Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 patrick
|
2337841249 |
@@ -1,4 +1,2 @@
|
|||||||
*.log
|
*.log
|
||||||
.env
|
.env
|
||||||
web/*/node_modules/
|
|
||||||
web/*/.next/
|
|
||||||
|
|||||||
@@ -44,158 +44,3 @@ Keine Commits in dieser Session.
|
|||||||
Keine Änderungen ermittelbar.
|
Keine Änderungen ermittelbar.
|
||||||
|
|
||||||
---
|
---
|
||||||
## 2026-08-27 17:26 – 17:28 (1m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** code
|
|
||||||
|
|
||||||
### Commits
|
|
||||||
- c895a67 core: initial Go module skeleton (config, db pool, tenant registry migration)
|
|
||||||
|
|
||||||
### Geänderte Dateien
|
|
||||||
- .gitignore | 2 ++
|
|
||||||
- DEVLOG.md | 46 ++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- cmd/core/main.go | 33 +++++++++++++++++++++++++++++++++
|
|
||||||
- go.mod | 5 +++++
|
|
||||||
- internal/config/config.go | 29 +++++++++++++++++++++++++++++
|
|
||||||
- internal/db/db.go | 11 +++++++++++
|
|
||||||
- migrations/0001_tenant_registry.sql | 10 ++++++++++
|
|
||||||
|
|
||||||
---
|
|
||||||
## 2026-08-27 17:28 – 17:29 (1m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** code
|
|
||||||
## 2026-08-28 21:44 – 21:44 (0m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** nexarch
|
|
||||||
|
|
||||||
### Commits
|
|
||||||
Keine Commits in dieser Session.
|
|
||||||
|
|
||||||
### Geänderte Dateien
|
|
||||||
- .gitignore | 2 ++
|
|
||||||
- DEVLOG.md | 46 ++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- cmd/core/main.go | 33 +++++++++++++++++++++++++++++++++
|
|
||||||
- go.mod | 5 +++++
|
|
||||||
- internal/config/config.go | 29 +++++++++++++++++++++++++++++
|
|
||||||
- internal/db/db.go | 11 +++++++++++
|
|
||||||
- migrations/0001_tenant_registry.sql | 10 ++++++++++
|
|
||||||
|
|
||||||
---
|
|
||||||
## 2026-08-27 17:31 – 17:31 (0m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** code
|
|
||||||
|
|
||||||
### Commits
|
|
||||||
Keine Commits in dieser Session.
|
|
||||||
|
|
||||||
### Geänderte Dateien
|
|
||||||
- .gitignore | 2 ++
|
|
||||||
- DEVLOG.md | 46 ++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- cmd/core/main.go | 33 +++++++++++++++++++++++++++++++++
|
|
||||||
- go.mod | 5 +++++
|
|
||||||
- internal/config/config.go | 29 +++++++++++++++++++++++++++++
|
|
||||||
- internal/db/db.go | 11 +++++++++++
|
|
||||||
- migrations/0001_tenant_registry.sql | 10 ++++++++++
|
|
||||||
|
|
||||||
---
|
|
||||||
## 2026-08-27 17:36 – 17:36 (0m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** code
|
|
||||||
|
|
||||||
### Commits
|
|
||||||
Keine Commits in dieser Session.
|
|
||||||
|
|
||||||
### Geänderte Dateien
|
|
||||||
- .gitignore | 2 ++
|
|
||||||
- DEVLOG.md | 46 ++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- cmd/core/main.go | 33 +++++++++++++++++++++++++++++++++
|
|
||||||
- go.mod | 5 +++++
|
|
||||||
- internal/config/config.go | 29 +++++++++++++++++++++++++++++
|
|
||||||
- internal/db/db.go | 11 +++++++++++
|
|
||||||
- migrations/0001_tenant_registry.sql | 10 ++++++++++
|
|
||||||
|
|
||||||
---
|
|
||||||
## 2026-08-27 17:36 – 17:37 (0m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** code
|
|
||||||
|
|
||||||
### Commits
|
|
||||||
Keine Commits in dieser Session.
|
|
||||||
|
|
||||||
### Geänderte Dateien
|
|
||||||
- .gitignore | 2 ++
|
|
||||||
- DEVLOG.md | 46 ++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- cmd/core/main.go | 33 +++++++++++++++++++++++++++++++++
|
|
||||||
- go.mod | 5 +++++
|
|
||||||
- internal/config/config.go | 29 +++++++++++++++++++++++++++++
|
|
||||||
- internal/db/db.go | 11 +++++++++++
|
|
||||||
- migrations/0001_tenant_registry.sql | 10 ++++++++++
|
|
||||||
- web/shl/README.md | 45 +++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/__tests__/Dialog.test.tsx | 38 ++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/__tests__/tokens.test.ts | 39 +++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/components/Dialog.tsx | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/components/FormElements.tsx | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/components/Shell.tsx | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/components/Table.tsx | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/components/Toast.tsx | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/i18n/i18n.tsx | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/index.ts | 25 +++++++++++++++++++++++++
|
|
||||||
- web/shl/package.json | 23 +++++++++++++++++++++++
|
|
||||||
- web/shl/theme/ThemeProvider.tsx | 81 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/tokens/tokens.ts | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/shl/tsconfig.json | 18 ++++++++++++++++++
|
|
||||||
|
|
||||||
---
|
|
||||||
## 2026-08-28 21:51 – 21:57 (5m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** nexarch
|
|
||||||
|
|
||||||
### Commits
|
|
||||||
- 3c226da SHL-01: fix — vitest jsdom-environment + jest-dom-Setup (3 Dialog-Tests schlugen ohne DOM fehl)
|
|
||||||
|
|
||||||
### Geänderte Dateien
|
|
||||||
- web/shl/package.json | 2 ++
|
|
||||||
- web/shl/vitest.config.ts | 8 ++++++++
|
|
||||||
- web/shl/vitest.setup.ts | 1 +
|
|
||||||
|
|
||||||
---
|
|
||||||
## 2026-08-28 23:37 – 23:43 (5m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** nexarch
|
|
||||||
|
|
||||||
### Commits
|
|
||||||
- fbcc9db RBAC-05: web/rbac-admin next.js-frontend (rollen+gruppen-verwaltung, audit-verlauf) auf shl-01
|
|
||||||
- bd80f0c Merge branch 'feature/shl-01-ui-shell-design-system-zentral' into feature/rbac-05-rechte-administrationsoberflaeche
|
|
||||||
- 051af43 RBAC-05: backend — handler.go (rollen-/gruppenverwaltung, selbst-eskalationsschutz), group.go ListGroups/Members
|
|
||||||
- 9de9005 Merge branch 'feature/iam-02-login-session-jwt-grundgeruest' into feature/rbac-05-rechte-administrationsoberflaeche
|
|
||||||
- 1b6a159 Merge branch 'feature/rbac-03-gruppen-abteilungen' into feature/rbac-05-rechte-administrationsoberflaeche
|
|
||||||
|
|
||||||
### Geänderte Dateien
|
|
||||||
- web/rbac-admin/app/groups/page.tsx | 183 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/app/layout.tsx | 30 ++++++++++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/app/page.tsx | 5 +++++
|
|
||||||
- web/rbac-admin/app/roles/page.tsx | 142 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/lib/api.ts | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/next.config.mjs | 5 +++++
|
|
||||||
- web/rbac-admin/package.json | 22 ++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/tsconfig.json | 21 +++++++++++++++++++++
|
|
||||||
|
|
||||||
---
|
|
||||||
## 2026-08-28 23:44 – 23:44 (0m)
|
|
||||||
**Beschreibung:** Claude Code Session
|
|
||||||
**Projekt:** code
|
|
||||||
|
|
||||||
### Commits
|
|
||||||
Keine Commits in dieser Session.
|
|
||||||
|
|
||||||
### Geänderte Dateien
|
|
||||||
- web/rbac-admin/app/groups/page.tsx | 183 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/app/layout.tsx | 30 ++++++++++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/app/page.tsx | 5 +++++
|
|
||||||
- web/rbac-admin/app/roles/page.tsx | 142 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/lib/api.ts | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/next.config.mjs | 5 +++++
|
|
||||||
- web/rbac-admin/package.json | 22 ++++++++++++++++++++++
|
|
||||||
- web/rbac-admin/tsconfig.json | 21 +++++++++++++++++++++
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|||||||
+3
-27
@@ -7,8 +7,6 @@ import (
|
|||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/config"
|
"gitea.perlbach24.de/scripte/nexarch/internal/config"
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/db"
|
"gitea.perlbach24.de/scripte/nexarch/internal/db"
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/tenant"
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
func main() {
|
func main() {
|
||||||
@@ -17,38 +15,16 @@ func main() {
|
|||||||
log.Fatalf("config: %v", err)
|
log.Fatalf("config: %v", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
ctx := context.Background()
|
pool, err := db.Connect(context.Background(), cfg.RegistryDSN)
|
||||||
|
|
||||||
registryPool, err := db.Connect(ctx, cfg.RegistryDSN)
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
log.Fatalf("registry db: %v", err)
|
log.Fatalf("db: %v", err)
|
||||||
}
|
}
|
||||||
defer registryPool.Close()
|
defer pool.Close()
|
||||||
|
|
||||||
adminPool, err := db.Connect(ctx, cfg.AdminDSN)
|
|
||||||
if err != nil {
|
|
||||||
log.Fatalf("admin db: %v", err)
|
|
||||||
}
|
|
||||||
defer adminPool.Close()
|
|
||||||
|
|
||||||
registry := tenant.NewRegistry(registryPool)
|
|
||||||
provisioner := tenant.NewProvisioner(adminPool, registry, cfg.TenantDSNTemplate)
|
|
||||||
tenantHandler := tenant.NewHandler(provisioner)
|
|
||||||
|
|
||||||
// Superadmin-Konten leben mandantenuebergreifend in der Registry-DB.
|
|
||||||
// Tenant-User-CRUD (user.TenantUserStore) braucht Connection-Routing pro
|
|
||||||
// Mandant (TEN-06, noch nicht gebaut) und wird hier bewusst noch nicht
|
|
||||||
// verdrahtet — Package ist bereits eigenstaendig nutzbar/testbar.
|
|
||||||
superadmins := user.NewSuperadminStore(registryPool)
|
|
||||||
userHandler := user.NewHandler(nil, superadmins)
|
|
||||||
|
|
||||||
mux := http.NewServeMux()
|
mux := http.NewServeMux()
|
||||||
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
|
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
|
||||||
w.WriteHeader(http.StatusOK)
|
w.WriteHeader(http.StatusOK)
|
||||||
})
|
})
|
||||||
// Vorlaeufige Pfade ohne Versionierung/Auth — werden mit API-01/IAM-02 abgeloest.
|
|
||||||
mux.HandleFunc("/internal/tenants", tenantHandler.CreateTenant)
|
|
||||||
mux.HandleFunc("/internal/superadmins", userHandler.CreateSuperadmin)
|
|
||||||
|
|
||||||
log.Printf("nexarch-core listening on %s", cfg.ListenAddr)
|
log.Printf("nexarch-core listening on %s", cfg.ListenAddr)
|
||||||
if err := http.ListenAndServe(cfg.ListenAddr, mux); err != nil {
|
if err := http.ListenAndServe(cfg.ListenAddr, mux); err != nil {
|
||||||
|
|||||||
@@ -1,66 +0,0 @@
|
|||||||
// rbac-admin-api ist der Aufrufpunkt fuer RBAC-07: startet den bereits
|
|
||||||
// fertigen RBAC-05-Handler (internal/rbac) als eigenstaendigen HTTP-Dienst,
|
|
||||||
// hinter derselben Session-Auth wie IAM-16 (account-api) — GLEICHER
|
|
||||||
// JWT-Secret, damit eine bei account-api ausgestellte Session hier auch
|
|
||||||
// gueltig ist. REINES WIRING — keine Aenderung an internal/rbac/.
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"log"
|
|
||||||
"net/http"
|
|
||||||
"os"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/auth"
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
|
||||||
)
|
|
||||||
|
|
||||||
func requireEnv(name string) string {
|
|
||||||
v := os.Getenv(name)
|
|
||||||
if v == "" {
|
|
||||||
log.Fatalf("%s muss gesetzt sein", name)
|
|
||||||
}
|
|
||||||
return v
|
|
||||||
}
|
|
||||||
|
|
||||||
func main() {
|
|
||||||
dsn := requireEnv("NEXARCH_RBACADMIN_TENANT_DSN")
|
|
||||||
// MUSS identisch mit NEXARCH_ACCOUNT_JWT_SECRET (IAM-16) sein, sonst
|
|
||||||
// verwirft dieser Dienst gueltige account-api-Sessions.
|
|
||||||
jwtSecret := requireEnv("NEXARCH_RBACADMIN_JWT_SECRET")
|
|
||||||
addr := os.Getenv("NEXARCH_RBACADMIN_API_LISTEN_ADDR")
|
|
||||||
if addr == "" {
|
|
||||||
addr = "127.0.0.1:8100"
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx := context.Background()
|
|
||||||
pool, err := pgxpool.New(ctx, dsn)
|
|
||||||
if err != nil {
|
|
||||||
log.Fatalf("datenbankverbindung: %v", err)
|
|
||||||
}
|
|
||||||
defer pool.Close()
|
|
||||||
|
|
||||||
tokenIssuer := auth.NewTokenIssuer(jwtSecret)
|
|
||||||
roles := rbac.NewStore(pool)
|
|
||||||
groups := rbac.NewGroupStore(pool)
|
|
||||||
handler := rbac.NewHandler(roles, groups)
|
|
||||||
|
|
||||||
mux := http.NewServeMux()
|
|
||||||
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
|
|
||||||
|
|
||||||
mux.HandleFunc("GET /rbac/roles", auth.RequireAuth(tokenIssuer, handler.ListRoles))
|
|
||||||
mux.HandleFunc("POST /rbac/users/role", auth.RequireAuth(tokenIssuer, handler.AssignRole))
|
|
||||||
mux.HandleFunc("GET /rbac/users/{id}/history", auth.RequireAuth(tokenIssuer, handler.RoleHistory))
|
|
||||||
mux.HandleFunc("GET /rbac/groups", auth.RequireAuth(tokenIssuer, handler.ListGroups))
|
|
||||||
mux.HandleFunc("POST /rbac/groups", auth.RequireAuth(tokenIssuer, handler.CreateGroup))
|
|
||||||
mux.HandleFunc("POST /rbac/groups/role", auth.RequireAuth(tokenIssuer, handler.SetGroupRole))
|
|
||||||
mux.HandleFunc("POST /rbac/groups/members", auth.RequireAuth(tokenIssuer, handler.AddGroupMember))
|
|
||||||
mux.HandleFunc("POST /rbac/groups/members/remove", auth.RequireAuth(tokenIssuer, handler.RemoveGroupMember))
|
|
||||||
|
|
||||||
log.Printf("rbac-admin-api: listening on %s", addr)
|
|
||||||
if err := http.ListenAndServe(addr, mux); err != nil {
|
|
||||||
log.Fatalf("http server: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=NEXARCH Core - Rechte-Administrations-Dienst (RBAC-05/RBAC-07)
|
|
||||||
After=network.target postgresql.service
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
User=nexarch
|
|
||||||
EnvironmentFile=/etc/nexarch/rbac-admin-api.env
|
|
||||||
ExecStart=__INSTALL_DIR__/bin/rbac-admin-api
|
|
||||||
Restart=on-failure
|
|
||||||
StandardOutput=journal
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
@@ -1,75 +0,0 @@
|
|||||||
# RBAC-07 – Prüfprotokoll: Rechte-Administrations-Dienst starten (RBAC-05 als laufender Dienst)
|
|
||||||
|
|
||||||
Voraussetzung RBAC-05, IAM-16 – beide bereits Fertig, hier UNVERÄNDERT.
|
|
||||||
|
|
||||||
## Reines Wiring, keine neue Logik
|
|
||||||
|
|
||||||
`git diff --stat internal/rbac/` liefert KEINEN Diff. `cmd/rbac-admin-api/main.go`
|
|
||||||
setzt ausschließlich bestehende Konstruktoren zusammen und wrappt jeden
|
|
||||||
Endpunkt mit `auth.RequireAuth` — derselben Middleware, die IAM-16
|
|
||||||
bereits nutzt.
|
|
||||||
|
|
||||||
## JWT-Secret-Konsistenz (explizit geprüft, nicht nur konfiguriert)
|
|
||||||
|
|
||||||
`NEXARCH_RBACADMIN_JWT_SECRET` MUSS identisch mit
|
|
||||||
`NEXARCH_ACCOUNT_JWT_SECRET` (IAM-16) sein, sonst verwirft dieser Dienst
|
|
||||||
gültige account-api-Sessions. Real getestet: mit account-api (Port
|
|
||||||
8099) eingeloggt, Session-Cookie unverändert gegen rbac-admin-api (Port
|
|
||||||
8100, ANDERER Prozess, ANDERE Portnummer) verwendet — Cookie wurde real
|
|
||||||
akzeptiert, kein zweiter Login nötig. Das beweist die Cross-Service-
|
|
||||||
Gültigkeit, nicht nur eine übereinstimmende Konfigurationszeile.
|
|
||||||
|
|
||||||
## Bootstrap-Erkenntnis (dokumentiert)
|
|
||||||
|
|
||||||
`internal/rbac.Handler.ListRoles` verlangt selbst bereits eine Rolle
|
|
||||||
mit `PermManageUsers` (`requireManageUsers`) — ein Benutzer OHNE
|
|
||||||
`role_assignments`-Zeile bekommt 403, auch für die reine Rollenliste.
|
|
||||||
Für den End-zu-Ende-Test wurde daher ein Testnutzer mit einer direkt in
|
|
||||||
der DB gesetzten `tenant_admin`-Bootstrap-Zeile angelegt (wie eine
|
|
||||||
Ersteinrichtung) — kein Umgehen der echten Prüfung, sondern deren
|
|
||||||
Voraussetzung.
|
|
||||||
|
|
||||||
## Umsetzung
|
|
||||||
|
|
||||||
- `cmd/rbac-admin-api/main.go` – Rollen/Gruppen-Endpunkte
|
|
||||||
(`GET /rbac/roles`, `POST /rbac/users/role`,
|
|
||||||
`GET /rbac/users/{id}/history`, `GET/POST /rbac/groups*`), alle
|
|
||||||
hinter `auth.RequireAuth`.
|
|
||||||
- `deploy/systemd/nexarch-rbac-admin-api.service.tmpl`.
|
|
||||||
|
|
||||||
## Prüfungen
|
|
||||||
|
|
||||||
| # | Prüfung | Ergebnis |
|
|
||||||
|---|---|---|
|
|
||||||
| 1 | Dienst startet und bleibt stabil (systemctl status aktiv) | **bestanden** – real auf 131: `nexarch-rbac-admin-api.service` aktiv |
|
|
||||||
| 2 | Realer Aufruf mit gültigem IAM-16-Session-Cookie liefert die erwartete Rollenliste, ohne/mit falschem Cookie 401/403 | **bestanden** – real per `curl`: mit dem bei `account-api` (IAM-16) ausgestellten Cookie → 200 mit der echten Rollen-/Rechte-Liste (`tenant_admin`, `user`); ohne Cookie → 401 |
|
|
||||||
| 3 | Code-Review: keine Änderung an internal/rbac/ selbst, nur main.go+systemd neu | **bestanden** – `git diff --stat internal/rbac/` liefert leeren Diff |
|
|
||||||
|
|
||||||
## Echte Verdrahtung auf 192.168.1.131
|
|
||||||
|
|
||||||
- `rbac-admin-api` gebaut nach `/opt/nexarch-core/bin/`,
|
|
||||||
`/etc/nexarch/rbac-admin-api.env` (0600, `NEXARCH_RBACADMIN_JWT_SECRET`
|
|
||||||
identisch zu `NEXARCH_ACCOUNT_JWT_SECRET`), Dienst installiert/aktiviert.
|
|
||||||
- Migrationen `0002_role_assignments`, `0003_groups` real auf
|
|
||||||
`tenant_acme` angewendet (fehlten dort), reale Grant-Lücke gefunden
|
|
||||||
und behoben (`role_assignments`, `role_assignment_history`, `groups`,
|
|
||||||
`group_members`), über `information_schema.role_table_grants`
|
|
||||||
verifiziert.
|
|
||||||
- End-zu-Ende-Beweis: Testnutzer mit Bootstrap-`tenant_admin`-Rolle,
|
|
||||||
Login gegen `account-api`, dasselbe Cookie gegen `rbac-admin-api`
|
|
||||||
verwendet → echte Rollenliste. Testdaten anschließend entfernt.
|
|
||||||
|
|
||||||
## Build/Test-Ergebnis (192.168.1.131)
|
|
||||||
|
|
||||||
```
|
|
||||||
go build ./... -> clean
|
|
||||||
go vet ./... -> clean
|
|
||||||
golangci-lint run ./cmd/rbac-admin-api/... -> 0 issues
|
|
||||||
```
|
|
||||||
|
|
||||||
## Gesamtergebnis
|
|
||||||
|
|
||||||
**Bestanden.** RBAC-05 ist jetzt ein real laufender, über systemd
|
|
||||||
verwalteter Dienst, cross-service authentifiziert über dieselbe
|
|
||||||
IAM-16-Session — der zweite Baustein der browserfähigen Core-GUI nach
|
|
||||||
TEN-05.
|
|
||||||
@@ -2,16 +2,4 @@ module gitea.perlbach24.de/scripte/nexarch
|
|||||||
|
|
||||||
go 1.22
|
go 1.22
|
||||||
|
|
||||||
require (
|
require github.com/jackc/pgx/v5 v5.6.0
|
||||||
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
||||||
github.com/jackc/pgx/v5 v5.6.0
|
|
||||||
golang.org/x/crypto v0.17.0
|
|
||||||
)
|
|
||||||
|
|
||||||
require (
|
|
||||||
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
||||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
|
|
||||||
github.com/jackc/puddle/v2 v2.2.1 // indirect
|
|
||||||
golang.org/x/sync v0.1.0 // indirect
|
|
||||||
golang.org/x/text v0.14.0 // indirect
|
|
||||||
)
|
|
||||||
|
|||||||
@@ -1,30 +0,0 @@
|
|||||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
|
||||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
|
||||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
|
||||||
github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
|
|
||||||
github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
|
|
||||||
github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
|
|
||||||
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
|
|
||||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
|
|
||||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
|
|
||||||
github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
|
|
||||||
github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
|
|
||||||
github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
|
|
||||||
github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
|
|
||||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
|
||||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
|
||||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
|
||||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
|
||||||
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
|
||||||
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
|
|
||||||
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
|
||||||
golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
|
|
||||||
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
|
|
||||||
golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
|
|
||||||
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
|
||||||
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
|
|
||||||
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
|
||||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
|
||||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
|
||||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
|
||||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
|
||||||
@@ -1,67 +0,0 @@
|
|||||||
package auth
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"net/http"
|
|
||||||
"time"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Handler stellt Login/Logout als HTTP-Endpunkte bereit. Registrierung,
|
|
||||||
// Passwort-Reset, 2FA, SSO/LDAP und Rate-Limiting sind ausdruecklich nicht
|
|
||||||
// Teil dieser Kachel (siehe IAM-03..07).
