {
|
||||
return fmt.Errorf("mitglied hinzufuegen: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RemoveMember entfernt einen Benutzer aus der Gruppe — die gruppenbasierten
|
||||
// Rechte entfallen fuer ihn sofort (Akzeptanzkriterium 3 / Pruefung 2), da
|
||||
// EffectivePermissionsForUser bei jedem Aufruf neu berechnet wird, nicht
|
||||
// zwischengespeichert.
|
||||
func (s *GroupStore) RemoveMember(ctx context.Context, groupID, userID string) error {
|
||||
_, err := s.pool.Exec(ctx, `DELETE FROM group_members WHERE group_id = $1 AND user_id = $2`, groupID, userID)
|
||||
if err != nil {
|
||||
return fmt.Errorf("mitglied entfernen: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeleteGroup loescht die Gruppe — ON DELETE CASCADE entfernt die
|
||||
// Mitgliedschaften mit, Benutzerkonten selbst bleiben unberuehrt
|
||||
// (Akzeptanzkriterium 3).
|
||||
func (s *GroupStore) DeleteGroup(ctx context.Context, groupID string) error {
|
||||
_, err := s.pool.Exec(ctx, `DELETE FROM groups WHERE id = $1`, groupID)
|
||||
if err != nil {
|
||||
return fmt.Errorf("gruppe loeschen: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ListGroups liefert alle Gruppen des Mandanten (Akzeptanzkriterium 1/2,
|
||||
// Grundlage fuer die Administrationsoberflaeche).
|
||||
func (s *GroupStore) ListGroups(ctx context.Context) ([]Group, error) {
|
||||
rows, err := s.pool.Query(ctx, `SELECT id, name, COALESCE(role, '') FROM groups ORDER BY name`)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("gruppen auflisten: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []Group
|
||||
for rows.Next() {
|
||||
var g Group
|
||||
var role string
|
||||
if err := rows.Scan(&g.ID, &g.Name, &role); err != nil {
|
||||
return nil, fmt.Errorf("gruppe lesen: %w", err)
|
||||
}
|
||||
g.Role = Role(role)
|
||||
out = append(out, g)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// Members liefert die User-IDs der Mitglieder einer Gruppe.
|
||||
func (s *GroupStore) Members(ctx context.Context, groupID string) ([]string, error) {
|
||||
rows, err := s.pool.Query(ctx, `SELECT user_id FROM group_members WHERE group_id = $1`, groupID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("mitglieder abfragen: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []string
|
||||
for rows.Next() {
|
||||
var id string
|
||||
if err := rows.Scan(&id); err != nil {
|
||||
return nil, fmt.Errorf("mitglied lesen: %w", err)
|
||||
}
|
||||
out = append(out, id)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// RolesForUser liefert alle Rollen, die einem Benutzer ueber seine
|
||||
// Gruppenmitgliedschaften zufallen (Akzeptanzkriterium 2: wirkt auf alle
|
||||
// Mitglieder). Eine Gruppe ohne zugewiesene Rolle traegt nichts bei.
|
||||
func (s *GroupStore) RolesForUser(ctx context.Context, userID string) ([]Role, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT g.role FROM groups g
|
||||
JOIN group_members gm ON gm.group_id = g.id
|
||||
WHERE gm.user_id = $1 AND g.role IS NOT NULL
|
||||
`, userID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("gruppenrollen abfragen: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []Role
|
||||
for rows.Next() {
|
||||
var r string
|
||||
if err := rows.Scan(&r); err != nil {
|
||||
return nil, fmt.Errorf("gruppenrolle lesen: %w", err)
|
||||
}
|
||||
out = append(out, Role(r))
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// EffectivePermissionsForUser vereinigt die Rechte aus der direkten
|
||||
// Rollenzuweisung (Store, RBAC-01) mit allen Rechten aus Gruppenrollen —
|
||||
// jede einzelne Rolle wird ueber die bestehende Hierarchie (EffectivePermissions)
|
||||
// aufgeloest, das Ergebnis dedupliziert.
|
||||
func (s *GroupStore) EffectivePermissionsForUser(ctx context.Context, directStore *Store, userID string) ([]Permission, error) {
|
||||
seen := make(map[Permission]bool)
|
||||
var out []Permission
|
||||
|
||||
add := func(role Role) {
|
||||
for _, p := range EffectivePermissions(role) {
|
||||
if !seen[p] {
|
||||
seen[p] = true
|
||||
out = append(out, p)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if directStore != nil {
|
||||
assignment, err := directStore.Get(ctx, userID)
|
||||
if err != nil && !errors.Is(err, ErrNotFound) {
|
||||
return nil, err
|
||||
}
|
||||
if err == nil {
|
||||
add(assignment.Role)
|
||||
}
|
||||
}
|
||||
|
||||
groupRoles, err := s.RolesForUser(ctx, userID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for _, r := range groupRoles {
|
||||
add(r)
|
||||
}
|
||||
|
||||
return out, nil
|
||||
}
|
||||
@@ -1,209 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
const groupSchema = `
|
||||
CREATE TABLE IF NOT EXISTS users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), email TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active', created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS role_assignments (
|
||||
user_id UUID PRIMARY KEY REFERENCES users(id), role TEXT NOT NULL CHECK (role IN ('user','tenant_admin')),
|
||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS groups (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), name TEXT NOT NULL, role TEXT CHECK (role IN ('user','tenant_admin')),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS group_members (
|
||||
group_id UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE, user_id UUID NOT NULL REFERENCES users(id),
|
||||
added_at TIMESTAMPTZ NOT NULL DEFAULT now(), PRIMARY KEY (group_id, user_id)
|
||||
);`
|
||||
|
||||
func setupGroupTestDB(t *testing.T, dbName string) *pgxpool.Pool {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("admin pool: %v", err)
|
||||
}
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
if _, err := adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
||||
t.Fatalf("testdatenbank anlegen: %v", err)
|
||||
}
|
||||
|
||||
dsn := strings.Replace(adminDSN, "/postgres?", "/"+dbName+"?", 1)
|
||||
pool, err := pgxpool.New(ctx, dsn)
|
||||
if err != nil {
|
||||
t.Fatalf("connect testdatenbank: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, groupSchema); err != nil {
|
||||
t.Fatalf("schema anwenden: %v", err)
|
||||
}
|
||||
|
||||
t.Cleanup(func() {
|
||||
pool.Close()
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
adminPool.Close()
|
||||
})
|
||||
return pool
|
||||
}
|
||||
|
||||
func createTestUser(t *testing.T, pool *pgxpool.Pool, email string) string {
|
||||
t.Helper()
|
||||
u, err := user.NewTenantUserStore(pool).Create(context.Background(), email, "Test")
|
||||
if err != nil {
|
||||
t.Fatalf("testuser anlegen: %v", err)
|
||||
}
|
||||
return u.ID
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1: Gruppen anlegen und Benutzer zuordnen.
|
||||
func TestGroup_CreateAndAddMember(t *testing.T) {
|
||||
pool := setupGroupTestDB(t, "test_rbac03_create")
|
||||
gs := NewGroupStore(pool)
|
||||
ctx := context.Background()
|
||||
|
||||
g, err := gs.CreateGroup(ctx, "Buchhaltung")
|
||||
if err != nil {
|
||||
t.Fatalf("create group: %v", err)
|
||||
}
|
||||
userID := createTestUser(t, pool, "alice@example.com")
|
||||
|
||||
if err := gs.AddMember(ctx, g.ID, userID); err != nil {
|
||||
t.Fatalf("add member: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 1: Gruppenrolle wirkt auf ALLE aktuellen
|
||||
// Mitglieder.
|
||||
func TestGroup_RoleAffectsAllCurrentMembers(t *testing.T) {
|
||||
pool := setupGroupTestDB(t, "test_rbac03_roleall")
|
||||
gs := NewGroupStore(pool)
|
||||
ctx := context.Background()
|
||||
|
||||
g, err := gs.CreateGroup(ctx, "Admins")
|
||||
if err != nil {
|
||||
t.Fatalf("create group: %v", err)
|
||||
}
|
||||
if err := gs.SetGroupRole(ctx, g.ID, RoleTenantAdmin); err != nil {
|
||||
t.Fatalf("set group role: %v", err)
|
||||
}
|
||||
|
||||
alice := createTestUser(t, pool, "alice@example.com")
|
||||
bob := createTestUser(t, pool, "bob@example.com")
|
||||
if err := gs.AddMember(ctx, g.ID, alice); err != nil {
|
||||
t.Fatalf("add alice: %v", err)
|
||||
}
|
||||
if err := gs.AddMember(ctx, g.ID, bob); err != nil {
|
||||
t.Fatalf("add bob: %v", err)
|
||||
}
|
||||
|
||||
for _, uid := range []string{alice, bob} {
|
||||
perms, err := gs.EffectivePermissionsForUser(ctx, nil, uid)
|
||||
if err != nil {
|
||||
t.Fatalf("effective permissions fuer %s: %v", uid, err)
|
||||
}
|
||||
if !contains(perms, PermManageUsers) {
|
||||
t.Fatalf("mitglied %s sollte tenant_admin-rechte ueber die gruppe haben, habe %v", uid, perms)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3 + Pruefung 2: Entfernen aus der Gruppe entzieht die
|
||||
// gruppenbasierten Rechte sofort.
|
||||
func TestGroup_RemoveMemberRevokesRightsImmediately(t *testing.T) {
|
||||
pool := setupGroupTestDB(t, "test_rbac03_remove")
|
||||
gs := NewGroupStore(pool)
|
||||
ctx := context.Background()
|
||||
|
||||
g, _ := gs.CreateGroup(ctx, "Admins")
|
||||
_ = gs.SetGroupRole(ctx, g.ID, RoleTenantAdmin)
|
||||
userID := createTestUser(t, pool, "alice@example.com")
|
||||
_ = gs.AddMember(ctx, g.ID, userID)
|
||||
|
||||
perms, err := gs.EffectivePermissionsForUser(ctx, nil, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("effective permissions (mitglied): %v", err)
|
||||
}
|
||||
if !contains(perms, PermManageUsers) {
|
||||
t.Fatal("erwartet tenant_admin-rechte als mitglied")
|
||||
}
|
||||
|
||||
if err := gs.RemoveMember(ctx, g.ID, userID); err != nil {
|
||||
t.Fatalf("remove member: %v", err)
|
||||
}
|
||||
|
||||
perms, err = gs.EffectivePermissionsForUser(ctx, nil, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("effective permissions (entfernt): %v", err)
|
||||
}
|
||||
if contains(perms, PermManageUsers) {
|
||||
t.Fatal("erwartet KEINE tenant_admin-rechte nach entfernen aus der gruppe")
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3: Loeschen einer Gruppe entzieht Rechte sauber, ohne
|
||||
// das Benutzerkonto zu loeschen.
|
||||
func TestGroup_DeleteGroupRevokesRightsWithoutDeletingUser(t *testing.T) {
|
||||
pool := setupGroupTestDB(t, "test_rbac03_delete")
|
||||
gs := NewGroupStore(pool)
|
||||
us := user.NewTenantUserStore(pool)
|
||||
ctx := context.Background()
|
||||
|
||||
g, _ := gs.CreateGroup(ctx, "Temp")
|
||||
_ = gs.SetGroupRole(ctx, g.ID, RoleTenantAdmin)
|
||||
userID := createTestUser(t, pool, "alice@example.com")
|
||||
_ = gs.AddMember(ctx, g.ID, userID)
|
||||
|
||||
if err := gs.DeleteGroup(ctx, g.ID); err != nil {
|
||||
t.Fatalf("delete group: %v", err)
|
||||
}
|
||||
|
||||
perms, err := gs.EffectivePermissionsForUser(ctx, nil, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("effective permissions: %v", err)
|
||||
}
|
||||
if contains(perms, PermManageUsers) {
|
||||
t.Fatal("erwartet keine rechte mehr nach loeschen der gruppe")
|
||||
}
|
||||
|
||||
if _, err := us.Get(ctx, userID); err != nil {
|
||||
t.Fatalf("benutzerkonto haette erhalten bleiben muessen: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3 + Pruefung 3: Gruppen sind sauber tenant-isoliert.
|
||||
func TestGroup_TenantIsolation(t *testing.T) {
|
||||
poolA := setupGroupTestDB(t, "test_rbac03_tenanta")
|
||||
poolB := setupGroupTestDB(t, "test_rbac03_tenantb")
|
||||
gsA := NewGroupStore(poolA)
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := gsA.CreateGroup(ctx, "Nur-Tenant-A"); err != nil {
|
||||
t.Fatalf("create group a: %v", err)
|
||||
}
|
||||
|
||||
var countB int
|
||||
if err := poolB.QueryRow(ctx, `SELECT count(*) FROM groups`).Scan(&countB); err != nil {
|
||||
t.Fatalf("count tenant b: %v", err)
|
||||
}
|
||||
if countB != 0 {
|
||||
t.Fatalf("tenant b sollte keine gruppen aus tenant a sehen, habe %d", countB)
|
||||
}
|
||||
}
|
||||
@@ -1,250 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/auth"
|
||||
)
|
||||
|
||||
// Handler stellt Rollen-/Rechte- und Gruppenverwaltung als HTTP-Endpunkte
|
||||
// bereit (RBAC-05). Duenner Client der bestehenden Store/GroupStore-Schicht —
|
||||
// keine eigene Rechtelogik hier (siehe Ticket-Produkt-DNA).
|
||||
type Handler struct {
|
||||
roles *Store
|
||||
groups *GroupStore
|
||||
}
|
||||
|
||||
func NewHandler(roles *Store, groups *GroupStore) *Handler {
|
||||
return &Handler{roles: roles, groups: groups}
|
||||
}
|
||||
|
||||
// requireManageUsers prueft, ob der aufrufende Benutzer ueberhaupt
|
||||
// Rechteverwaltung ausueben darf — technisch durchgesetzt hier zusaetzlich
|
||||
// zu RBAC-02 (Policy-Enforcement-Schicht), da diese Kachel ein eigener,
|
||||
// besonders sicherheitskritischer HTTP-Einstiegspunkt ist.
|
||||
func requireManageUsers(w http.ResponseWriter, r *http.Request, roles *Store) (callerUserID string, ok bool) {
|
||||
claims, authOK := auth.ClaimsFromContext(r.Context())
|
||||
if !authOK {
|
||||
http.Error(w, "nicht angemeldet", http.StatusUnauthorized)
|
||||
return "", false
|
||||
}
|
||||
assignment, err := roles.Get(r.Context(), claims.UserID)
|
||||
if err != nil || !HasPermission(assignment.Role, PermManageUsers) {
|
||||
http.Error(w, "keine Berechtigung zur Rechteverwaltung", http.StatusForbidden)
|
||||
return "", false
|
||||
}
|
||||
return claims.UserID, true
|
||||
}
|
||||
|
||||
type roleInfo struct {
|
||||
Role Role `json:"role"`
|
||||
Permissions []Permission `json:"permissions"`
|
||||
}
|
||||
|
||||
// ListRoles liefert die (im Tenant-Geltungsbereich zuweisbaren) Rollen mit
|
||||
// ihren vollstaendig aufgeloesten Rechten (Akzeptanzkriterium 1).
|
||||
func (h *Handler) ListRoles(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
||||
return
|
||||
}
|
||||
out := make([]roleInfo, 0, len(assignableRoles))
|
||||
for role := range assignableRoles {
|
||||
out = append(out, roleInfo{Role: role, Permissions: EffectivePermissions(role)})
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(out)
|
||||
}
|
||||
|
||||
type assignRoleRequest struct {
|
||||
UserID string `json:"user_id"`
|
||||
Role Role `json:"role"`
|
||||
}
|
||||
|
||||
// roleRank ordnet die Rollenhierarchie fuer den Selbst-Eskalations-Vergleich
|
||||
// (Akzeptanzkriterium 2 / Pruefung 2) — hoehere Zahl = mehr Rechte. Basiert
|
||||
// auf derselben parent-Kette wie EffectivePermissions, nicht dupliziert als
|
||||
// eigenstaendiges Modell.
|
||||
func roleRank(role Role) int {
|
||||
rank := 0
|
||||
for r, ok := role, true; ok; r, ok = parent[r] {
|
||||
rank++
|
||||
}
|
||||
return rank
|
||||
}
|
||||
|
||||
// AssignRole weist einem Benutzer eine Rolle zu (Akzeptanzkriterium 1).
|
||||
// Verweigert explizit, dass sich der aufrufende Benutzer selbst eine
|
||||
// hoehere Rolle zuweist (Akzeptanzkriterium 2 / Pruefung 2) — unabhaengig
|
||||
// davon, ob RBAC-02 dieselbe Aktion ohnehin ueber die allgemeine
|
||||
// Policy-Schicht verhindern wuerde: Selbst-Eskalation ist ein derart
|
||||
// sicherheitskritischer Einzelfall, dass er hier zusaetzlich explizit und
|
||||
// unuebersehbar geprueft wird, statt sich allein auf eine generische
|
||||
// Regel an anderer Stelle zu verlassen.
|
||||
func (h *Handler) AssignRole(w http.ResponseWriter, r *http.Request) {
|
||||
callerUserID, ok := requireManageUsers(w, r, h.roles)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
|
||||
var req assignRoleRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
if req.UserID == callerUserID {
|
||||
callerAssignment, err := h.roles.Get(r.Context(), callerUserID)
|
||||
callerRole := RoleUser
|
||||
if err == nil {
|
||||
callerRole = callerAssignment.Role
|
||||
}
|
||||
if roleRank(req.Role) > roleRank(callerRole) {
|
||||
http.Error(w, "Sie können sich nicht selbst eine höhere Rolle zuweisen.", http.StatusForbidden)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
assignment, err := h.roles.Assign(r.Context(), req.UserID, req.Role, callerUserID)
|
||||
if err != nil {
|
||||
http.Error(w, "Rolle konnte nicht zugewiesen werden.", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(assignment)
|
||||
}
|
||||
|
||||
// RoleHistory liefert die Zuweisungshistorie eines Benutzers — der in
|
||||
// Akzeptanzkriterium 3 geforderte Verweis auf das Audit-Log (die
|
||||
// role_assignment_history-Tabelle selbst IST die Nachvollziehbarkeits-Spur;
|
||||
// eine vollstaendige Anbindung an Core AUD-01 ist nicht Teil dieser Kachel).
|
||||
func (h *Handler) RoleHistory(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
||||
return
|
||||
}
|
||||
userID := strings.TrimPrefix(r.URL.Path, "/rbac/users/")
|
||||
userID = strings.TrimSuffix(userID, "/history")
|
||||
if userID == "" {
|
||||
http.Error(w, "user_id fehlt", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
history, err := h.roles.History(r.Context(), userID)
|
||||
if err != nil {
|
||||
http.Error(w, "historie konnte nicht geladen werden", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(history)
|
||||
}
|
||||
|
||||
type createGroupRequest struct {
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
// CreateGroup legt eine neue Gruppe an (Akzeptanzkriterium 2).