|
|
||||||
type Handler struct {
|
|
||||||
login *LoginService
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewHandler(login *LoginService) *Handler {
|
|
||||||
return &Handler{login: login}
|
|
||||||
}
|
|
||||||
|
|
||||||
type loginRequest struct {
|
|
||||||
Email string `json:"email"`
|
|
||||||
Password string `json:"password"`
|
|
||||||
}
|
|
||||||
|
|
||||||
func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
|
|
||||||
var req loginRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
token, err := h.login.Login(r.Context(), req.Email, req.Password)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, ErrInvalidCredentials.Error(), http.StatusUnauthorized)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
http.SetCookie(w, &http.Cookie{
|
|
||||||
Name: CookieName,
|
|
||||||
Value: token,
|
|
||||||
Path: "/",
|
|
||||||
HttpOnly: true,
|
|
||||||
Secure: true,
|
|
||||||
SameSite: http.SameSiteStrictMode,
|
|
||||||
MaxAge: int(AccessTokenTTL.Seconds()),
|
|
||||||
})
|
|
||||||
w.WriteHeader(http.StatusOK)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Logout loescht das Session-Cookie. Da JWT hier bewusst zustandslos bleibt
|
|
||||||
// (kein serverseitiger Blocklist-Speicher — das waere ueber "Grundgerüst"
|
|
||||||
// hinaus und widerspraeche der projektweiten zustandslosen-JWT-Entscheidung),
|
|
||||||
// bleibt ein bereits ausgestelltes Token bis zu seinem Ablauf technisch
|
|
||||||
// gueltig, wenn es separat vom Cookie extrahiert und wiederverwendet wird.
|
|
||||||
func (h *Handler) Logout(w http.ResponseWriter, r *http.Request) {
|
|
||||||
http.SetCookie(w, &http.Cookie{
|
|
||||||
Name: CookieName,
|
|
||||||
Value: "",
|
|
||||||
Path: "/",
|
|
||||||
HttpOnly: true,
|
|
||||||
Secure: true,
|
|
||||||
SameSite: http.SameSiteStrictMode,
|
|
||||||
MaxAge: -1,
|
|
||||||
Expires: time.Unix(0, 0),
|
|
||||||
})
|
|
||||||
w.WriteHeader(http.StatusOK)
|
|
||||||
}
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
package auth
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
|
||||||
)
|
|
||||||
|
|
||||||
var ErrInvalidCredentials = errors.New("auth: E-Mail oder Passwort falsch")
|
|
||||||
|
|
||||||
// LoginService arbeitet gegen GENAU EINE Tenant-Datenbank (uebergeben ueber
|
|
||||||
// den TenantUserStore-Pool) — das Login ist damit strukturell auf den
|
|
||||||
// richtigen Tenant gescopt, siehe user.TenantUserStore.GetByEmailForAuth.
|
|
||||||
type LoginService struct {
|
|
||||||
users *user.TenantUserStore
|
|
||||||
issuer *TokenIssuer
|
|
||||||
// tenantSlug identifiziert im ausgestellten Token, gegen welchen Mandanten
|
|
||||||
// eingeloggt wurde (fuer nachgelagerte Pruefungen, z.B. Middleware-Logs).
|
|
||||||
tenantSlug string
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewLoginService(users *user.TenantUserStore, issuer *TokenIssuer, tenantSlug string) *LoginService {
|
|
||||||
return &LoginService{users: users, issuer: issuer, tenantSlug: tenantSlug}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Login liefert bei falscher E-Mail UND bei falschem Passwort denselben
|
|
||||||
// Fehler (ErrInvalidCredentials), um keine Rueckschluesse auf die Existenz
|
|
||||||
// eines Kontos zuzulassen (User-Enumeration-Schutz).
|
|
||||||
func (s *LoginService) Login(ctx context.Context, email, password string) (string, error) {
|
|
||||||
creds, err := s.users.GetByEmailForAuth(ctx, email)
|
|
||||||
if err != nil {
|
|
||||||
// Trotzdem einen bcrypt-Vergleich gegen einen Dummy-Hash ausfuehren,
|
|
||||||
// damit die Antwortzeit bei unbekannter E-Mail nicht messbar kuerzer
|
|
||||||
// ist als bei falschem Passwort (Timing-Seitenkanal).
|
|
||||||
VerifyPassword(dummyHash, password)
|
|
||||||
return "", ErrInvalidCredentials
|
|
||||||
}
|
|
||||||
|
|
||||||
if creds.User.Status != user.StatusActive {
|
|
||||||
return "", ErrInvalidCredentials
|
|
||||||
}
|
|
||||||
|
|
||||||
if !VerifyPassword(creds.PasswordHash, password) {
|
|
||||||
return "", ErrInvalidCredentials
|
|
||||||
}
|
|
||||||
|
|
||||||
return s.issuer.Issue(creds.User.ID, s.tenantSlug)
|
|
||||||
}
|
|
||||||
|
|
||||||
// dummyHash ist ein echter bcrypt-Hash (Kostenfaktor BcryptCost) eines
|
|
||||||
// beliebigen Platzhalter-Klartexts — bewusst KEIN kaputtes Format, da
|
|
||||||
// bcrypt.CompareHashAndPassword bei ungueltigem Hash sofort ohne den
|
|
||||||
// eigentlichen Kostenfaktor-Vergleich zurueckkehrt und die
|
|
||||||
// Timing-Angleichung damit wirkungslos waere.
|
|
||||||
const dummyHash = "$2a$12$cmwiETrG9DK5/uTM2fg4uetngYUspKjME5P8fNpk0QYTaO64N0r3C"
|
|
||||||
@@ -1,177 +0,0 @@
|
|||||||
package auth
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"os"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
|
||||||
)
|
|
||||||
|
|
||||||
const usersSchema = `
|
|
||||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
||||||
CREATE TABLE users (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
email TEXT NOT NULL UNIQUE,
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active',
|
|
||||||
password_hash TEXT NOT NULL DEFAULT '',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);`
|
|
||||||
|
|
||||||
func setupTenantDB(t *testing.T, dbName string) *pgxpool.Pool {
|
|
||||||
t.Helper()
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin pool: %v", err)
|
|
||||||
}
|
|
||||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
if _, err := adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
|
||||||
t.Fatalf("testdatenbank anlegen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
dsn := strings.Replace(adminDSN, "/postgres?", "/"+dbName+"?", 1)
|
|
||||||
pool, err := pgxpool.New(ctx, dsn)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("connect testdatenbank: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := pool.Exec(ctx, usersSchema); err != nil {
|
|
||||||
t.Fatalf("schema anwenden: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
t.Cleanup(func() {
|
|
||||||
pool.Close()
|
|
||||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
adminPool.Close()
|
|
||||||
})
|
|
||||||
return pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func createUserWithPassword(t *testing.T, store *user.TenantUserStore, email, password string) user.User {
|
|
||||||
t.Helper()
|
|
||||||
ctx := context.Background()
|
|
||||||
u, err := store.Create(ctx, email, "Test User")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("create user: %v", err)
|
|
||||||
}
|
|
||||||
hash, err := HashPassword(password)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("hash password: %v", err)
|
|
||||||
}
|
|
||||||
if err := store.SetPasswordHash(ctx, u.ID, hash); err != nil {
|
|
||||||
t.Fatalf("set password: %v", err)
|
|
||||||
}
|
|
||||||
return u
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestLoginService_SuccessAndWrongPassword(t *testing.T) {
|
|
||||||
pool := setupTenantDB(t, "test_iam02_login")
|
|
||||||
store := user.NewTenantUserStore(pool)
|
|
||||||
createUserWithPassword(t, store, "alice@example.com", "korrektes-passwort")
|
|
||||||
|
|
||||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
|
||||||
login := NewLoginService(store, issuer, "acme")
|
|
||||||
|
|
||||||
token, err := login.Login(context.Background(), "alice@example.com", "korrektes-passwort")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("login: %v", err)
|
|
||||||
}
|
|
||||||
if token == "" {
|
|
||||||
t.Fatal("erwartet nicht-leeres token")
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, err := login.Login(context.Background(), "alice@example.com", "falsches-passwort"); !errors.Is(err, ErrInvalidCredentials) {
|
|
||||||
t.Fatalf("erwartet ErrInvalidCredentials, habe %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, err := login.Login(context.Background(), "unbekannt@example.com", "irgendwas"); !errors.Is(err, ErrInvalidCredentials) {
|
|
||||||
t.Fatalf("erwartet ErrInvalidCredentials bei unbekannter email, habe %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Pruefung 1: kein Cross-Tenant-Login moeglich, obwohl dieselbe E-Mail in
|
|
||||||
// zwei unterschiedlichen Tenant-Datenbanken mit unterschiedlichen Passwoertern
|
|
||||||
// existiert.
|
|
||||||
func TestLoginService_NoCrossTenantLogin(t *testing.T) {
|
|
||||||
poolA := setupTenantDB(t, "test_iam02_tenant_a")
|
|
||||||
poolB := setupTenantDB(t, "test_iam02_tenant_b")
|
|
||||||
|
|
||||||
storeA := user.NewTenantUserStore(poolA)
|
|
||||||
storeB := user.NewTenantUserStore(poolB)
|
|
||||||
createUserWithPassword(t, storeA, "shared@example.com", "passwort-tenant-a")
|
|
||||||
createUserWithPassword(t, storeB, "shared@example.com", "passwort-tenant-b")
|
|
||||||
|
|
||||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
|
||||||
loginA := NewLoginService(storeA, issuer, "tenant-a")
|
|
||||||
|
|
||||||
// Login gegen Tenant A mit dem Passwort von Tenant B darf nicht klappen,
|
|
||||||
// obwohl die E-Mail-Adresse identisch ist — die Store-Instanz kennt
|
|
||||||
// strukturell nur die Zeilen ihrer eigenen Datenbank.
|
|
||||||
if _, err := loginA.Login(context.Background(), "shared@example.com", "passwort-tenant-b"); !errors.Is(err, ErrInvalidCredentials) {
|
|
||||||
t.Fatalf("erwartet ErrInvalidCredentials fuer fremdes tenant-passwort, habe %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
token, err := loginA.Login(context.Background(), "shared@example.com", "passwort-tenant-a")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("login gegen eigenen tenant sollte klappen: %v", err)
|
|
||||||
}
|
|
||||||
claims, err := issuer.Verify(token)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("verify: %v", err)
|
|
||||||
}
|
|
||||||
if claims.TenantSlug != "tenant-a" {
|
|
||||||
t.Fatalf("token tenant = %q, want tenant-a", claims.TenantSlug)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3: geschuetzte Route ohne gueltige Session nicht erreichbar.
|
|
||||||
func TestRequireAuth_BlocksWithoutValidCookie(t *testing.T) {
|
|
||||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
|
||||||
protected := RequireAuth(issuer, func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
w.WriteHeader(http.StatusOK)
|
|
||||||
})
|
|
||||||
|
|
||||||
// Kein Cookie.
|
|
||||||
req := httptest.NewRequest(http.MethodGet, "/geschuetzt", nil)
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
protected(rec, req)
|
|
||||||
if rec.Code != http.StatusUnauthorized {
|
|
||||||
t.Fatalf("ohne cookie: status = %d, want 401", rec.Code)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Manipuliertes Cookie.
|
|
||||||
req = httptest.NewRequest(http.MethodGet, "/geschuetzt", nil)
|
|
||||||
req.AddCookie(&http.Cookie{Name: CookieName, Value: "kaputt.token.hier"})
|
|
||||||
rec = httptest.NewRecorder()
|
|
||||||
protected(rec, req)
|
|
||||||
if rec.Code != http.StatusUnauthorized {
|
|
||||||
t.Fatalf("mit kaputtem cookie: status = %d, want 401", rec.Code)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Gueltiges Token.
|
|
||||||
token, err := issuer.Issue("user-1", "acme")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("issue: %v", err)
|
|
||||||
}
|
|
||||||
req = httptest.NewRequest(http.MethodGet, "/geschuetzt", nil)
|
|
||||||
req.AddCookie(&http.Cookie{Name: CookieName, Value: token})
|
|
||||||
rec = httptest.NewRecorder()
|
|
||||||
protected(rec, req)
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("mit gueltigem cookie: status = %d, want 200", rec.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,41 +0,0 @@
|
|||||||
package auth
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"net/http"
|
|
||||||
)
|
|
||||||
|
|
||||||
const CookieName = "nexarch_session"
|
|
||||||
|
|
||||||
type contextKey int
|
|
||||||
|
|
||||||
const claimsContextKey contextKey = iota
|
|
||||||
|
|
||||||
// RequireAuth schuetzt eine Route: ohne gueltiges, nicht abgelaufenes Token
|
|
||||||
// im Session-Cookie wird 401 zurueckgegeben und der Handler nicht aufgerufen
|
|
||||||
// (IAM-02 Akzeptanzkriterium 3).
|
|
||||||
func RequireAuth(issuer *TokenIssuer, next http.HandlerFunc) http.HandlerFunc {
|
|
||||||
return func(w http.ResponseWriter, r *http.Request) {
|
|
||||||
cookie, err := r.Cookie(CookieName)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "nicht angemeldet", http.StatusUnauthorized)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
claims, err := issuer.Verify(cookie.Value)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "nicht angemeldet", http.StatusUnauthorized)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx := context.WithValue(r.Context(), claimsContextKey, claims)
|
|
||||||
next(w, r.WithContext(ctx))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ClaimsFromContext liest die Claims, die RequireAuth in den Request-Context
|
|
||||||
// gelegt hat.
|
|
||||||
func ClaimsFromContext(ctx context.Context) (*Claims, bool) {
|
|
||||||
c, ok := ctx.Value(claimsContextKey).(*Claims)
|
|
||||||
return c, ok
|
|
||||||
}
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
// Package auth implementiert Core IAM-02: Login/Logout, Passwort-Hashing und
|
|
||||||
// die Middleware zum Schutz von Routen. Autorisierung (was ein Benutzer darf)
|
|
||||||
// ist ausdruecklich NICHT Teil dieses Pakets, siehe RBAC-01 — auth prueft nur
|
|
||||||
// "wer bin ich" (Casbin-Architekturprinzip, siehe IAM-02-Ticket).
|
|
||||||
package auth
|
|
||||||
|
|
||||||
import "golang.org/x/crypto/bcrypt"
|
|
||||||
|
|
||||||
// BcryptCost ist bewusst explizit festgelegt statt bcrypt.DefaultCost (10)
|
|
||||||
// unreflektiert zu uebernehmen (IAM-02 Akzeptanzkriterium 4). Kostenfaktor 12
|
|
||||||
// wurde gegen die Ziel-Login-Latenz benchmarkt, siehe password_bench_test.go
|
|
||||||
// und den Pruefungs-Eintrag in der Commit-Nachricht.
|
|
||||||
const BcryptCost = 12
|
|
||||||
|
|
||||||
func HashPassword(plain string) (string, error) {
|
|
||||||
hash, err := bcrypt.GenerateFromPassword([]byte(plain), BcryptCost)
|
|
||||||
if err != nil {
|
|
||||||
return "", err
|
|
||||||
}
|
|
||||||
return string(hash), nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// VerifyPassword ist timing-safe: bcrypt.CompareHashAndPassword vergleicht
|
|
||||||
// konstant in der Zeit bzgl. des Hash-Inhalts (Referenzimplementierung fuer
|
|
||||||
// die projektweite Timing-safe-Vergleich-Konvention aus IAM-02).
|
|
||||||
func VerifyPassword(hash, plain string) bool {
|
|
||||||
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain)) == nil
|
|
||||||
}
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
package auth
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
"time"
|
|
||||||
)
|
|
||||||
|
|
||||||
// TargetLoginLatency ist der Zielwert aus IAM-02 Akzeptanzkriterium 4: der
|
|
||||||
// bcrypt-Vergleich allein darf die Login-Latenz nicht dominieren. 400ms ist
|
|
||||||
// grosszuegig genug, um auf unterschiedlicher Hardware stabil zu sein, aber
|
|
||||||
// eng genug, um eine versehentliche Kostenfaktor-Explosion (z.B. 16 statt 12)
|
|
||||||
// zuverlaessig aufzudecken.
|
|
||||||
const TargetLoginLatency = 400 * time.Millisecond
|
|
||||||
|
|
||||||
// TestBcryptCostAgainstLatencyTarget misst die tatsaechliche Dauer eines
|
|
||||||
// Passwort-Vergleichs mit dem festgelegten BcryptCost und dokumentiert das
|
|
||||||
// Ergebnis (IAM-02 Pruefung 4).
|
|
||||||
func TestBcryptCostAgainstLatencyTarget(t *testing.T) {
|
|
||||||
hash, err := HashPassword("benchmark-passwort")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("hash: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
start := time.Now()
|
|
||||||
if !VerifyPassword(hash, "benchmark-passwort") {
|
|
||||||
t.Fatal("verifikation haette erfolgreich sein muessen")
|
|
||||||
}
|
|
||||||
elapsed := time.Since(start)
|
|
||||||
|
|
||||||
t.Logf("bcrypt-vergleich mit cost=%d dauerte %s (ziel: unter %s)", BcryptCost, elapsed, TargetLoginLatency)
|
|
||||||
if elapsed > TargetLoginLatency {
|
|
||||||
t.Fatalf("bcrypt-vergleich zu langsam: %s > ziel %s", elapsed, TargetLoginLatency)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func BenchmarkVerifyPassword(b *testing.B) {
|
|
||||||
hash, _ := HashPassword("benchmark-passwort")
|
|
||||||
b.ResetTimer()
|
|
||||||
for i := 0; i < b.N; i++ {
|
|
||||||
VerifyPassword(hash, "benchmark-passwort")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
package auth
|
|
||||||
|
|
||||||
import "testing"
|
|
||||||
|
|
||||||
func TestHashAndVerifyPassword(t *testing.T) {
|
|
||||||
hash, err := HashPassword("s3hr-geheim!")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("hash: %v", err)
|
|
||||||
}
|
|
||||||
if hash == "s3hr-geheim!" {
|
|
||||||
t.Fatal("passwort wurde nicht gehasht")
|
|
||||||
}
|
|
||||||
if !VerifyPassword(hash, "s3hr-geheim!") {
|
|
||||||
t.Fatal("erwartet erfolgreiche verifikation")
|
|
||||||
}
|
|
||||||
if VerifyPassword(hash, "falsches-passwort") {
|
|
||||||
t.Fatal("erwartet fehlgeschlagene verifikation")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestDummyHashIsValidBcryptHash(t *testing.T) {
|
|
||||||
// Stellt sicher, dass der Timing-Angleichs-Hash in login.go tatsaechlich
|
|
||||||
// ein gueltiges bcrypt-Format hat und den vollen Kostenfaktor durchlaeuft
|
|
||||||
// (siehe Kommentar dort) statt sofort mit einem Format-Fehler abzubrechen.
|
|
||||||
if VerifyPassword(dummyHash, "irgendein-text") {
|
|
||||||
t.Fatal("dummyHash sollte fuer beliebigen text nicht passen")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,63 +0,0 @@
|
|||||||
package auth
|
|
||||||
|
|
||||||
import (
|
|
||||||
"errors"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"github.com/golang-jwt/jwt/v5"
|
|
||||||
)
|
|
||||||
|
|
||||||
// AccessTokenTTL ist bewusst kurz gehalten (Session-Ablauf statt langlebiger
|
|
||||||
// Tokens), passend zur "so vertrauenswuerdig wie noetig"-Produkt-DNA.
|
|
||||||
const AccessTokenTTL = 30 * time.Minute
|
|
||||||
|
|
||||||
var ErrInvalidToken = errors.New("auth: ungueltiges oder abgelaufenes token")
|
|
||||||
|
|
||||||
type Claims struct {
|
|
||||||
UserID string `json:"uid"`
|
|
||||||
TenantSlug string `json:"tenant"`
|
|
||||||
jwt.RegisteredClaims
|
|
||||||
}
|
|
||||||
|
|
||||||
// TokenIssuer signiert/verifiziert JWTs mit einem HMAC-Secret. Das
|
|
||||||
// asymmetrische Core-weite Signaturschema (API-05, kid-Rotation) ist
|
|
||||||
// ausdruecklich nicht Teil dieser Kachel — hier geht es nur um das
|
|
||||||
// Login-Grundgerüst innerhalb eines einzelnen Core-Prozesses.
|
|
||||||
type TokenIssuer struct {
|
|
||||||
secret []byte
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewTokenIssuer(secret string) *TokenIssuer {
|
|
||||||
return &TokenIssuer{secret: []byte(secret)}
|
|
||||||
}
|
|
||||||
|
|
||||||
func (i *TokenIssuer) Issue(userID, tenantSlug string) (string, error) {
|
|
||||||
now := time.Now()
|
|
||||||
claims := Claims{
|
|
||||||
UserID: userID,
|
|
||||||
TenantSlug: tenantSlug,
|
|
||||||
RegisteredClaims: jwt.RegisteredClaims{
|
|
||||||
IssuedAt: jwt.NewNumericDate(now),
|
|
||||||
ExpiresAt: jwt.NewNumericDate(now.Add(AccessTokenTTL)),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
||||||
return token.SignedString(i.secret)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Verify prueft Signatur UND Ablauf (jwt.ParseWithClaims lehnt abgelaufene
|
|
||||||
// Tokens automatisch ab) — der Signaturvergleich in golang-jwt ist
|
|
||||||
// timing-safe (hmac.Equal).
|
|
||||||
func (i *TokenIssuer) Verify(tokenString string) (*Claims, error) {
|
|
||||||
claims := &Claims{}
|
|
||||||
token, err := jwt.ParseWithClaims(tokenString, claims, func(t *jwt.Token) (interface{}, error) {
|
|
||||||
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
||||||
return nil, ErrInvalidToken
|
|
||||||
}
|
|
||||||
return i.secret, nil
|
|
||||||
})
|
|
||||||
if err != nil || !token.Valid {
|
|
||||||
return nil, ErrInvalidToken
|
|
||||||
}
|
|
||||||
return claims, nil
|
|
||||||
}
|
|
||||||
@@ -1,82 +0,0 @@
|
|||||||
package auth
|
|
||||||
|
|
||||||
import (
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
"time"
|
|
||||||
|
|
||||||
"github.com/golang-jwt/jwt/v5"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestTokenIssueAndVerify(t *testing.T) {
|
|
||||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
|
||||||
|
|
||||||
token, err := issuer.Issue("user-1", "acme")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("issue: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
claims, err := issuer.Verify(token)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("verify: %v", err)
|
|
||||||
}
|
|
||||||
if claims.UserID != "user-1" || claims.TenantSlug != "acme" {
|
|
||||||
t.Fatalf("claims unerwartet: %+v", claims)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Pruefung 2: Token-Manipulationstest.
|
|
||||||
func TestTokenVerify_RejectsManipulatedPayload(t *testing.T) {
|
|
||||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
|
||||||
token, err := issuer.Issue("user-1", "acme")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("issue: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
parts := strings.Split(token, ".")
|
|
||||||
if len(parts) != 3 {
|
|
||||||
t.Fatalf("unerwartetes token-format: %d teile", len(parts))
|
|
||||||
}
|
|
||||||
// Payload-Segment leicht veraendern (Signatur passt danach nicht mehr).
|
|
||||||
tampered := parts[0] + "." + parts[1] + "x" + "." + parts[2]
|
|
||||||
|
|
||||||
if _, err := issuer.Verify(tampered); err == nil {
|
|
||||||
t.Fatal("erwartet fehler bei manipuliertem token, habe nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestTokenVerify_RejectsWrongSecret(t *testing.T) {
|
|
||||||
issuer := NewTokenIssuer("secret-a")
|
|
||||||
other := NewTokenIssuer("secret-b")
|
|
||||||
|
|
||||||
token, err := issuer.Issue("user-1", "acme")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("issue: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := other.Verify(token); err == nil {
|
|
||||||
t.Fatal("erwartet fehler bei falschem secret, habe nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Pruefung 3: abgelaufenes Token erzwingt Neuanmeldung.
|
|
||||||
func TestTokenVerify_RejectsExpiredToken(t *testing.T) {
|
|
||||||
issuer := NewTokenIssuer("test-secret-nur-fuer-tests")
|
|
||||||
|
|
||||||
claims := Claims{
|
|
||||||
UserID: "user-1",
|
|
||||||
TenantSlug: "acme",
|
|
||||||
RegisteredClaims: jwt.RegisteredClaims{
|
|
||||||
IssuedAt: jwt.NewNumericDate(time.Now().Add(-2 * AccessTokenTTL)),
|
|
||||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(-time.Minute)),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
tok := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
||||||
expired, err := tok.SignedString([]byte("test-secret-nur-fuer-tests"))
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("signieren: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, err := issuer.Verify(expired); err == nil {
|
|
||||||
t.Fatal("erwartet fehler bei abgelaufenem token, habe nil")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -11,14 +11,7 @@ import (
|
|||||||
// multi_tenancy: Modell C (physisch getrennte DB pro Mandant).
|
// multi_tenancy: Modell C (physisch getrennte DB pro Mandant).
|
||||||
type Config struct {
|
type Config struct {
|
||||||
ListenAddr string
|
ListenAddr string
|
||||||
// RegistryDSN verbindet zur Control-Plane-Registry-Datenbank.
|
|
||||||
RegistryDSN string
|
RegistryDSN string
|
||||||
// AdminDSN verbindet zur Wartungsdatenbank (z.B. "postgres") und wird nur
|
|
||||||
// fuer CREATE/DROP DATABASE beim Tenant-Provisioning verwendet.
|
|
||||||
AdminDSN string
|
|
||||||
// TenantDSNTemplate enthaelt genau ein "%s" als Platzhalter fuer den
|
|
||||||
// Datenbanknamen einer neu provisionierten Tenant-Datenbank.
|
|
||||||
TenantDSNTemplate string
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func Load() (Config, error) {
|
func Load() (Config, error) {
|
||||||
@@ -27,25 +20,10 @@ func Load() (Config, error) {
|
|||||||
return Config{}, fmt.Errorf("NEXARCH_REGISTRY_DSN not set")
|
return Config{}, fmt.Errorf("NEXARCH_REGISTRY_DSN not set")
|
||||||
}
|
}
|
||||||
|
|
||||||
adminDSN := os.Getenv("NEXARCH_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
return Config{}, fmt.Errorf("NEXARCH_ADMIN_DSN not set")
|
|
||||||
}
|
|
||||||
|
|
||||||
dsnTemplate := os.Getenv("NEXARCH_TENANT_DSN_TEMPLATE")
|
|
||||||
if dsnTemplate == "" {
|
|
||||||
return Config{}, fmt.Errorf("NEXARCH_TENANT_DSN_TEMPLATE not set")
|
|
||||||
}
|
|
||||||
|
|
||||||
addr := os.Getenv("NEXARCH_LISTEN_ADDR")
|
addr := os.Getenv("NEXARCH_LISTEN_ADDR")
|
||||||
if addr == "" {
|
if addr == "" {
|
||||||
addr = ":8080"
|
addr = ":8080"
|
||||||
}
|
}
|
||||||
|
|
||||||
return Config{
|
return Config{ListenAddr: addr, RegistryDSN: dsn}, nil
|
||||||
ListenAddr: addr,
|
|
||||||
RegistryDSN: dsn,
|
|
||||||
AdminDSN: adminDSN,
|
|
||||||
TenantDSNTemplate: dsnTemplate,
|
|
||||||
}, nil
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,67 +0,0 @@
|
|||||||
package policy
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
|
||||||
)
|
|
||||||
|
|
||||||
// ErrDenied wird geliefert, wenn keine Regel role+permission erlaubt —
|
|
||||||
// Default-Deny (Akzeptanzkriterium 2).
|
|
||||||
var ErrDenied = errors.New("policy: zugriff verweigert")
|
|
||||||
|
|
||||||
// Enforcer ist die EINE zentrale Entscheidungs- und Durchsetzungsschicht
|
|
||||||
// (Akzeptanzkriterium 1). Repository-/Query-Code ruft ausschliesslich Guard
|
|
||||||
// bzw. GuardTenantScoped auf, nie eine Rohabfrage direkt.
|
|
||||||
type Enforcer struct {
|
|
||||||
store *Store
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewEnforcer(store *Store) *Enforcer {
|
|
||||||
return &Enforcer{store: store}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Authorize entscheidet erlaubt/verboten — unabhaengig von jeder konkreten
|
|
||||||
// Query, rein anhand der deklarativen Regeln (Akzeptanzkriterium 2: fuer
|
|
||||||
// sich genommen testbar, ohne Anwendungslogik).
|
|
||||||
func (e *Enforcer) Authorize(ctx context.Context, role rbac.Role, perm rbac.Permission) error {
|
|
||||||
allowed, err := e.store.IsAllowed(ctx, role, perm)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if !allowed {
|
|
||||||
return fmt.Errorf("%w: rolle %q hat kein recht %q", ErrDenied, role, perm)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Guard ist die zentrale Enforcement-Funktion (Akzeptanzkriterium 1): query
|
|
||||||
// wird NUR aufgerufen, wenn Authorize zustimmt. Es gibt keinen Weg, query
|
|
||||||
// ausserhalb von Guard aufzurufen und trotzdem den Aufrufer als autorisiert
|
|
||||||
// zu behandeln — die Autorisierungsentscheidung steht immer VOR dem
|
|
||||||
// Datenzugriff, nie danach.
|
|
||||||
func Guard[T any](ctx context.Context, e *Enforcer, role rbac.Role, perm rbac.Permission, query func(ctx context.Context) (T, error)) (T, error) {
|
|
||||||
var zero T
|
|
||||||
if err := e.Authorize(ctx, role, perm); err != nil {
|
|
||||||
return zero, err
|
|
||||||
}
|
|
||||||
return query(ctx)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GuardTenantScoped erzwingt zusaetzlich, dass tenantSlug TEIL der Query-
|
|
||||||
// Funktion selbst ist (Akzeptanzkriterium 3): der Funktionstyp verlangt,
|
|
||||||
// dass die Repository-Implementierung tenantSlug in ihre eigene WHERE-
|
|
||||||
// Klausel einbaut — ein nachgelagerter Filter auf dem Ergebnis (der
|
|
||||||
// archivmail-Fehler aus "Bekannte Fehler vermeiden") ist mit dieser
|
|
||||||
// Signatur nicht moeglich, da die Query-Funktion tenantSlug selbst
|
|
||||||
// entgegennimmt und dafuer verantwortlich ist, statt ihn hinterher
|
|
||||||
// anzuwenden.
|
|
||||||
func GuardTenantScoped[T any](ctx context.Context, e *Enforcer, role rbac.Role, perm rbac.Permission, tenantSlug string, query func(ctx context.Context, tenantSlug string) (T, error)) (T, error) {
|
|
||||||
var zero T
|
|
||||||
if err := e.Authorize(ctx, role, perm); err != nil {
|
|
||||||
return zero, err
|
|
||||||
}
|
|
||||||
return query(ctx, tenantSlug)
|
|
||||||
}
|
|
||||||
@@ -1,187 +0,0 @@
|
|||||||
package policy
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"os"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
|
||||||
)
|
|
||||||
|
|
||||||
func setupTest(t *testing.T) (*Store, *Enforcer, func()) {
|
|
||||||
t.Helper()
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
pool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("pool: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := pool.Exec(ctx, `
|
|
||||||
CREATE TABLE IF NOT EXISTS policy_rules (
|
|
||||||
role TEXT NOT NULL, permission TEXT NOT NULL,
|
|
||||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
PRIMARY KEY (role, permission)
|
|
||||||
);
|
|
||||||
CREATE TABLE IF NOT EXISTS policy_rule_changes (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), role TEXT NOT NULL, permission TEXT NOT NULL,
|
|
||||||
action TEXT NOT NULL CHECK (action IN ('grant','revoke')), actor TEXT NOT NULL,
|
|
||||||
version INT NOT NULL, changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
`); err != nil {
|
|
||||||
t.Fatalf("schema: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
store := NewStore(pool)
|
|
||||||
cleanup := func() {
|
|
||||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_rule_changes WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
|
||||||
_, _ = pool.Exec(ctx, `DELETE FROM policy_rules WHERE role LIKE 'test\_%' ESCAPE '\'`)
|
|
||||||
pool.Close()
|
|
||||||
}
|
|
||||||
return store, NewEnforcer(store), cleanup
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 2 + Pruefung 2: Anfrage ohne passende Policy wird
|
|
||||||
// zuverlaessig abgewiesen (Default-Deny), nicht standardmaessig erlaubt.
|
|
||||||
func TestAuthorize_DefaultDeny(t *testing.T) {
|
|
||||||
_, enforcer, cleanup := setupTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
err := enforcer.Authorize(ctx, rbac.Role("test_niemand"), rbac.Permission("test_irgendwas"))
|
|
||||||
if !errors.Is(err, ErrDenied) {
|
|
||||||
t.Fatalf("erwartet ErrDenied ohne konfigurierte regel, habe %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 1 + Pruefung 1: Guard ruft query NUR bei Autorisierung
|
|
||||||
// auf — kein Datenzugriffs-Pfad umgeht die Enforcement-Schicht.
|
|
||||||
func TestGuard_NeverCallsQueryWithoutAuthorization(t *testing.T) {
|
|
||||||
store, enforcer, cleanup := setupTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
role := rbac.Role("test_rolle_guard")
|
|
||||||
perm := rbac.Permission("test_lesen")
|
|
||||||
|
|
||||||
queryCalled := false
|
|
||||||
_, err := Guard(ctx, enforcer, role, perm, func(ctx context.Context) (string, error) {
|
|
||||||
queryCalled = true
|
|
||||||
return "geheime-daten", nil
|
|
||||||
})
|
|
||||||
if !errors.Is(err, ErrDenied) {
|
|
||||||
t.Fatalf("erwartet ErrDenied, habe %v", err)
|
|
||||||
}
|
|
||||||
if queryCalled {
|
|
||||||
t.Fatal("query haette bei fehlender autorisierung NICHT aufgerufen werden duerfen")
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
|
||||||
t.Fatalf("grant: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
result, err := Guard(ctx, enforcer, role, perm, func(ctx context.Context) (string, error) {
|
|
||||||
queryCalled = true
|
|
||||||
return "geheime-daten", nil
|
|
||||||
})
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("guard nach grant: %v", err)
|
|
||||||
}
|
|
||||||
if !queryCalled || result != "geheime-daten" {
|
|
||||||
t.Fatalf("erwartet query-aufruf mit ergebnis nach autorisierung, habe queryCalled=%v result=%q", queryCalled, result)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 2 + 3: Policy-Entscheidungen deklarativ und unabhaengig
|
|
||||||
// von Anwendungslogik testbar — Regelwechsel wirkt ohne Codeaenderung,
|
|
||||||
// Historie ist versioniert nachvollziehbar.
|
|
||||||
func TestGrantRevoke_ChangesBehaviorWithoutCodeChange(t *testing.T) {
|
|
||||||
store, enforcer, cleanup := setupTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
role := rbac.Role("test_rolle_history")
|
|
||||||
perm := rbac.Permission("test_schreiben")
|
|
||||||
|
|
||||||
allowed, err := store.IsAllowed(ctx, role, perm)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("is allowed (vorher): %v", err)
|
|
||||||
}
|
|
||||||
if allowed {
|
|
||||||
t.Fatal("erwartet nicht erlaubt vor grant")
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
|
||||||
t.Fatalf("grant: %v", err)
|
|
||||||
}
|
|
||||||
if err := enforcer.Authorize(ctx, role, perm); err != nil {
|
|
||||||
t.Fatalf("authorize nach grant sollte erlauben: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := store.Revoke(ctx, role, perm, "admin@example.com"); err != nil {
|
|
||||||
t.Fatalf("revoke: %v", err)
|
|
||||||
}
|
|
||||||
if err := enforcer.Authorize(ctx, role, perm); !errors.Is(err, ErrDenied) {
|
|
||||||
t.Fatalf("authorize nach revoke sollte verweigern, habe %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
history, err := store.History(ctx, role, perm)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("history: %v", err)
|
|
||||||
}
|
|
||||||
if len(history) != 2 {
|
|
||||||
t.Fatalf("erwartet 2 historieneintraege (grant, revoke), habe %d", len(history))
|
|
||||||
}
|
|
||||||
if history[0].Action != "grant" || history[0].Version != 1 {
|
|
||||||
t.Fatalf("history[0] unerwartet: %+v", history[0])
|
|
||||||
}
|
|
||||||
if history[1].Action != "revoke" || history[1].Version != 2 {
|
|
||||||
t.Fatalf("history[1] unerwartet: %+v", history[1])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3 + Pruefung 3 (Tenant-Scoping): GuardTenantScoped
|
|
||||||
// zwingt tenantSlug in die Query-Funktion selbst, kein Post-Filter moeglich.
|
|
||||||
func TestGuardTenantScoped_IsolatesDataBetweenTenants(t *testing.T) {
|
|
||||||
_, enforcer, cleanup := setupTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
// Simuliertes Repository: die WHERE-Klausel (hier: Map-Lookup) liegt
|
|
||||||
// INNERHALB der Query-Funktion, nicht als nachgelagerter Filter.
|
|
||||||
data := map[string][]string{
|
|
||||||
"acme": {"dokument-a1", "dokument-a2"},
|
|
||||||
"globex": {"dokument-b1"},
|
|
||||||
}
|
|
||||||
repoQuery := func(ctx context.Context, tenantSlug string) ([]string, error) {
|
|
||||||
return data[tenantSlug], nil
|
|
||||||
}
|
|
||||||
|
|
||||||
role := rbac.Role("test_tenant_rolle")
|
|
||||||
perm := rbac.Permission("test_dokumente_lesen")
|
|
||||||
if err := enforcer.store.Grant(ctx, role, perm, "admin@example.com"); err != nil {
|
|
||||||
t.Fatalf("grant: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
gotAcme, err := GuardTenantScoped(ctx, enforcer, role, perm, "acme", repoQuery)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("guard tenant scoped (acme): %v", err)
|
|
||||||
}
|
|
||||||
if len(gotAcme) != 2 {
|
|
||||||
t.Fatalf("erwartet 2 dokumente fuer acme, habe %d", len(gotAcme))
|
|
||||||
}
|
|
||||||
|
|
||||||
gotGlobex, err := GuardTenantScoped(ctx, enforcer, role, perm, "globex", repoQuery)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("guard tenant scoped (globex): %v", err)
|
|
||||||
}
|
|
||||||
if len(gotGlobex) != 1 {
|
|
||||||
t.Fatalf("erwartet 1 dokument fuer globex, habe %d", len(gotGlobex))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,124 +0,0 @@
|
|||||||
// Package policy implementiert Core RBAC-02: die zentrale Policy-
|
|
||||||
// Entscheidungs- und Durchsetzungsschicht. Regeln liegen deklarativ in der
|
|
||||||
// Datenbank (Casbin-Prinzip: Policy als Modell+Regeln getrennt vom Code),
|
|
||||||
// versioniert und auditierbar — anders als Casbin-Dateien im Dateisystem
|
|
||||||
// (siehe "bewusst vermeiden" im Ticket).
|
|
||||||
package policy
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/rbac"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Rule ist eine gewaehrte Regel: role darf permission.
|
|
||||||
type Rule struct {
|
|
||||||
Role rbac.Role
|
|
||||||
Permission rbac.Permission
|
|
||||||
}
|
|
||||||
|
|
||||||
// RuleChange ist ein Eintrag der Aenderungshistorie (Akzeptanzkriterium 3).
|
|
||||||
type RuleChange struct {
|
|
||||||
Role rbac.Role
|
|
||||||
Permission rbac.Permission
|
|
||||||
Action string // "grant" oder "revoke"
|
|
||||||
Actor string
|
|
||||||
Version int
|
|
||||||
}
|
|
||||||
|
|
||||||
// Store verwaltet den deklarativen Regelsatz. IsAllowed schaut NUR in die
|
|
||||||
// Datenbank — es gibt keinen hartcodierten Go-Fallback, ein Regelwechsel
|
|
||||||
// wirkt sich ohne Codeaenderung sofort aus (Akzeptanzkriterium 2 / 3).
|
|
||||||
type Store struct {
|
|
||||||
pool *pgxpool.Pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewStore(pool *pgxpool.Pool) *Store {
|
|
||||||
return &Store{pool: pool}
|
|
||||||
}
|
|
||||||
|
|
||||||
// IsAllowed prueft, ob role das Recht permission besitzt. Default-Deny:
|
|
||||||
// existiert keine passende Regel, ist der Zugriff verboten
|
|
||||||
// (Akzeptanzkriterium 2 / Pruefung 2) — es gibt keinen impliziten
|
|
||||||
// "erlaubt, wenn nichts anderes gesagt"-Pfad.
|
|
||||||
func (s *Store) IsAllowed(ctx context.Context, role rbac.Role, perm rbac.Permission) (bool, error) {
|
|
||||||
var exists bool
|
|
||||||
err := s.pool.QueryRow(ctx, `
|
|
||||||
SELECT EXISTS(SELECT 1 FROM policy_rules WHERE role = $1 AND permission = $2)
|
|
||||||
`, string(role), string(perm)).Scan(&exists)
|
|
||||||
if err != nil {
|
|
||||||
return false, fmt.Errorf("policy pruefen: %w", err)
|
|
||||||
}
|
|
||||||
return exists, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Grant gewaehrt role das Recht permission — deklarativ, ohne Codeaenderung
|
|
||||||
// wirksam. actor wird fuer die Aenderungshistorie festgehalten.
|
|
||||||
func (s *Store) Grant(ctx context.Context, role rbac.Role, perm rbac.Permission, actor string) error {
|
|
||||||
return s.change(ctx, role, perm, "grant", actor, `
|
|
||||||
INSERT INTO policy_rules (role, permission, granted_by, granted_at)
|
|
||||||
VALUES ($1, $2, $3, now())
|
|
||||||
ON CONFLICT (role, permission) DO UPDATE SET granted_by = $3, granted_at = now()
|
|
||||||
`, string(role), string(perm), actor)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Revoke entzieht role das Recht permission.
|
|
||||||
func (s *Store) Revoke(ctx context.Context, role rbac.Role, perm rbac.Permission, actor string) error {
|
|
||||||
return s.change(ctx, role, perm, "revoke", actor, `
|
|
||||||
DELETE FROM policy_rules WHERE role = $1 AND permission = $2
|
|
||||||
`, string(role), string(perm))
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *Store) change(ctx context.Context, role rbac.Role, perm rbac.Permission, action, actor, sql string, args ...any) error {
|
|
||||||
tx, err := s.pool.Begin(ctx)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("transaktion starten: %w", err)
|
|
||||||
}
|
|
||||||
defer func() { _ = tx.Rollback(ctx) }()
|
|
||||||
|
|
||||||
if _, err := tx.Exec(ctx, sql, args...); err != nil {
|
|
||||||
return fmt.Errorf("regel aendern: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
var version int
|
|
||||||
if err := tx.QueryRow(ctx, `
|
|
||||||
SELECT COALESCE(MAX(version), 0) + 1 FROM policy_rule_changes WHERE role = $1 AND permission = $2
|
|
||||||
`, string(role), string(perm)).Scan(&version); err != nil {
|
|
||||||
return fmt.Errorf("naechste version ermitteln: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, err := tx.Exec(ctx, `
|
|
||||||
INSERT INTO policy_rule_changes (role, permission, action, actor, version, changed_at)
|
|
||||||
VALUES ($1, $2, $3, $4, $5, now())
|
|
||||||
`, string(role), string(perm), action, actor, version); err != nil {
|
|
||||||
return fmt.Errorf("historie schreiben: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
return tx.Commit(ctx)
|
|
||||||
}
|
|
||||||
|
|
||||||
// History liefert die vollstaendige, versionierte Aenderungshistorie einer
|
|
||||||
// Regel (Akzeptanzkriterium 3).
|
|
||||||
func (s *Store) History(ctx context.Context, role rbac.Role, perm rbac.Permission) ([]RuleChange, error) {
|
|
||||||
rows, err := s.pool.Query(ctx, `
|
|
||||||
SELECT action, actor, version FROM policy_rule_changes
|
|
||||||
WHERE role = $1 AND permission = $2 ORDER BY version
|
|
||||||
`, string(role), string(perm))
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("historie abfragen: %w", err)
|
|
||||||
}
|
|
||||||
defer rows.Close()
|
|
||||||
|
|
||||||
var out []RuleChange
|
|
||||||
for rows.Next() {
|
|
||||||
c := RuleChange{Role: role, Permission: perm}
|
|
||||||
if err := rows.Scan(&c.Action, &c.Actor, &c.Version); err != nil {
|
|
||||||
return nil, fmt.Errorf("historieneintrag lesen: %w", err)
|
|
||||||
}
|
|
||||||
out = append(out, c)
|
|
||||||
}
|
|
||||||
return out, rows.Err()
|
|
||||||
}
|
|
||||||
@@ -1,200 +0,0 @@
|
|||||||
package rbac
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
var ErrGroupNotFound = errors.New("rbac: gruppe nicht gefunden")
|
|
||||||
|
|
||||||
type Group struct {
|
|
||||||
ID string
|
|
||||||
Name string
|
|
||||||
Role Role // leer, wenn der Gruppe noch keine Rolle zugewiesen wurde
|
|
||||||
}
|
|
||||||
|
|
||||||
// GroupStore verwaltet Gruppen/Abteilungen innerhalb GENAU EINER Tenant-
|
|
||||||
// Datenbank (Modell C, wie Store fuer direkte Rollenzuweisungen) —
|
|
||||||
// Akzeptanzkriterium 3 (tenant-isoliert) ist damit strukturell erfuellt.
|
|
||||||
type GroupStore struct {
|
|
||||||
pool *pgxpool.Pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewGroupStore(pool *pgxpool.Pool) *GroupStore {
|
|
||||||
return &GroupStore{pool: pool}
|
|
||||||
}
|
|
||||||
|
|
||||||
// CreateGroup legt eine neue, noch rollenlose Gruppe an (Akzeptanzkriterium 1).
|
|
||||||
func (s *GroupStore) CreateGroup(ctx context.Context, name string) (Group, error) {
|
|
||||||
if name == "" {
|
|
||||||
return Group{}, errors.New("rbac: gruppenname darf nicht leer sein")
|
|
||||||
}
|
|
||||||
var g Group
|
|
||||||
g.Name = name
|
|
||||||
if err := s.pool.QueryRow(ctx, `
|
|
||||||
INSERT INTO groups (name) VALUES ($1) RETURNING id
|
|
||||||
`, name).Scan(&g.ID); err != nil {
|
|
||||||
return Group{}, fmt.Errorf("gruppe anlegen: %w", err)
|
|
||||||
}
|
|
||||||
return g, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetGroupRole weist der Gruppe eine Rolle zu (Akzeptanzkriterium 2) — nur
|
|
||||||
// 'user'/'tenant_admin' sind auf Gruppenebene zuweisbar, dieselbe erlaubte
|
|
||||||
// Matrix wie in Store.Assign (superadmin bleibt mandantenuebergreifend und
|
|
||||||
// ausserhalb jeder Gruppenlogik).