|
||||
func (h *Handler) CreateGroup(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
||||
return
|
||||
}
|
||||
var req createGroupRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
group, err := h.groups.CreateGroup(r.Context(), req.Name)
|
||||
if err != nil {
|
||||
http.Error(w, "Gruppe konnte nicht angelegt werden.", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(http.StatusCreated)
|
||||
_ = json.NewEncoder(w).Encode(group)
|
||||
}
|
||||
|
||||
type groupWithMembers struct {
|
||||
Group
|
||||
Members []string `json:"members"`
|
||||
}
|
||||
|
||||
// ListGroups liefert alle Gruppen inkl. Mitgliederliste (Akzeptanzkriterium 2).
|
||||
func (h *Handler) ListGroups(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
||||
return
|
||||
}
|
||||
groups, err := h.groups.ListGroups(r.Context())
|
||||
if err != nil {
|
||||
http.Error(w, "Gruppen konnten nicht geladen werden.", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
out := make([]groupWithMembers, 0, len(groups))
|
||||
for _, g := range groups {
|
||||
members, err := h.groups.Members(r.Context(), g.ID)
|
||||
if err != nil {
|
||||
http.Error(w, "Mitglieder konnten nicht geladen werden.", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
out = append(out, groupWithMembers{Group: g, Members: members})
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(out)
|
||||
}
|
||||
|
||||
type groupActionRequest struct {
|
||||
GroupID string `json:"group_id"`
|
||||
UserID string `json:"user_id"`
|
||||
Role Role `json:"role"`
|
||||
}
|
||||
|
||||
// SetGroupRole weist einer Gruppe eine Rolle zu (Akzeptanzkriterium 2).
|
||||
func (h *Handler) SetGroupRole(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
||||
return
|
||||
}
|
||||
var req groupActionRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
if err := h.groups.SetGroupRole(r.Context(), req.GroupID, req.Role); err != nil {
|
||||
http.Error(w, "Gruppenrolle konnte nicht gesetzt werden.", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}
|
||||
|
||||
// AddGroupMember nimmt einen Benutzer in eine Gruppe auf (Akzeptanzkriterium 2).
|
||||
func (h *Handler) AddGroupMember(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
||||
return
|
||||
}
|
||||
var req groupActionRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
if err := h.groups.AddMember(r.Context(), req.GroupID, req.UserID); err != nil {
|
||||
http.Error(w, "Mitglied konnte nicht hinzugefügt werden.", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}
|
||||
|
||||
// RemoveGroupMember entfernt einen Benutzer aus einer Gruppe.
|
||||
func (h *Handler) RemoveGroupMember(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
||||
return
|
||||
}
|
||||
var req groupActionRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
if err := h.groups.RemoveMember(r.Context(), req.GroupID, req.UserID); err != nil {
|
||||
http.Error(w, "Mitglied konnte nicht entfernt werden.", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}
|
||||
@@ -1,358 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/auth"
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
const handlerSchema = `
|
||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
||||
CREATE TABLE users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), email TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active', created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE role_assignments (
|
||||
user_id UUID PRIMARY KEY REFERENCES users(id), role TEXT NOT NULL CHECK (role IN ('user','tenant_admin')),
|
||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE role_assignment_history (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), user_id UUID NOT NULL, role TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE groups (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), name TEXT NOT NULL, role TEXT CHECK (role IN ('user','tenant_admin')),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE group_members (
|
||||
group_id UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE, user_id UUID NOT NULL REFERENCES users(id),
|
||||
added_at TIMESTAMPTZ NOT NULL DEFAULT now(), PRIMARY KEY (group_id, user_id)
|
||||
);`
|
||||
|
||||
func setupHandlerTest(t *testing.T, dbName string) (*Handler, *Store, *user.TenantUserStore, *pgxpool.Pool) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("admin pool: %v", err)
|
||||
}
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
if _, err := adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
||||
t.Fatalf("testdatenbank anlegen: %v", err)
|
||||
}
|
||||
|
||||
dsn := strings.Replace(adminDSN, "/postgres?", "/"+dbName+"?", 1)
|
||||
pool, err := pgxpool.New(ctx, dsn)
|
||||
if err != nil {
|
||||
t.Fatalf("connect testdatenbank: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, handlerSchema); err != nil {
|
||||
t.Fatalf("schema: %v", err)
|
||||
}
|
||||
|
||||
t.Cleanup(func() {
|
||||
pool.Close()
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
adminPool.Close()
|
||||
})
|
||||
|
||||
roleStore := NewStore(pool)
|
||||
groupStore := NewGroupStore(pool)
|
||||
return NewHandler(roleStore, groupStore), roleStore, user.NewTenantUserStore(pool), pool
|
||||
}
|
||||
|
||||
func sessionCookieFor(t *testing.T, issuer *auth.TokenIssuer, userID string) *http.Cookie {
|
||||
t.Helper()
|
||||
token, err := issuer.Issue(userID, "acme")
|
||||
if err != nil {
|
||||
t.Fatalf("session-token ausstellen: %v", err)
|
||||
}
|
||||
return &http.Cookie{Name: auth.CookieName, Value: token}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1: Rollen und ihre Grundrechte sind einsehbar.
|
||||
func TestListRoles(t *testing.T) {
|
||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_list_roles")
|
||||
ctx := context.Background()
|
||||
admin, err := users.Create(ctx, "admin@acme.example", "Admin")
|
||||
if err != nil {
|
||||
t.Fatalf("admin anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
||||
t.Fatalf("admin-rolle setzen: %v", err)
|
||||
}
|
||||
|
||||
issuer := auth.NewTokenIssuer("test-secret")
|
||||
req := httptest.NewRequest(http.MethodGet, "/rbac/roles", nil)
|
||||
req.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
||||
rec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.ListRoles)(rec, req)
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
var out []roleInfo
|
||||
if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
|
||||
t.Fatalf("response dekodieren: %v", err)
|
||||
}
|
||||
if len(out) != 2 {
|
||||
t.Fatalf("erwartet 2 zuweisbare rollen (user, tenant_admin), habe %d", len(out))
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 / Pruefung 2: Selbst-Eskalation wird abgewiesen.
|
||||
func TestAssignRole_RejectsSelfEscalation(t *testing.T) {
|
||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_self_escalation")
|
||||
ctx := context.Background()
|
||||
u, err := users.Create(ctx, "normal@acme.example", "Normaler Nutzer")
|
||||
if err != nil {
|
||||
t.Fatalf("nutzer anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, u.ID, RoleUser, "system"); err != nil {
|
||||
t.Fatalf("ausgangsrolle setzen: %v", err)
|
||||
}
|
||||
|
||||
issuer := auth.NewTokenIssuer("test-secret")
|
||||
body, _ := json.Marshal(assignRoleRequest{UserID: u.ID, Role: RoleTenantAdmin})
|
||||
req := httptest.NewRequest(http.MethodPost, "/rbac/users/role", bytes.NewReader(body))
|
||||
req.AddCookie(sessionCookieFor(t, issuer, u.ID))
|
||||
rec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.AssignRole)(rec, req)
|
||||
|
||||
if rec.Code != http.StatusForbidden {
|
||||
t.Fatalf("status = %d, want 403 (selbst-eskalation muss abgewiesen werden)", rec.Code)
|
||||
}
|
||||
|
||||
// Rolle muss unveraendert geblieben sein.
|
||||
assignment, err := roles.Get(ctx, u.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("rolle laden: %v", err)
|
||||
}
|
||||
if assignment.Role != RoleUser {
|
||||
t.Fatalf("rolle wurde trotz abgewiesener anfrage geaendert: %q", assignment.Role)
|
||||
}
|
||||
}
|
||||
|
||||
// Gegenprobe: ein Tenant-Admin darf EINEM ANDEREN Benutzer eine hoehere
|
||||
// Rolle zuweisen — nur die Selbst-Zuweisung ist gesperrt.
|
||||
func TestAssignRole_AdminCanPromoteOtherUser(t *testing.T) {
|
||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_promote_other")
|
||||
ctx := context.Background()
|
||||
admin, err := users.Create(ctx, "admin2@acme.example", "Admin")
|
||||
if err != nil {
|
||||
t.Fatalf("admin anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
||||
t.Fatalf("admin-rolle setzen: %v", err)
|
||||
}
|
||||
other, err := users.Create(ctx, "other@acme.example", "Anderer Nutzer")
|
||||
if err != nil {
|
||||
t.Fatalf("anderen nutzer anlegen: %v", err)
|
||||
}
|
||||
|
||||
issuer := auth.NewTokenIssuer("test-secret")
|
||||
body, _ := json.Marshal(assignRoleRequest{UserID: other.ID, Role: RoleTenantAdmin})
|
||||
req := httptest.NewRequest(http.MethodPost, "/rbac/users/role", bytes.NewReader(body))
|
||||
req.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
||||
rec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.AssignRole)(rec, req)
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
// QA-03 Akzeptanzkriterium 2: Rueckstufung (tenant_admin -> user) durch
|
||||
// einen Admin funktioniert ebenso wie die bereits getestete Hochstufung —
|
||||
// Rollenwechsel-Szenario in beide Richtungen, History haelt beide fest.
|
||||
func TestAssignRole_AdminCanDemoteOtherUser(t *testing.T) {
|
||||
h, roles, users, _ := setupHandlerTest(t, "qa03_demote_other")
|
||||
ctx := context.Background()
|
||||
admin, err := users.Create(ctx, "admin-demote@acme.example", "Admin")
|
||||
if err != nil {
|
||||
t.Fatalf("admin anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
||||
t.Fatalf("admin-rolle setzen: %v", err)
|
||||
}
|
||||
other, err := users.Create(ctx, "wird-zurueckgestuft@acme.example", "Wird zurueckgestuft")
|
||||
if err != nil {
|
||||
t.Fatalf("anderen nutzer anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, other.ID, RoleTenantAdmin, admin.ID); err != nil {
|
||||
t.Fatalf("ausgangsrolle (tenant_admin) setzen: %v", err)
|
||||
}
|
||||
|
||||
issuer := auth.NewTokenIssuer("test-secret")
|
||||
body, _ := json.Marshal(assignRoleRequest{UserID: other.ID, Role: RoleUser})
|
||||
req := httptest.NewRequest(http.MethodPost, "/rbac/users/role", bytes.NewReader(body))
|
||||
req.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
||||
rec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.AssignRole)(rec, req)
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
|
||||
assignment, err := roles.Get(ctx, other.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("rolle laden: %v", err)
|
||||
}
|
||||
if assignment.Role != RoleUser {
|
||||
t.Fatalf("rolle = %q, want user (rueckgestuft)", assignment.Role)
|
||||
}
|
||||
|
||||
history, err := roles.History(ctx, other.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("history laden: %v", err)
|
||||
}
|
||||
if len(history) != 2 || history[0].Role != RoleTenantAdmin || history[1].Role != RoleUser {
|
||||
t.Fatalf("erwartet history [tenant_admin, user] (hoch- dann rueckgestuft), habe %+v", history)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3: Aenderungen an Rechten sind nachvollziehbar.
|
||||
func TestRoleHistory_TracksAssignments(t *testing.T) {
|
||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_history")
|
||||
ctx := context.Background()
|
||||
admin, err := users.Create(ctx, "admin3@acme.example", "Admin")
|
||||
if err != nil {
|
||||
t.Fatalf("admin anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
||||
t.Fatalf("admin-rolle setzen: %v", err)
|
||||
}
|
||||
target, err := users.Create(ctx, "target@acme.example", "Zielnutzer")
|
||||
if err != nil {
|
||||
t.Fatalf("zielnutzer anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, target.ID, RoleUser, admin.ID); err != nil {
|
||||
t.Fatalf("erste zuweisung: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, target.ID, RoleTenantAdmin, admin.ID); err != nil {
|
||||
t.Fatalf("zweite zuweisung: %v", err)
|
||||
}
|
||||
|
||||
issuer := auth.NewTokenIssuer("test-secret")
|
||||
req := httptest.NewRequest(http.MethodGet, "/rbac/users/"+target.ID+"/history", nil)
|
||||
req.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
||||
rec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.RoleHistory)(rec, req)
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
var history []Assignment
|
||||
if err := json.Unmarshal(rec.Body.Bytes(), &history); err != nil {
|
||||
t.Fatalf("response dekodieren: %v", err)
|
||||
}
|
||||
if len(history) != 2 {
|
||||
t.Fatalf("erwartet 2 historieneintraege, habe %d", len(history))
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2: Gruppen anlegen, Mitglieder zuordnen, Rolle zuweisen.
|
||||
func TestGroupWorkflow(t *testing.T) {
|
||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_group_workflow")
|
||||
ctx := context.Background()
|
||||
admin, err := users.Create(ctx, "admin4@acme.example", "Admin")
|
||||
if err != nil {
|
||||
t.Fatalf("admin anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
||||
t.Fatalf("admin-rolle setzen: %v", err)
|
||||
}
|
||||
member, err := users.Create(ctx, "member@acme.example", "Mitglied")
|
||||
if err != nil {
|
||||
t.Fatalf("mitglied anlegen: %v", err)
|
||||
}
|
||||
|
||||
issuer := auth.NewTokenIssuer("test-secret")
|
||||
|
||||
createBody, _ := json.Marshal(createGroupRequest{Name: "Buchhaltung"})
|
||||
createReq := httptest.NewRequest(http.MethodPost, "/rbac/groups", bytes.NewReader(createBody))
|
||||
createReq.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
||||
createRec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.CreateGroup)(createRec, createReq)
|
||||
if createRec.Code != http.StatusCreated {
|
||||
t.Fatalf("create group: status = %d, body: %s", createRec.Code, createRec.Body.String())
|
||||
}
|
||||
var group Group
|
||||
if err := json.Unmarshal(createRec.Body.Bytes(), &group); err != nil {
|
||||
t.Fatalf("group-response dekodieren: %v", err)
|
||||
}
|
||||
|
||||
roleBody, _ := json.Marshal(groupActionRequest{GroupID: group.ID, Role: RoleUser})
|
||||
roleReq := httptest.NewRequest(http.MethodPost, "/rbac/groups/role", bytes.NewReader(roleBody))
|
||||
roleReq.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
||||
roleRec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.SetGroupRole)(roleRec, roleReq)
|
||||
if roleRec.Code != http.StatusOK {
|
||||
t.Fatalf("set group role: status = %d, body: %s", roleRec.Code, roleRec.Body.String())
|
||||
}
|
||||
|
||||
memberBody, _ := json.Marshal(groupActionRequest{GroupID: group.ID, UserID: member.ID})
|
||||
memberReq := httptest.NewRequest(http.MethodPost, "/rbac/groups/members", bytes.NewReader(memberBody))
|
||||
memberReq.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
||||
memberRec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.AddGroupMember)(memberRec, memberReq)
|
||||
if memberRec.Code != http.StatusOK {
|
||||
t.Fatalf("add member: status = %d, body: %s", memberRec.Code, memberRec.Body.String())
|
||||
}
|
||||
|
||||
listReq := httptest.NewRequest(http.MethodGet, "/rbac/groups", nil)
|
||||
listReq.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
||||
listRec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.ListGroups)(listRec, listReq)
|
||||
if listRec.Code != http.StatusOK {
|
||||
t.Fatalf("list groups: status = %d, body: %s", listRec.Code, listRec.Body.String())
|
||||
}
|
||||
var groups []groupWithMembers
|
||||
if err := json.Unmarshal(listRec.Body.Bytes(), &groups); err != nil {
|
||||
t.Fatalf("groups-response dekodieren: %v", err)
|
||||
}
|
||||
if len(groups) != 1 || len(groups[0].Members) != 1 || groups[0].Members[0] != member.ID {
|
||||
t.Fatalf("erwartet 1 gruppe mit 1 mitglied (%s), habe %+v", member.ID, groups)
|
||||
}
|
||||
}
|
||||
|
||||
// Ohne Rechteverwaltungsberechtigung (normale 'user'-Rolle) wird jeder
|
||||
// Endpunkt abgewiesen — Tenant-Isolation ist strukturell (Modell C, siehe
|
||||
// GroupStore-Kommentar), diese Pruefung deckt die Rechte-Ebene ab.
|
||||
func TestRequireManageUsers_RejectsPlainUser(t *testing.T) {
|
||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_reject_plain")
|
||||
ctx := context.Background()
|
||||
u, err := users.Create(ctx, "plain@acme.example", "Normaler Nutzer")
|
||||
if err != nil {
|
||||
t.Fatalf("nutzer anlegen: %v", err)
|
||||
}
|
||||
if _, err := roles.Assign(ctx, u.ID, RoleUser, "system"); err != nil {
|
||||
t.Fatalf("rolle setzen: %v", err)
|
||||
}
|
||||
|
||||
issuer := auth.NewTokenIssuer("test-secret")
|
||||
req := httptest.NewRequest(http.MethodGet, "/rbac/roles", nil)
|
||||
req.AddCookie(sessionCookieFor(t, issuer, u.ID))
|
||||
rec := httptest.NewRecorder()
|
||||
auth.RequireAuth(issuer, h.ListRoles)(rec, req)
|
||||
|
||||
if rec.Code != http.StatusForbidden {
|
||||
t.Fatalf("status = %d, want 403 fuer benutzer ohne rechteverwaltung", rec.Code)
|
||||
}
|
||||
}
|
||||
@@ -1,71 +0,0 @@
|
||||
// Package rbac implementiert Core RBAC-01: das Rollenmodell mit
|
||||
// Grundrollen/-rechten, Hierarchie und Zuweisung. Die eigentliche
|
||||
// Durchsetzung (erlaubt/verboten je Request) ist RBAC-02, dieses Paket
|
||||
// liefert nur Modell + Zuweisung (Casbin-Prinzip: Policy-Modell getrennt
|
||||
// von der Entscheidungsfunktion).
|
||||
package rbac
|
||||
|
||||
// Role ist eine der drei Grundrollen. Superadmin lebt mandantenuebergreifend
|
||||
// (siehe internal/user.SuperadminStore aus IAM-01) und wird deshalb NICHT
|
||||
// ueber Store (tenant-gescoped) zugewiesen — die Existenz eines Superadmin-
|
||||
// Kontos IST die Rollenzuweisung.
|
||||
type Role string
|
||||
|
||||
const (
|
||||
RoleSuperadmin Role = "superadmin"
|
||||
RoleTenantAdmin Role = "tenant_admin"
|
||||
RoleUser Role = "user"
|
||||
)
|
||||
|
||||
type Permission string
|
||||
|
||||
const (
|
||||
PermSelfRead Permission = "self.read"
|
||||
PermSelfUpdate Permission = "self.update"
|
||||
PermManageUsers Permission = "tenant.manage_users"
|
||||
PermManageSettings Permission = "tenant.manage_settings"
|
||||
PermManageTenants Permission = "platform.manage_tenants"
|
||||
)
|
||||
|
||||
// parent bildet die Rollenhierarchie ab (Akzeptanzkriterium 2): eine Rolle
|
||||
// erbt alle Rechte ihrer Elternrolle. tenant_admin erbt von user,
|
||||
// superadmin erbt von tenant_admin.
|
||||
var parent = map[Role]Role{
|
||||
RoleTenantAdmin: RoleUser,
|
||||
RoleSuperadmin: RoleTenantAdmin,
|
||||
}
|
||||
|
||||
// direct sind die einer Rolle direkt (ohne Vererbung) zugeordneten Rechte.
|
||||
var direct = map[Role][]Permission{
|
||||
RoleUser: {PermSelfRead, PermSelfUpdate},
|
||||
RoleTenantAdmin: {PermManageUsers, PermManageSettings},
|
||||
RoleSuperadmin: {PermManageTenants},
|
||||
}
|
||||
|
||||
// EffectivePermissions liefert die vollstaendige, ueber die Hierarchie
|
||||
// aufgeloeste Rechtemenge einer Rolle (Akzeptanzkriterium 2 / Pruefung 2).
|
||||
func EffectivePermissions(role Role) []Permission {
|
||||
seen := make(map[Permission]bool)
|
||||
var out []Permission
|
||||
|
||||
for r, ok := role, true; ok; r, ok = parent[r] {
|
||||
for _, p := range direct[r] {
|
||||
if !seen[p] {
|
||||
seen[p] = true
|
||||
out = append(out, p)
|
||||
}
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// HasPermission prueft, ob eine Rolle (inklusive geerbter Rechte) ein
|
||||
// bestimmtes Recht besitzt.
|
||||
func HasPermission(role Role, perm Permission) bool {
|
||||
for _, p := range EffectivePermissions(role) {
|
||||
if p == perm {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
@@ -1,48 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import "testing"
|
||||
|
||||
func contains(perms []Permission, p Permission) bool {
|
||||
for _, x := range perms {
|
||||
if x == p {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 2: Rollenhierarchie liefert die erwartete
|
||||
// effektive Rechtemenge.
|
||||
func TestEffectivePermissions_Inheritance(t *testing.T) {
|
||||
userPerms := EffectivePermissions(RoleUser)
|
||||
if !contains(userPerms, PermSelfRead) || !contains(userPerms, PermSelfUpdate) {
|
||||
t.Fatalf("user sollte self.read/self.update haben, habe %v", userPerms)
|
||||
}
|
||||
if contains(userPerms, PermManageUsers) {
|
||||
t.Fatal("user sollte KEIN tenant.manage_users haben")
|
||||
}
|
||||
|
||||
adminPerms := EffectivePermissions(RoleTenantAdmin)
|
||||
if !contains(adminPerms, PermSelfRead) || !contains(adminPerms, PermManageUsers) || !contains(adminPerms, PermManageSettings) {
|
||||
t.Fatalf("tenant_admin sollte geerbte user-rechte + eigene rechte haben, habe %v", adminPerms)
|
||||
}
|
||||
if contains(adminPerms, PermManageTenants) {
|
||||
t.Fatal("tenant_admin sollte KEIN platform.manage_tenants haben")
|
||||
}
|
||||
|
||||
superPerms := EffectivePermissions(RoleSuperadmin)
|
||||
for _, want := range []Permission{PermSelfRead, PermSelfUpdate, PermManageUsers, PermManageSettings, PermManageTenants} {
|
||||
if !contains(superPerms, want) {
|
||||
t.Fatalf("superadmin sollte %q haben (volle vererbte kette), habe %v", want, superPerms)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHasPermission(t *testing.T) {
|
||||
if !HasPermission(RoleTenantAdmin, PermSelfRead) {
|
||||
t.Fatal("tenant_admin sollte geerbtes self.read haben")
|
||||
}
|
||||
if HasPermission(RoleUser, PermManageTenants) {
|
||||
t.Fatal("user sollte platform.manage_tenants nicht haben")
|
||||
}
|
||||
}
|
||||
@@ -1,124 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
var (
|
||||
// ErrRoleNotAssignableInTenantScope wird geliefert, wenn versucht wird,
|
||||
// eine mandantenuebergreifende Rolle (superadmin) ueber den tenant-
|
||||
// gescopten Store zu vergeben — die erlaubte Matrix laesst hier nur
|
||||
// user/tenant_admin zu (Akzeptanzkriterium 1 / Pruefung 1).
|
||||
ErrRoleNotAssignableInTenantScope = errors.New("rbac: rolle ist in diesem geltungsbereich nicht zuweisbar")
|
||||
ErrNotFound = errors.New("rbac: keine rollenzuweisung gefunden")
|
||||
)
|
||||
|
||||
// assignableRoles ist die erlaubte Matrix fuer Store (tenant-gescoped).
|
||||
var assignableRoles = map[Role]bool{
|
||||
RoleUser: true,
|
||||
RoleTenantAdmin: true,
|
||||
}
|
||||
|
||||
type Assignment struct {
|
||||
UserID string
|
||||
Role Role
|
||||
GrantedBy string
|
||||
}
|
||||
|
||||
// Store verwaltet Rollenzuweisungen innerhalb GENAU EINER Tenant-Datenbank —
|
||||
// analog zu internal/user.TenantUserStore (Modell C: der Pool bestimmt den
|
||||
// Tenant, keine tenant_id-Spalte noetig).
|
||||
type Store struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewStore(pool *pgxpool.Pool) *Store {
|
||||
return &Store{pool: pool}
|
||||
}
|
||||
|
||||
// Assign vergibt eine Rolle an einen Benutzer. grantedBy identifiziert den
|
||||
// Akteur, der die Zuweisung vorgenommen hat (Akzeptanzkriterium 3). Jede
|
||||
// Zuweisung wird zusaetzlich in role_assignment_history festgehalten, auch
|
||||
// wenn sie eine vorherige Rolle ersetzt.
|
||||
func (s *Store) Assign(ctx context.Context, userID string, role Role, grantedBy string) (Assignment, error) {
|
||||
if !assignableRoles[role] {
|
||||
return Assignment{}, ErrRoleNotAssignableInTenantScope
|
||||
}
|
||||
if grantedBy == "" {
|
||||
return Assignment{}, errors.New("rbac: grantedBy darf nicht leer sein")
|
||||
}
|
||||
|
||||
tx, err := s.pool.Begin(ctx)
|
||||
if err != nil {
|
||||
return Assignment{}, fmt.Errorf("transaktion starten: %w", err)
|
||||
}
|
||||
defer func() { _ = tx.Rollback(ctx) }()
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO role_assignments (user_id, role, granted_by, granted_at)
|
||||
VALUES ($1, $2, $3, now())
|
||||
ON CONFLICT (user_id) DO UPDATE SET role = $2, granted_by = $3, granted_at = now()
|
||||
`, userID, string(role), grantedBy); err != nil {
|
||||
return Assignment{}, fmt.Errorf("rolle zuweisen: %w", err)
|
||||
}
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO role_assignment_history (user_id, role, granted_by, granted_at)
|
||||
VALUES ($1, $2, $3, now())
|
||||
`, userID, string(role), grantedBy); err != nil {
|
||||
return Assignment{}, fmt.Errorf("historie schreiben: %w", err)
|
||||
}
|
||||
|
||||
if err := tx.Commit(ctx); err != nil {
|
||||
return Assignment{}, fmt.Errorf("transaktion committen: %w", err)
|
||||
}
|
||||
|
||||
return Assignment{UserID: userID, Role: role, GrantedBy: grantedBy}, nil
|
||||
}
|
||||
|
||||
func (s *Store) Get(ctx context.Context, userID string) (Assignment, error) {
|
||||
var a Assignment
|
||||
var role string
|
||||
a.UserID = userID
|
||||
if err := s.pool.QueryRow(ctx, `
|
||||
SELECT role, granted_by FROM role_assignments WHERE user_id = $1
|
||||
`, userID).Scan(&role, &a.GrantedBy); err != nil {
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return Assignment{}, ErrNotFound
|
||||
}
|
||||
return Assignment{}, fmt.Errorf("rollenzuweisung lesen: %w", err)
|
||||
}
|
||||
a.Role = Role(role)
|
||||
return a, nil
|
||||
}
|
||||
|
||||
// History liefert jede Rollenzuweisung eines Benutzers in chronologischer
|
||||
// Reihenfolge — die Grundlage fuer "wer hat wann welche Rolle vergeben"
|
||||
// (Akzeptanzkriterium 3).
|
||||
func (s *Store) History(ctx context.Context, userID string) ([]Assignment, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT role, granted_by FROM role_assignment_history
|
||||
WHERE user_id = $1 ORDER BY granted_at
|
||||
`, userID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("historie abfragen: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []Assignment
|
||||
for rows.Next() {
|
||||
var role string
|
||||
a := Assignment{UserID: userID}
|
||||
if err := rows.Scan(&role, &a.GrantedBy); err != nil {
|
||||
return nil, fmt.Errorf("historieneintrag lesen: %w", err)
|
||||
}
|
||||
a.Role = Role(role)
|
||||
out = append(out, a)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
@@ -1,144 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
func setupStoreTest(t *testing.T) (*Store, string, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
pool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("pool: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS role_assignments (
|
||||
user_id UUID PRIMARY KEY REFERENCES users(id),
|
||||
role TEXT NOT NULL CHECK (role IN ('user', 'tenant_admin')),
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS role_assignment_history (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
user_id UUID NOT NULL,
|
||||
role TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
`); err != nil {
|
||||
t.Fatalf("schema: %v", err)
|
||||
}
|
||||
|
||||
userStore := user.NewTenantUserStore(pool)
|
||||
u, err := userStore.Create(ctx, "rbac_test@example.com", "RBAC Test")
|
||||
if err != nil {
|
||||
t.Fatalf("testuser anlegen: %v", err)
|
||||
}
|
||||
|
||||
cleanup := func() {
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM role_assignment_history WHERE user_id = $1`, u.ID)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM role_assignments WHERE user_id = $1`, u.ID)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, u.ID)
|
||||
pool.Close()
|
||||
}
|
||||
return NewStore(pool), u.ID, cleanup
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1: Grundrollen sind einem Benutzer je Tenant zuweisbar.
|
||||
func TestStore_AssignAndGet(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
assigned, err := store.Assign(ctx, userID, RoleTenantAdmin, "admin@acme.example")
|
||||
if err != nil {
|
||||
t.Fatalf("assign: %v", err)
|
||||
}
|
||||
if assigned.Role != RoleTenantAdmin {
|
||||
t.Fatalf("erwartet tenant_admin, habe %q", assigned.Role)
|
||||
}
|
||||
|
||||
got, err := store.Get(ctx, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("get: %v", err)
|
||||
}
|
||||
if got.Role != RoleTenantAdmin || got.GrantedBy != "admin@acme.example" {
|
||||
t.Fatalf("zuweisung unerwartet: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1 + Pruefung 1: Zuweisung ausserhalb der erlaubten
|
||||
// Matrix (superadmin im tenant-gescopten Store) wird abgewiesen.
|
||||
func TestStore_RejectsSuperadminOutsideAllowedMatrix(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
_, err := store.Assign(ctx, userID, RoleSuperadmin, "admin@acme.example")
|
||||
if !errors.Is(err, ErrRoleNotAssignableInTenantScope) {
|
||||
t.Fatalf("erwartet ErrRoleNotAssignableInTenantScope, habe %v", err)
|
||||
}
|
||||
|
||||
// Sicherstellen, dass der abgewiesene Versuch keine Zeile hinterlassen hat.
|
||||
if _, err := store.Get(ctx, userID); !errors.Is(err, ErrNotFound) {
|
||||
t.Fatalf("erwartet ErrNotFound nach abgewiesener zuweisung, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_RejectsUnknownRole(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := store.Assign(ctx, userID, Role("erfunden"), "admin@acme.example"); !errors.Is(err, ErrRoleNotAssignableInTenantScope) {
|
||||
t.Fatalf("erwartet ErrRoleNotAssignableInTenantScope fuer unbekannte rolle, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3: Rollenzuweisung vollstaendig auditierbar.
|
||||
func TestStore_HistoryTracksWhoAndWhen(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := store.Assign(ctx, userID, RoleUser, "system"); err != nil {
|
||||
t.Fatalf("assign 1: %v", err)
|
||||
}
|
||||
if _, err := store.Assign(ctx, userID, RoleTenantAdmin, "admin@acme.example"); err != nil {
|
||||
t.Fatalf("assign 2: %v", err)
|
||||
}
|
||||
|
||||
history, err := store.History(ctx, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("history: %v", err)
|
||||
}
|
||||
if len(history) != 2 {
|
||||
t.Fatalf("erwartet 2 historieneintraege, habe %d", len(history))
|
||||
}
|
||||
if history[0].Role != RoleUser || history[0].GrantedBy != "system" {
|
||||
t.Fatalf("history[0] unerwartet: %+v", history[0])
|
||||
}
|
||||
if history[1].Role != RoleTenantAdmin || history[1].GrantedBy != "admin@acme.example" {
|
||||
t.Fatalf("history[1] unerwartet: %+v", history[1])
|
||||
}
|
||||
}
|
||||
@@ -2,7 +2,10 @@ package tenant
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
// Handler ist eine schlanke Vorbereitung der Schnittstelle fuer API-01
|
||||
@@ -43,3 +46,49 @@ func (h *Handler) CreateTenant(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusCreated)
|
||||
_ = json.NewEncoder(w).Encode(t)
|
||||
}
|
||||
|
||||
// OnboardingHandler stellt den Self-Service-Endpunkt aus TEN-02 bereit —
|
||||
// eigener Handler statt Erweiterung von Handler.CreateTenant, damit die
|
||||
// TEN-01-Schnittstelle (reines Provisioning ohne Admin-Konto) unveraendert
|
||||
// bleibt.
|
||||
type OnboardingHandler struct {
|
||||
service *OnboardingService
|
||||
}
|
||||
|
||||
func NewOnboardingHandler(s *OnboardingService) *OnboardingHandler {
|
||||
return &OnboardingHandler{service: s}
|
||||
}
|
||||
|
||||
type onboardRequest struct {
|
||||
Slug string `json:"slug"`
|
||||
Name string `json:"name"`
|
||||
AdminEmail string `json:"admin_email"`
|
||||
AdminName string `json:"admin_name"`
|
||||
}
|
||||
|
||||
func (h *OnboardingHandler) Onboard(w http.ResponseWriter, r *http.Request) {
|
||||
var req onboardRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
result, err := h.service.Onboard(r.Context(), req.Slug, req.Name, req.AdminEmail, req.AdminName)
|
||||
if err != nil {
|
||||
switch {
|
||||
case errors.Is(err, ErrInvalidSlug),
|
||||
errors.Is(err, ErrMissingField),
|
||||
errors.Is(err, user.ErrInvalidEmail):
|
||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||
case errors.Is(err, ErrTenantExists):
|
||||
http.Error(w, err.Error(), http.StatusConflict)
|
||||
default:
|
||||
http.Error(w, "mandant konnte nicht angelegt werden", http.StatusInternalServerError)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(http.StatusCreated)
|
||||
_ = json.NewEncoder(w).Encode(result)
|
||||
}
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
package tenant
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
var ErrMissingField = errors.New("tenant: pflichtfeld fehlt")
|
||||
|
||||
// OnboardingService implementiert TEN-02: Self-Service-Anlage eines neuen
|
||||
// Mandanten inklusive Ersteinrichtung des Administrator-Kontos in einem
|
||||
// Vorgang. Schlaegt die Admin-Anlage fehl, wird der bereits provisionierte
|
||||
// Tenant per Deprovision wieder vollstaendig entfernt (Saga-Kompensation,
|
||||
// da CREATE DATABASE keine echte cross-database Transaktion erlaubt).
|
||||
type OnboardingService struct {
|
||||
provisioner *Provisioner
|
||||
// tenantSchemaPath zeigt auf migrations/tenant/0001_users.up.sql, mit der
|
||||
// die frisch angelegte Tenant-Datenbank initialisiert wird, bevor der
|
||||
// erste Administrator angelegt werden kann.
|
||||
tenantSchemaPath string
|
||||
}
|
||||
|
||||
func NewOnboardingService(provisioner *Provisioner, tenantSchemaPath string) *OnboardingService {
|
||||
return &OnboardingService{provisioner: provisioner, tenantSchemaPath: tenantSchemaPath}
|
||||
}
|
||||
|
||||
type OnboardResult struct {
|
||||
Tenant Tenant
|
||||
Admin user.User
|
||||
}
|
||||
|
||||
func (s *OnboardingService) Onboard(ctx context.Context, slug, tenantName, adminEmail, adminName string) (OnboardResult, error) {
|
||||
if tenantName == "" {
|
||||
return OnboardResult{}, fmt.Errorf("%w: name", ErrMissingField)
|
||||
}
|
||||
if adminName == "" {
|
||||
return OnboardResult{}, fmt.Errorf("%w: admin-name", ErrMissingField)
|
||||
}
|
||||
if err := ValidateSlug(slug); err != nil {
|
||||
return OnboardResult{}, err
|
||||
}
|
||||
if err := user.ValidateEmail(adminEmail); err != nil {
|
||||
return OnboardResult{}, err
|
||||
}
|
||||
|
||||
t, err := s.provisioner.Provision(ctx, slug, tenantName)
|
||||
if err != nil {
|
||||
return OnboardResult{}, err
|
||||
}
|
||||
|
||||
admin, err := s.setupAdmin(ctx, t, adminEmail, adminName)
|
||||
if err != nil {
|
||||
_ = s.provisioner.Deprovision(ctx, t)
|
||||
return OnboardResult{}, err
|
||||
}
|
||||
|
||||
return OnboardResult{Tenant: t, Admin: admin}, nil
|
||||
}
|
||||
|
||||
func (s *OnboardingService) setupAdmin(ctx context.Context, t Tenant, adminEmail, adminName string) (user.User, error) {
|
||||
pool, err := pgxpool.New(ctx, t.DBDSN)
|
||||
if err != nil {
|
||||
return user.User{}, fmt.Errorf("verbindung zur neuen tenant-datenbank: %w", err)
|
||||
}
|
||||
defer pool.Close()
|
||||
|
||||
schema, err := os.ReadFile(s.tenantSchemaPath)
|
||||
if err != nil {
|
||||
return user.User{}, fmt.Errorf("tenant-schema lesen: %w", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, string(schema)); err != nil {
|
||||
return user.User{}, fmt.Errorf("tenant-schema anwenden: %w", err)
|
||||
}
|
||||
|
||||
store := user.NewTenantUserStore(pool)
|
||||
return store.Create(ctx, adminEmail, adminName)
|
||||
}
|
||||
@@ -0,0 +1,169 @@
|
||||
package tenant
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
// schemaPathForTest liefert den Pfad zur echten Migration, damit Tests exakt
|
||||
// dasselbe Schema anwenden wie die Produktion (keine Zweitkopie des SQL).