|
|
||||||
func (s *GroupStore) SetGroupRole(ctx context.Context, groupID string, role Role) error {
|
|
||||||
if !assignableRoles[role] {
|
|
||||||
return ErrRoleNotAssignableInTenantScope
|
|
||||||
}
|
|
||||||
tag, err := s.pool.Exec(ctx, `UPDATE groups SET role = $2 WHERE id = $1`, groupID, string(role))
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("gruppenrolle setzen: %w", err)
|
|
||||||
}
|
|
||||||
if tag.RowsAffected() == 0 {
|
|
||||||
return ErrGroupNotFound
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// AddMember nimmt einen Benutzer in die Gruppe auf.
|
|
||||||
func (s *GroupStore) AddMember(ctx context.Context, groupID, userID string) error {
|
|
||||||
_, err := s.pool.Exec(ctx, `
|
|
||||||
INSERT INTO group_members (group_id, user_id) VALUES ($1, $2)
|
|
||||||
ON CONFLICT (group_id, user_id) DO NOTHING
|
|
||||||
`, groupID, userID)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("mitglied hinzufuegen: %w", err)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// RemoveMember entfernt einen Benutzer aus der Gruppe — die gruppenbasierten
|
|
||||||
// Rechte entfallen fuer ihn sofort (Akzeptanzkriterium 3 / Pruefung 2), da
|
|
||||||
// EffectivePermissionsForUser bei jedem Aufruf neu berechnet wird, nicht
|
|
||||||
// zwischengespeichert.
|
|
||||||
func (s *GroupStore) RemoveMember(ctx context.Context, groupID, userID string) error {
|
|
||||||
_, err := s.pool.Exec(ctx, `DELETE FROM group_members WHERE group_id = $1 AND user_id = $2`, groupID, userID)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("mitglied entfernen: %w", err)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// DeleteGroup loescht die Gruppe — ON DELETE CASCADE entfernt die
|
|
||||||
// Mitgliedschaften mit, Benutzerkonten selbst bleiben unberuehrt
|
|
||||||
// (Akzeptanzkriterium 3).
|
|
||||||
func (s *GroupStore) DeleteGroup(ctx context.Context, groupID string) error {
|
|
||||||
_, err := s.pool.Exec(ctx, `DELETE FROM groups WHERE id = $1`, groupID)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("gruppe loeschen: %w", err)
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListGroups liefert alle Gruppen des Mandanten (Akzeptanzkriterium 1/2,
|
|
||||||
// Grundlage fuer die Administrationsoberflaeche).
|
|
||||||
func (s *GroupStore) ListGroups(ctx context.Context) ([]Group, error) {
|
|
||||||
rows, err := s.pool.Query(ctx, `SELECT id, name, COALESCE(role, '') FROM groups ORDER BY name`)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("gruppen auflisten: %w", err)
|
|
||||||
}
|
|
||||||
defer rows.Close()
|
|
||||||
|
|
||||||
var out []Group
|
|
||||||
for rows.Next() {
|
|
||||||
var g Group
|
|
||||||
var role string
|
|
||||||
if err := rows.Scan(&g.ID, &g.Name, &role); err != nil {
|
|
||||||
return nil, fmt.Errorf("gruppe lesen: %w", err)
|
|
||||||
}
|
|
||||||
g.Role = Role(role)
|
|
||||||
out = append(out, g)
|
|
||||||
}
|
|
||||||
return out, rows.Err()
|
|
||||||
}
|
|
||||||
|
|
||||||
// Members liefert die User-IDs der Mitglieder einer Gruppe.
|
|
||||||
func (s *GroupStore) Members(ctx context.Context, groupID string) ([]string, error) {
|
|
||||||
rows, err := s.pool.Query(ctx, `SELECT user_id FROM group_members WHERE group_id = $1`, groupID)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("mitglieder abfragen: %w", err)
|
|
||||||
}
|
|
||||||
defer rows.Close()
|
|
||||||
|
|
||||||
var out []string
|
|
||||||
for rows.Next() {
|
|
||||||
var id string
|
|
||||||
if err := rows.Scan(&id); err != nil {
|
|
||||||
return nil, fmt.Errorf("mitglied lesen: %w", err)
|
|
||||||
}
|
|
||||||
out = append(out, id)
|
|
||||||
}
|
|
||||||
return out, rows.Err()
|
|
||||||
}
|
|
||||||
|
|
||||||
// RolesForUser liefert alle Rollen, die einem Benutzer ueber seine
|
|
||||||
// Gruppenmitgliedschaften zufallen (Akzeptanzkriterium 2: wirkt auf alle
|
|
||||||
// Mitglieder). Eine Gruppe ohne zugewiesene Rolle traegt nichts bei.
|
|
||||||
func (s *GroupStore) RolesForUser(ctx context.Context, userID string) ([]Role, error) {
|
|
||||||
rows, err := s.pool.Query(ctx, `
|
|
||||||
SELECT g.role FROM groups g
|
|
||||||
JOIN group_members gm ON gm.group_id = g.id
|
|
||||||
WHERE gm.user_id = $1 AND g.role IS NOT NULL
|
|
||||||
`, userID)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("gruppenrollen abfragen: %w", err)
|
|
||||||
}
|
|
||||||
defer rows.Close()
|
|
||||||
|
|
||||||
var out []Role
|
|
||||||
for rows.Next() {
|
|
||||||
var r string
|
|
||||||
if err := rows.Scan(&r); err != nil {
|
|
||||||
return nil, fmt.Errorf("gruppenrolle lesen: %w", err)
|
|
||||||
}
|
|
||||||
out = append(out, Role(r))
|
|
||||||
}
|
|
||||||
return out, rows.Err()
|
|
||||||
}
|
|
||||||
|
|
||||||
// EffectivePermissionsForUser vereinigt die Rechte aus der direkten
|
|
||||||
// Rollenzuweisung (Store, RBAC-01) mit allen Rechten aus Gruppenrollen —
|
|
||||||
// jede einzelne Rolle wird ueber die bestehende Hierarchie (EffectivePermissions)
|
|
||||||
// aufgeloest, das Ergebnis dedupliziert.
|
|
||||||
func (s *GroupStore) EffectivePermissionsForUser(ctx context.Context, directStore *Store, userID string) ([]Permission, error) {
|
|
||||||
seen := make(map[Permission]bool)
|
|
||||||
var out []Permission
|
|
||||||
|
|
||||||
add := func(role Role) {
|
|
||||||
for _, p := range EffectivePermissions(role) {
|
|
||||||
if !seen[p] {
|
|
||||||
seen[p] = true
|
|
||||||
out = append(out, p)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if directStore != nil {
|
|
||||||
assignment, err := directStore.Get(ctx, userID)
|
|
||||||
if err != nil && !errors.Is(err, ErrNotFound) {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
if err == nil {
|
|
||||||
add(assignment.Role)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
groupRoles, err := s.RolesForUser(ctx, userID)
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
for _, r := range groupRoles {
|
|
||||||
add(r)
|
|
||||||
}
|
|
||||||
|
|
||||||
return out, nil
|
|
||||||
}
|
|
||||||
@@ -1,209 +0,0 @@
|
|||||||
package rbac
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
|
||||||
)
|
|
||||||
|
|
||||||
const groupSchema = `
|
|
||||||
CREATE TABLE IF NOT EXISTS users (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), email TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active', created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE IF NOT EXISTS role_assignments (
|
|
||||||
user_id UUID PRIMARY KEY REFERENCES users(id), role TEXT NOT NULL CHECK (role IN ('user','tenant_admin')),
|
|
||||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE IF NOT EXISTS groups (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), name TEXT NOT NULL, role TEXT CHECK (role IN ('user','tenant_admin')),
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE IF NOT EXISTS group_members (
|
|
||||||
group_id UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE, user_id UUID NOT NULL REFERENCES users(id),
|
|
||||||
added_at TIMESTAMPTZ NOT NULL DEFAULT now(), PRIMARY KEY (group_id, user_id)
|
|
||||||
);`
|
|
||||||
|
|
||||||
func setupGroupTestDB(t *testing.T, dbName string) *pgxpool.Pool {
|
|
||||||
t.Helper()
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin pool: %v", err)
|
|
||||||
}
|
|
||||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
if _, err := adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
|
||||||
t.Fatalf("testdatenbank anlegen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
dsn := strings.Replace(adminDSN, "/postgres?", "/"+dbName+"?", 1)
|
|
||||||
pool, err := pgxpool.New(ctx, dsn)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("connect testdatenbank: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := pool.Exec(ctx, groupSchema); err != nil {
|
|
||||||
t.Fatalf("schema anwenden: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
t.Cleanup(func() {
|
|
||||||
pool.Close()
|
|
||||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
adminPool.Close()
|
|
||||||
})
|
|
||||||
return pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func createTestUser(t *testing.T, pool *pgxpool.Pool, email string) string {
|
|
||||||
t.Helper()
|
|
||||||
u, err := user.NewTenantUserStore(pool).Create(context.Background(), email, "Test")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("testuser anlegen: %v", err)
|
|
||||||
}
|
|
||||||
return u.ID
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 1: Gruppen anlegen und Benutzer zuordnen.
|
|
||||||
func TestGroup_CreateAndAddMember(t *testing.T) {
|
|
||||||
pool := setupGroupTestDB(t, "test_rbac03_create")
|
|
||||||
gs := NewGroupStore(pool)
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
g, err := gs.CreateGroup(ctx, "Buchhaltung")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("create group: %v", err)
|
|
||||||
}
|
|
||||||
userID := createTestUser(t, pool, "alice@example.com")
|
|
||||||
|
|
||||||
if err := gs.AddMember(ctx, g.ID, userID); err != nil {
|
|
||||||
t.Fatalf("add member: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 2 + Pruefung 1: Gruppenrolle wirkt auf ALLE aktuellen
|
|
||||||
// Mitglieder.
|
|
||||||
func TestGroup_RoleAffectsAllCurrentMembers(t *testing.T) {
|
|
||||||
pool := setupGroupTestDB(t, "test_rbac03_roleall")
|
|
||||||
gs := NewGroupStore(pool)
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
g, err := gs.CreateGroup(ctx, "Admins")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("create group: %v", err)
|
|
||||||
}
|
|
||||||
if err := gs.SetGroupRole(ctx, g.ID, RoleTenantAdmin); err != nil {
|
|
||||||
t.Fatalf("set group role: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
alice := createTestUser(t, pool, "alice@example.com")
|
|
||||||
bob := createTestUser(t, pool, "bob@example.com")
|
|
||||||
if err := gs.AddMember(ctx, g.ID, alice); err != nil {
|
|
||||||
t.Fatalf("add alice: %v", err)
|
|
||||||
}
|
|
||||||
if err := gs.AddMember(ctx, g.ID, bob); err != nil {
|
|
||||||
t.Fatalf("add bob: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, uid := range []string{alice, bob} {
|
|
||||||
perms, err := gs.EffectivePermissionsForUser(ctx, nil, uid)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("effective permissions fuer %s: %v", uid, err)
|
|
||||||
}
|
|
||||||
if !contains(perms, PermManageUsers) {
|
|
||||||
t.Fatalf("mitglied %s sollte tenant_admin-rechte ueber die gruppe haben, habe %v", uid, perms)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3 + Pruefung 2: Entfernen aus der Gruppe entzieht die
|
|
||||||
// gruppenbasierten Rechte sofort.
|
|
||||||
func TestGroup_RemoveMemberRevokesRightsImmediately(t *testing.T) {
|
|
||||||
pool := setupGroupTestDB(t, "test_rbac03_remove")
|
|
||||||
gs := NewGroupStore(pool)
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
g, _ := gs.CreateGroup(ctx, "Admins")
|
|
||||||
_ = gs.SetGroupRole(ctx, g.ID, RoleTenantAdmin)
|
|
||||||
userID := createTestUser(t, pool, "alice@example.com")
|
|
||||||
_ = gs.AddMember(ctx, g.ID, userID)
|
|
||||||
|
|
||||||
perms, err := gs.EffectivePermissionsForUser(ctx, nil, userID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("effective permissions (mitglied): %v", err)
|
|
||||||
}
|
|
||||||
if !contains(perms, PermManageUsers) {
|
|
||||||
t.Fatal("erwartet tenant_admin-rechte als mitglied")
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := gs.RemoveMember(ctx, g.ID, userID); err != nil {
|
|
||||||
t.Fatalf("remove member: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
perms, err = gs.EffectivePermissionsForUser(ctx, nil, userID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("effective permissions (entfernt): %v", err)
|
|
||||||
}
|
|
||||||
if contains(perms, PermManageUsers) {
|
|
||||||
t.Fatal("erwartet KEINE tenant_admin-rechte nach entfernen aus der gruppe")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3: Loeschen einer Gruppe entzieht Rechte sauber, ohne
|
|
||||||
// das Benutzerkonto zu loeschen.
|
|
||||||
func TestGroup_DeleteGroupRevokesRightsWithoutDeletingUser(t *testing.T) {
|
|
||||||
pool := setupGroupTestDB(t, "test_rbac03_delete")
|
|
||||||
gs := NewGroupStore(pool)
|
|
||||||
us := user.NewTenantUserStore(pool)
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
g, _ := gs.CreateGroup(ctx, "Temp")
|
|
||||||
_ = gs.SetGroupRole(ctx, g.ID, RoleTenantAdmin)
|
|
||||||
userID := createTestUser(t, pool, "alice@example.com")
|
|
||||||
_ = gs.AddMember(ctx, g.ID, userID)
|
|
||||||
|
|
||||||
if err := gs.DeleteGroup(ctx, g.ID); err != nil {
|
|
||||||
t.Fatalf("delete group: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
perms, err := gs.EffectivePermissionsForUser(ctx, nil, userID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("effective permissions: %v", err)
|
|
||||||
}
|
|
||||||
if contains(perms, PermManageUsers) {
|
|
||||||
t.Fatal("erwartet keine rechte mehr nach loeschen der gruppe")
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, err := us.Get(ctx, userID); err != nil {
|
|
||||||
t.Fatalf("benutzerkonto haette erhalten bleiben muessen: %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3 + Pruefung 3: Gruppen sind sauber tenant-isoliert.
|
|
||||||
func TestGroup_TenantIsolation(t *testing.T) {
|
|
||||||
poolA := setupGroupTestDB(t, "test_rbac03_tenanta")
|
|
||||||
poolB := setupGroupTestDB(t, "test_rbac03_tenantb")
|
|
||||||
gsA := NewGroupStore(poolA)
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
if _, err := gsA.CreateGroup(ctx, "Nur-Tenant-A"); err != nil {
|
|
||||||
t.Fatalf("create group a: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
var countB int
|
|
||||||
if err := poolB.QueryRow(ctx, `SELECT count(*) FROM groups`).Scan(&countB); err != nil {
|
|
||||||
t.Fatalf("count tenant b: %v", err)
|
|
||||||
}
|
|
||||||
if countB != 0 {
|
|
||||||
t.Fatalf("tenant b sollte keine gruppen aus tenant a sehen, habe %d", countB)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,250 +0,0 @@
|
|||||||
package rbac
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"net/http"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/auth"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Handler stellt Rollen-/Rechte- und Gruppenverwaltung als HTTP-Endpunkte
|
|
||||||
// bereit (RBAC-05). Duenner Client der bestehenden Store/GroupStore-Schicht —
|
|
||||||
// keine eigene Rechtelogik hier (siehe Ticket-Produkt-DNA).
|
|
||||||
type Handler struct {
|
|
||||||
roles *Store
|
|
||||||
groups *GroupStore
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewHandler(roles *Store, groups *GroupStore) *Handler {
|
|
||||||
return &Handler{roles: roles, groups: groups}
|
|
||||||
}
|
|
||||||
|
|
||||||
// requireManageUsers prueft, ob der aufrufende Benutzer ueberhaupt
|
|
||||||
// Rechteverwaltung ausueben darf — technisch durchgesetzt hier zusaetzlich
|
|
||||||
// zu RBAC-02 (Policy-Enforcement-Schicht), da diese Kachel ein eigener,
|
|
||||||
// besonders sicherheitskritischer HTTP-Einstiegspunkt ist.
|
|
||||||
func requireManageUsers(w http.ResponseWriter, r *http.Request, roles *Store) (callerUserID string, ok bool) {
|
|
||||||
claims, authOK := auth.ClaimsFromContext(r.Context())
|
|
||||||
if !authOK {
|
|
||||||
http.Error(w, "nicht angemeldet", http.StatusUnauthorized)
|
|
||||||
return "", false
|
|
||||||
}
|
|
||||||
assignment, err := roles.Get(r.Context(), claims.UserID)
|
|
||||||
if err != nil || !HasPermission(assignment.Role, PermManageUsers) {
|
|
||||||
http.Error(w, "keine Berechtigung zur Rechteverwaltung", http.StatusForbidden)
|
|
||||||
return "", false
|
|
||||||
}
|
|
||||||
return claims.UserID, true
|
|
||||||
}
|
|
||||||
|
|
||||||
type roleInfo struct {
|
|
||||||
Role Role `json:"role"`
|
|
||||||
Permissions []Permission `json:"permissions"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListRoles liefert die (im Tenant-Geltungsbereich zuweisbaren) Rollen mit
|
|
||||||
// ihren vollstaendig aufgeloesten Rechten (Akzeptanzkriterium 1).
|
|
||||||
func (h *Handler) ListRoles(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
out := make([]roleInfo, 0, len(assignableRoles))
|
|
||||||
for role := range assignableRoles {
|
|
||||||
out = append(out, roleInfo{Role: role, Permissions: EffectivePermissions(role)})
|
|
||||||
}
|
|
||||||
w.Header().Set("Content-Type", "application/json")
|
|
||||||
_ = json.NewEncoder(w).Encode(out)
|
|
||||||
}
|
|
||||||
|
|
||||||
type assignRoleRequest struct {
|
|
||||||
UserID string `json:"user_id"`
|
|
||||||
Role Role `json:"role"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// roleRank ordnet die Rollenhierarchie fuer den Selbst-Eskalations-Vergleich
|
|
||||||
// (Akzeptanzkriterium 2 / Pruefung 2) — hoehere Zahl = mehr Rechte. Basiert
|
|
||||||
// auf derselben parent-Kette wie EffectivePermissions, nicht dupliziert als
|
|
||||||
// eigenstaendiges Modell.
|
|
||||||
func roleRank(role Role) int {
|
|
||||||
rank := 0
|
|
||||||
for r, ok := role, true; ok; r, ok = parent[r] {
|
|
||||||
rank++
|
|
||||||
}
|
|
||||||
return rank
|
|
||||||
}
|
|
||||||
|
|
||||||
// AssignRole weist einem Benutzer eine Rolle zu (Akzeptanzkriterium 1).
|
|
||||||
// Verweigert explizit, dass sich der aufrufende Benutzer selbst eine
|
|
||||||
// hoehere Rolle zuweist (Akzeptanzkriterium 2 / Pruefung 2) — unabhaengig
|
|
||||||
// davon, ob RBAC-02 dieselbe Aktion ohnehin ueber die allgemeine
|
|
||||||
// Policy-Schicht verhindern wuerde: Selbst-Eskalation ist ein derart
|
|
||||||
// sicherheitskritischer Einzelfall, dass er hier zusaetzlich explizit und
|
|
||||||
// unuebersehbar geprueft wird, statt sich allein auf eine generische
|
|
||||||
// Regel an anderer Stelle zu verlassen.
|
|
||||||
func (h *Handler) AssignRole(w http.ResponseWriter, r *http.Request) {
|
|
||||||
callerUserID, ok := requireManageUsers(w, r, h.roles)
|
|
||||||
if !ok {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
var req assignRoleRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
if req.UserID == callerUserID {
|
|
||||||
callerAssignment, err := h.roles.Get(r.Context(), callerUserID)
|
|
||||||
callerRole := RoleUser
|
|
||||||
if err == nil {
|
|
||||||
callerRole = callerAssignment.Role
|
|
||||||
}
|
|
||||||
if roleRank(req.Role) > roleRank(callerRole) {
|
|
||||||
http.Error(w, "Sie können sich nicht selbst eine höhere Rolle zuweisen.", http.StatusForbidden)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
assignment, err := h.roles.Assign(r.Context(), req.UserID, req.Role, callerUserID)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "Rolle konnte nicht zugewiesen werden.", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
w.Header().Set("Content-Type", "application/json")
|
|
||||||
_ = json.NewEncoder(w).Encode(assignment)
|
|
||||||
}
|
|
||||||
|
|
||||||
// RoleHistory liefert die Zuweisungshistorie eines Benutzers — der in
|
|
||||||
// Akzeptanzkriterium 3 geforderte Verweis auf das Audit-Log (die
|
|
||||||
// role_assignment_history-Tabelle selbst IST die Nachvollziehbarkeits-Spur;
|
|
||||||
// eine vollstaendige Anbindung an Core AUD-01 ist nicht Teil dieser Kachel).
|
|
||||||
func (h *Handler) RoleHistory(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
userID := strings.TrimPrefix(r.URL.Path, "/rbac/users/")
|
|
||||||
userID = strings.TrimSuffix(userID, "/history")
|
|
||||||
if userID == "" {
|
|
||||||
http.Error(w, "user_id fehlt", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
history, err := h.roles.History(r.Context(), userID)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "historie konnte nicht geladen werden", http.StatusInternalServerError)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
w.Header().Set("Content-Type", "application/json")
|
|
||||||
_ = json.NewEncoder(w).Encode(history)
|
|
||||||
}
|
|
||||||
|
|
||||||
type createGroupRequest struct {
|
|
||||||
Name string `json:"name"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// CreateGroup legt eine neue Gruppe an (Akzeptanzkriterium 2).
|
|
||||||
func (h *Handler) CreateGroup(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
var req createGroupRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
group, err := h.groups.CreateGroup(r.Context(), req.Name)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "Gruppe konnte nicht angelegt werden.", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
w.Header().Set("Content-Type", "application/json")
|
|
||||||
w.WriteHeader(http.StatusCreated)
|
|
||||||
_ = json.NewEncoder(w).Encode(group)
|
|
||||||
}
|
|
||||||
|
|
||||||
type groupWithMembers struct {
|
|
||||||
Group
|
|
||||||
Members []string `json:"members"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// ListGroups liefert alle Gruppen inkl. Mitgliederliste (Akzeptanzkriterium 2).
|
|
||||||
func (h *Handler) ListGroups(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
groups, err := h.groups.ListGroups(r.Context())
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "Gruppen konnten nicht geladen werden.", http.StatusInternalServerError)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
out := make([]groupWithMembers, 0, len(groups))
|
|
||||||
for _, g := range groups {
|
|
||||||
members, err := h.groups.Members(r.Context(), g.ID)
|
|
||||||
if err != nil {
|
|
||||||
http.Error(w, "Mitglieder konnten nicht geladen werden.", http.StatusInternalServerError)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
out = append(out, groupWithMembers{Group: g, Members: members})
|
|
||||||
}
|
|
||||||
w.Header().Set("Content-Type", "application/json")
|
|
||||||
_ = json.NewEncoder(w).Encode(out)
|
|
||||||
}
|
|
||||||
|
|
||||||
type groupActionRequest struct {
|
|
||||||
GroupID string `json:"group_id"`
|
|
||||||
UserID string `json:"user_id"`
|
|
||||||
Role Role `json:"role"`
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetGroupRole weist einer Gruppe eine Rolle zu (Akzeptanzkriterium 2).