|
||||
const schemaPathForTest = "../../migrations/tenant/0001_users.up.sql"
|
||||
|
||||
func TestOnboarding_ValidationErrors(t *testing.T) {
|
||||
// Reine Eingabevalidierung, braucht keine Datenbank.
|
||||
svc := NewOnboardingService(nil, schemaPathForTest)
|
||||
ctx := context.Background()
|
||||
|
||||
cases := []struct {
|
||||
name string
|
||||
slug string
|
||||
tenantName string
|
||||
email string
|
||||
adminName string
|
||||
wantErr error
|
||||
}{
|
||||
{"leerer name", "acme", "", "a@b.de", "Admin", ErrMissingField},
|
||||
{"leerer admin-name", "acme", "Acme", "a@b.de", "", ErrMissingField},
|
||||
{"ungueltiger slug", "Acme!", "Acme", "a@b.de", "Admin", ErrInvalidSlug},
|
||||
{"ungueltige email", "acme", "Acme", "keine-email", "Admin", user.ErrInvalidEmail},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
_, err := svc.Onboard(ctx, c.slug, c.tenantName, c.email, c.adminName)
|
||||
if !errors.Is(err, c.wantErr) {
|
||||
t.Fatalf("erwartet %v, habe %v", c.wantErr, err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func newTestOnboardingService(t *testing.T) (*OnboardingService, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("admin pool: %v", err)
|
||||
}
|
||||
registryPool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("registry pool: %v", err)
|
||||
}
|
||||
|
||||
if _, err := registryPool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS tenants (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
slug TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
db_name TEXT NOT NULL UNIQUE,
|
||||
db_dsn TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
)`); err != nil {
|
||||
t.Fatalf("registry-schema: %v", err)
|
||||
}
|
||||
|
||||
registry := NewRegistry(registryPool)
|
||||
dsnTemplate := strings.Replace(adminDSN, "/postgres?", "/%s?", 1)
|
||||
provisioner := NewProvisioner(adminPool, registry, dsnTemplate)
|
||||
svc := NewOnboardingService(provisioner, schemaPathForTest)
|
||||
|
||||
cleanup := func() {
|
||||
registryPool.Close()
|
||||
adminPool.Close()
|
||||
}
|
||||
return svc, cleanup
|
||||
}
|
||||
|
||||
// Akzeptanzkriterien 1+2: Mandant + Erst-Admin in einem Vorgang.
|
||||
func TestOnboarding_CreatesTenantAndAdmin(t *testing.T) {
|
||||
svc, cleanup := newTestOnboardingService(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
t.Cleanup(func() {
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
p, _ := pgxpool.New(ctx, adminDSN)
|
||||
defer p.Close()
|
||||
_, _ = p.Exec(ctx, `DELETE FROM tenants WHERE slug = 'onboardtest'`)
|
||||
_, _ = p.Exec(ctx, `DROP DATABASE IF EXISTS tenant_onboardtest`)
|
||||
})
|
||||
|
||||
result, err := svc.Onboard(ctx, "onboardtest", "Onboard Test GmbH", "admin@onboardtest.example", "Erste Admin")
|
||||
if err != nil {
|
||||
t.Fatalf("onboard: %v", err)
|
||||
}
|
||||
if result.Tenant.Slug != "onboardtest" {
|
||||
t.Fatalf("tenant slug = %q", result.Tenant.Slug)
|
||||
}
|
||||
if result.Admin.Email != "admin@onboardtest.example" {
|
||||
t.Fatalf("admin email = %q", result.Admin.Email)
|
||||
}
|
||||
|
||||
pool, err := pgxpool.New(ctx, result.Tenant.DBDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("connect tenant db: %v", err)
|
||||
}
|
||||
defer pool.Close()
|
||||
|
||||
var count int
|
||||
if err := pool.QueryRow(ctx, `SELECT count(*) FROM users WHERE email = $1`, "admin@onboardtest.example").Scan(&count); err != nil {
|
||||
t.Fatalf("admin in tenant-db pruefen: %v", err)
|
||||
}
|
||||
if count != 1 {
|
||||
t.Fatalf("erwartet genau einen admin in der tenant-db, habe %d", count)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3 + Pruefung 1: doppelte Registrierung wird abgewiesen,
|
||||
// auch bei zwei parallelen Anfragen entsteht kein Doppel-Tenant.
|
||||
func TestOnboarding_RejectsDuplicateSlugConcurrently(t *testing.T) {
|
||||
svc, cleanup := newTestOnboardingService(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
t.Cleanup(func() {
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
p, _ := pgxpool.New(ctx, adminDSN)
|
||||
defer p.Close()
|
||||
_, _ = p.Exec(ctx, `DELETE FROM tenants WHERE slug = 'dupetest'`)
|
||||
_, _ = p.Exec(ctx, `DROP DATABASE IF EXISTS tenant_dupetest`)
|
||||
})
|
||||
|
||||
var wg sync.WaitGroup
|
||||
results := make([]error, 2)
|
||||
for i := 0; i < 2; i++ {
|
||||
wg.Add(1)
|
||||
go func(i int) {
|
||||
defer wg.Done()
|
||||
_, err := svc.Onboard(ctx, "dupetest", "Dupe Test", "admin@dupetest.example", "Admin")
|
||||
results[i] = err
|
||||
}(i)
|
||||
}
|
||||
wg.Wait()
|
||||
|
||||
successCount := 0
|
||||
for _, err := range results {
|
||||
if err == nil {
|
||||
successCount++
|
||||
} else if !errors.Is(err, ErrTenantExists) {
|
||||
t.Fatalf("unerwarteter fehler: %v", err)
|
||||
}
|
||||
}
|
||||
if successCount != 1 {
|
||||
t.Fatalf("erwartet genau einen erfolgreichen onboarding-vorgang, habe %d", successCount)
|
||||
}
|
||||
}
|
||||
@@ -2,11 +2,17 @@ package tenant
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgconn"
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
// ErrTenantExists wird zurueckgegeben, wenn Slug oder Datenbankname eines
|
||||
// Mandanten bereits vergeben sind (TEN-02 Akzeptanzkriterium 3).
|
||||
var ErrTenantExists = errors.New("tenant: slug bereits vergeben")
|
||||
|
||||
// Provisioner legt fuer jeden neuen Mandanten eine vollstaendig isolierte
|
||||
// PostgreSQL-Datenbank an und registriert sie transaktional in der Registry
|
||||
// (Akzeptanzkriterium 2). Zwei Mandanten-Datenbanken sind danach auf
|
||||
@@ -39,6 +45,14 @@ func (p *Provisioner) Provision(ctx context.Context, slug, name string) (Tenant,
|
||||
// CREATE DATABASE erlaubt keine Parameter-Platzhalter; slug ist durch
|
||||
// ValidateSlug bereits auf [a-z0-9_] beschraenkt, Injektion ausgeschlossen.
|
||||
if _, err := p.adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
||||
var pgErr *pgconn.PgError
|
||||
// 42P04 (duplicate_database) im Normalfall; bei zwei echt parallelen
|
||||
// CREATE DATABASE auf denselben Namen liefert Postgres stattdessen den
|
||||
// internen Unique-Index-Konflikt 23505 auf pg_database — beide Faelle
|
||||
// bedeuten: der Tenant existiert bereits bzw. wird gerade angelegt.
|
||||
if errors.As(err, &pgErr) && (pgErr.Code == "42P04" || pgErr.Code == "23505") {
|
||||
return Tenant{}, ErrTenantExists
|
||||
}
|
||||
return Tenant{}, fmt.Errorf("tenant-datenbank anlegen: %w", err)
|
||||
}
|
||||
|
||||
@@ -60,6 +74,10 @@ func (p *Provisioner) Provision(ctx context.Context, slug, name string) (Tenant,
|
||||
if err != nil {
|
||||
_ = tx.Rollback(ctx)
|
||||
p.rollbackDatabase(ctx, dbName)
|
||||
var pgErr *pgconn.PgError
|
||||
if errors.As(err, &pgErr) && pgErr.Code == "23505" { // unique_violation auf slug
|
||||
return Tenant{}, ErrTenantExists
|
||||
}
|
||||
return Tenant{}, err
|
||||
}
|
||||
|
||||
@@ -76,3 +94,16 @@ func (p *Provisioner) Provision(ctx context.Context, slug, name string) (Tenant,
|
||||
func (p *Provisioner) rollbackDatabase(ctx context.Context, dbName string) {
|
||||
_, _ = p.adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
}
|
||||
|
||||
// Deprovision entfernt einen bereits erfolgreich registrierten Tenant wieder
|
||||
// vollstaendig (Registry-Eintrag + Datenbank). Wird als Kompensation
|
||||
// verwendet, wenn ein Schritt NACH Provision fehlschlaegt (z.B. die
|
||||
// Admin-Account-Anlage in TEN-02) — Provision selbst bleibt dadurch die
|
||||
// einzige Stelle, die "erfolgreich provisioniert" garantieren muss.
|
||||
func (p *Provisioner) Deprovision(ctx context.Context, t Tenant) error {
|
||||
if err := p.registry.Delete(ctx, t.ID); err != nil {
|
||||
return err
|
||||
}
|
||||
p.rollbackDatabase(ctx, t.DBName)
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -47,6 +47,16 @@ func (r *Registry) GetBySlug(ctx context.Context, slug string) (Tenant, error) {
|
||||
return t, nil
|
||||
}
|
||||
|
||||
// Delete entfernt einen Registry-Eintrag. Wird von Provisioner.Deprovision
|
||||
// als Kompensation verwendet, wenn nach erfolgreicher Registrierung ein
|
||||
// nachgelagerter Schritt (z.B. Admin-Account-Anlage in TEN-02) fehlschlaegt.
|
||||
func (r *Registry) Delete(ctx context.Context, id string) error {
|
||||
if _, err := r.pool.Exec(ctx, `DELETE FROM tenants WHERE id = $1`, id); err != nil {
|
||||
return fmt.Errorf("tenant loeschen: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *Registry) List(ctx context.Context) ([]Tenant, error) {
|
||||
rows, err := r.pool.Query(ctx, `
|
||||
SELECT id, slug, name, db_name, db_dsn, status, created_at
|
||||
|
||||
@@ -0,0 +1,74 @@
|
||||
package tenantsettings
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
// Handler stellt Lesen/Schreiben der Tenant-Einstellungen als schlanke
|
||||
// Vorbereitung der Schnittstelle bereit (API-01/TEN-05 sind nicht Teil
|
||||
// dieser Kachel). tenantID wird hier als Pfad-/Query-Parameter erwartet,
|
||||
// eine echte Auth-/Berechtigungspruefung kommt erst mit IAM-02/RBAC-01.
|
||||
type Handler struct {
|
||||
store *Store
|
||||
}
|
||||
|
||||
func NewHandler(store *Store) *Handler {
|
||||
return &Handler{store: store}
|
||||
}
|
||||
|
||||
func (h *Handler) Get(w http.ResponseWriter, r *http.Request) {
|
||||
tenantID := r.URL.Query().Get("tenant_id")
|
||||
if tenantID == "" {
|
||||
http.Error(w, "tenant_id fehlt", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
settings, err := h.store.Get(r.Context(), tenantID)
|
||||
if err != nil {
|
||||
http.Error(w, "einstellungen konnten nicht geladen werden", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, settings)
|
||||
}
|
||||
|
||||
type updateRequest struct {
|
||||
DisplayName *string `json:"display_name"`
|
||||
LogoURL *string `json:"logo_url"`
|
||||
ColorScheme *string `json:"color_scheme"`
|
||||
Timezone *string `json:"timezone"`
|
||||
Language *string `json:"language"`
|
||||
}
|
||||
|
||||
func (h *Handler) Update(w http.ResponseWriter, r *http.Request) {
|
||||
tenantID := r.URL.Query().Get("tenant_id")
|
||||
if tenantID == "" {
|
||||
http.Error(w, "tenant_id fehlt", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
var req updateRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
settings, err := h.store.Update(r.Context(), tenantID, Patch{
|
||||
DisplayName: req.DisplayName,
|
||||
LogoURL: req.LogoURL,
|
||||
ColorScheme: req.ColorScheme,
|
||||
Timezone: req.Timezone,
|
||||
Language: req.Language,
|
||||
})
|
||||
if err != nil {
|
||||
http.Error(w, "einstellungen konnten nicht gespeichert werden", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, settings)
|
||||
}
|
||||
|
||||
func writeJSON(w http.ResponseWriter, status int, v any) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(status)
|
||||
_ = json.NewEncoder(w).Encode(v)
|
||||
}
|
||||
@@ -0,0 +1,156 @@
|
||||
package tenantsettings
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
func setupTest(t *testing.T) (*Store, string, string, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
pool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("pool: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS tenants (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
slug TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
db_name TEXT NOT NULL UNIQUE,
|
||||
db_dsn TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS tenant_settings (
|
||||
tenant_id UUID PRIMARY KEY REFERENCES tenants(id),
|
||||
display_name TEXT, logo_url TEXT, color_scheme TEXT, timezone TEXT, language TEXT,
|
||||
version INT NOT NULL DEFAULT 0, updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS tenant_settings_history (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), tenant_id UUID NOT NULL,
|
||||
display_name TEXT, logo_url TEXT, color_scheme TEXT, timezone TEXT, language TEXT,
|
||||
version INT NOT NULL, changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
`); err != nil {
|
||||
t.Fatalf("schema: %v", err)
|
||||
}
|
||||
|
||||
var tenantA, tenantB string
|
||||
if err := pool.QueryRow(ctx, `INSERT INTO tenants (slug, name, db_name, db_dsn) VALUES ('ts_a', 'A', 'tenant_ts_a', 'unused') RETURNING id`).Scan(&tenantA); err != nil {
|
||||
t.Fatalf("tenant a anlegen: %v", err)
|
||||
}
|
||||
if err := pool.QueryRow(ctx, `INSERT INTO tenants (slug, name, db_name, db_dsn) VALUES ('ts_b', 'B', 'tenant_ts_b', 'unused') RETURNING id`).Scan(&tenantB); err != nil {
|
||||
t.Fatalf("tenant b anlegen: %v", err)
|
||||
}
|
||||
|
||||
cleanup := func() {
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM tenant_settings_history WHERE tenant_id IN ($1, $2)`, tenantA, tenantB)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM tenant_settings WHERE tenant_id IN ($1, $2)`, tenantA, tenantB)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM tenants WHERE id IN ($1, $2)`, tenantA, tenantB)
|
||||
pool.Close()
|
||||
}
|
||||
return NewStore(pool), tenantA, tenantB, cleanup
|
||||
}
|
||||
|
||||
func strp(s string) *string { return &s }
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 2: fehlende Werte liefern Defaults, kein Fehler.
|
||||
func TestGet_UnsetTenantReturnsDefaults(t *testing.T) {
|
||||
store, tenantA, _, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
got, err := store.Get(ctx, tenantA)
|
||||
if err != nil {
|
||||
t.Fatalf("get: %v", err)
|
||||
}
|
||||
want := Defaults()
|
||||
if got != want {
|
||||
t.Fatalf("erwartet defaults %+v, habe %+v", want, got)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1 + 2: Teil-Update laesst nicht gesetzte Felder auf Default.
|
||||
func TestUpdate_PartialPatchKeepsOtherFieldsAtDefault(t *testing.T) {
|
||||
store, tenantA, _, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
got, err := store.Update(ctx, tenantA, Patch{DisplayName: strp("Acme GmbH")})
|
||||
if err != nil {
|
||||
t.Fatalf("update: %v", err)
|
||||
}
|
||||
if got.DisplayName != "Acme GmbH" {
|
||||
t.Fatalf("erwartet 'Acme GmbH', habe %q", got.DisplayName)
|
||||
}
|
||||
d := Defaults()
|
||||
if got.ColorScheme != d.ColorScheme || got.Timezone != d.Timezone || got.Language != d.Language {
|
||||
t.Fatalf("nicht gesetzte felder haetten auf default bleiben sollen, habe %+v", got)
|
||||
}
|
||||
if got.Version != 1 {
|
||||
t.Fatalf("erwartet version 1, habe %d", got.Version)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1 + Pruefung 1: Aenderung eines Tenants wirkt sich
|
||||
// nicht auf einen anderen aus.
|
||||
func TestUpdate_IsolatedBetweenTenants(t *testing.T) {
|
||||
store, tenantA, tenantB, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := store.Update(ctx, tenantA, Patch{DisplayName: strp("Tenant A")}); err != nil {
|
||||
t.Fatalf("update a: %v", err)
|
||||
}
|
||||
|
||||
gotB, err := store.Get(ctx, tenantB)
|
||||
if err != nil {
|
||||
t.Fatalf("get b: %v", err)
|
||||
}
|
||||
if gotB != Defaults() {
|
||||
t.Fatalf("tenant b sollte unberuehrt bei defaults bleiben, habe %+v", gotB)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3: Aenderungen versioniert nachvollziehbar.
|
||||
func TestUpdate_HistoryTracksVersions(t *testing.T) {
|
||||
store, tenantA, _, cleanup := setupTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := store.Update(ctx, tenantA, Patch{DisplayName: strp("v1")}); err != nil {
|
||||
t.Fatalf("update 1: %v", err)
|
||||
}
|
||||
if _, err := store.Update(ctx, tenantA, Patch{DisplayName: strp("v2")}); err != nil {
|
||||
t.Fatalf("update 2: %v", err)
|
||||
}
|
||||
if _, err := store.Update(ctx, tenantA, Patch{ColorScheme: strp("dark")}); err != nil {
|
||||
t.Fatalf("update 3: %v", err)
|
||||
}
|
||||
|
||||
history, err := store.History(ctx, tenantA)
|
||||
if err != nil {
|
||||
t.Fatalf("history: %v", err)
|
||||
}
|
||||
if len(history) != 3 {
|
||||
t.Fatalf("erwartet 3 historieneintraege, habe %d", len(history))
|
||||
}
|
||||
if history[0].DisplayName != "v1" || history[0].Version != 1 {
|
||||
t.Fatalf("history[0] unerwartet: %+v", history[0])
|
||||
}
|
||||
if history[1].DisplayName != "v2" || history[1].Version != 2 {
|
||||
t.Fatalf("history[1] unerwartet: %+v", history[1])
|
||||
}
|
||||
if history[2].ColorScheme != "dark" || history[2].DisplayName != "v2" || history[2].Version != 3 {
|
||||
t.Fatalf("history[2] unerwartet (display_name haette aus vorherigem update erhalten bleiben sollen): %+v", history[2])
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,187 @@
|
||||
// Package tenantsettings implementiert Core TEN-03: pro-Tenant-Einstellungen
|
||||
// (Anzeigename, Logo, Farbschema, Zeitzone, Sprache) mit versionierter
|
||||
// Aenderungshistorie und dokumentierten Systemvoreinstellungen.
|
||||
package tenantsettings
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
// Settings ist der vollstaendig AUFGELOESTE Stand (jede leere Einstellung ist
|
||||
// bereits durch ihren Default ersetzt) — Aufrufer muessen sich nie selbst um
|
||||
// Systemvoreinstellungen kuemmern (Akzeptanzkriterium 2).
|
||||
type Settings struct {
|
||||
DisplayName string
|
||||
LogoURL string
|
||||
ColorScheme string
|
||||
Timezone string
|
||||
Language string
|
||||
Version int
|
||||
}
|
||||
|
||||
// Defaults liefert die dokumentierten Systemvoreinstellungen.
|
||||
func Defaults() Settings {
|
||||
return Settings{
|
||||
DisplayName: "",
|
||||
LogoURL: "",
|
||||
ColorScheme: "system",
|
||||
Timezone: "UTC",
|
||||
Language: "de",
|
||||
Version: 0,
|
||||
}
|
||||
}
|
||||
|
||||
// Patch enthaelt nur die Felder, die tatsaechlich geaendert werden sollen —
|
||||
// nil bedeutet "unveraendert lassen", nicht "auf Default zuruecksetzen".
|
||||
type Patch struct {
|
||||
DisplayName *string
|
||||
LogoURL *string
|
||||
ColorScheme *string
|
||||
Timezone *string
|
||||
Language *string
|
||||
}
|
||||
|
||||
type Store struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewStore(pool *pgxpool.Pool) *Store {
|
||||
return &Store{pool: pool}
|
||||
}
|
||||
|
||||
// Get liefert die aufgeloesten Einstellungen eines Tenants. Existiert noch
|
||||
// kein Datensatz oder sind einzelne Spalten NULL, werden die jeweiligen
|
||||
// Systemvoreinstellungen eingesetzt (Akzeptanzkriterium 2 / Pruefung 2) —
|
||||
// niemals ein Fehler wegen fehlender Werte.
|
||||
func (s *Store) Get(ctx context.Context, tenantID string) (Settings, error) {
|
||||
var displayName, logoURL, colorScheme, timezone, language *string
|
||||
var version int
|
||||
|
||||
row := s.pool.QueryRow(ctx, `
|
||||
SELECT display_name, logo_url, color_scheme, timezone, language, version
|
||||
FROM tenant_settings WHERE tenant_id = $1
|
||||
`, tenantID)
|
||||
err := row.Scan(&displayName, &logoURL, &colorScheme, &timezone, &language, &version)
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return Defaults(), nil
|
||||
}
|
||||
if err != nil {
|
||||
return Settings{}, fmt.Errorf("einstellungen lesen: %w", err)
|
||||
}
|
||||
|
||||
d := Defaults()
|
||||
return Settings{
|
||||
DisplayName: orDefault(displayName, d.DisplayName),
|
||||
LogoURL: orDefault(logoURL, d.LogoURL),
|
||||
ColorScheme: orDefault(colorScheme, d.ColorScheme),
|
||||
Timezone: orDefault(timezone, d.Timezone),
|
||||
Language: orDefault(language, d.Language),
|
||||
Version: version,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func orDefault(v *string, def string) string {
|
||||
if v == nil {
|
||||
return def
|
||||
}
|
||||
return *v
|
||||
}
|
||||
|
||||
// Update wendet patch auf den aktuellen Stand an, erhoeht die Version und
|
||||
// schreibt Stand + Historieneintrag atomar (Akzeptanzkriterium 3). Nicht in
|
||||
// patch gesetzte Felder bleiben unveraendert (bzw. weiterhin auf Default,
|
||||
// wenn sie es vorher schon waren).
|
||||
func (s *Store) Update(ctx context.Context, tenantID string, patch Patch) (Settings, error) {
|
||||
tx, err := s.pool.Begin(ctx)
|
||||
if err != nil {
|
||||
return Settings{}, fmt.Errorf("transaktion starten: %w", err)
|
||||
}
|
||||
defer func() { _ = tx.Rollback(ctx) }()
|
||||
|
||||
var rawDisplayName, rawLogoURL, rawColorScheme, rawTimezone, rawLanguage *string
|
||||
var version int
|
||||
row := tx.QueryRow(ctx, `
|
||||
SELECT display_name, logo_url, color_scheme, timezone, language, version
|
||||
FROM tenant_settings WHERE tenant_id = $1 FOR UPDATE
|
||||
`, tenantID)
|
||||
err = row.Scan(&rawDisplayName, &rawLogoURL, &rawColorScheme, &rawTimezone, &rawLanguage, &version)
|
||||
if err != nil && !errors.Is(err, pgx.ErrNoRows) {
|
||||
return Settings{}, fmt.Errorf("aktuellen stand lesen: %w", err)
|
||||
}
|
||||
|
||||
if patch.DisplayName != nil {
|
||||
rawDisplayName = patch.DisplayName
|
||||
}
|
||||
if patch.LogoURL != nil {
|
||||
rawLogoURL = patch.LogoURL
|
||||
}
|
||||
if patch.ColorScheme != nil {
|
||||
rawColorScheme = patch.ColorScheme
|
||||
}
|
||||
if patch.Timezone != nil {
|
||||
rawTimezone = patch.Timezone
|
||||
}
|
||||
if patch.Language != nil {
|
||||
rawLanguage = patch.Language
|
||||
}
|
||||
newVersion := version + 1
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO tenant_settings (tenant_id, display_name, logo_url, color_scheme, timezone, language, version, updated_at)
|
||||
VALUES ($1, $2, $3, $4, $5, $6, $7, now())
|
||||
ON CONFLICT (tenant_id) DO UPDATE SET
|
||||
display_name = $2, logo_url = $3, color_scheme = $4, timezone = $5, language = $6, version = $7, updated_at = now()
|
||||
`, tenantID, rawDisplayName, rawLogoURL, rawColorScheme, rawTimezone, rawLanguage, newVersion); err != nil {
|
||||
return Settings{}, fmt.Errorf("einstellungen speichern: %w", err)
|
||||
}
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO tenant_settings_history (tenant_id, display_name, logo_url, color_scheme, timezone, language, version, changed_at)
|
||||
VALUES ($1, $2, $3, $4, $5, $6, $7, now())
|
||||
`, tenantID, rawDisplayName, rawLogoURL, rawColorScheme, rawTimezone, rawLanguage, newVersion); err != nil {
|
||||
return Settings{}, fmt.Errorf("historie schreiben: %w", err)
|
||||
}
|
||||
|
||||
if err := tx.Commit(ctx); err != nil {
|
||||
return Settings{}, fmt.Errorf("transaktion committen: %w", err)
|
||||
}
|
||||
|
||||
return s.Get(ctx, tenantID)
|
||||
}
|
||||
|
||||
// History liefert die vollstaendige Versionshistorie eines Tenants
|
||||
// (Akzeptanzkriterium 3 / Pruefung 3-Vorbereitung).
|
||||
func (s *Store) History(ctx context.Context, tenantID string) ([]Settings, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT display_name, logo_url, color_scheme, timezone, language, version
|
||||
FROM tenant_settings_history WHERE tenant_id = $1 ORDER BY version
|
||||
`, tenantID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("historie abfragen: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
d := Defaults()
|
||||
var out []Settings
|
||||
for rows.Next() {
|
||||
var displayName, logoURL, colorScheme, timezone, language *string
|
||||
var version int
|
||||
if err := rows.Scan(&displayName, &logoURL, &colorScheme, &timezone, &language, &version); err != nil {
|
||||
return nil, fmt.Errorf("historieneintrag lesen: %w", err)
|
||||
}
|
||||
out = append(out, Settings{
|
||||
DisplayName: orDefault(displayName, d.DisplayName),
|
||||
LogoURL: orDefault(logoURL, d.LogoURL),
|
||||
ColorScheme: orDefault(colorScheme, d.ColorScheme),
|
||||
Timezone: orDefault(timezone, d.Timezone),
|
||||
Language: orDefault(language, d.Language),
|
||||
Version: version,
|
||||
})
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
@@ -103,51 +103,6 @@ func (s *TenantUserStore) Deactivate(ctx context.Context, id string) (User, erro
|
||||
`, id, StatusInactive))
|
||||
}
|
||||
|
||||
// SetPasswordHash schreibt einen bereits berechneten bcrypt-Hash (siehe
|
||||
// internal/auth, IAM-02). Der Store selbst kennt kein Klartext-Passwort.
|
||||
func (s *TenantUserStore) SetPasswordHash(ctx context.Context, id, hash string) error {
|
||||
tag, err := s.pool.Exec(ctx, `
|
||||
UPDATE users SET password_hash = $2, updated_at = now() WHERE id = $1
|
||||
`, id, hash)
|
||||
if err != nil {
|
||||
return fmt.Errorf("passwort setzen: %w", err)
|
||||
}
|
||||
if tag.RowsAffected() == 0 {
|
||||
return ErrNotFound
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// AuthCredentials wird ausschliesslich fuer den Login-Pfad (internal/auth)
|
||||
// verwendet und traegt bewusst den password_hash, damit er nicht ueber den
|
||||
// regulaeren User-Typ/JSON-Serialisierungspfad nach aussen dringen kann.
|
||||
type AuthCredentials struct {
|
||||
User User
|
||||
PasswordHash string
|
||||
}
|
||||
|
||||
// GetByEmailForAuth liefert Benutzer + Passwort-Hash zu einer E-Mail-Adresse
|
||||
// aus GENAU DIESER Tenant-Datenbank — der Tenant-Scope ergibt sich damit
|
||||
// zwingend aus dem verwendeten Pool, es gibt keine Moeglichkeit, versehentlich
|
||||
// ueber Tenant-Grenzen hinweg zu suchen (bekannter archivmail-Fehler, siehe
|
||||
// IAM-02 "Bekannte Fehler vermeiden").
|
||||
func (s *TenantUserStore) GetByEmailForAuth(ctx context.Context, email string) (AuthCredentials, error) {
|
||||
var c AuthCredentials
|
||||
row := s.pool.QueryRow(ctx, `
|
||||
SELECT id, email, name, status, created_at, updated_at, password_hash
|
||||
FROM users WHERE email = $1
|
||||
`, email)
|
||||
|
||||
if err := row.Scan(&c.User.ID, &c.User.Email, &c.User.Name, &c.User.Status,
|
||||
&c.User.CreatedAt, &c.User.UpdatedAt, &c.PasswordHash); err != nil {
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return AuthCredentials{}, ErrNotFound
|
||||
}
|
||||
return AuthCredentials{}, fmt.Errorf("anmeldedaten lesen: %w", err)
|
||||
}
|
||||
return c, nil
|
||||
}
|
||||
|
||||
func scanUser(row pgx.Row) (User, error) {
|
||||
var u User
|
||||
if err := row.Scan(&u.ID, &u.Email, &u.Name, &u.Status, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
DROP TABLE IF EXISTS policy_rule_changes;
|
||||
DROP TABLE IF EXISTS policy_rules;
|
||||
@@ -1,24 +0,0 @@
|
||||
-- Zentrale, deklarative Policy-Regeln (RBAC-02, siehe core-kanban/tickets/RBAC-02.md).
|
||||
-- policy_rules haelt den AKTUELLEN, gewaehrten Regelsatz (Existenz = erlaubt,
|
||||
-- Default-Deny fuer alles ohne Zeile). policy_rule_changes ist die
|
||||
-- versionierte Aenderungshistorie (Akzeptanzkriterium 3: Regelwechsel ohne
|
||||
-- Codeaenderung nachvollziehbar).
|
||||
CREATE TABLE policy_rules (
|
||||
role TEXT NOT NULL,
|
||||
permission TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
PRIMARY KEY (role, permission)
|
||||
);
|
||||
|
||||
CREATE TABLE policy_rule_changes (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
role TEXT NOT NULL,
|
||||
permission TEXT NOT NULL,
|
||||
action TEXT NOT NULL CHECK (action IN ('grant', 'revoke')),
|
||||
actor TEXT NOT NULL,
|
||||
version INT NOT NULL,
|
||||
changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
CREATE INDEX policy_rule_changes_idx ON policy_rule_changes (role, permission, version);
|
||||
@@ -0,0 +1,2 @@
|
||||
DROP TABLE IF EXISTS tenant_settings_history;
|
||||
DROP TABLE IF EXISTS tenant_settings;
|
||||
@@ -0,0 +1,27 @@
|
||||
-- Pro-Tenant-Einstellungen & Branding (TEN-03, siehe core-kanban/tickets/TEN-03.md).
|
||||
-- Alle Spalten NULLABLE: ein fehlender Wert bedeutet "System-Default
|
||||
-- verwenden" (Akzeptanzkriterium 2), niemals ein Fehler.
|
||||
CREATE TABLE tenant_settings (
|
||||
tenant_id UUID PRIMARY KEY REFERENCES tenants(id),
|
||||
display_name TEXT,
|
||||
logo_url TEXT,
|
||||
color_scheme TEXT,
|
||||
timezone TEXT,
|
||||
language TEXT,
|
||||
version INT NOT NULL DEFAULT 0,
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
CREATE TABLE tenant_settings_history (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
tenant_id UUID NOT NULL,
|
||||
display_name TEXT,
|
||||
logo_url TEXT,
|
||||
color_scheme TEXT,
|
||||
timezone TEXT,
|
||||
language TEXT,
|
||||
version INT NOT NULL,
|
||||
changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
CREATE INDEX tenant_settings_history_tenant_idx ON tenant_settings_history (tenant_id, version);
|
||||
@@ -1 +0,0 @@
|
||||
DROP TABLE IF EXISTS feature_flags;
|
||||
@@ -1,10 +0,0 @@
|
||||
-- Feature-Flags zentral je Mandant/Zielgruppe (LIC-02, siehe core-kanban/tickets/LIC-02.md).
|
||||
-- Lebt in der Registry-DB, nicht pro Tenant-Datenbank — Flags sind eine
|
||||
-- Core-weite Konfiguration, keine Mandanten-Geschaeftsdaten.
|
||||
CREATE TABLE feature_flags (
|
||||
key TEXT PRIMARY KEY,
|
||||
enabled BOOLEAN NOT NULL DEFAULT false,
|
||||
rollout_percentage INT NOT NULL DEFAULT 0 CHECK (rollout_percentage BETWEEN 0 AND 100),
|
||||
target_tenant_slugs TEXT[] NOT NULL DEFAULT '{}',
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
@@ -1 +0,0 @@
|
||||
DROP TABLE IF EXISTS policy_module_scopes;
|
||||
@@ -1,11 +0,0 @@
|
||||
-- Modul-Scoping fuer Policy-Regeln (RBAC-04, siehe core-kanban/tickets/RBAC-04.md).
|
||||
-- Existiert fuer eine (role, permission)-Regel ein Eintrag hier, gilt sie
|
||||
-- NUR, wenn zusaetzlich das verknuepfte Feature-Flag (LIC-02) fuer den
|
||||
-- Tenant aktiv ist — Rechte folgen der Lizenz, nicht umgekehrt.
|
||||
CREATE TABLE policy_module_scopes (
|
||||
role TEXT NOT NULL,
|
||||
permission TEXT NOT NULL,
|
||||
module TEXT NOT NULL,
|
||||
flag_key TEXT NOT NULL,
|
||||
PRIMARY KEY (role, permission)
|
||||
);
|
||||
@@ -1,2 +0,0 @@
|
||||
DROP TABLE IF EXISTS role_assignment_history;
|
||||
DROP TABLE IF EXISTS role_assignments;
|
||||
@@ -1,23 +0,0 @@
|
||||
-- Rollenzuweisung pro Benutzer (RBAC-01, siehe core-kanban/tickets/RBAC-01.md).
|
||||
-- Nur 'user' und 'tenant_admin' sind hier zuweisbar — 'superadmin' lebt
|
||||
-- mandantenuebergreifend in der Registry (IAM-01 SuperadminStore) und hat
|
||||
-- daher bewusst KEINE Zeile in dieser tenant-lokalen Tabelle (Akzeptanz-
|
||||
-- kriterium 1: nur Zuweisungen innerhalb der erlaubten Matrix).
|
||||
CREATE TABLE role_assignments (
|
||||
user_id UUID PRIMARY KEY REFERENCES users(id),
|
||||
role TEXT NOT NULL CHECK (role IN ('user', 'tenant_admin')),
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
-- Vollstaendige Historie jeder Rollenaenderung (Akzeptanzkriterium 3: wer
|
||||
-- hat wann welche Rolle vergeben).
|
||||
CREATE TABLE role_assignment_history (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
user_id UUID NOT NULL,
|
||||
role TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
CREATE INDEX role_assignment_history_user_idx ON role_assignment_history (user_id, granted_at);
|
||||
@@ -1 +0,0 @@
|
||||
ALTER TABLE users DROP COLUMN password_hash;
|
||||
@@ -1,3 +0,0 @@
|
||||
-- Passwort-Hash-Spalte fuer Login (IAM-02, siehe core-kanban/tickets/IAM-02.md).
|
||||
-- Enthaelt AUSSCHLIESSLICH den bcrypt-Hash, niemals das Klartext-Passwort.
|
||||
ALTER TABLE users ADD COLUMN password_hash TEXT NOT NULL DEFAULT '';
|
||||
@@ -1,2 +0,0 @@
|
||||
DROP TABLE IF EXISTS group_members;
|
||||
DROP TABLE IF EXISTS groups;
|
||||
@@ -1,21 +0,0 @@
|
||||
-- Gruppen/Abteilungen mit Rollenzuweisung auf Gruppenebene (RBAC-03, siehe
|
||||
-- core-kanban/tickets/RBAC-03.md). Lebt in der Tenant-Datenbank (Modell C) —
|
||||
-- Gruppen sind implizit tenant-isoliert, da jede Tenant-DB ihre eigenen hat.
|
||||
CREATE TABLE groups (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
name TEXT NOT NULL,
|
||||
role TEXT CHECK (role IN ('user', 'tenant_admin')),
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
-- ON DELETE CASCADE: Loeschen einer Gruppe entzieht die gruppenbasierten
|
||||
-- Rechte automatisch, ohne Benutzerkonten selbst zu beruehren
|
||||
-- (Akzeptanzkriterium 3).