|
|
||||||
func (h *Handler) SetGroupRole(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
var req groupActionRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if err := h.groups.SetGroupRole(r.Context(), req.GroupID, req.Role); err != nil {
|
|
||||||
http.Error(w, "Gruppenrolle konnte nicht gesetzt werden.", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
w.WriteHeader(http.StatusOK)
|
|
||||||
}
|
|
||||||
|
|
||||||
// AddGroupMember nimmt einen Benutzer in eine Gruppe auf (Akzeptanzkriterium 2).
|
|
||||||
func (h *Handler) AddGroupMember(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
var req groupActionRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if err := h.groups.AddMember(r.Context(), req.GroupID, req.UserID); err != nil {
|
|
||||||
http.Error(w, "Mitglied konnte nicht hinzugefügt werden.", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
w.WriteHeader(http.StatusOK)
|
|
||||||
}
|
|
||||||
|
|
||||||
// RemoveGroupMember entfernt einen Benutzer aus einer Gruppe.
|
|
||||||
func (h *Handler) RemoveGroupMember(w http.ResponseWriter, r *http.Request) {
|
|
||||||
if _, ok := requireManageUsers(w, r, h.roles); !ok {
|
|
||||||
return
|
|
||||||
}
|
|
||||||
var req groupActionRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if err := h.groups.RemoveMember(r.Context(), req.GroupID, req.UserID); err != nil {
|
|
||||||
http.Error(w, "Mitglied konnte nicht entfernt werden.", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
w.WriteHeader(http.StatusOK)
|
|
||||||
}
|
|
||||||
@@ -1,309 +0,0 @@
|
|||||||
package rbac
|
|
||||||
|
|
||||||
import (
|
|
||||||
"bytes"
|
|
||||||
"context"
|
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
|
||||||
"net/http"
|
|
||||||
"net/http/httptest"
|
|
||||||
"os"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/auth"
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
|
||||||
)
|
|
||||||
|
|
||||||
const handlerSchema = `
|
|
||||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
||||||
CREATE TABLE users (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), email TEXT NOT NULL UNIQUE, name TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active', created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE role_assignments (
|
|
||||||
user_id UUID PRIMARY KEY REFERENCES users(id), role TEXT NOT NULL CHECK (role IN ('user','tenant_admin')),
|
|
||||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE role_assignment_history (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), user_id UUID NOT NULL, role TEXT NOT NULL,
|
|
||||||
granted_by TEXT NOT NULL, granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE groups (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(), name TEXT NOT NULL, role TEXT CHECK (role IN ('user','tenant_admin')),
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE group_members (
|
|
||||||
group_id UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE, user_id UUID NOT NULL REFERENCES users(id),
|
|
||||||
added_at TIMESTAMPTZ NOT NULL DEFAULT now(), PRIMARY KEY (group_id, user_id)
|
|
||||||
);`
|
|
||||||
|
|
||||||
func setupHandlerTest(t *testing.T, dbName string) (*Handler, *Store, *user.TenantUserStore, *pgxpool.Pool) {
|
|
||||||
t.Helper()
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin pool: %v", err)
|
|
||||||
}
|
|
||||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
if _, err := adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
|
||||||
t.Fatalf("testdatenbank anlegen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
dsn := strings.Replace(adminDSN, "/postgres?", "/"+dbName+"?", 1)
|
|
||||||
pool, err := pgxpool.New(ctx, dsn)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("connect testdatenbank: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := pool.Exec(ctx, handlerSchema); err != nil {
|
|
||||||
t.Fatalf("schema: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
t.Cleanup(func() {
|
|
||||||
pool.Close()
|
|
||||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
adminPool.Close()
|
|
||||||
})
|
|
||||||
|
|
||||||
roleStore := NewStore(pool)
|
|
||||||
groupStore := NewGroupStore(pool)
|
|
||||||
return NewHandler(roleStore, groupStore), roleStore, user.NewTenantUserStore(pool), pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func sessionCookieFor(t *testing.T, issuer *auth.TokenIssuer, userID string) *http.Cookie {
|
|
||||||
t.Helper()
|
|
||||||
token, err := issuer.Issue(userID, "acme")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("session-token ausstellen: %v", err)
|
|
||||||
}
|
|
||||||
return &http.Cookie{Name: auth.CookieName, Value: token}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 1: Rollen und ihre Grundrechte sind einsehbar.
|
|
||||||
func TestListRoles(t *testing.T) {
|
|
||||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_list_roles")
|
|
||||||
ctx := context.Background()
|
|
||||||
admin, err := users.Create(ctx, "admin@acme.example", "Admin")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin anlegen: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
|
||||||
t.Fatalf("admin-rolle setzen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
issuer := auth.NewTokenIssuer("test-secret")
|
|
||||||
req := httptest.NewRequest(http.MethodGet, "/rbac/roles", nil)
|
|
||||||
req.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.ListRoles)(rec, req)
|
|
||||||
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
|
|
||||||
}
|
|
||||||
var out []roleInfo
|
|
||||||
if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
|
|
||||||
t.Fatalf("response dekodieren: %v", err)
|
|
||||||
}
|
|
||||||
if len(out) != 2 {
|
|
||||||
t.Fatalf("erwartet 2 zuweisbare rollen (user, tenant_admin), habe %d", len(out))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 2 / Pruefung 2: Selbst-Eskalation wird abgewiesen.
|
|
||||||
func TestAssignRole_RejectsSelfEscalation(t *testing.T) {
|
|
||||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_self_escalation")
|
|
||||||
ctx := context.Background()
|
|
||||||
u, err := users.Create(ctx, "normal@acme.example", "Normaler Nutzer")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("nutzer anlegen: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := roles.Assign(ctx, u.ID, RoleUser, "system"); err != nil {
|
|
||||||
t.Fatalf("ausgangsrolle setzen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
issuer := auth.NewTokenIssuer("test-secret")
|
|
||||||
body, _ := json.Marshal(assignRoleRequest{UserID: u.ID, Role: RoleTenantAdmin})
|
|
||||||
req := httptest.NewRequest(http.MethodPost, "/rbac/users/role", bytes.NewReader(body))
|
|
||||||
req.AddCookie(sessionCookieFor(t, issuer, u.ID))
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.AssignRole)(rec, req)
|
|
||||||
|
|
||||||
if rec.Code != http.StatusForbidden {
|
|
||||||
t.Fatalf("status = %d, want 403 (selbst-eskalation muss abgewiesen werden)", rec.Code)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Rolle muss unveraendert geblieben sein.
|
|
||||||
assignment, err := roles.Get(ctx, u.ID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("rolle laden: %v", err)
|
|
||||||
}
|
|
||||||
if assignment.Role != RoleUser {
|
|
||||||
t.Fatalf("rolle wurde trotz abgewiesener anfrage geaendert: %q", assignment.Role)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Gegenprobe: ein Tenant-Admin darf EINEM ANDEREN Benutzer eine hoehere
|
|
||||||
// Rolle zuweisen — nur die Selbst-Zuweisung ist gesperrt.
|
|
||||||
func TestAssignRole_AdminCanPromoteOtherUser(t *testing.T) {
|
|
||||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_promote_other")
|
|
||||||
ctx := context.Background()
|
|
||||||
admin, err := users.Create(ctx, "admin2@acme.example", "Admin")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin anlegen: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
|
||||||
t.Fatalf("admin-rolle setzen: %v", err)
|
|
||||||
}
|
|
||||||
other, err := users.Create(ctx, "other@acme.example", "Anderer Nutzer")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("anderen nutzer anlegen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
issuer := auth.NewTokenIssuer("test-secret")
|
|
||||||
body, _ := json.Marshal(assignRoleRequest{UserID: other.ID, Role: RoleTenantAdmin})
|
|
||||||
req := httptest.NewRequest(http.MethodPost, "/rbac/users/role", bytes.NewReader(body))
|
|
||||||
req.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.AssignRole)(rec, req)
|
|
||||||
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3: Aenderungen an Rechten sind nachvollziehbar.
|
|
||||||
func TestRoleHistory_TracksAssignments(t *testing.T) {
|
|
||||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_history")
|
|
||||||
ctx := context.Background()
|
|
||||||
admin, err := users.Create(ctx, "admin3@acme.example", "Admin")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin anlegen: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
|
||||||
t.Fatalf("admin-rolle setzen: %v", err)
|
|
||||||
}
|
|
||||||
target, err := users.Create(ctx, "target@acme.example", "Zielnutzer")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("zielnutzer anlegen: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := roles.Assign(ctx, target.ID, RoleUser, admin.ID); err != nil {
|
|
||||||
t.Fatalf("erste zuweisung: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := roles.Assign(ctx, target.ID, RoleTenantAdmin, admin.ID); err != nil {
|
|
||||||
t.Fatalf("zweite zuweisung: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
issuer := auth.NewTokenIssuer("test-secret")
|
|
||||||
req := httptest.NewRequest(http.MethodGet, "/rbac/users/"+target.ID+"/history", nil)
|
|
||||||
req.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.RoleHistory)(rec, req)
|
|
||||||
|
|
||||||
if rec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
|
|
||||||
}
|
|
||||||
var history []Assignment
|
|
||||||
if err := json.Unmarshal(rec.Body.Bytes(), &history); err != nil {
|
|
||||||
t.Fatalf("response dekodieren: %v", err)
|
|
||||||
}
|
|
||||||
if len(history) != 2 {
|
|
||||||
t.Fatalf("erwartet 2 historieneintraege, habe %d", len(history))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 2: Gruppen anlegen, Mitglieder zuordnen, Rolle zuweisen.
|
|
||||||
func TestGroupWorkflow(t *testing.T) {
|
|
||||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_group_workflow")
|
|
||||||
ctx := context.Background()
|
|
||||||
admin, err := users.Create(ctx, "admin4@acme.example", "Admin")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin anlegen: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := roles.Assign(ctx, admin.ID, RoleTenantAdmin, "system"); err != nil {
|
|
||||||
t.Fatalf("admin-rolle setzen: %v", err)
|
|
||||||
}
|
|
||||||
member, err := users.Create(ctx, "member@acme.example", "Mitglied")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("mitglied anlegen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
issuer := auth.NewTokenIssuer("test-secret")
|
|
||||||
|
|
||||||
createBody, _ := json.Marshal(createGroupRequest{Name: "Buchhaltung"})
|
|
||||||
createReq := httptest.NewRequest(http.MethodPost, "/rbac/groups", bytes.NewReader(createBody))
|
|
||||||
createReq.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
|
||||||
createRec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.CreateGroup)(createRec, createReq)
|
|
||||||
if createRec.Code != http.StatusCreated {
|
|
||||||
t.Fatalf("create group: status = %d, body: %s", createRec.Code, createRec.Body.String())
|
|
||||||
}
|
|
||||||
var group Group
|
|
||||||
if err := json.Unmarshal(createRec.Body.Bytes(), &group); err != nil {
|
|
||||||
t.Fatalf("group-response dekodieren: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
roleBody, _ := json.Marshal(groupActionRequest{GroupID: group.ID, Role: RoleUser})
|
|
||||||
roleReq := httptest.NewRequest(http.MethodPost, "/rbac/groups/role", bytes.NewReader(roleBody))
|
|
||||||
roleReq.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
|
||||||
roleRec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.SetGroupRole)(roleRec, roleReq)
|
|
||||||
if roleRec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("set group role: status = %d, body: %s", roleRec.Code, roleRec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
memberBody, _ := json.Marshal(groupActionRequest{GroupID: group.ID, UserID: member.ID})
|
|
||||||
memberReq := httptest.NewRequest(http.MethodPost, "/rbac/groups/members", bytes.NewReader(memberBody))
|
|
||||||
memberReq.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
|
||||||
memberRec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.AddGroupMember)(memberRec, memberReq)
|
|
||||||
if memberRec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("add member: status = %d, body: %s", memberRec.Code, memberRec.Body.String())
|
|
||||||
}
|
|
||||||
|
|
||||||
listReq := httptest.NewRequest(http.MethodGet, "/rbac/groups", nil)
|
|
||||||
listReq.AddCookie(sessionCookieFor(t, issuer, admin.ID))
|
|
||||||
listRec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.ListGroups)(listRec, listReq)
|
|
||||||
if listRec.Code != http.StatusOK {
|
|
||||||
t.Fatalf("list groups: status = %d, body: %s", listRec.Code, listRec.Body.String())
|
|
||||||
}
|
|
||||||
var groups []groupWithMembers
|
|
||||||
if err := json.Unmarshal(listRec.Body.Bytes(), &groups); err != nil {
|
|
||||||
t.Fatalf("groups-response dekodieren: %v", err)
|
|
||||||
}
|
|
||||||
if len(groups) != 1 || len(groups[0].Members) != 1 || groups[0].Members[0] != member.ID {
|
|
||||||
t.Fatalf("erwartet 1 gruppe mit 1 mitglied (%s), habe %+v", member.ID, groups)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Ohne Rechteverwaltungsberechtigung (normale 'user'-Rolle) wird jeder
|
|
||||||
// Endpunkt abgewiesen — Tenant-Isolation ist strukturell (Modell C, siehe
|
|
||||||
// GroupStore-Kommentar), diese Pruefung deckt die Rechte-Ebene ab.
|
|
||||||
func TestRequireManageUsers_RejectsPlainUser(t *testing.T) {
|
|
||||||
h, roles, users, _ := setupHandlerTest(t, "rbac05_reject_plain")
|
|
||||||
ctx := context.Background()
|
|
||||||
u, err := users.Create(ctx, "plain@acme.example", "Normaler Nutzer")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("nutzer anlegen: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := roles.Assign(ctx, u.ID, RoleUser, "system"); err != nil {
|
|
||||||
t.Fatalf("rolle setzen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
issuer := auth.NewTokenIssuer("test-secret")
|
|
||||||
req := httptest.NewRequest(http.MethodGet, "/rbac/roles", nil)
|
|
||||||
req.AddCookie(sessionCookieFor(t, issuer, u.ID))
|
|
||||||
rec := httptest.NewRecorder()
|
|
||||||
auth.RequireAuth(issuer, h.ListRoles)(rec, req)
|
|
||||||
|
|
||||||
if rec.Code != http.StatusForbidden {
|
|
||||||
t.Fatalf("status = %d, want 403 fuer benutzer ohne rechteverwaltung", rec.Code)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,71 +0,0 @@
|
|||||||
// Package rbac implementiert Core RBAC-01: das Rollenmodell mit
|
|
||||||
// Grundrollen/-rechten, Hierarchie und Zuweisung. Die eigentliche
|
|
||||||
// Durchsetzung (erlaubt/verboten je Request) ist RBAC-02, dieses Paket
|
|
||||||
// liefert nur Modell + Zuweisung (Casbin-Prinzip: Policy-Modell getrennt
|
|
||||||
// von der Entscheidungsfunktion).
|
|
||||||
package rbac
|
|
||||||
|
|
||||||
// Role ist eine der drei Grundrollen. Superadmin lebt mandantenuebergreifend
|
|
||||||
// (siehe internal/user.SuperadminStore aus IAM-01) und wird deshalb NICHT
|
|
||||||
// ueber Store (tenant-gescoped) zugewiesen — die Existenz eines Superadmin-
|
|
||||||
// Kontos IST die Rollenzuweisung.
|
|
||||||
type Role string
|
|
||||||
|
|
||||||
const (
|
|
||||||
RoleSuperadmin Role = "superadmin"
|
|
||||||
RoleTenantAdmin Role = "tenant_admin"
|
|
||||||
RoleUser Role = "user"
|
|
||||||
)
|
|
||||||
|
|
||||||
type Permission string
|
|
||||||
|
|
||||||
const (
|
|
||||||
PermSelfRead Permission = "self.read"
|
|
||||||
PermSelfUpdate Permission = "self.update"
|
|
||||||
PermManageUsers Permission = "tenant.manage_users"
|
|
||||||
PermManageSettings Permission = "tenant.manage_settings"
|
|
||||||
PermManageTenants Permission = "platform.manage_tenants"
|
|
||||||
)
|
|
||||||
|
|
||||||
// parent bildet die Rollenhierarchie ab (Akzeptanzkriterium 2): eine Rolle
|
|
||||||
// erbt alle Rechte ihrer Elternrolle. tenant_admin erbt von user,
|
|
||||||
// superadmin erbt von tenant_admin.
|
|
||||||
var parent = map[Role]Role{
|
|
||||||
RoleTenantAdmin: RoleUser,
|
|
||||||
RoleSuperadmin: RoleTenantAdmin,
|
|
||||||
}
|
|
||||||
|
|
||||||
// direct sind die einer Rolle direkt (ohne Vererbung) zugeordneten Rechte.
|
|
||||||
var direct = map[Role][]Permission{
|
|
||||||
RoleUser: {PermSelfRead, PermSelfUpdate},
|
|
||||||
RoleTenantAdmin: {PermManageUsers, PermManageSettings},
|
|
||||||
RoleSuperadmin: {PermManageTenants},
|
|
||||||
}
|
|
||||||
|
|
||||||
// EffectivePermissions liefert die vollstaendige, ueber die Hierarchie
|
|
||||||
// aufgeloeste Rechtemenge einer Rolle (Akzeptanzkriterium 2 / Pruefung 2).
|
|
||||||
func EffectivePermissions(role Role) []Permission {
|
|
||||||
seen := make(map[Permission]bool)
|
|
||||||
var out []Permission
|
|
||||||
|
|
||||||
for r, ok := role, true; ok; r, ok = parent[r] {
|
|
||||||
for _, p := range direct[r] {
|
|
||||||
if !seen[p] {
|
|
||||||
seen[p] = true
|
|
||||||
out = append(out, p)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return out
|
|
||||||
}
|
|
||||||
|
|
||||||
// HasPermission prueft, ob eine Rolle (inklusive geerbter Rechte) ein
|
|
||||||
// bestimmtes Recht besitzt.
|
|
||||||
func HasPermission(role Role, perm Permission) bool {
|
|
||||||
for _, p := range EffectivePermissions(role) {
|
|
||||||
if p == perm {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
@@ -1,48 +0,0 @@
|
|||||||
package rbac
|
|
||||||
|
|
||||||
import "testing"
|
|
||||||
|
|
||||||
func contains(perms []Permission, p Permission) bool {
|
|
||||||
for _, x := range perms {
|
|
||||||
if x == p {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 2 + Pruefung 2: Rollenhierarchie liefert die erwartete
|
|
||||||
// effektive Rechtemenge.
|
|
||||||
func TestEffectivePermissions_Inheritance(t *testing.T) {
|
|
||||||
userPerms := EffectivePermissions(RoleUser)
|
|
||||||
if !contains(userPerms, PermSelfRead) || !contains(userPerms, PermSelfUpdate) {
|
|
||||||
t.Fatalf("user sollte self.read/self.update haben, habe %v", userPerms)
|
|
||||||
}
|
|
||||||
if contains(userPerms, PermManageUsers) {
|
|
||||||
t.Fatal("user sollte KEIN tenant.manage_users haben")
|
|
||||||
}
|
|
||||||
|
|
||||||
adminPerms := EffectivePermissions(RoleTenantAdmin)
|
|
||||||
if !contains(adminPerms, PermSelfRead) || !contains(adminPerms, PermManageUsers) || !contains(adminPerms, PermManageSettings) {
|
|
||||||
t.Fatalf("tenant_admin sollte geerbte user-rechte + eigene rechte haben, habe %v", adminPerms)
|
|
||||||
}
|
|
||||||
if contains(adminPerms, PermManageTenants) {
|
|
||||||
t.Fatal("tenant_admin sollte KEIN platform.manage_tenants haben")
|
|
||||||
}
|
|
||||||
|
|
||||||
superPerms := EffectivePermissions(RoleSuperadmin)
|
|
||||||
for _, want := range []Permission{PermSelfRead, PermSelfUpdate, PermManageUsers, PermManageSettings, PermManageTenants} {
|
|
||||||
if !contains(superPerms, want) {
|
|
||||||
t.Fatalf("superadmin sollte %q haben (volle vererbte kette), habe %v", want, superPerms)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestHasPermission(t *testing.T) {
|
|
||||||
if !HasPermission(RoleTenantAdmin, PermSelfRead) {
|
|
||||||
t.Fatal("tenant_admin sollte geerbtes self.read haben")
|
|
||||||
}
|
|
||||||
if HasPermission(RoleUser, PermManageTenants) {
|
|
||||||
t.Fatal("user sollte platform.manage_tenants nicht haben")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,124 +0,0 @@
|
|||||||
package rbac
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5"
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
var (
|
|
||||||
// ErrRoleNotAssignableInTenantScope wird geliefert, wenn versucht wird,
|
|
||||||
// eine mandantenuebergreifende Rolle (superadmin) ueber den tenant-
|
|
||||||
// gescopten Store zu vergeben — die erlaubte Matrix laesst hier nur
|
|
||||||
// user/tenant_admin zu (Akzeptanzkriterium 1 / Pruefung 1).
|
|
||||||
ErrRoleNotAssignableInTenantScope = errors.New("rbac: rolle ist in diesem geltungsbereich nicht zuweisbar")
|
|
||||||
ErrNotFound = errors.New("rbac: keine rollenzuweisung gefunden")
|
|
||||||
)
|
|
||||||
|
|
||||||
// assignableRoles ist die erlaubte Matrix fuer Store (tenant-gescoped).
|
|
||||||
var assignableRoles = map[Role]bool{
|
|
||||||
RoleUser: true,
|
|
||||||
RoleTenantAdmin: true,
|
|
||||||
}
|
|
||||||
|
|
||||||
type Assignment struct {
|
|
||||||
UserID string
|
|
||||||
Role Role
|
|
||||||
GrantedBy string
|
|
||||||
}
|
|
||||||
|
|
||||||
// Store verwaltet Rollenzuweisungen innerhalb GENAU EINER Tenant-Datenbank —
|
|
||||||
// analog zu internal/user.TenantUserStore (Modell C: der Pool bestimmt den
|
|
||||||
// Tenant, keine tenant_id-Spalte noetig).
|
|
||||||
type Store struct {
|
|
||||||
pool *pgxpool.Pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewStore(pool *pgxpool.Pool) *Store {
|
|
||||||
return &Store{pool: pool}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Assign vergibt eine Rolle an einen Benutzer. grantedBy identifiziert den
|
|
||||||
// Akteur, der die Zuweisung vorgenommen hat (Akzeptanzkriterium 3). Jede
|
|
||||||
// Zuweisung wird zusaetzlich in role_assignment_history festgehalten, auch
|
|
||||||
// wenn sie eine vorherige Rolle ersetzt.