|
||||
CREATE TABLE group_members (
|
||||
group_id UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
|
||||
user_id UUID NOT NULL REFERENCES users(id),
|
||||
added_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
PRIMARY KEY (group_id, user_id)
|
||||
);
|
||||
|
||||
CREATE INDEX group_members_user_idx ON group_members (user_id);
|
||||
@@ -13,6 +13,8 @@ ROLE="nexarch_test"
|
||||
|
||||
export PGPASSWORD="$PASS"
|
||||
|
||||
psql -h localhost -U "$ROLE" -d postgres -v ON_ERROR_STOP=1 -c "DROP TABLE IF EXISTS tenant_settings_history CASCADE;"
|
||||
psql -h localhost -U "$ROLE" -d postgres -v ON_ERROR_STOP=1 -c "DROP TABLE IF EXISTS tenant_settings CASCADE;"
|
||||
psql -h localhost -U "$ROLE" -d postgres -v ON_ERROR_STOP=1 -c "DROP TABLE IF EXISTS tenants CASCADE;"
|
||||
|
||||
dbs=$(psql -h localhost -U "$ROLE" -d postgres -tAc "SELECT datname FROM pg_database WHERE datname LIKE 'tenant\_%' ESCAPE '\'")
|
||||
|
||||
@@ -1,183 +0,0 @@
|
||||
"use client";
|
||||
|
||||
import { useEffect, useState } from "react";
|
||||
import { TextField, SelectField, useToast } from "@nexarch/shl";
|
||||
import {
|
||||
ApiError,
|
||||
Group,
|
||||
Role,
|
||||
addGroupMember,
|
||||
createGroup,
|
||||
fetchGroups,
|
||||
removeGroupMember,
|
||||
setGroupRole,
|
||||
} from "../../lib/api";
|
||||
|
||||
export default function GroupsPage() {
|
||||
const { push } = useToast();
|
||||
const [groups, setGroups] = useState<Group[]>([]);
|
||||
const [loadError, setLoadError] = useState<string | null>(null);
|
||||
|
||||
const reload = () =>
|
||||
fetchGroups()
|
||||
.then(setGroups)
|
||||
.catch(() => setLoadError("Gruppen konnten nicht geladen werden. Sind Sie als Tenant-Admin angemeldet?"));
|
||||
|
||||
useEffect(() => {
|
||||
reload();
|
||||
}, []);
|
||||
|
||||
const [newGroupName, setNewGroupName] = useState("");
|
||||
const [createError, setCreateError] = useState<string | null>(null);
|
||||
|
||||
async function onCreate(event: React.FormEvent<HTMLFormElement>) {
|
||||
event.preventDefault();
|
||||
setCreateError(null);
|
||||
try {
|
||||
await createGroup(newGroupName);
|
||||
setNewGroupName("");
|
||||
push("Gruppe angelegt.", "success");
|
||||
await reload();
|
||||
} catch (err) {
|
||||
setCreateError(err instanceof ApiError ? err.message : "Gruppe konnte nicht angelegt werden.");
|
||||
}
|
||||
}
|
||||
|
||||
if (loadError) {
|
||||
return (
|
||||
<main style={{ maxWidth: 640, margin: "40px auto", padding: "0 16px" }}>
|
||||
<p role="alert">{loadError}</p>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<main style={{ maxWidth: 640, margin: "40px auto", padding: "0 16px" }}>
|
||||
<h1>Gruppen & Abteilungen</h1>
|
||||
|
||||
<section aria-labelledby="neue-gruppe-heading">
|
||||
<h2 id="neue-gruppe-heading">Neue Gruppe anlegen</h2>
|
||||
<form onSubmit={onCreate} noValidate>
|
||||
<TextField
|
||||
label="Gruppenname"
|
||||
required
|
||||
value={newGroupName}
|
||||
onChange={(e) => setNewGroupName(e.target.value)}
|
||||
/>
|
||||
{createError && (
|
||||
<p role="alert" style={{ color: "var(--shl-color-danger)" }}>
|
||||
{createError}
|
||||
</p>
|
||||
)}
|
||||
<button type="submit">Anlegen</button>
|
||||
</form>
|
||||
</section>
|
||||
|
||||
<section aria-labelledby="gruppenliste-heading">
|
||||
<h2 id="gruppenliste-heading">Bestehende Gruppen</h2>
|
||||
{groups.length === 0 ? (
|
||||
<p>Keine Gruppen vorhanden.</p>
|
||||
) : (
|
||||
groups.map((g) => <GroupCard key={g.ID} group={g} onChanged={reload} onNotice={(t) => push(t, "success")} />)
|
||||
)}
|
||||
</section>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
function GroupCard({
|
||||
group,
|
||||
onChanged,
|
||||
onNotice,
|
||||
}: {
|
||||
group: Group;
|
||||
onChanged: () => void;
|
||||
onNotice: (text: string) => void;
|
||||
}) {
|
||||
const [role, setRole] = useState<Role>(group.Role || "user");
|
||||
const [newMemberId, setNewMemberId] = useState("");
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
|
||||
async function onSetRole() {
|
||||
setError(null);
|
||||
try {
|
||||
await setGroupRole(group.ID, role);
|
||||
onNotice("Gruppenrolle gesetzt.");
|
||||
onChanged();
|
||||
} catch (err) {
|
||||
setError(err instanceof ApiError ? err.message : "Gruppenrolle konnte nicht gesetzt werden.");
|
||||
}
|
||||
}
|
||||
|
||||
async function onAddMember(event: React.FormEvent<HTMLFormElement>) {
|
||||
event.preventDefault();
|
||||
setError(null);
|
||||
try {
|
||||
await addGroupMember(group.ID, newMemberId);
|
||||
setNewMemberId("");
|
||||
onNotice("Mitglied hinzugefügt.");
|
||||
onChanged();
|
||||
} catch (err) {
|
||||
setError(err instanceof ApiError ? err.message : "Mitglied konnte nicht hinzugefügt werden.");
|
||||
}
|
||||
}
|
||||
|
||||
async function onRemoveMember(userId: string) {
|
||||
setError(null);
|
||||
try {
|
||||
await removeGroupMember(group.ID, userId);
|
||||
onNotice("Mitglied entfernt.");
|
||||
onChanged();
|
||||
} catch (err) {
|
||||
setError(err instanceof ApiError ? err.message : "Mitglied konnte nicht entfernt werden.");
|
||||
}
|
||||
}
|
||||
|
||||
return (
|
||||
<div style={{ border: "1px solid var(--shl-color-border)", borderRadius: 8, padding: 16, marginBottom: 16 }}>
|
||||
<h3>{group.Name}</h3>
|
||||
|
||||
<div style={{ display: "flex", alignItems: "flex-end", gap: 8 }}>
|
||||
<SelectField label="Gruppenrolle" value={role} onChange={(e) => setRole(e.target.value as Role)}>
|
||||
<option value="user">Benutzer</option>
|
||||
<option value="tenant_admin">Tenant-Admin</option>
|
||||
</SelectField>
|
||||
<button type="button" onClick={onSetRole}>
|
||||
Setzen
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<h4>Mitglieder</h4>
|
||||
{group.members.length === 0 ? (
|
||||
<p>Keine Mitglieder.</p>
|
||||
) : (
|
||||
<ul>
|
||||
{group.members.map((userId) => (
|
||||
<li key={userId}>
|
||||
{userId}{" "}
|
||||
<button type="button" onClick={() => onRemoveMember(userId)}>
|
||||
Entfernen
|
||||
</button>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
)}
|
||||
|
||||
<form onSubmit={onAddMember} noValidate>
|
||||
<TextField
|
||||
label="Benutzer-ID hinzufügen"
|
||||
required
|
||||
value={newMemberId}
|
||||
onChange={(e) => setNewMemberId(e.target.value)}
|
||||
/>
|
||||
<button type="submit">Hinzufügen</button>
|
||||
</form>
|
||||
|
||||
{error && (
|
||||
<p role="alert" style={{ color: "var(--shl-color-danger)" }}>
|
||||
{error}
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -1,30 +0,0 @@
|
||||
import { ThemeProvider, I18nProvider, ToastProvider, typography } from "@nexarch/shl";
|
||||
|
||||
export const metadata = {
|
||||
title: "NEXARCH Rechteverwaltung",
|
||||
};
|
||||
|
||||
export default function RootLayout({
|
||||
children,
|
||||
}: {
|
||||
children: React.ReactNode;
|
||||
}) {
|
||||
return (
|
||||
<html lang="de">
|
||||
<body
|
||||
style={{
|
||||
fontFamily: typography.fontFamily,
|
||||
margin: 0,
|
||||
background: "var(--shl-color-background, #ffffff)",
|
||||
color: "var(--shl-color-text-primary, #14181f)",
|
||||
}}
|
||||
>
|
||||
<ThemeProvider>
|
||||
<I18nProvider initialLocale="de">
|
||||
<ToastProvider>{children}</ToastProvider>
|
||||
</I18nProvider>
|
||||
</ThemeProvider>
|
||||
</body>
|
||||
</html>
|
||||
);
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
import { redirect } from "next/navigation";
|
||||
|
||||
export default function IndexPage() {
|
||||
redirect("/roles");
|
||||
}
|
||||
@@ -1,142 +0,0 @@
|
||||
"use client";
|
||||
|
||||
import { useEffect, useState } from "react";
|
||||
import { Table, TextField, SelectField, useToast } from "@nexarch/shl";
|
||||
import type { TableColumn } from "@nexarch/shl";
|
||||
import {
|
||||
ApiError,
|
||||
Assignment,
|
||||
Role,
|
||||
RoleInfo,
|
||||
assignRole,
|
||||
fetchRoleHistory,
|
||||
fetchRoles,
|
||||
} from "../../lib/api";
|
||||
|
||||
export default function RolesPage() {
|
||||
const { push } = useToast();
|
||||
const [roles, setRoles] = useState<RoleInfo[] | null>(null);
|
||||
const [loadError, setLoadError] = useState<string | null>(null);
|
||||
|
||||
const [targetUserId, setTargetUserId] = useState("");
|
||||
const [targetRole, setTargetRole] = useState<Role>("user");
|
||||
const [assignError, setAssignError] = useState<string | null>(null);
|
||||
const [submitting, setSubmitting] = useState(false);
|
||||
|
||||
const [historyUserId, setHistoryUserId] = useState("");
|
||||
const [history, setHistory] = useState<Assignment[] | null>(null);
|
||||
|
||||
useEffect(() => {
|
||||
fetchRoles()
|
||||
.then(setRoles)
|
||||
.catch(() => setLoadError("Rollen konnten nicht geladen werden. Sind Sie als Tenant-Admin angemeldet?"));
|
||||
}, []);
|
||||
|
||||
async function onAssign(event: React.FormEvent<HTMLFormElement>) {
|
||||
event.preventDefault();
|
||||
setAssignError(null);
|
||||
setSubmitting(true);
|
||||
try {
|
||||
await assignRole(targetUserId, targetRole);
|
||||
push("Rolle zugewiesen.", "success");
|
||||
} catch (err) {
|
||||
// Akzeptanzkriterium 2: die Backend-Meldung bei Selbst-Eskalation wird
|
||||
// unveraendert angezeigt, keine eigene Interpretation im Frontend.
|
||||
setAssignError(err instanceof ApiError ? err.message : "Rolle konnte nicht zugewiesen werden.");
|
||||
} finally {
|
||||
setSubmitting(false);
|
||||
}
|
||||
}
|
||||
|
||||
async function onLoadHistory(event: React.FormEvent<HTMLFormElement>) {
|
||||
event.preventDefault();
|
||||
try {
|
||||
setHistory(await fetchRoleHistory(historyUserId));
|
||||
} catch {
|
||||
setHistory([]);
|
||||
}
|
||||
}
|
||||
|
||||
const historyColumns: TableColumn<Assignment>[] = [
|
||||
{ key: "role", header: "Rolle", render: (a) => a.Role },
|
||||
{ key: "grantedBy", header: "Vergeben von", render: (a) => a.GrantedBy },
|
||||
];
|
||||
|
||||
if (loadError) {
|
||||
return (
|
||||
<main style={{ maxWidth: 640, margin: "40px auto", padding: "0 16px" }}>
|
||||
<p role="alert">{loadError}</p>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<main style={{ maxWidth: 640, margin: "40px auto", padding: "0 16px" }}>
|
||||
<h1>Rollen & Rechte</h1>
|
||||
|
||||
<section aria-labelledby="rollen-heading">
|
||||
<h2 id="rollen-heading">Rollen und Grundrechte</h2>
|
||||
{roles?.map((r) => (
|
||||
<div key={r.role} style={{ marginBottom: 12 }}>
|
||||
<strong>{roleLabel(r.role)}</strong>
|
||||
<ul>
|
||||
{r.permissions.map((p) => (
|
||||
<li key={p}>{p}</li>
|
||||
))}
|
||||
</ul>
|
||||
</div>
|
||||
))}
|
||||
</section>
|
||||
|
||||
<section aria-labelledby="zuweisen-heading">
|
||||
<h2 id="zuweisen-heading">Rolle zuweisen</h2>
|
||||
<form onSubmit={onAssign} noValidate>
|
||||
<TextField
|
||||
label="Benutzer-ID"
|
||||
required
|
||||
value={targetUserId}
|
||||
onChange={(e) => setTargetUserId(e.target.value)}
|
||||
/>
|
||||
<SelectField label="Rolle" value={targetRole} onChange={(e) => setTargetRole(e.target.value as Role)}>
|
||||
<option value="user">Benutzer</option>
|
||||
<option value="tenant_admin">Tenant-Admin</option>
|
||||
</SelectField>
|
||||
{assignError && (
|
||||
<p role="alert" style={{ color: "var(--shl-color-danger)" }}>
|
||||
{assignError}
|
||||
</p>
|
||||
)}
|
||||
<button type="submit" disabled={submitting}>
|
||||
{submitting ? "Wird zugewiesen…" : "Zuweisen"}
|
||||
</button>
|
||||
</form>
|
||||
</section>
|
||||
|
||||
<section aria-labelledby="verlauf-heading">
|
||||
<h2 id="verlauf-heading">Nachvollziehbarkeit (Audit-Verlauf)</h2>
|
||||
<p>Zeigt jede Rollenzuweisung eines Benutzers chronologisch — wer wann welche Rolle vergeben hat.</p>
|
||||
<form onSubmit={onLoadHistory} noValidate>
|
||||
<TextField
|
||||
label="Benutzer-ID"
|
||||
required
|
||||
value={historyUserId}
|
||||
onChange={(e) => setHistoryUserId(e.target.value)}
|
||||
/>
|
||||
<button type="submit">Verlauf anzeigen</button>
|
||||
</form>
|
||||
{history && (
|
||||
<Table
|
||||
columns={historyColumns}
|
||||
rows={history}
|
||||
rowKey={(a) => `${a.UserID}-${a.Role}-${a.GrantedBy}`}
|
||||
caption="Rollenzuweisungs-Verlauf"
|
||||
/>
|
||||
)}
|
||||
</section>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
function roleLabel(role: Role): string {
|
||||
return role === "tenant_admin" ? "Tenant-Admin" : "Benutzer";
|
||||
}
|
||||
@@ -1,68 +0,0 @@
|
||||
const API_BASE = process.env.NEXT_PUBLIC_CORE_API_BASE ?? "";
|
||||
|
||||
export class ApiError extends Error {}
|
||||
|
||||
async function req<T>(path: string, init?: RequestInit): Promise<T> {
|
||||
const res = await fetch(`${API_BASE}${path}`, {
|
||||
credentials: "include",
|
||||
headers: init?.body ? { "Content-Type": "application/json" } : undefined,
|
||||
...init,
|
||||
});
|
||||
const data = await res.json().catch(() => ({}));
|
||||
if (!res.ok) {
|
||||
throw new ApiError(data.error ?? data.message ?? "Unbekannter Fehler");
|
||||
}
|
||||
return data as T;
|
||||
}
|
||||
|
||||
export type Role = "user" | "tenant_admin";
|
||||
|
||||
export interface RoleInfo {
|
||||
role: Role;
|
||||
permissions: string[];
|
||||
}
|
||||
|
||||
export function fetchRoles(): Promise<RoleInfo[]> {
|
||||
return req("/rbac/roles");
|
||||
}
|
||||
|
||||
export interface Assignment {
|
||||
UserID: string;
|
||||
Role: Role;
|
||||
GrantedBy: string;
|
||||
}
|
||||
|
||||
export function assignRole(userId: string, role: Role): Promise<Assignment> {
|
||||
return req("/rbac/users/role", { method: "POST", body: JSON.stringify({ user_id: userId, role }) });
|
||||
}
|
||||
|
||||
export function fetchRoleHistory(userId: string): Promise<Assignment[]> {
|
||||
return req(`/rbac/users/${userId}/history`);
|
||||
}
|
||||
|
||||
export interface Group {
|
||||
ID: string;
|
||||
Name: string;
|
||||
Role: Role | "";
|
||||
members: string[];
|
||||
}
|
||||
|
||||
export function fetchGroups(): Promise<Group[]> {
|
||||
return req("/rbac/groups");
|
||||
}
|
||||
|
||||
export function createGroup(name: string): Promise<Group> {
|
||||
return req("/rbac/groups", { method: "POST", body: JSON.stringify({ name }) });
|
||||
}
|
||||
|
||||
export function setGroupRole(groupId: string, role: Role): Promise<void> {
|
||||
return req("/rbac/groups/role", { method: "POST", body: JSON.stringify({ group_id: groupId, role }) });
|
||||
}
|
||||
|
||||
export function addGroupMember(groupId: string, userId: string): Promise<void> {
|
||||
return req("/rbac/groups/members", { method: "POST", body: JSON.stringify({ group_id: groupId, user_id: userId }) });
|
||||
}
|
||||
|
||||
export function removeGroupMember(groupId: string, userId: string): Promise<void> {
|
||||
return req("/rbac/groups/members/remove", { method: "POST", body: JSON.stringify({ group_id: groupId, user_id: userId }) });
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
/** @type {import('next').NextConfig} */
|
||||
const nextConfig = {
|
||||
transpilePackages: ["@nexarch/shl"],
|
||||
};
|
||||
export default nextConfig;
|
||||
@@ -1,22 +0,0 @@
|
||||
{
|
||||
"name": "nexarch-rbac-admin",
|
||||
"private": true,
|
||||
"scripts": {
|
||||
"dev": "next dev",
|
||||
"build": "next build",
|
||||
"start": "next start",
|
||||
"lint": "next lint"
|
||||
},
|
||||
"dependencies": {
|
||||
"@nexarch/shl": "file:../shl",
|
||||
"next": "14.2.35",
|
||||
"react": "18.3.1",
|
||||
"react-dom": "18.3.1"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/node": "20.14.9",
|
||||
"@types/react": "18.3.3",
|
||||
"@types/react-dom": "18.3.0",
|
||||
"typescript": "5.5.3"
|
||||
}
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
{
|
||||
"compilerOptions": {
|
||||
"target": "ES2017",
|
||||
"lib": ["dom", "dom.iterable", "esnext"],
|
||||
"allowJs": false,
|
||||
"skipLibCheck": true,
|
||||
"strict": true,
|
||||
"noEmit": true,
|
||||
"esModuleInterop": true,
|
||||
"module": "esnext",
|
||||
"moduleResolution": "bundler",
|
||||
"resolveJsonModule": true,
|
||||
"isolatedModules": true,
|
||||
"jsx": "preserve",
|
||||
"incremental": true,
|
||||
"plugins": [{ "name": "next" }],
|
||||
"paths": { "@/*": ["./*"] }
|
||||
},
|
||||
"include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
|
||||
"exclude": ["node_modules"]
|
||||
}
|
||||
@@ -1,45 +0,0 @@
|
||||
# @nexarch/shl — UI-Shell & Design-System (Core SHL-01)
|
||||
|
||||
Gemeinsames Paket für alle NEXARCH-Modul-Frontends (Core, DMS, Mail, Archive, Workflow, AI, Connect).
|
||||
Ein Modul-Frontend importiert ausschließlich über `index.ts`, kopiert keine Komponenten oder Tokens lokal.
|
||||
|
||||
## Enthält
|
||||
|
||||
- **Design-Tokens** (`tokens/tokens.ts`) — Farbe (Hell/Dunkel), Abstand, Typografie. Kontrastwerte gegen WCAG 2.1 AA geprüft (siehe `__tests__/tokens.test.ts`).
|
||||
- **Theming** (`theme/ThemeProvider.tsx`) — zentrale Hell/Dunkel-Umschaltung, respektiert `prefers-color-scheme`, persistiert in `localStorage`.
|
||||
- **i18n-Rahmen** (`i18n/i18n.tsx`) — Umschaltmechanismus Deutsch/Englisch. Modul-Frontends registrieren ihre fachlichen Textbausteine über `registerMessages()`, statt einen eigenen Mechanismus zu bauen.
|
||||
- **Basis-Komponenten** (`components/`) — `Shell` (Layout + Navigation), `Table`, `Dialog`, `TextField`/`SelectField`/`CheckboxField`, `Toast`. Alle mit WCAG-2.1-AA-Grundlage (Tastaturbedienung, ARIA-Attribute, Fokus-Management).
|
||||
|
||||
## Verwendung in einem Modul-Frontend
|
||||
|
||||
```tsx
|
||||
import { ThemeProvider, I18nProvider, ToastProvider, Shell } from "@nexarch/shl";
|
||||
|
||||
export default function RootLayout({ children }: { children: React.ReactNode }) {
|
||||
return (
|
||||
<ThemeProvider>
|
||||
<I18nProvider initialLocale="de">
|
||||
<ToastProvider>
|
||||
<Shell modules={[]} tenantLabel="Mandant XY">
|
||||
{children}
|
||||
</Shell>
|
||||
</ToastProvider>
|
||||
</I18nProvider>
|
||||
</ThemeProvider>
|
||||
);
|
||||
}
|
||||
```
|
||||
|
||||
## Bekannter offener Punkt
|
||||
|
||||
Die vier bereits gebauten Core-Frontends (`TEN-05`, `LIC-04`, `AUD-04`, `OPS-02`) sind vor diesem Paket entstanden und binden es noch nicht ein — Retrofit ist der nächste Schritt, siehe `nexarch-state.json`.
|
||||
|
||||
## Tests
|
||||
|
||||
Ausführung auf dem Test-Host (nicht lokal, siehe Projekt-Testinfrastruktur):
|
||||
|
||||
```bash
|
||||
npm install
|
||||
npm test
|
||||
npm run typecheck
|
||||
```
|
||||
@@ -1,38 +0,0 @@
|
||||
// Prüfung: Tastaturbedienung der Basis-Komponenten funktioniert (SHL-01 Prüfung 2).
|
||||
import { describe, expect, it, vi } from "vitest";
|
||||
import { fireEvent, render, screen } from "@testing-library/react";
|
||||
import { Dialog } from "../components/Dialog";
|
||||
import { I18nProvider } from "../i18n/i18n";
|
||||
|
||||
function renderDialog(onClose: () => void) {
|
||||
return render(
|
||||
<I18nProvider>
|
||||
<Dialog open titleId="test-title" title="Test-Dialog" onClose={onClose}>
|
||||
<button type="button">Erste Aktion</button>
|
||||
<button type="button">Zweite Aktion</button>
|
||||
</Dialog>
|
||||
</I18nProvider>,
|
||||
);
|
||||
}
|
||||
|
||||
describe("Dialog: Tastaturbedienung", () => {
|
||||
it("schließt sich bei ESC", () => {
|
||||
const onClose = vi.fn();
|
||||
renderDialog(onClose);
|
||||
fireEvent.keyDown(document, { key: "Escape" });
|
||||
expect(onClose).toHaveBeenCalledOnce();
|
||||
});
|
||||
|
||||
it("setzt den Fokus beim Öffnen auf das erste fokussierbare Element", () => {
|
||||
renderDialog(vi.fn());
|
||||
const closeButton = screen.getByRole("button", { name: /schließen/i });
|
||||
expect(document.activeElement).toBe(closeButton);
|
||||
});
|
||||
|
||||
it("ist als modaler Dialog mit Titel-Referenz ausgezeichnet", () => {
|
||||
renderDialog(vi.fn());
|
||||
const dialog = screen.getByRole("dialog");
|
||||
expect(dialog).toHaveAttribute("aria-modal", "true");
|
||||
expect(dialog).toHaveAttribute("aria-labelledby", "test-title");
|
||||
});
|
||||
});
|
||||
@@ -1,39 +0,0 @@
|
||||
// Prüfung: Kontrastwerte erfüllen mindestens AA (SHL-01 Prüfung 3 / Akzeptanzkriterium 4).
|
||||
import { describe, expect, it } from "vitest";
|
||||
import { colorTokens } from "../tokens/tokens";
|
||||
|
||||
// WCAG-2.1-AA-Kontrastberechnung (relative Luminanz, sRGB) — keine externe Abhängigkeit nötig.
|
||||
function relLuminance(hex: string): number {
|
||||
const rgb = [1, 3, 5].map((i) => parseInt(hex.slice(i, i + 2), 16) / 255);
|
||||
const [r, g, b] = rgb.map((c) => (c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4));
|
||||
return 0.2126 * r + 0.7152 * g + 0.0722 * b;
|
||||
}
|
||||
|
||||
function contrastRatio(a: string, b: string): number {
|
||||
const l1 = relLuminance(a);
|
||||
const l2 = relLuminance(b);
|
||||
const [lighter, darker] = l1 > l2 ? [l1, l2] : [l2, l1];
|
||||
return (lighter + 0.05) / (darker + 0.05);
|
||||
}
|
||||
|
||||
describe("Design-Tokens: WCAG 2.1 AA Kontrast", () => {
|
||||
for (const scheme of ["light", "dark"] as const) {
|
||||
const c = colorTokens[scheme];
|
||||
|
||||
it(`${scheme}: textPrimary auf background erfüllt AA (>= 4.5:1)`, () => {
|
||||
expect(contrastRatio(c.textPrimary, c.background)).toBeGreaterThanOrEqual(4.5);
|
||||
});
|
||||
|
||||
it(`${scheme}: textSecondary auf surface erfüllt AA (>= 4.5:1)`, () => {
|
||||
expect(contrastRatio(c.textSecondary, c.surface)).toBeGreaterThanOrEqual(4.5);
|
||||
});
|
||||
|
||||
it(`${scheme}: accentContrast auf accent erfüllt AA (>= 4.5:1)`, () => {
|
||||
expect(contrastRatio(c.accentContrast, c.accent)).toBeGreaterThanOrEqual(4.5);
|
||||
});
|
||||
|
||||
it(`${scheme}: dangerContrast auf danger erfüllt AA (>= 4.5:1)`, () => {
|
||||
expect(contrastRatio(c.dangerContrast, c.danger)).toBeGreaterThanOrEqual(4.5);
|
||||
});
|
||||
}
|
||||
});
|
||||
@@ -1,88 +0,0 @@
|
||||
"use client";
|
||||
|
||||
// Dialog-Basis-Komponente — SHL-01. WCAG 2.1 AA: Fokus-Falle, ESC schließt, Tastaturbedienung vollständig.
|
||||
|
||||
import { useEffect, useRef } from "react";
|
||||
import type { ReactNode } from "react";
|
||||
import { useI18n } from "../i18n/i18n";
|
||||
|
||||
const FOCUSABLE_SELECTOR =
|
||||
'a[href], button:not([disabled]), textarea:not([disabled]), input:not([disabled]), select:not([disabled]), [tabindex]:not([tabindex="-1"])';
|
||||
|
||||
export interface DialogProps {
|
||||
open: boolean;
|
||||
onClose: () => void;
|
||||
titleId: string;
|
||||
title: string;
|
||||
children: ReactNode;
|
||||
}
|
||||
|
||||
export function Dialog({ open, onClose, titleId, title, children }: DialogProps) {
|
||||
const { t } = useI18n();
|
||||
const dialogRef = useRef<HTMLDivElement>(null);
|
||||
const previouslyFocused = useRef<HTMLElement | null>(null);
|
||||
|
||||
useEffect(() => {
|
||||
if (!open) return;
|
||||
previouslyFocused.current = document.activeElement as HTMLElement | null;
|
||||
|
||||
const node = dialogRef.current;
|
||||
const focusables = node?.querySelectorAll<HTMLElement>(FOCUSABLE_SELECTOR);
|
||||
focusables?.[0]?.focus();
|
||||
|
||||
function handleKeyDown(event: KeyboardEvent) {
|
||||
if (event.key === "Escape") {
|
||||
onClose();
|
||||
return;
|
||||
}
|
||||
if (event.key !== "Tab" || !node) return;
|
||||
|
||||
const items = Array.from(node.querySelectorAll<HTMLElement>(FOCUSABLE_SELECTOR));
|
||||
if (items.length === 0) return;
|
||||
const first = items[0];
|
||||
const last = items[items.length - 1];
|
||||
|
||||
if (event.shiftKey && document.activeElement === first) {
|
||||
event.preventDefault();
|
||||
last.focus();
|
||||
} else if (!event.shiftKey && document.activeElement === last) {
|
||||
event.preventDefault();
|
||||
first.focus();
|
||||
}
|
||||
}
|
||||
|
||||
document.addEventListener("keydown", handleKeyDown);
|
||||
return () => {
|
||||
document.removeEventListener("keydown", handleKeyDown);
|
||||
previouslyFocused.current?.focus();
|
||||
};
|
||||
}, [open, onClose]);
|
||||
|
||||
if (!open) return null;
|
||||
|
||||
return (
|
||||
<div
|
||||
className="shl-dialog-backdrop"
|
||||
role="presentation"
|
||||
onMouseDown={(event) => {
|
||||
if (event.target === event.currentTarget) onClose();
|
||||
}}
|
||||
>
|
||||
<div
|
||||
ref={dialogRef}
|
||||
className="shl-dialog"
|
||||
role="dialog"
|
||||
aria-modal="true"
|
||||
aria-labelledby={titleId}
|
||||
>
|
||||
<div className="shl-dialog-header">
|
||||
<h2 id={titleId}>{title}</h2>
|
||||
<button type="button" onClick={onClose} aria-label={t("shl.dialog.close")}>
|
||||
×
|
||||
</button>
|
||||
</div>
|
||||
<div className="shl-dialog-body">{children}</div>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -1,98 +0,0 @@
|
||||
// Formularelemente-Basis-Komponenten — SHL-01. WCAG: jedes Feld hat verknüpftes <label>,
|
||||
// Fehler werden per aria-describedby + aria-invalid angebunden, nicht nur farblich markiert.
|
||||
|
||||
import { useId } from "react";
|
||||
import type { InputHTMLAttributes, ReactNode, SelectHTMLAttributes } from "react";
|
||||
|
||||
interface FieldWrapperProps {
|
||||
label: string;
|
||||
error?: string;
|
||||
hint?: string;
|
||||
children: (ids: { inputId: string; describedBy: string | undefined }) => ReactNode;
|
||||
}
|
||||
|
||||
function FieldWrapper({ label, error, hint, children }: FieldWrapperProps) {
|
||||
const inputId = useId();
|
||||
const hintId = hint ? `${inputId}-hint` : undefined;
|
||||
const errorId = error ? `${inputId}-error` : undefined;
|
||||
const describedBy = [hintId, errorId].filter(Boolean).join(" ") || undefined;
|
||||
|
||||
return (
|
||||
<div className="shl-field">
|
||||
<label htmlFor={inputId}>{label}</label>
|
||||
{children({ inputId, describedBy })}
|
||||
{hint && (
|
||||
<p id={hintId} className="shl-field-hint">
|
||||
{hint}
|
||||
</p>
|
||||
)}
|
||||
{error && (
|
||||
<p id={errorId} className="shl-field-error" role="alert">
|
||||
{error}
|
||||
</p>
|
||||
)}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
export interface TextFieldProps
|
||||
extends Omit<InputHTMLAttributes<HTMLInputElement>, "id" | "aria-describedby"> {
|
||||
label: string;
|
||||
error?: string;
|
||||
hint?: string;
|
||||
}
|
||||
|
||||
export function TextField({ label, error, hint, ...inputProps }: TextFieldProps) {
|
||||
return (
|
||||
<FieldWrapper label={label} error={error} hint={hint}>
|
||||
{({ inputId, describedBy }) => (
|
||||
<input
|
||||
id={inputId}
|
||||
aria-describedby={describedBy}
|
||||
aria-invalid={error ? true : undefined}
|
||||
{...inputProps}
|
||||
/>
|
||||
)}
|
||||
</FieldWrapper>
|
||||
);
|
||||
}
|
||||
|
||||
export interface SelectFieldProps
|
||||
extends Omit<SelectHTMLAttributes<HTMLSelectElement>, "id" | "aria-describedby"> {
|
||||
label: string;
|
||||
error?: string;
|
||||
hint?: string;
|
||||
children: ReactNode;
|
||||
}
|
||||
|
||||
export function SelectField({ label, error, hint, children, ...selectProps }: SelectFieldProps) {
|
||||
return (
|
||||
<FieldWrapper label={label} error={error} hint={hint}>
|
||||
{({ inputId, describedBy }) => (
|
||||
<select
|
||||
id={inputId}
|
||||
aria-describedby={describedBy}
|
||||
aria-invalid={error ? true : undefined}
|
||||
{...selectProps}
|
||||
>
|
||||
{children}
|
||||
</select>
|
||||
)}
|
||||
</FieldWrapper>
|
||||
);
|
||||
}
|
||||
|
||||
export interface CheckboxFieldProps
|
||||
extends Omit<InputHTMLAttributes<HTMLInputElement>, "id" | "type"> {
|
||||
label: string;
|
||||
}
|
||||
|
||||
export function CheckboxField({ label, ...inputProps }: CheckboxFieldProps) {
|
||||
const inputId = useId();
|
||||
return (
|
||||
<div className="shl-field shl-field-checkbox">
|
||||
<input id={inputId} type="checkbox" {...inputProps} />
|
||||
<label htmlFor={inputId}>{label}</label>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
"use client";
|
||||
|
||||
// Layout-Shell mit Navigation — SHL-01 Akzeptanzkriterium 1.
|
||||
// Globale Navigation zeigt nur Module, die Core für Tenant/Benutzer freigibt (Backend entscheidet, UI blendet nur aus).
|
||||
|
||||
import type { ReactNode } from "react";
|
||||
import { useI18n } from "../i18n/i18n";
|
||||
import { useTheme } from "../theme/ThemeProvider";
|
||||
|
||||
export interface ModuleLink {
|
||||
key: string;
|
||||
label: string;
|
||||
href: string;
|
||||
active?: boolean;
|
||||
}
|
||||
|
||||
export interface ShellProps {
|
||||
modules: ModuleLink[];
|
||||
tenantLabel: string;
|
||||
children: ReactNode;
|
||||
}
|
||||
|
||||
export function Shell({ modules, tenantLabel, children }: ShellProps) {
|
||||
const { scheme, toggle } = useTheme();
|
||||
const { t } = useI18n();
|
||||
|
||||
return (
|
||||
<div className="shl-shell">
|
||||
<a className="shl-skip-link" href="#shl-main-content">
|
||||
{t("shl.shell.skipToContent", "Zum Inhalt springen")}
|
||||
</a>
|
||||
<header className="shl-shell-header">
|
||||
<nav aria-label={t("shl.shell.moduleNav", "Modul-Navigation")}>
|
||||
<ul>
|
||||
{modules.map((mod) => (
|
||||
<li key={mod.key}>
|
||||
<a href={mod.href} aria-current={mod.active ? "page" : undefined}>
|
||||
{mod.label}
|
||||
</a>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
</nav>
|
||||
<div className="shl-shell-context">
|
||||
<span className="shl-tenant-context">{tenantLabel}</span>
|
||||
<button
|
||||
type="button"
|
||||
onClick={toggle}
|
||||
aria-label={
|
||||
scheme === "light" ? t("shl.theme.toggleToDark") : t("shl.theme.toggleToLight")
|
||||
}
|
||||
>
|
||||
{scheme === "light" ? "🌙" : "☀️"}
|
||||
</button>
|
||||
</div>
|
||||
</header>
|
||||
<main id="shl-main-content" className="shl-shell-content" tabIndex={-1}>
|
||||
{children}
|
||||
</main>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -1,83 +0,0 @@
|
||||
// Table-Basis-Komponente — SHL-01. WCAG: semantische <table>, scope auf Kopfzellen, sortierbare Spalten per Tastatur.
|
||||
|
||||
import type { ReactNode } from "react";
|
||||
import { useI18n } from "../i18n/i18n";
|
||||
|
||||
export interface TableColumn<Row> {
|
||||
key: string;
|
||||
header: string;
|
||||
render: (row: Row) => ReactNode;
|
||||
sortable?: boolean;
|
||||
}
|
||||
|
||||
export interface TableProps<Row> {
|
||||
columns: TableColumn<Row>[];
|
||||
rows: Row[];
|
||||
rowKey: (row: Row) => string;
|
||||
sortKey?: string;
|
||||
sortDirection?: "asc" | "desc";
|
||||
onSort?: (key: string) => void;
|
||||
caption?: string;
|
||||
}
|
||||
|
||||
export function Table<Row>({
|
||||
columns,
|
||||
rows,
|
||||
rowKey,
|
||||
sortKey,
|
||||
sortDirection,
|
||||
onSort,
|
||||
caption,
|
||||
}: TableProps<Row>) {
|
||||
const { t } = useI18n();
|
||||
|
||||
return (
|
||||
<table className="shl-table">
|
||||
{caption && <caption>{caption}</caption>}
|
||||
<thead>
|
||||
<tr>
|
||||
{columns.map((column) => {
|
||||
const isSorted = column.key === sortKey;
|
||||
const ariaSort = column.sortable
|
||||
? isSorted
|
||||
? sortDirection === "asc"
|
||||
? "ascending"
|
||||
: "descending"
|
||||
: "none"
|
||||
: undefined;
|
||||
return (
|
||||
<th key={column.key} scope="col" aria-sort={ariaSort}>
|
||||
{column.sortable ? (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => onSort?.(column.key)}
|
||||
className="shl-table-sort-button"
|
||||
>
|
||||
{column.header}
|
||||
</button>
|
||||
) : (
|
||||
column.header
|
||||
)}
|
||||
</th>
|
||||
);
|
||||
})}
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{rows.length === 0 ? (
|
||||
<tr>
|
||||
<td colSpan={columns.length}>{t("shl.table.noRows")}</td>
|
||||
</tr>
|
||||
) : (
|
||||
rows.map((row) => (
|
||||
<tr key={rowKey(row)}>
|
||||
{columns.map((column) => (
|
||||
<td key={column.key}>{column.render(row)}</td>
|
||||
))}
|
||||
</tr>
|
||||
))
|
||||
)}
|
||||
</tbody>
|
||||
</table>
|
||||
);
|
||||
}
|
||||
@@ -1,67 +0,0 @@
|
||||
"use client";
|
||||
|
||||
// Toast-Basis-Komponente — SHL-01. WCAG: aria-live sorgt dafür, dass Screenreader Meldungen ansagen.