|
|
||||||
func (s *Store) Assign(ctx context.Context, userID string, role Role, grantedBy string) (Assignment, error) {
|
|
||||||
if !assignableRoles[role] {
|
|
||||||
return Assignment{}, ErrRoleNotAssignableInTenantScope
|
|
||||||
}
|
|
||||||
if grantedBy == "" {
|
|
||||||
return Assignment{}, errors.New("rbac: grantedBy darf nicht leer sein")
|
|
||||||
}
|
|
||||||
|
|
||||||
tx, err := s.pool.Begin(ctx)
|
|
||||||
if err != nil {
|
|
||||||
return Assignment{}, fmt.Errorf("transaktion starten: %w", err)
|
|
||||||
}
|
|
||||||
defer func() { _ = tx.Rollback(ctx) }()
|
|
||||||
|
|
||||||
if _, err := tx.Exec(ctx, `
|
|
||||||
INSERT INTO role_assignments (user_id, role, granted_by, granted_at)
|
|
||||||
VALUES ($1, $2, $3, now())
|
|
||||||
ON CONFLICT (user_id) DO UPDATE SET role = $2, granted_by = $3, granted_at = now()
|
|
||||||
`, userID, string(role), grantedBy); err != nil {
|
|
||||||
return Assignment{}, fmt.Errorf("rolle zuweisen: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, err := tx.Exec(ctx, `
|
|
||||||
INSERT INTO role_assignment_history (user_id, role, granted_by, granted_at)
|
|
||||||
VALUES ($1, $2, $3, now())
|
|
||||||
`, userID, string(role), grantedBy); err != nil {
|
|
||||||
return Assignment{}, fmt.Errorf("historie schreiben: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := tx.Commit(ctx); err != nil {
|
|
||||||
return Assignment{}, fmt.Errorf("transaktion committen: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
return Assignment{UserID: userID, Role: role, GrantedBy: grantedBy}, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *Store) Get(ctx context.Context, userID string) (Assignment, error) {
|
|
||||||
var a Assignment
|
|
||||||
var role string
|
|
||||||
a.UserID = userID
|
|
||||||
if err := s.pool.QueryRow(ctx, `
|
|
||||||
SELECT role, granted_by FROM role_assignments WHERE user_id = $1
|
|
||||||
`, userID).Scan(&role, &a.GrantedBy); err != nil {
|
|
||||||
if errors.Is(err, pgx.ErrNoRows) {
|
|
||||||
return Assignment{}, ErrNotFound
|
|
||||||
}
|
|
||||||
return Assignment{}, fmt.Errorf("rollenzuweisung lesen: %w", err)
|
|
||||||
}
|
|
||||||
a.Role = Role(role)
|
|
||||||
return a, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// History liefert jede Rollenzuweisung eines Benutzers in chronologischer
|
|
||||||
// Reihenfolge — die Grundlage fuer "wer hat wann welche Rolle vergeben"
|
|
||||||
// (Akzeptanzkriterium 3).
|
|
||||||
func (s *Store) History(ctx context.Context, userID string) ([]Assignment, error) {
|
|
||||||
rows, err := s.pool.Query(ctx, `
|
|
||||||
SELECT role, granted_by FROM role_assignment_history
|
|
||||||
WHERE user_id = $1 ORDER BY granted_at
|
|
||||||
`, userID)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("historie abfragen: %w", err)
|
|
||||||
}
|
|
||||||
defer rows.Close()
|
|
||||||
|
|
||||||
var out []Assignment
|
|
||||||
for rows.Next() {
|
|
||||||
var role string
|
|
||||||
a := Assignment{UserID: userID}
|
|
||||||
if err := rows.Scan(&role, &a.GrantedBy); err != nil {
|
|
||||||
return nil, fmt.Errorf("historieneintrag lesen: %w", err)
|
|
||||||
}
|
|
||||||
a.Role = Role(role)
|
|
||||||
out = append(out, a)
|
|
||||||
}
|
|
||||||
return out, rows.Err()
|
|
||||||
}
|
|
||||||
@@ -1,144 +0,0 @@
|
|||||||
package rbac
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"os"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
|
|
||||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
|
||||||
)
|
|
||||||
|
|
||||||
func setupStoreTest(t *testing.T) (*Store, string, func()) {
|
|
||||||
t.Helper()
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
pool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("pool: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := pool.Exec(ctx, `
|
|
||||||
CREATE TABLE IF NOT EXISTS users (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
email TEXT NOT NULL UNIQUE,
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE IF NOT EXISTS role_assignments (
|
|
||||||
user_id UUID PRIMARY KEY REFERENCES users(id),
|
|
||||||
role TEXT NOT NULL CHECK (role IN ('user', 'tenant_admin')),
|
|
||||||
granted_by TEXT NOT NULL,
|
|
||||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
CREATE TABLE IF NOT EXISTS role_assignment_history (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
user_id UUID NOT NULL,
|
|
||||||
role TEXT NOT NULL,
|
|
||||||
granted_by TEXT NOT NULL,
|
|
||||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
`); err != nil {
|
|
||||||
t.Fatalf("schema: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
userStore := user.NewTenantUserStore(pool)
|
|
||||||
u, err := userStore.Create(ctx, "rbac_test@example.com", "RBAC Test")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("testuser anlegen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
cleanup := func() {
|
|
||||||
_, _ = pool.Exec(ctx, `DELETE FROM role_assignment_history WHERE user_id = $1`, u.ID)
|
|
||||||
_, _ = pool.Exec(ctx, `DELETE FROM role_assignments WHERE user_id = $1`, u.ID)
|
|
||||||
_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, u.ID)
|
|
||||||
pool.Close()
|
|
||||||
}
|
|
||||||
return NewStore(pool), u.ID, cleanup
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 1: Grundrollen sind einem Benutzer je Tenant zuweisbar.
|
|
||||||
func TestStore_AssignAndGet(t *testing.T) {
|
|
||||||
store, userID, cleanup := setupStoreTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
assigned, err := store.Assign(ctx, userID, RoleTenantAdmin, "admin@acme.example")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("assign: %v", err)
|
|
||||||
}
|
|
||||||
if assigned.Role != RoleTenantAdmin {
|
|
||||||
t.Fatalf("erwartet tenant_admin, habe %q", assigned.Role)
|
|
||||||
}
|
|
||||||
|
|
||||||
got, err := store.Get(ctx, userID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("get: %v", err)
|
|
||||||
}
|
|
||||||
if got.Role != RoleTenantAdmin || got.GrantedBy != "admin@acme.example" {
|
|
||||||
t.Fatalf("zuweisung unerwartet: %+v", got)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 1 + Pruefung 1: Zuweisung ausserhalb der erlaubten
|
|
||||||
// Matrix (superadmin im tenant-gescopten Store) wird abgewiesen.
|
|
||||||
func TestStore_RejectsSuperadminOutsideAllowedMatrix(t *testing.T) {
|
|
||||||
store, userID, cleanup := setupStoreTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
_, err := store.Assign(ctx, userID, RoleSuperadmin, "admin@acme.example")
|
|
||||||
if !errors.Is(err, ErrRoleNotAssignableInTenantScope) {
|
|
||||||
t.Fatalf("erwartet ErrRoleNotAssignableInTenantScope, habe %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Sicherstellen, dass der abgewiesene Versuch keine Zeile hinterlassen hat.
|
|
||||||
if _, err := store.Get(ctx, userID); !errors.Is(err, ErrNotFound) {
|
|
||||||
t.Fatalf("erwartet ErrNotFound nach abgewiesener zuweisung, habe %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestStore_RejectsUnknownRole(t *testing.T) {
|
|
||||||
store, userID, cleanup := setupStoreTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
if _, err := store.Assign(ctx, userID, Role("erfunden"), "admin@acme.example"); !errors.Is(err, ErrRoleNotAssignableInTenantScope) {
|
|
||||||
t.Fatalf("erwartet ErrRoleNotAssignableInTenantScope fuer unbekannte rolle, habe %v", err)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3: Rollenzuweisung vollstaendig auditierbar.
|
|
||||||
func TestStore_HistoryTracksWhoAndWhen(t *testing.T) {
|
|
||||||
store, userID, cleanup := setupStoreTest(t)
|
|
||||||
defer cleanup()
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
if _, err := store.Assign(ctx, userID, RoleUser, "system"); err != nil {
|
|
||||||
t.Fatalf("assign 1: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := store.Assign(ctx, userID, RoleTenantAdmin, "admin@acme.example"); err != nil {
|
|
||||||
t.Fatalf("assign 2: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
history, err := store.History(ctx, userID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("history: %v", err)
|
|
||||||
}
|
|
||||||
if len(history) != 2 {
|
|
||||||
t.Fatalf("erwartet 2 historieneintraege, habe %d", len(history))
|
|
||||||
}
|
|
||||||
if history[0].Role != RoleUser || history[0].GrantedBy != "system" {
|
|
||||||
t.Fatalf("history[0] unerwartet: %+v", history[0])
|
|
||||||
}
|
|
||||||
if history[1].Role != RoleTenantAdmin || history[1].GrantedBy != "admin@acme.example" {
|
|
||||||
t.Fatalf("history[1] unerwartet: %+v", history[1])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
package tenant
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"net/http"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Handler ist eine schlanke Vorbereitung der Schnittstelle fuer API-01
|
|
||||||
// (REST-API-Grundgerüst & Versionierung) und TEN-02 (Self-Service-Onboarding).
|
|
||||||
// Auth/Rate-Limiting/Versionierung selbst sind ausdruecklich nicht Teil von
|
|
||||||
// TEN-01 und werden dort nachgezogen.
|
|
||||||
type Handler struct {
|
|
||||||
provisioner *Provisioner
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewHandler(p *Provisioner) *Handler {
|
|
||||||
return &Handler{provisioner: p}
|
|
||||||
}
|
|
||||||
|
|
||||||
type createTenantRequest struct {
|
|
||||||
Slug string `json:"slug"`
|
|
||||||
Name string `json:"name"`
|
|
||||||
}
|
|
||||||
|
|
||||||
func (h *Handler) CreateTenant(w http.ResponseWriter, r *http.Request) {
|
|
||||||
var req createTenantRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
t, err := h.provisioner.Provision(r.Context(), req.Slug, req.Name)
|
|
||||||
if err != nil {
|
|
||||||
if err == ErrInvalidSlug {
|
|
||||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
http.Error(w, "tenant konnte nicht angelegt werden", http.StatusInternalServerError)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
w.Header().Set("Content-Type", "application/json")
|
|
||||||
w.WriteHeader(http.StatusCreated)
|
|
||||||
_ = json.NewEncoder(w).Encode(t)
|
|
||||||
}
|
|
||||||
@@ -1,78 +0,0 @@
|
|||||||
package tenant
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Provisioner legt fuer jeden neuen Mandanten eine vollstaendig isolierte
|
|
||||||
// PostgreSQL-Datenbank an und registriert sie transaktional in der Registry
|
|
||||||
// (Akzeptanzkriterium 2). Zwei Mandanten-Datenbanken sind danach auf
|
|
||||||
// Infrastrukturebene komplett getrennt (Akzeptanzkriterium 3).
|
|
||||||
type Provisioner struct {
|
|
||||||
// adminPool ist mit der Wartungsdatenbank (z. B. "postgres") verbunden
|
|
||||||
// und wird ausschliesslich fuer CREATE/DROP DATABASE verwendet, da diese
|
|
||||||
// Befehle in PostgreSQL nicht in einer Transaktion laufen koennen.
|
|
||||||
adminPool *pgxpool.Pool
|
|
||||||
registry *Registry
|
|
||||||
// dsnTemplate enthaelt genau ein "%s" als Platzhalter fuer den
|
|
||||||
// Datenbanknamen, z. B. "postgresql://user:pass@host:5432/%s?sslmode=disable".
|
|
||||||
dsnTemplate string
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewProvisioner(adminPool *pgxpool.Pool, registry *Registry, dsnTemplate string) *Provisioner {
|
|
||||||
return &Provisioner{adminPool: adminPool, registry: registry, dsnTemplate: dsnTemplate}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Provision legt die Tenant-Datenbank an und registriert sie. Schlaegt die
|
|
||||||
// Registrierung fehl, wird die bereits angelegte Datenbank wieder entfernt,
|
|
||||||
// damit kein verwaister, unregistrierter Tenant zurueckbleibt.
|
|
||||||
func (p *Provisioner) Provision(ctx context.Context, slug, name string) (Tenant, error) {
|
|
||||||
if err := ValidateSlug(slug); err != nil {
|
|
||||||
return Tenant{}, err
|
|
||||||
}
|
|
||||||
|
|
||||||
dbName := dbNameForSlug(slug)
|
|
||||||
|
|
||||||
// CREATE DATABASE erlaubt keine Parameter-Platzhalter; slug ist durch
|
|
||||||
// ValidateSlug bereits auf [a-z0-9_] beschraenkt, Injektion ausgeschlossen.
|
|
||||||
if _, err := p.adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
|
||||||
return Tenant{}, fmt.Errorf("tenant-datenbank anlegen: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
t := Tenant{
|
|
||||||
Slug: slug,
|
|
||||||
Name: name,
|
|
||||||
DBName: dbName,
|
|
||||||
DBDSN: fmt.Sprintf(p.dsnTemplate, dbName),
|
|
||||||
Status: StatusActive,
|
|
||||||
}
|
|
||||||
|
|
||||||
tx, err := p.registry.pool.Begin(ctx)
|
|
||||||
if err != nil {
|
|
||||||
p.rollbackDatabase(ctx, dbName)
|
|
||||||
return Tenant{}, fmt.Errorf("registry-transaktion starten: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
created, err := p.registry.insertTx(ctx, tx, t)
|
|
||||||
if err != nil {
|
|
||||||
_ = tx.Rollback(ctx)
|
|
||||||
p.rollbackDatabase(ctx, dbName)
|
|
||||||
return Tenant{}, err
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := tx.Commit(ctx); err != nil {
|
|
||||||
p.rollbackDatabase(ctx, dbName)
|
|
||||||
return Tenant{}, fmt.Errorf("registry-transaktion committen: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
return created, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// rollbackDatabase entfernt eine bereits angelegte Tenant-Datenbank, wenn die
|
|
||||||
// Registrierung fehlschlug, damit Provisioning insgesamt atomar wirkt.
|
|
||||||
func (p *Provisioner) rollbackDatabase(ctx context.Context, dbName string) {
|
|
||||||
_, _ = p.adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
}
|
|
||||||
@@ -1,105 +0,0 @@
|
|||||||
package tenant
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"os"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Integrationstest fuer Akzeptanzkriterien 2 und 3. Benoetigt eine echte
|
|
||||||
// Postgres-Instanz und wird ohne TEST_ADMIN_DSN uebersprungen, nicht als
|
|
||||||
// fehlgeschlagen gewertet — siehe Pruefungen-Ergebnis im PR.
|
|
||||||
//
|
|
||||||
// TEST_ADMIN_DSN muss auf die Wartungsdatenbank zeigen, z. B.:
|
|
||||||
//
|
|
||||||
// postgresql://postgres:postgres@localhost:5432/postgres?sslmode=disable
|
|
||||||
func TestProvision_CreatesIsolatedDatabases(t *testing.T) {
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin pool: %v", err)
|
|
||||||
}
|
|
||||||
defer adminPool.Close()
|
|
||||||
|
|
||||||
registryPool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("registry pool: %v", err)
|
|
||||||
}
|
|
||||||
defer registryPool.Close()
|
|
||||||
|
|
||||||
if _, err := registryPool.Exec(ctx, `
|
|
||||||
CREATE TABLE IF NOT EXISTS tenants (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
slug TEXT NOT NULL UNIQUE,
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
db_name TEXT NOT NULL UNIQUE,
|
|
||||||
db_dsn TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
)`); err != nil {
|
|
||||||
t.Fatalf("registry-schema: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
dsnTemplate := strings.Replace(adminDSN, "/postgres?", "/%s?", 1)
|
|
||||||
registry := NewRegistry(registryPool)
|
|
||||||
provisioner := NewProvisioner(adminPool, registry, dsnTemplate)
|
|
||||||
|
|
||||||
t.Cleanup(func() {
|
|
||||||
_, _ = registryPool.Exec(ctx, `DELETE FROM tenants WHERE slug IN ('acme','globex')`)
|
|
||||||
_, _ = adminPool.Exec(ctx, `DROP DATABASE IF EXISTS tenant_acme`)
|
|
||||||
_, _ = adminPool.Exec(ctx, `DROP DATABASE IF EXISTS tenant_globex`)
|
|
||||||
})
|
|
||||||
|
|
||||||
tenantA, err := provisioner.Provision(ctx, "acme", "Acme GmbH")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("provision acme: %v", err)
|
|
||||||
}
|
|
||||||
tenantB, err := provisioner.Provision(ctx, "globex", "Globex AG")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("provision globex: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if tenantA.DBName == tenantB.DBName {
|
|
||||||
t.Fatalf("erwartet unterschiedliche db_name, beide sind %q", tenantA.DBName)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 3 / Pruefung 3: In der Datenbank von Tenant A existiert
|
|
||||||
// keine Verbindungsmoeglichkeit zu Tenant B, weil beide physisch getrennte
|
|
||||||
// Datenbanken sind, statt sich auf einen Query-Filter zu verlassen.
|
|
||||||
poolA, err := pgxpool.New(ctx, tenantA.DBDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("connect tenant a: %v", err)
|
|
||||||
}
|
|
||||||
defer poolA.Close()
|
|
||||||
|
|
||||||
var globexVisible bool
|
|
||||||
err = poolA.QueryRow(ctx, `
|
|
||||||
SELECT EXISTS (
|
|
||||||
SELECT 1 FROM pg_catalog.pg_database WHERE datname = $1
|
|
||||||
)
|
|
||||||
`, tenantB.DBName).Scan(&globexVisible)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("pruefung tenant-trennung: %v", err)
|
|
||||||
}
|
|
||||||
// pg_database ist clusterweit sichtbar (Existenz der DB), aber die
|
|
||||||
// eigentliche Pruefung ist: aus poolA (verbunden mit tenant_acme) ist keine
|
|
||||||
// Tabelle/Zeile aus tenant_globex erreichbar, da current_database() getrennt ist.
|
|
||||||
var currentDB string
|
|
||||||
if err := poolA.QueryRow(ctx, `SELECT current_database()`).Scan(¤tDB); err != nil {
|
|
||||||
t.Fatalf("current_database: %v", err)
|
|
||||||
}
|
|
||||||
if currentDB != tenantA.DBName {
|
|
||||||
t.Fatalf("current_database() = %q, want %q — keine physische Trennung", currentDB, tenantA.DBName)
|
|
||||||
}
|
|
||||||
if currentDB == tenantB.DBName {
|
|
||||||
t.Fatalf("tenant a verbindung zeigt auf tenant b datenbank")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,69 +0,0 @@
|
|||||||
package tenant
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5"
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Registry kapselt den Zugriff auf die Control-Plane-Registry-Datenbank.
|
|
||||||
// Sie enthaelt ausschliesslich Tenant-Metadaten (Akzeptanzkriterium 1) —
|
|
||||||
// niemals Geschaeftsdaten eines Mandanten.
|
|
||||||
type Registry struct {
|
|
||||||
pool *pgxpool.Pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewRegistry(pool *pgxpool.Pool) *Registry {
|
|
||||||
return &Registry{pool: pool}
|
|
||||||
}
|
|
||||||
|
|
||||||
// insertTx schreibt den Tenant-Datensatz innerhalb einer laufenden Transaktion,
|
|
||||||
// damit Provisioner.Provision DB-Anlage und Registrierung atomar behandeln kann.
|
|
||||||
func (r *Registry) insertTx(ctx context.Context, tx pgx.Tx, t Tenant) (Tenant, error) {
|
|
||||||
row := tx.QueryRow(ctx, `
|
|
||||||
INSERT INTO tenants (slug, name, db_name, db_dsn, status)
|
|
||||||
VALUES ($1, $2, $3, $4, $5)
|
|
||||||
RETURNING id, created_at
|
|
||||||
`, t.Slug, t.Name, t.DBName, t.DBDSN, t.Status)
|
|
||||||
|
|
||||||
if err := row.Scan(&t.ID, &t.CreatedAt); err != nil {
|
|
||||||
return Tenant{}, fmt.Errorf("tenant registrieren: %w", err)
|
|
||||||
}
|
|
||||||
return t, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (r *Registry) GetBySlug(ctx context.Context, slug string) (Tenant, error) {
|
|
||||||
var t Tenant
|
|
||||||
row := r.pool.QueryRow(ctx, `
|
|
||||||
SELECT id, slug, name, db_name, db_dsn, status, created_at
|
|
||||||
FROM tenants WHERE slug = $1
|
|
||||||
`, slug)
|
|
||||||
|
|
||||||
if err := row.Scan(&t.ID, &t.Slug, &t.Name, &t.DBName, &t.DBDSN, &t.Status, &t.CreatedAt); err != nil {
|
|
||||||
return Tenant{}, fmt.Errorf("tenant laden: %w", err)
|
|
||||||
}
|
|
||||||
return t, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (r *Registry) List(ctx context.Context) ([]Tenant, error) {
|
|
||||||
rows, err := r.pool.Query(ctx, `
|
|
||||||
SELECT id, slug, name, db_name, db_dsn, status, created_at
|
|
||||||
FROM tenants ORDER BY created_at
|
|
||||||
`)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("tenants auflisten: %w", err)
|
|
||||||
}
|
|
||||||
defer rows.Close()
|
|
||||||
|
|
||||||
var out []Tenant
|
|
||||||
for rows.Next() {
|
|
||||||
var t Tenant
|
|
||||||
if err := rows.Scan(&t.ID, &t.Slug, &t.Name, &t.DBName, &t.DBDSN, &t.Status, &t.CreatedAt); err != nil {
|
|
||||||
return nil, fmt.Errorf("tenant lesen: %w", err)
|
|
||||||
}
|
|
||||||
out = append(out, t)
|
|
||||||
}
|
|
||||||
return out, rows.Err()
|
|
||||||
}
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
// Package tenant implements Core TEN-01: die Control-Plane-Registry und die
|
|
||||||
// Provisioning-Routine fuer physisch getrennte Mandanten-Datenbanken (Modell C).
|
|
||||||
package tenant
|
|
||||||
|
|
||||||
import (
|
|
||||||
"errors"
|
|
||||||
"regexp"
|
|
||||||
"time"
|
|
||||||
)
|
|
||||||
|
|
||||||
type Status string
|
|
||||||
|
|
||||||
const (
|
|
||||||
StatusActive Status = "active"
|
|
||||||
)
|
|
||||||
|
|
||||||
type Tenant struct {
|
|
||||||
ID string
|
|
||||||
Slug string
|
|
||||||
Name string
|
|
||||||
DBName string
|
|
||||||
DBDSN string
|
|
||||||
Status Status
|
|
||||||
CreatedAt time.Time
|
|
||||||
}
|
|
||||||
|
|
||||||
// slugPattern erzwingt sichere, als SQL-Identifier verwendbare Slugs, damit
|
|
||||||
// der Datenbankname niemals aus unkontrolliertem Nutzereingabe-Text gebaut wird.