|
||||
|
||||
import { createContext, useCallback, useContext, useMemo, useState } from "react";
|
||||
import type { ReactNode } from "react";
|
||||
import { useI18n } from "../i18n/i18n";
|
||||
|
||||
export type ToastVariant = "info" | "success" | "danger" | "warning";
|
||||
|
||||
export interface ToastMessage {
|
||||
id: string;
|
||||
text: string;
|
||||
variant: ToastVariant;
|
||||
}
|
||||
|
||||
interface ToastContextValue {
|
||||
toasts: ToastMessage[];
|
||||
push: (text: string, variant?: ToastVariant) => void;
|
||||
dismiss: (id: string) => void;
|
||||
}
|
||||
|
||||
const ToastContext = createContext<ToastContextValue | null>(null);
|
||||
|
||||
export function ToastProvider({ children }: { children: ReactNode }) {
|
||||
const [toasts, setToasts] = useState<ToastMessage[]>([]);
|
||||
const { t } = useI18n();
|
||||
|
||||
const dismiss = useCallback((id: string) => {
|
||||
setToasts((current) => current.filter((toast) => toast.id !== id));
|
||||
}, []);
|
||||
|
||||
const push = useCallback((text: string, variant: ToastVariant = "info") => {
|
||||
const id = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
|
||||
setToasts((current) => [...current, { id, text, variant }]);
|
||||
}, []);
|
||||
|
||||
const value = useMemo(() => ({ toasts, push, dismiss }), [toasts, push, dismiss]);
|
||||
|
||||
return (
|
||||
<ToastContext.Provider value={value}>
|
||||
{children}
|
||||
<div className="shl-toast-region" role="status" aria-live="polite" aria-atomic="false">
|
||||
{toasts.map((toast) => (
|
||||
<div key={toast.id} className={`shl-toast shl-toast-${toast.variant}`}>
|
||||
<span>{toast.text}</span>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => dismiss(toast.id)}
|
||||
aria-label={t("shl.toast.dismiss")}
|
||||
>
|
||||
×
|
||||
</button>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</ToastContext.Provider>
|
||||
);
|
||||
}
|
||||
|
||||
export function useToast(): ToastContextValue {
|
||||
const ctx = useContext(ToastContext);
|
||||
if (!ctx) {
|
||||
throw new Error("useToast muss innerhalb von <ToastProvider> aufgerufen werden");
|
||||
}
|
||||
return ctx;
|
||||
}
|
||||
@@ -1,75 +0,0 @@
|
||||
"use client";
|
||||
|
||||
// i18n-Rahmen (mind. Deutsch/Englisch) — SHL-01 Akzeptanzkriterium 5.
|
||||
// Liefert nur den Umschaltmechanismus + Basis-Komponenten-Texte.
|
||||
// Modul-Frontends liefern ihre eigenen fachlichen Textbausteine über registerMessages(),
|
||||
// statt einen eigenen i18n-Mechanismus zu bauen (siehe UI-UX-KONZEPT.md Abschnitt 4).
|
||||
|
||||
import { createContext, useContext, useMemo, useState } from "react";
|
||||
import type { ReactNode } from "react";
|
||||
|
||||
export type Locale = "de" | "en";
|
||||
|
||||
type MessageDict = Record<string, string>;
|
||||
type MessageBundle = Record<Locale, MessageDict>;
|
||||
|
||||
const baseMessages: MessageBundle = {
|
||||
de: {
|
||||
"shl.dialog.close": "Schließen",
|
||||
"shl.toast.dismiss": "Meldung schließen",
|
||||
"shl.table.noRows": "Keine Einträge vorhanden",
|
||||
"shl.theme.toggleToLight": "Helles Erscheinungsbild",
|
||||
"shl.theme.toggleToDark": "Dunkles Erscheinungsbild",
|
||||
},
|
||||
en: {
|
||||
"shl.dialog.close": "Close",
|
||||
"shl.toast.dismiss": "Dismiss message",
|
||||
"shl.table.noRows": "No entries",
|
||||
"shl.theme.toggleToLight": "Switch to light theme",
|
||||
"shl.theme.toggleToDark": "Switch to dark theme",
|
||||
},
|
||||
};
|
||||
|
||||
// Registry, in die Modul-Frontends ihre eigenen Textbausteine einhängen.
|
||||
const registry: MessageBundle = { de: { ...baseMessages.de }, en: { ...baseMessages.en } };
|
||||
|
||||
export function registerMessages(locale: Locale, messages: MessageDict): void {
|
||||
registry[locale] = { ...registry[locale], ...messages };
|
||||
}
|
||||
|
||||
interface I18nContextValue {
|
||||
locale: Locale;
|
||||
setLocale: (locale: Locale) => void;
|
||||
t: (key: string, fallback?: string) => string;
|
||||
}
|
||||
|
||||
const I18nContext = createContext<I18nContextValue | null>(null);
|
||||
|
||||
export function I18nProvider({
|
||||
initialLocale = "de",
|
||||
children,
|
||||
}: {
|
||||
initialLocale?: Locale;
|
||||
children: ReactNode;
|
||||
}) {
|
||||
const [locale, setLocale] = useState<Locale>(initialLocale);
|
||||
|
||||
const value = useMemo<I18nContextValue>(
|
||||
() => ({
|
||||
locale,
|
||||
setLocale,
|
||||
t: (key: string, fallback?: string) => registry[locale][key] ?? fallback ?? key,
|
||||
}),
|
||||
[locale],
|
||||
);
|
||||
|
||||
return <I18nContext.Provider value={value}>{children}</I18nContext.Provider>;
|
||||
}
|
||||
|
||||
export function useI18n(): I18nContextValue {
|
||||
const ctx = useContext(I18nContext);
|
||||
if (!ctx) {
|
||||
throw new Error("useI18n muss innerhalb von <I18nProvider> aufgerufen werden");
|
||||
}
|
||||
return ctx;
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
// Öffentliche Schnittstelle des Pakets @nexarch/shl — Modul-Frontends importieren ausschließlich hierüber,
|
||||
// nicht aus internen Unterpfaden (SHL-01 Akzeptanzkriterium 2: dokumentiert, versioniert, importierbar statt kopiert).
|
||||
|
||||
export { colorTokens, spacing, breakpoints, typography, cssVariables } from "./tokens/tokens";
|
||||
export type { ColorScheme, ColorTokens } from "./tokens/tokens";
|
||||
|
||||
export { ThemeProvider, useTheme, currentColors } from "./theme/ThemeProvider";
|
||||
|
||||
export { I18nProvider, useI18n, registerMessages } from "./i18n/i18n";
|
||||
export type { Locale } from "./i18n/i18n";
|
||||
|
||||
export { Shell } from "./components/Shell";
|
||||
export type { ShellProps, ModuleLink } from "./components/Shell";
|
||||
|
||||
export { Dialog } from "./components/Dialog";
|
||||
export type { DialogProps } from "./components/Dialog";
|
||||
|
||||
export { Table } from "./components/Table";
|
||||
export type { TableProps, TableColumn } from "./components/Table";
|
||||
|
||||
export { TextField, SelectField, CheckboxField } from "./components/FormElements";
|
||||
export type { TextFieldProps, SelectFieldProps, CheckboxFieldProps } from "./components/FormElements";
|
||||
|
||||
export { ToastProvider, useToast } from "./components/Toast";
|
||||
export type { ToastMessage, ToastVariant } from "./components/Toast";
|
||||
@@ -1,25 +0,0 @@
|
||||
{
|
||||
"name": "@nexarch/shl",
|
||||
"version": "0.1.0",
|
||||
"private": true,
|
||||
"description": "NEXARCH UI-Shell & Design-System (Core SHL-01) — gemeinsames Paket für alle Modul-Frontends.",
|
||||
"main": "index.ts",
|
||||
"types": "index.ts",
|
||||
"scripts": {
|
||||
"test": "vitest run",
|
||||
"typecheck": "tsc --noEmit"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"react": "^18.3.1",
|
||||
"react-dom": "^18.3.1"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@testing-library/jest-dom": "^6.4.8",
|
||||
"@testing-library/react": "^16.0.0",
|
||||
"@types/react": "18.3.3",
|
||||
"@types/react-dom": "18.3.0",
|
||||
"jsdom": "^24.1.1",
|
||||
"typescript": "5.5.3",
|
||||
"vitest": "^2.0.0"
|
||||
}
|
||||
}
|
||||
@@ -1,81 +0,0 @@
|
||||
"use client";
|
||||
|
||||
// Zentrales Theming (Hell/Dunkel) — SHL-01 Akzeptanzkriterium 6.
|
||||
// Einzige Quelle für Hell/Dunkel-Werte; Modul-Frontends schalten nur um, bauen kein eigenes Theming.
|
||||
|
||||
import { createContext, useCallback, useContext, useEffect, useMemo, useState } from "react";
|
||||
import type { ReactNode } from "react";
|
||||
import { colorTokens, cssVariables, type ColorScheme } from "../tokens/tokens";
|
||||
|
||||
const STORAGE_KEY = "nexarch-shl-theme";
|
||||
|
||||
interface ThemeContextValue {
|
||||
scheme: ColorScheme;
|
||||
setScheme: (scheme: ColorScheme) => void;
|
||||
toggle: () => void;
|
||||
}
|
||||
|
||||
const ThemeContext = createContext<ThemeContextValue | null>(null);
|
||||
|
||||
function readStoredScheme(): ColorScheme | null {
|
||||
if (typeof window === "undefined") return null;
|
||||
try {
|
||||
const stored = window.localStorage.getItem(STORAGE_KEY);
|
||||
return stored === "light" || stored === "dark" ? stored : null;
|
||||
} catch {
|
||||
// localStorage kann in privaten Fenstern/eingeschränkten Kontexten fehlschlagen — kein Absturz, nur kein persistierter Zustand.
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function systemPrefersDark(): boolean {
|
||||
if (typeof window === "undefined" || !window.matchMedia) return false;
|
||||
return window.matchMedia("(prefers-color-scheme: dark)").matches;
|
||||
}
|
||||
|
||||
export function ThemeProvider({ children }: { children: ReactNode }) {
|
||||
const [scheme, setSchemeState] = useState<ColorScheme>("light");
|
||||
|
||||
useEffect(() => {
|
||||
const stored = readStoredScheme();
|
||||
setSchemeState(stored ?? (systemPrefersDark() ? "dark" : "light"));
|
||||
}, []);
|
||||
|
||||
const setScheme = useCallback((next: ColorScheme) => {
|
||||
setSchemeState(next);
|
||||
try {
|
||||
window.localStorage.setItem(STORAGE_KEY, next);
|
||||
} catch {
|
||||
// Speichern optional — Umschaltung funktioniert auch ohne Persistenz.
|
||||
}
|
||||
}, []);
|
||||
|
||||
const toggle = useCallback(() => {
|
||||
setScheme(scheme === "light" ? "dark" : "light");
|
||||
}, [scheme, setScheme]);
|
||||
|
||||
useEffect(() => {
|
||||
const vars = cssVariables(scheme);
|
||||
const root = document.documentElement;
|
||||
for (const [key, value] of Object.entries(vars)) {
|
||||
root.style.setProperty(key, value);
|
||||
}
|
||||
root.dataset.shlTheme = scheme;
|
||||
}, [scheme]);
|
||||
|
||||
const value = useMemo(() => ({ scheme, setScheme, toggle }), [scheme, setScheme, toggle]);
|
||||
|
||||
return <ThemeContext.Provider value={value}>{children}</ThemeContext.Provider>;
|
||||
}
|
||||
|
||||
export function useTheme(): ThemeContextValue {
|
||||
const ctx = useContext(ThemeContext);
|
||||
if (!ctx) {
|
||||
throw new Error("useTheme muss innerhalb von <ThemeProvider> aufgerufen werden");
|
||||
}
|
||||
return ctx;
|
||||
}
|
||||
|
||||
export function currentColors(scheme: ColorScheme) {
|
||||
return colorTokens[scheme];
|
||||
}
|
||||
@@ -1,96 +0,0 @@
|
||||
// Design-Tokens: einzige Quelle für Farbe, Abstand, Typografie im gesamten Frontend-Verbund.
|
||||
// Modul-Frontends importieren diese Tokens, überschreiben sie nicht lokal (SHL-01 Akzeptanzkriterium 3).
|
||||
// Kontrastwerte sind gegen WCAG 2.1 AA geprüft (Akzeptanzkriterium 1/4): mindestens 4.5:1 für Fließtext.
|
||||
|
||||
export type ColorScheme = "light" | "dark";
|
||||
|
||||
export interface ColorTokens {
|
||||
background: string;
|
||||
surface: string;
|
||||
surfaceRaised: string;
|
||||
border: string;
|
||||
textPrimary: string;
|
||||
textSecondary: string;
|
||||
accent: string;
|
||||
accentContrast: string;
|
||||
danger: string;
|
||||
dangerContrast: string;
|
||||
success: string;
|
||||
warning: string;
|
||||
focusRing: string;
|
||||
}
|
||||
|
||||
// Kontrastwerte geprüft: textPrimary auf background/surface >= 7:1, textSecondary >= 4.5:1,
|
||||
// accentContrast auf accent >= 4.5:1 (WCAG AA, siehe SHL-01 Prüfung 3).
|
||||
export const colorTokens: Record<ColorScheme, ColorTokens> = {
|
||||
light: {
|
||||
background: "#FFFFFF",
|
||||
surface: "#F5F6F8",
|
||||
surfaceRaised: "#FFFFFF",
|
||||
border: "#D7DBE0",
|
||||
textPrimary: "#14181F",
|
||||
textSecondary: "#4B5563",
|
||||
accent: "#1D4ED8",
|
||||
accentContrast: "#FFFFFF",
|
||||
danger: "#B91C1C",
|
||||
dangerContrast: "#FFFFFF",
|
||||
success: "#15803D",
|
||||
warning: "#B45309",
|
||||
focusRing: "#1D4ED8",
|
||||
},
|
||||
dark: {
|
||||
background: "#0F1115",
|
||||
surface: "#181B21",
|
||||
surfaceRaised: "#20242C",
|
||||
border: "#333944",
|
||||
textPrimary: "#F2F4F7",
|
||||
textSecondary: "#B4BAC4",
|
||||
accent: "#5B8DEF",
|
||||
accentContrast: "#0F1115",
|
||||
danger: "#F87171",
|
||||
dangerContrast: "#0F1115",
|
||||
success: "#4ADE80",
|
||||
warning: "#FBBF24",
|
||||
focusRing: "#5B8DEF",
|
||||
},
|
||||
};
|
||||
|
||||
export const spacing = {
|
||||
xs: "4px",
|
||||
sm: "8px",
|
||||
md: "16px",
|
||||
lg: "24px",
|
||||
xl: "32px",
|
||||
xxl: "48px",
|
||||
} as const;
|
||||
|
||||
export const breakpoints = {
|
||||
mobile: "0px",
|
||||
tablet: "768px",
|
||||
desktop: "1200px",
|
||||
} as const;
|
||||
|
||||
export const typography = {
|
||||
fontFamily: "'Inter', 'Segoe UI', system-ui, sans-serif",
|
||||
fontFamilyMono: "'JetBrains Mono', ui-monospace, monospace",
|
||||
sizeSm: "13px",
|
||||
sizeMd: "15px",
|
||||
sizeLg: "18px",
|
||||
sizeXl: "24px",
|
||||
lineHeight: 1.5,
|
||||
weightRegular: 400,
|
||||
weightMedium: 500,
|
||||
weightBold: 600,
|
||||
} as const;
|
||||
|
||||
export function cssVariables(scheme: ColorScheme): Record<string, string> {
|
||||
const c = colorTokens[scheme];
|
||||
const vars: Record<string, string> = {};
|
||||
for (const [key, value] of Object.entries(c)) {
|
||||
vars[`--shl-color-${key.replace(/([A-Z])/g, "-$1").toLowerCase()}`] = value;
|
||||
}
|
||||
for (const [key, value] of Object.entries(spacing)) {
|
||||
vars[`--shl-spacing-${key}`] = value;
|
||||
}
|
||||
return vars;
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
{
|
||||
"compilerOptions": {
|
||||
"target": "ES2020",
|
||||
"lib": ["dom", "dom.iterable", "esnext"],
|
||||
"jsx": "react-jsx",
|
||||
"module": "ESNext",
|
||||
"moduleResolution": "bundler",
|
||||
"strict": true,
|
||||
"declaration": true,
|
||||
"esModuleInterop": true,
|
||||
"skipLibCheck": true,
|
||||
"forceConsistentCasingInFileNames": true,
|
||||
"noUnusedLocals": true,
|
||||
"noUnusedParameters": true
|
||||
},
|
||||
"include": ["**/*.ts", "**/*.tsx"],
|
||||
"exclude": ["node_modules"]
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
import { defineConfig } from "vitest/config";
|
||||
|
||||
export default defineConfig({
|
||||
test: {
|
||||
environment: "jsdom",
|
||||
setupFiles: ["./vitest.setup.ts"],
|
||||
},
|
||||
});
|
||||
@@ -1,9 +0,0 @@
|
||||
import "@testing-library/jest-dom/vitest";
|
||||
import { afterEach } from "vitest";
|
||||
import { cleanup } from "@testing-library/react";
|
||||
|
||||
// Ohne explizites Cleanup bleiben zwischen den it()-Blöcken gerenderte Dialoge im DOM stehen
|
||||
// (mehrere <html>/<body>-Bäume stapeln sich), wodurch getByRole() mehrere Treffer statt einen findet.
|
||||
afterEach(() => {
|
||||
cleanup();
|
||||
});
|
||||
Reference in New Issue
Block a user