|
|
||||||
var slugPattern = regexp.MustCompile(`^[a-z][a-z0-9_]{1,48}$`)
|
|
||||||
|
|
||||||
var ErrInvalidSlug = errors.New("tenant: slug muss mit Kleinbuchstaben beginnen und darf nur [a-z0-9_] enthalten (2-49 Zeichen)")
|
|
||||||
|
|
||||||
func ValidateSlug(slug string) error {
|
|
||||||
if !slugPattern.MatchString(slug) {
|
|
||||||
return ErrInvalidSlug
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func dbNameForSlug(slug string) string {
|
|
||||||
return "tenant_" + slug
|
|
||||||
}
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
package tenant
|
|
||||||
|
|
||||||
import "testing"
|
|
||||||
|
|
||||||
func TestValidateSlug(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
slug string
|
|
||||||
wantErr bool
|
|
||||||
}{
|
|
||||||
{"acme", false},
|
|
||||||
{"acme_gmbh", false},
|
|
||||||
{"a1", false},
|
|
||||||
{"", true},
|
|
||||||
{"a", true},
|
|
||||||
{"1acme", true},
|
|
||||||
{"Acme", true},
|
|
||||||
{"acme-gmbh", true},
|
|
||||||
{"acme;drop table tenants", true},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, c := range cases {
|
|
||||||
err := ValidateSlug(c.slug)
|
|
||||||
if (err != nil) != c.wantErr {
|
|
||||||
t.Errorf("ValidateSlug(%q) error = %v, wantErr %v", c.slug, err, c.wantErr)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestDBNameForSlug(t *testing.T) {
|
|
||||||
got := dbNameForSlug("acme")
|
|
||||||
want := "tenant_acme"
|
|
||||||
if got != want {
|
|
||||||
t.Errorf("dbNameForSlug() = %q, want %q", got, want)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,66 +0,0 @@
|
|||||||
package user
|
|
||||||
|
|
||||||
import (
|
|
||||||
"encoding/json"
|
|
||||||
"errors"
|
|
||||||
"net/http"
|
|
||||||
)
|
|
||||||
|
|
||||||
// Handler stellt die CRUD-API fuer Benutzerkonten bereit (IAM-01-Auftrag).
|
|
||||||
// Auth/Sessions (IAM-02) und Rollen (RBAC-01) sind ausdruecklich nicht Teil
|
|
||||||
// dieser Kachel und daher hier noch nicht angebunden.
|
|
||||||
type Handler struct {
|
|
||||||
users *TenantUserStore
|
|
||||||
superadmins *SuperadminStore
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewHandler(users *TenantUserStore, superadmins *SuperadminStore) *Handler {
|
|
||||||
return &Handler{users: users, superadmins: superadmins}
|
|
||||||
}
|
|
||||||
|
|
||||||
type createUserRequest struct {
|
|
||||||
Email string `json:"email"`
|
|
||||||
Name string `json:"name"`
|
|
||||||
}
|
|
||||||
|
|
||||||
func (h *Handler) CreateUser(w http.ResponseWriter, r *http.Request) {
|
|
||||||
var req createUserRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
u, err := h.users.Create(r.Context(), req.Email, req.Name)
|
|
||||||
writeUserResult(w, u, err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// CreateSuperadmin legt ein mandantenuebergreifendes Superadmin-Konto an —
|
|
||||||
// bewusst ein eigener Endpunkt statt eines Tenant-Parameters mit Null-Wert.
|
|
||||||
func (h *Handler) CreateSuperadmin(w http.ResponseWriter, r *http.Request) {
|
|
||||||
var req createUserRequest
|
|
||||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
|
||||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
u, err := h.superadmins.Create(r.Context(), req.Email, req.Name)
|
|
||||||
writeUserResult(w, u, err)
|
|
||||||
}
|
|
||||||
|
|
||||||
func writeUserResult(w http.ResponseWriter, u User, err error) {
|
|
||||||
if err != nil {
|
|
||||||
switch {
|
|
||||||
case errors.Is(err, ErrInvalidEmail), errors.Is(err, ErrEmailTaken):
|
|
||||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
||||||
case errors.Is(err, ErrNotFound):
|
|
||||||
http.Error(w, err.Error(), http.StatusNotFound)
|
|
||||||
default:
|
|
||||||
http.Error(w, "benutzer konnte nicht verarbeitet werden", http.StatusInternalServerError)
|
|
||||||
}
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
w.Header().Set("Content-Type", "application/json")
|
|
||||||
w.WriteHeader(http.StatusCreated)
|
|
||||||
_ = json.NewEncoder(w).Encode(u)
|
|
||||||
}
|
|
||||||
@@ -1,173 +0,0 @@
|
|||||||
package user
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
// setupTestDB legt eine frische, isolierte Testdatenbank an, wendet die
|
|
||||||
// uebergebene Migration an und liefert einen verbundenen Pool. Wird ohne
|
|
||||||
// TEST_ADMIN_DSN uebersprungen — siehe internal/tenant/provisioner_test.go
|
|
||||||
// fuer dasselbe Muster.
|
|
||||||
func setupTestDB(t *testing.T, dbName, schemaSQL string) *pgxpool.Pool {
|
|
||||||
t.Helper()
|
|
||||||
|
|
||||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
|
||||||
if adminDSN == "" {
|
|
||||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
|
||||||
}
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("admin pool: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
if _, err := adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
|
||||||
t.Fatalf("testdatenbank anlegen: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
dsn := strings.Replace(adminDSN, "/postgres?", "/"+dbName+"?", 1)
|
|
||||||
pool, err := pgxpool.New(ctx, dsn)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("connect testdatenbank: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, err := pool.Exec(ctx, schemaSQL); err != nil {
|
|
||||||
t.Fatalf("schema anwenden: %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
t.Cleanup(func() {
|
|
||||||
pool.Close()
|
|
||||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
|
||||||
adminPool.Close()
|
|
||||||
})
|
|
||||||
|
|
||||||
return pool
|
|
||||||
}
|
|
||||||
|
|
||||||
const usersSchema = `
|
|
||||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
||||||
CREATE TABLE users (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
email TEXT NOT NULL UNIQUE,
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);`
|
|
||||||
|
|
||||||
const superadminsSchema = `
|
|
||||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
||||||
CREATE TABLE superadmins (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
email TEXT NOT NULL UNIQUE,
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);`
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 1 + 3, Pruefung 1 (inkl. Negativfall doppelte E-Mail).
|
|
||||||
func TestTenantUserStore_CRUD(t *testing.T) {
|
|
||||||
pool := setupTestDB(t, "test_iam01_users", usersSchema)
|
|
||||||
store := NewTenantUserStore(pool)
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
created, err := store.Create(ctx, "alice@example.com", "Alice")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("create: %v", err)
|
|
||||||
}
|
|
||||||
if created.Status != StatusActive {
|
|
||||||
t.Fatalf("erwartet status active, hat %q", created.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
got, err := store.Get(ctx, created.ID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("get: %v", err)
|
|
||||||
}
|
|
||||||
if got.Email != "alice@example.com" {
|
|
||||||
t.Fatalf("get email = %q", got.Email)
|
|
||||||
}
|
|
||||||
|
|
||||||
updated, err := store.Update(ctx, created.ID, "", "Alice A.")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("update: %v", err)
|
|
||||||
}
|
|
||||||
if updated.Name != "Alice A." || updated.Email != "alice@example.com" {
|
|
||||||
t.Fatalf("update ergebnis unerwartet: %+v", updated)
|
|
||||||
}
|
|
||||||
|
|
||||||
list, err := store.List(ctx)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("list: %v", err)
|
|
||||||
}
|
|
||||||
if len(list) != 1 {
|
|
||||||
t.Fatalf("erwartet 1 benutzer, habe %d", len(list))
|
|
||||||
}
|
|
||||||
|
|
||||||
deactivated, err := store.Deactivate(ctx, created.ID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("deactivate: %v", err)
|
|
||||||
}
|
|
||||||
if deactivated.Status != StatusInactive {
|
|
||||||
t.Fatalf("erwartet status inactive, hat %q", deactivated.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Negativfall: doppelte E-Mail-Adresse.
|
|
||||||
if _, err := store.Create(ctx, "second@example.com", "Bob"); err != nil {
|
|
||||||
t.Fatalf("create second: %v", err)
|
|
||||||
}
|
|
||||||
if _, err := store.Create(ctx, "second@example.com", "Bob Zwei"); !errors.Is(err, ErrEmailTaken) {
|
|
||||||
t.Fatalf("erwartet ErrEmailTaken, habe %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Negativfall: fehlender Benutzer.
|
|
||||||
if _, err := store.Get(ctx, created.ID+"-nicht-vorhanden"); err == nil {
|
|
||||||
t.Fatalf("erwartet fehler bei unbekannter/ungueltiger id")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Akzeptanzkriterium 2 + Pruefung 2: Superadmin-Anlage ohne Tenant-Kontext.
|
|
||||||
// SuperadminStore.Create hat keinen Tenant-Parameter — es gibt syntaktisch
|
|
||||||
// keine Moeglichkeit, hier versehentlich einen Tenant-Sonderfall zu vergessen.
|
|
||||||
func TestSuperadminStore_CreateWithoutTenantContext(t *testing.T) {
|
|
||||||
pool := setupTestDB(t, "test_iam01_superadmins", superadminsSchema)
|
|
||||||
store := NewSuperadminStore(pool)
|
|
||||||
ctx := context.Background()
|
|
||||||
|
|
||||||
created, err := store.Create(ctx, "root@nexarch.internal", "Root")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("create superadmin: %v", err)
|
|
||||||
}
|
|
||||||
if created.Status != StatusActive {
|
|
||||||
t.Fatalf("erwartet status active, hat %q", created.Status)
|
|
||||||
}
|
|
||||||
|
|
||||||
got, err := store.Get(ctx, created.ID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("get: %v", err)
|
|
||||||
}
|
|
||||||
if got.Email != "root@nexarch.internal" {
|
|
||||||
t.Fatalf("get email = %q", got.Email)
|
|
||||||
}
|
|
||||||
|
|
||||||
if _, err := store.Create(ctx, "root@nexarch.internal", "Root Zwei"); !errors.Is(err, ErrEmailTaken) {
|
|
||||||
t.Fatalf("erwartet ErrEmailTaken (globale eindeutigkeit), habe %v", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
deactivated, err := store.Deactivate(ctx, created.ID)
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("deactivate: %v", err)
|
|
||||||
}
|
|
||||||
if deactivated.Status != StatusInactive {
|
|
||||||
t.Fatalf("erwartet status inactive, hat %q", deactivated.Status)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,77 +0,0 @@
|
|||||||
package user
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
// SuperadminStore verwaltet mandantenuebergreifende Superadmin-Konten in der
|
|
||||||
// Control-Plane-Registry (siehe internal/tenant.Registry). Superadmin-ohne-
|
|
||||||
// Tenant ist dadurch ein eigener Typ statt eines Sonderfalls von User/
|
|
||||||
// TenantUserStore — es gibt keinen Tenant-Parameter, den man weglassen
|
|
||||||
// koennte (IAM-01, "ohne Sonderbehandlung im Code").
|
|
||||||
type SuperadminStore struct {
|
|
||||||
pool *pgxpool.Pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewSuperadminStore(pool *pgxpool.Pool) *SuperadminStore {
|
|
||||||
return &SuperadminStore{pool: pool}
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *SuperadminStore) Create(ctx context.Context, email, name string) (User, error) {
|
|
||||||
if err := ValidateEmail(email); err != nil {
|
|
||||||
return User{}, err
|
|
||||||
}
|
|
||||||
|
|
||||||
var u User
|
|
||||||
u.Email, u.Name, u.Status = email, name, StatusActive
|
|
||||||
|
|
||||||
row := s.pool.QueryRow(ctx, `
|
|
||||||
INSERT INTO superadmins (email, name, status)
|
|
||||||
VALUES ($1, $2, $3)
|
|
||||||
RETURNING id, created_at, updated_at
|
|
||||||
`, u.Email, u.Name, u.Status)
|
|
||||||
|
|
||||||
if err := row.Scan(&u.ID, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
|
||||||
return User{}, mapWriteErr(err)
|
|
||||||
}
|
|
||||||
return u, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *SuperadminStore) Get(ctx context.Context, id string) (User, error) {
|
|
||||||
return scanUser(s.pool.QueryRow(ctx, `
|
|
||||||
SELECT id, email, name, status, created_at, updated_at
|
|
||||||
FROM superadmins WHERE id = $1
|
|
||||||
`, id))
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *SuperadminStore) List(ctx context.Context) ([]User, error) {
|
|
||||||
rows, err := s.pool.Query(ctx, `
|
|
||||||
SELECT id, email, name, status, created_at, updated_at
|
|
||||||
FROM superadmins ORDER BY created_at
|
|
||||||
`)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("superadmins auflisten: %w", err)
|
|
||||||
}
|
|
||||||
defer rows.Close()
|
|
||||||
|
|
||||||
var out []User
|
|
||||||
for rows.Next() {
|
|
||||||
var u User
|
|
||||||
if err := rows.Scan(&u.ID, &u.Email, &u.Name, &u.Status, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
|
||||||
return nil, fmt.Errorf("superadmin lesen: %w", err)
|
|
||||||
}
|
|
||||||
out = append(out, u)
|
|
||||||
}
|
|
||||||
return out, rows.Err()
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *SuperadminStore) Deactivate(ctx context.Context, id string) (User, error) {
|
|
||||||
return scanUser(s.pool.QueryRow(ctx, `
|
|
||||||
UPDATE superadmins SET status = $2, updated_at = now()
|
|
||||||
WHERE id = $1
|
|
||||||
RETURNING id, email, name, status, created_at, updated_at
|
|
||||||
`, id, StatusInactive))
|
|
||||||
}
|
|
||||||
@@ -1,173 +0,0 @@
|
|||||||
package user
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/jackc/pgx/v5"
|
|
||||||
"github.com/jackc/pgx/v5/pgconn"
|
|
||||||
"github.com/jackc/pgx/v5/pgxpool"
|
|
||||||
)
|
|
||||||
|
|
||||||
// TenantUserStore verwaltet Benutzer innerhalb GENAU EINER Tenant-Datenbank.
|
|
||||||
// Welcher Mandant gemeint ist, ergibt sich ausschliesslich aus dem
|
|
||||||
// uebergebenen Pool — es gibt keine tenant_id-Spalte (siehe migrations/tenant/0001_users.up.sql).
|
|
||||||
type TenantUserStore struct {
|
|
||||||
pool *pgxpool.Pool
|
|
||||||
}
|
|
||||||
|
|
||||||
func NewTenantUserStore(pool *pgxpool.Pool) *TenantUserStore {
|
|
||||||
return &TenantUserStore{pool: pool}
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *TenantUserStore) Create(ctx context.Context, email, name string) (User, error) {
|
|
||||||
if err := ValidateEmail(email); err != nil {
|
|
||||||
return User{}, err
|
|
||||||
}
|
|
||||||
|
|
||||||
var u User
|
|
||||||
u.Email, u.Name, u.Status = email, name, StatusActive
|
|
||||||
|
|
||||||
row := s.pool.QueryRow(ctx, `
|
|
||||||
INSERT INTO users (email, name, status)
|
|
||||||
VALUES ($1, $2, $3)
|
|
||||||
RETURNING id, created_at, updated_at
|
|
||||||
`, u.Email, u.Name, u.Status)
|
|
||||||
|
|
||||||
if err := row.Scan(&u.ID, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
|
||||||
return User{}, mapWriteErr(err)
|
|
||||||
}
|
|
||||||
return u, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *TenantUserStore) Get(ctx context.Context, id string) (User, error) {
|
|
||||||
return scanUser(s.pool.QueryRow(ctx, `
|
|
||||||
SELECT id, email, name, status, created_at, updated_at
|
|
||||||
FROM users WHERE id = $1
|
|
||||||
`, id))
|
|
||||||
}
|
|
||||||
|
|
||||||
func (s *TenantUserStore) List(ctx context.Context) ([]User, error) {
|
|
||||||
rows, err := s.pool.Query(ctx, `
|
|
||||||
SELECT id, email, name, status, created_at, updated_at
|
|
||||||
FROM users ORDER BY created_at
|
|
||||||
`)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("benutzer auflisten: %w", err)
|
|
||||||
}
|
|
||||||
defer rows.Close()
|
|
||||||
|
|
||||||
var out []User
|
|
||||||
for rows.Next() {
|
|
||||||
var u User
|
|
||||||
if err := rows.Scan(&u.ID, &u.Email, &u.Name, &u.Status, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
|
||||||
return nil, fmt.Errorf("benutzer lesen: %w", err)
|
|
||||||
}
|
|
||||||
out = append(out, u)
|
|
||||||
}
|
|
||||||
return out, rows.Err()
|
|
||||||
}
|
|
||||||
|
|
||||||
// Update aendert Name und E-Mail. Eine leere email/name laesst das jeweilige
|
|
||||||
// Feld unveraendert.
|
|
||||||
func (s *TenantUserStore) Update(ctx context.Context, id, email, name string) (User, error) {
|
|
||||||
if email != "" {
|
|
||||||
if err := ValidateEmail(email); err != nil {
|
|
||||||
return User{}, err
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
row := s.pool.QueryRow(ctx, `
|
|
||||||
UPDATE users
|
|
||||||
SET email = COALESCE(NULLIF($2, ''), email),
|
|
||||||
name = COALESCE(NULLIF($3, ''), name),
|
|
||||||
updated_at = now()
|
|
||||||
WHERE id = $1
|
|
||||||
RETURNING id, email, name, status, created_at, updated_at
|
|
||||||
`, id, email, name)
|
|
||||||
|
|
||||||
u, err := scanUser(row)
|
|
||||||
if err != nil {
|
|
||||||
return User{}, mapWriteErr(err)
|
|
||||||
}
|
|
||||||
return u, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Deactivate setzt den Benutzer auf inaktiv statt ihn zu loeschen.
|
|
||||||
func (s *TenantUserStore) Deactivate(ctx context.Context, id string) (User, error) {
|
|
||||||
return scanUser(s.pool.QueryRow(ctx, `
|
|
||||||
UPDATE users SET status = $2, updated_at = now()
|
|
||||||
WHERE id = $1
|
|
||||||
RETURNING id, email, name, status, created_at, updated_at
|
|
||||||
`, id, StatusInactive))
|
|
||||||
}
|
|
||||||
|
|
||||||
// SetPasswordHash schreibt einen bereits berechneten bcrypt-Hash (siehe
|
|
||||||
// internal/auth, IAM-02). Der Store selbst kennt kein Klartext-Passwort.
|
|
||||||
func (s *TenantUserStore) SetPasswordHash(ctx context.Context, id, hash string) error {
|
|
||||||
tag, err := s.pool.Exec(ctx, `
|
|
||||||
UPDATE users SET password_hash = $2, updated_at = now() WHERE id = $1
|
|
||||||
`, id, hash)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("passwort setzen: %w", err)
|
|
||||||
}
|
|
||||||
if tag.RowsAffected() == 0 {
|
|
||||||
return ErrNotFound
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// AuthCredentials wird ausschliesslich fuer den Login-Pfad (internal/auth)
|
|
||||||
// verwendet und traegt bewusst den password_hash, damit er nicht ueber den
|
|
||||||
// regulaeren User-Typ/JSON-Serialisierungspfad nach aussen dringen kann.
|
|
||||||
type AuthCredentials struct {
|
|
||||||
User User
|
|
||||||
PasswordHash string
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetByEmailForAuth liefert Benutzer + Passwort-Hash zu einer E-Mail-Adresse
|
|
||||||
// aus GENAU DIESER Tenant-Datenbank — der Tenant-Scope ergibt sich damit
|
|
||||||
// zwingend aus dem verwendeten Pool, es gibt keine Moeglichkeit, versehentlich
|
|
||||||
// ueber Tenant-Grenzen hinweg zu suchen (bekannter archivmail-Fehler, siehe
|
|
||||||
// IAM-02 "Bekannte Fehler vermeiden").
|
|
||||||
func (s *TenantUserStore) GetByEmailForAuth(ctx context.Context, email string) (AuthCredentials, error) {
|
|
||||||
var c AuthCredentials
|
|
||||||
row := s.pool.QueryRow(ctx, `
|
|
||||||
SELECT id, email, name, status, created_at, updated_at, password_hash
|
|
||||||
FROM users WHERE email = $1
|
|
||||||
`, email)
|
|
||||||
|
|
||||||
if err := row.Scan(&c.User.ID, &c.User.Email, &c.User.Name, &c.User.Status,
|
|
||||||
&c.User.CreatedAt, &c.User.UpdatedAt, &c.PasswordHash); err != nil {
|
|
||||||
if errors.Is(err, pgx.ErrNoRows) {
|
|
||||||
return AuthCredentials{}, ErrNotFound
|
|
||||||
}
|
|
||||||
return AuthCredentials{}, fmt.Errorf("anmeldedaten lesen: %w", err)
|
|
||||||
}
|
|
||||||
return c, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func scanUser(row pgx.Row) (User, error) {
|
|
||||||
var u User
|
|
||||||
if err := row.Scan(&u.ID, &u.Email, &u.Name, &u.Status, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
|
||||||
if errors.Is(err, pgx.ErrNoRows) {
|
|
||||||
return User{}, ErrNotFound
|
|
||||||
}
|
|
||||||
return User{}, fmt.Errorf("benutzer lesen: %w", err)
|
|
||||||
}
|
|
||||||
return u, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// mapWriteErr uebersetzt den Unique-Constraint-Verstoss der E-Mail-Spalte in
|
|
||||||
// einen sprechenden Fehler statt der rohen Postgres-Fehlermeldung.
|
|
||||||
func mapWriteErr(err error) error {
|
|
||||||
var pgErr *pgconn.PgError
|
|
||||||
if errors.As(err, &pgErr) && pgErr.Code == "23505" {
|
|
||||||
return ErrEmailTaken
|
|
||||||
}
|
|
||||||
if errors.Is(err, pgx.ErrNoRows) {
|
|
||||||
return ErrNotFound
|
|
||||||
}
|
|
||||||
return fmt.Errorf("benutzer schreiben: %w", err)
|
|
||||||
}
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
// Package user implementiert Core IAM-01: das Benutzer-Datenmodell und die
|
|
||||||
// CRUD-Operationen. Tenant-Zugehoerigkeit ist ueber die Zieldatenbank
|
|
||||||
// gegeben (Modell C, siehe internal/tenant) — Superadmin-Konten leben
|
|
||||||
// dagegen mandantenuebergreifend in der Registry und sind ueber
|
|
||||||
// SuperadminStore als eigener, First-Class-Typ modelliert, nicht als
|
|
||||||
// tenant_id-NULL-Sonderfall in User.
|
|
||||||
package user
|
|
||||||
|
|
||||||
import (
|
|
||||||
"errors"
|
|
||||||
"regexp"
|
|
||||||
"time"
|
|
||||||
)
|
|
||||||
|
|
||||||
type Status string
|
|
||||||
|
|
||||||
const (
|
|
||||||
StatusActive Status = "active"
|
|
||||||
StatusInactive Status = "inactive"
|
|
||||||
)
|
|
||||||
|
|
||||||
type User struct {
|
|
||||||
ID string
|
|
||||||
Email string
|
|
||||||
Name string
|
|
||||||
Status Status
|
|
||||||
CreatedAt time.Time
|
|
||||||
UpdatedAt time.Time
|
|
||||||
}
|
|
||||||
|
|
||||||
var emailPattern = regexp.MustCompile(`^[^\s@]+@[^\s@]+\.[^\s@]+$`)
|
|
||||||
|
|
||||||
var ErrInvalidEmail = errors.New("user: ungueltige E-Mail-Adresse")
|
|
||||||
var ErrEmailTaken = errors.New("user: E-Mail-Adresse bereits vergeben")
|
|
||||||
var ErrNotFound = errors.New("user: nicht gefunden")
|
|
||||||
|
|
||||||
func ValidateEmail(email string) error {
|
|
||||||
if !emailPattern.MatchString(email) {
|
|
||||||
return ErrInvalidEmail
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
package user
|
|
||||||
|
|
||||||
import "testing"
|
|
||||||
|
|
||||||
func TestValidateEmail(t *testing.T) {
|
|
||||||
cases := []struct {
|
|
||||||
email string
|
|
||||||
wantErr bool
|
|
||||||
}{
|
|
||||||
{"a@b.de", false},
|
|
||||||
{"a.b+c@sub.example.com", false},
|
|
||||||
{"", true},
|
|
||||||
{"keine-email", true},
|
|
||||||
{"a@b", true},
|
|
||||||
{"@b.de", true},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, c := range cases {
|
|
||||||
err := ValidateEmail(c.email)
|
|
||||||
if (err != nil) != c.wantErr {
|
|
||||||
t.Errorf("ValidateEmail(%q) error = %v, wantErr %v", c.email, err, c.wantErr)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
DROP TABLE IF EXISTS tenants;
|
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
-- Control-plane registry: tenant list + connection info (Modell C).
|
||||||
|
-- Core TEN-01 (siehe core-kanban).
|
||||||
|
CREATE TABLE tenants (
|
||||||
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||||
|
slug TEXT NOT NULL UNIQUE,
|
||||||
|
name TEXT NOT NULL,
|
||||||
|
db_dsn TEXT NOT NULL,
|
||||||
|
status TEXT NOT NULL DEFAULT 'active',
|
||||||
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||||
|
);
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
-- Control-plane registry: Tenant-Liste + Verbindungsinformationen (Modell C).
|
|
||||||
-- Enthaelt AUSSCHLIESSLICH Tenant-Metadaten, keine Geschaeftsdaten eines Mandanten.
|
|
||||||
-- Core TEN-01 (siehe core-kanban/tickets/TEN-01.md).
|
|
||||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
||||||
|
|
||||||
CREATE TABLE tenants (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
slug TEXT NOT NULL UNIQUE,
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
db_name TEXT NOT NULL UNIQUE,
|
|
||||||
db_dsn TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
DROP TABLE IF EXISTS superadmins;
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
-- Superadmin-Konten arbeiten mandantenuebergreifend und leben deshalb in der
|
|
||||||
-- Control-Plane-Registry (siehe TEN-01), nicht in einer Tenant-Datenbank.
|
|
||||||
-- Das bildet "Superadmin ohne Tenant" strukturell als First-Class-Zustand ab,
|
|
||||||
-- statt ihn als Sonderfall in der Tenant-users-Tabelle zu behandeln
|
|
||||||
-- (IAM-01, siehe core-kanban/tickets/IAM-01.md — bekannte Fehler vermeiden).
|
|
||||||
-- E-Mail-Eindeutigkeit ist hier global, da die Registry-DB einmalig existiert.
|
|
||||||
CREATE TABLE superadmins (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
email TEXT NOT NULL UNIQUE,
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
DROP TABLE IF EXISTS policy_rule_changes;
|
|
||||||
DROP TABLE IF EXISTS policy_rules;
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
-- Zentrale, deklarative Policy-Regeln (RBAC-02, siehe core-kanban/tickets/RBAC-02.md).
|
|
||||||
-- policy_rules haelt den AKTUELLEN, gewaehrten Regelsatz (Existenz = erlaubt,
|
|
||||||
-- Default-Deny fuer alles ohne Zeile). policy_rule_changes ist die
|
|
||||||
-- versionierte Aenderungshistorie (Akzeptanzkriterium 3: Regelwechsel ohne
|
|
||||||
-- Codeaenderung nachvollziehbar).
|
|
||||||
CREATE TABLE policy_rules (
|
|
||||||
role TEXT NOT NULL,
|
|
||||||
permission TEXT NOT NULL,
|
|
||||||
granted_by TEXT NOT NULL,
|
|
||||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
PRIMARY KEY (role, permission)
|
|
||||||
);
|
|
||||||
|
|
||||||
CREATE TABLE policy_rule_changes (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
role TEXT NOT NULL,
|
|
||||||
permission TEXT NOT NULL,
|
|
||||||
action TEXT NOT NULL CHECK (action IN ('grant', 'revoke')),
|
|
||||||
actor TEXT NOT NULL,
|
|
||||||
version INT NOT NULL,
|
|
||||||
changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
|
|
||||||
CREATE INDEX policy_rule_changes_idx ON policy_rule_changes (role, permission, version);
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
DROP TABLE IF EXISTS users;
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
-- Benutzer-Datenmodell (IAM-01, siehe core-kanban/tickets/IAM-01.md).
|
|
||||||
-- Diese Migration laeuft in der DB EINES Mandanten (Modell C, siehe TEN-01) —
|
|
||||||
-- die Tenant-Zugehoerigkeit ist implizit durch die Datenbankverbindung
|
|
||||||
-- gegeben, es gibt daher bewusst KEINE tenant_id-Spalte.
|
|
||||||
-- E-Mail-Eindeutigkeit ist hier tenant-scoped: der UNIQUE-Constraint gilt
|
|
||||||
-- nur innerhalb dieser einen Tenant-Datenbank.
|
|
||||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
||||||
|
|
||||||
CREATE TABLE users (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
email TEXT NOT NULL UNIQUE,
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
status TEXT NOT NULL DEFAULT 'active',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
DROP TABLE IF EXISTS role_assignment_history;
|
|
||||||
DROP TABLE IF EXISTS role_assignments;
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
-- Rollenzuweisung pro Benutzer (RBAC-01, siehe core-kanban/tickets/RBAC-01.md).
|
|
||||||
-- Nur 'user' und 'tenant_admin' sind hier zuweisbar — 'superadmin' lebt
|
|
||||||
-- mandantenuebergreifend in der Registry (IAM-01 SuperadminStore) und hat
|
|
||||||
-- daher bewusst KEINE Zeile in dieser tenant-lokalen Tabelle (Akzeptanz-
|
|
||||||
-- kriterium 1: nur Zuweisungen innerhalb der erlaubten Matrix).
|
|
||||||
CREATE TABLE role_assignments (
|
|
||||||
user_id UUID PRIMARY KEY REFERENCES users(id),
|
|
||||||
role TEXT NOT NULL CHECK (role IN ('user', 'tenant_admin')),
|
|
||||||
granted_by TEXT NOT NULL,
|
|
||||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
|
|
||||||
-- Vollstaendige Historie jeder Rollenaenderung (Akzeptanzkriterium 3: wer
|
|
||||||
-- hat wann welche Rolle vergeben).
|
|
||||||
CREATE TABLE role_assignment_history (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
user_id UUID NOT NULL,
|
|
||||||
role TEXT NOT NULL,
|
|
||||||
granted_by TEXT NOT NULL,
|
|
||||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
|
|
||||||
CREATE INDEX role_assignment_history_user_idx ON role_assignment_history (user_id, granted_at);
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
ALTER TABLE users DROP COLUMN password_hash;
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
-- Passwort-Hash-Spalte fuer Login (IAM-02, siehe core-kanban/tickets/IAM-02.md).
|
|
||||||
-- Enthaelt AUSSCHLIESSLICH den bcrypt-Hash, niemals das Klartext-Passwort.
|
|
||||||
ALTER TABLE users ADD COLUMN password_hash TEXT NOT NULL DEFAULT '';
|
|
||||||
@@ -1,2 +0,0 @@
|
|||||||
DROP TABLE IF EXISTS group_members;
|
|
||||||
DROP TABLE IF EXISTS groups;
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
-- Gruppen/Abteilungen mit Rollenzuweisung auf Gruppenebene (RBAC-03, siehe
|
|
||||||
-- core-kanban/tickets/RBAC-03.md). Lebt in der Tenant-Datenbank (Modell C) —
|
|
||||||
-- Gruppen sind implizit tenant-isoliert, da jede Tenant-DB ihre eigenen hat.
|
|
||||||
CREATE TABLE groups (
|
|
||||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
||||||
name TEXT NOT NULL,
|
|
||||||
role TEXT CHECK (role IN ('user', 'tenant_admin')),
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
||||||
);
|
|
||||||
|
|
||||||
-- ON DELETE CASCADE: Loeschen einer Gruppe entzieht die gruppenbasierten
|
|
||||||
-- Rechte automatisch, ohne Benutzerkonten selbst zu beruehren
|
|
||||||
-- (Akzeptanzkriterium 3).
|
|
||||||
CREATE TABLE group_members (
|
|
||||||
group_id UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
|
|
||||||
user_id UUID NOT NULL REFERENCES users(id),
|
|
||||||
added_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
||||||
PRIMARY KEY (group_id, user_id)
|
|
||||||
);
|
|
||||||
|
|
||||||
CREATE INDEX group_members_user_idx ON group_members (user_id);
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# Setzt die nexarch-Testumgebung zurueck: loescht die geteilte
|
|
||||||
# Registry-Tabelle "tenants" in der postgres-Wartungsdatenbank sowie alle
|
|
||||||
# tenant_*-Datenbanken. Noetig, weil verschiedene Feature-Branches
|
|
||||||
# unterschiedliche Registry-Schemata erwarten, aber dieselbe physische
|
|
||||||
# Postgres-Instanz auf dem Testhost teilen (siehe [[project-nexarch-test-infra]]).
|
|
||||||
#
|
|
||||||
# Aufruf: NEXARCH_TEST_DB_PASSWORD=... ./scripts/reset-test-env.sh
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
PASS="${NEXARCH_TEST_DB_PASSWORD:?Setze NEXARCH_TEST_DB_PASSWORD vor dem Aufruf}"
|
|
||||||
ROLE="nexarch_test"
|
|
||||||
|
|
||||||
export PGPASSWORD="$PASS"
|
|
||||||
|
|
||||||
psql -h localhost -U "$ROLE" -d postgres -v ON_ERROR_STOP=1 -c "DROP TABLE IF EXISTS tenants CASCADE;"
|
|
||||||
|
|
||||||
dbs=$(psql -h localhost -U "$ROLE" -d postgres -tAc "SELECT datname FROM pg_database WHERE datname LIKE 'tenant\_%' ESCAPE '\'")
|
|
||||||
for db in $dbs; do
|
|
||||||
psql -h localhost -U "$ROLE" -d postgres -v ON_ERROR_STOP=1 -c "DROP DATABASE IF EXISTS \"${db}\";"
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "Testumgebung zurueckgesetzt: registry-tabelle + $(echo "$dbs" | grep -c . || true) tenant-datenbank(en) entfernt."
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# Ein-Kommando-Pruefung fuer den aktuellen Code-Stand auf dem Testhost:
|
|
||||||
# Registry+Tenant-DBs zuruecksetzen, dann build/vet/test in einem Rutsch.
|
|
||||||
# -p 1 ist Pflicht, da mehrere Pakete dieselbe physische Registry-Tabelle auf
|
|
||||||
# dem Testhost teilen (siehe [[project-nexarch-test-infra]]).
|
|
||||||
#
|
|
||||||
# Aufruf: NEXARCH_TEST_DB_PASSWORD=... ./scripts/run-checks.sh
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
PASS="${NEXARCH_TEST_DB_PASSWORD:?Setze NEXARCH_TEST_DB_PASSWORD vor dem Aufruf}"
|
|
||||||
cd "$(dirname "$0")/.."
|
|
||||||
|
|
||||||
NEXARCH_TEST_DB_PASSWORD="$PASS" bash scripts/reset-test-env.sh
|
|
||||||
|
|
||||||
export TEST_ADMIN_DSN="postgresql://nexarch_test:${PASS}@localhost:5432/postgres?sslmode=disable"
|
|
||||||
|
|
||||||
echo "== go build =="
|
|
||||||
go build ./...
|
|
||||||
|
|
||||||
echo "== go vet =="
|
|
||||||
go vet ./...
|
|
||||||
|
|
||||||
echo "== go test (-p 1) =="
|
|
||||||
go test ./... -p 1 -count=1
|
|
||||||
@@ -1,183 +0,0 @@
|
|||||||
"use client";
|
|
||||||
|
|
||||||
import { useEffect, useState } from "react";
|
|
||||||
import { TextField, SelectField, useToast } from "@nexarch/shl";
|
|
||||||
import {
|
|
||||||
ApiError,
|
|
||||||
Group,
|
|
||||||
Role,
|
|
||||||
addGroupMember,
|
|
||||||
createGroup,
|
|
||||||
fetchGroups,
|
|
||||||
removeGroupMember,
|
|
||||||
setGroupRole,
|
|
||||||
} from "../../lib/api";
|
|
||||||
|
|
||||||
export default function GroupsPage() {
|
|
||||||
const { push } = useToast();
|
|
||||||
const [groups, setGroups] = useState<Group[]>([]);
|
|
||||||
const [loadError, setLoadError] = useState<string | null>(null);
|
|
||||||
|
|
||||||
const reload = () =>
|
|
||||||
fetchGroups()
|
|
||||||
.then(setGroups)
|
|
||||||
.catch(() => setLoadError("Gruppen konnten nicht geladen werden. Sind Sie als Tenant-Admin angemeldet?"));
|
|
||||||
|
|
||||||
useEffect(() => {
|
|
||||||
reload();
|
|
||||||
}, []);
|
|
||||||
|
|
||||||
const [newGroupName, setNewGroupName] = useState("");
|
|
||||||
const [createError, setCreateError] = useState<string | null>(null);
|
|
||||||
|
|
||||||
async function onCreate(event: React.FormEvent<HTMLFormElement>) {
|
|
||||||
event.preventDefault();
|
|
||||||
setCreateError(null);
|
|
||||||
try {
|
|
||||||
await createGroup(newGroupName);
|
|
||||||
setNewGroupName("");
|
|
||||||
push("Gruppe angelegt.", "success");
|
|
||||||
await reload();
|
|
||||||
} catch (err) {
|
|
||||||
setCreateError(err instanceof ApiError ? err.message : "Gruppe konnte nicht angelegt werden.");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (loadError) {
|
|
||||||
return (
|
|
||||||
<main style={{ maxWidth: 640, margin: "40px auto", padding: "0 16px" }}>
|
|
||||||
<p role="alert">{loadError}</p>
|
|
||||||
</main>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
return (
|
|
||||||
<main style={{ maxWidth: 640, margin: "40px auto", padding: "0 16px" }}>
|
|
||||||
<h1>Gruppen & Abteilungen</h1>
|
|
||||||
|
|
||||||
<section aria-labelledby="neue-gruppe-heading">
|
|
||||||
<h2 id="neue-gruppe-heading">Neue Gruppe anlegen</h2>
|
|
||||||
<form onSubmit={onCreate} noValidate>
|
|
||||||
<TextField
|
|
||||||
label="Gruppenname"
|
|
||||||
required
|
|
||||||
value={newGroupName}
|
|
||||||
onChange={(e) => setNewGroupName(e.target.value)}
|
|
||||||
/>
|
|
||||||
{createError && (
|
|
||||||
<p role="alert" style={{ color: "var(--shl-color-danger)" }}>
|
|
||||||
{createError}
|
|
||||||
</p>
|
|
||||||
)}
|
|
||||||
<button type="submit">Anlegen</button>
|
|
||||||
</form>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section aria-labelledby="gruppenliste-heading">
|
|
||||||
<h2 id="gruppenliste-heading">Bestehende Gruppen</h2>
|
|
||||||
{groups.length === 0 ? (
|
|
||||||
<p>Keine Gruppen vorhanden.</p>
|
|
||||||
) : (
|
|
||||||
groups.map((g) => <GroupCard key={g.ID} group={g} onChanged={reload} onNotice={(t) => push(t, "success")} />)
|
|
||||||
)}
|
|
||||||
</section>
|
|
||||||
</main>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
function GroupCard({
|
|
||||||
group,
|
|
||||||
onChanged,
|
|
||||||
onNotice,
|
|
||||||
}: {
|
|
||||||
group: Group;
|
|
||||||
onChanged: () => void;
|
|
||||||
onNotice: (text: string) => void;
|
|
||||||
}) {
|
|
||||||
const [role, setRole] = useState<Role>(group.Role || "user");
|
|
||||||
const [newMemberId, setNewMemberId] = useState("");
|
|
||||||
const [error, setError] = useState<string | null>(null);
|
|
||||||
|
|
||||||
async function onSetRole() {
|
|
||||||
setError(null);
|
|
||||||
try {
|
|
||||||
await setGroupRole(group.ID, role);
|
|
||||||
onNotice("Gruppenrolle gesetzt.");
|
|
||||||
onChanged();
|
|
||||||
} catch (err) {
|
|
||||||
setError(err instanceof ApiError ? err.message : "Gruppenrolle konnte nicht gesetzt werden.");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
async function onAddMember(event: React.FormEvent<HTMLFormElement>) {
|
|
||||||
event.preventDefault();
|
|
||||||
setError(null);
|
|
||||||
try {
|
|
||||||
await addGroupMember(group.ID, newMemberId);
|
|
||||||
setNewMemberId("");
|
|
||||||
onNotice("Mitglied hinzugefügt.");
|
|
||||||
onChanged();
|
|
||||||
} catch (err) {
|
|
||||||
setError(err instanceof ApiError ? err.message : "Mitglied konnte nicht hinzugefügt werden.");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
async function onRemoveMember(userId: string) {
|
|
||||||
setError(null);
|
|
||||||
try {
|
|
||||||
await removeGroupMember(group.ID, userId);
|
|
||||||
onNotice("Mitglied entfernt.");
|
|
||||||
onChanged();
|
|
||||||
} catch (err) {
|
|
||||||
setError(err instanceof ApiError ? err.message : "Mitglied konnte nicht entfernt werden.");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return (
|
|
||||||
<div style={{ border: "1px solid var(--shl-color-border)", borderRadius: 8, padding: 16, marginBottom: 16 }}>
|
|
||||||
<h3>{group.Name}</h3>
|
|
||||||
|
|
||||||
<div style={{ display: "flex", alignItems: "flex-end", gap: 8 }}>
|
|
||||||
<SelectField label="Gruppenrolle" value={role} onChange={(e) => setRole(e.target.value as Role)}>
|
|
||||||
<option value="user">Benutzer</option>
|
|
||||||
<option value="tenant_admin">Tenant-Admin</option>
|
|
||||||
</SelectField>
|
|
||||||
<button type="button" onClick={onSetRole}>
|
|
||||||
Setzen
|
|
||||||
</button>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<h4>Mitglieder</h4>
|
|
||||||
{group.members.length === 0 ? (
|
|
||||||
<p>Keine Mitglieder.</p>
|
|
||||||
) : (
|
|
||||||
<ul>
|
|
||||||
{group.members.map((userId) => (
|
|
||||||
<li key={userId}>
|
|
||||||
{userId}{" "}
|
|
||||||
<button type="button" onClick={() => onRemoveMember(userId)}>
|
|
||||||
Entfernen
|
|
||||||
</button>
|
|
||||||
</li>
|
|
||||||
))}
|
|
||||||
</ul>
|
|
||||||
)}
|
|
||||||
|
|
||||||
<form onSubmit={onAddMember} noValidate>
|
|
||||||
<TextField
|
|
||||||
label="Benutzer-ID hinzufügen"
|
|
||||||
required
|
|
||||||
value={newMemberId}
|
|
||||||
onChange={(e) => setNewMemberId(e.target.value)}
|
|
||||||
/>
|
|
||||||
<button type="submit">Hinzufügen</button>
|
|
||||||
</form>
|
|
||||||
|
|
||||||
{error && (
|
|
||||||
<p role="alert" style={{ color: "var(--shl-color-danger)" }}>
|
|
||||||
{error}
|
|
||||||
</p>
|
|
||||||
)}
|
|
||||||
</div>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
import { ThemeProvider, I18nProvider, ToastProvider, typography } from "@nexarch/shl";
|
|
||||||
|
|
||||||
export const metadata = {
|
|
||||||
title: "NEXARCH Rechteverwaltung",
|
|
||||||
};
|
|
||||||
|
|
||||||
export default function RootLayout({
|
|
||||||
children,
|
|
||||||
}: {
|
|
||||||
children: React.ReactNode;
|
|
||||||
}) {
|
|
||||||
return (
|
|
||||||
<html lang="de">
|
|
||||||
<body
|
|
||||||
style={{
|
|
||||||
fontFamily: typography.fontFamily,
|
|
||||||
margin: 0,
|
|
||||||
background: "var(--shl-color-background, #ffffff)",
|
|
||||||
color: "var(--shl-color-text-primary, #14181f)",
|
|
||||||
}}
|
|
||||||
>
|
|
||||||
<ThemeProvider>
|
|
||||||
<I18nProvider initialLocale="de">
|
|
||||||
<ToastProvider>{children}</ToastProvider>
|
|
||||||
</I18nProvider>
|
|
||||||
</ThemeProvider>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
import { redirect } from "next/navigation";
|
|
||||||
|
|
||||||
export default function IndexPage() {
|
|
||||||
redirect("/roles");
|
|
||||||
}
|
|
||||||
@@ -1,142 +0,0 @@
|
|||||||
"use client";
|
|
||||||
|
|
||||||
import { useEffect, useState } from "react";
|
|
||||||
import { Table, TextField, SelectField, useToast } from "@nexarch/shl";
|
|
||||||
import type { TableColumn } from "@nexarch/shl";
|
|
||||||
import {
|
|
||||||
ApiError,
|
|
||||||
Assignment,
|
|
||||||
Role,
|
|
||||||
RoleInfo,
|
|
||||||
assignRole,
|
|
||||||
fetchRoleHistory,
|
|
||||||
fetchRoles,
|
|
||||||
} from "../../lib/api";
|
|
||||||
|
|
||||||
export default function RolesPage() {
|
|
||||||
const { push } = useToast();
|
|
||||||
const [roles, setRoles] = useState<RoleInfo[] | null>(null);
|
|
||||||
const [loadError, setLoadError] = useState<string | null>(null);
|
|
||||||
|
|
||||||
const [targetUserId, setTargetUserId] = useState("");
|
|
||||||
const [targetRole, setTargetRole] = useState<Role>("user");
|
|
||||||
const [assignError, setAssignError] = useState<string | null>(null);
|
|
||||||
const [submitting, setSubmitting] = useState(false);
|
|
||||||
|
|
||||||
const [historyUserId, setHistoryUserId] = useState("");
|
|
||||||
const [history, setHistory] = useState<Assignment[] | null>(null);
|
|
||||||
|
|
||||||
useEffect(() => {
|
|
||||||
fetchRoles()
|
|
||||||
.then(setRoles)
|
|
||||||
.catch(() => setLoadError("Rollen konnten nicht geladen werden. Sind Sie als Tenant-Admin angemeldet?"));
|
|
||||||
}, []);
|
|
||||||
|
|
||||||
async function onAssign(event: React.FormEvent<HTMLFormElement>) {
|
|
||||||
event.preventDefault();
|
|
||||||
setAssignError(null);
|
|
||||||
setSubmitting(true);
|
|
||||||
try {
|
|
||||||
await assignRole(targetUserId, targetRole);
|
|
||||||
push("Rolle zugewiesen.", "success");
|
|
||||||
} catch (err) {
|
|
||||||
// Akzeptanzkriterium 2: die Backend-Meldung bei Selbst-Eskalation wird
|
|
||||||
// unveraendert angezeigt, keine eigene Interpretation im Frontend.
|
|
||||||
setAssignError(err instanceof ApiError ? err.message : "Rolle konnte nicht zugewiesen werden.");
|
|
||||||
} finally {
|
|
||||||
setSubmitting(false);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
async function onLoadHistory(event: React.FormEvent<HTMLFormElement>) {
|
|
||||||
event.preventDefault();
|
|
||||||
try {
|
|
||||||
setHistory(await fetchRoleHistory(historyUserId));
|
|
||||||
} catch {
|
|
||||||
setHistory([]);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
const historyColumns: TableColumn<Assignment>[] = [
|
|
||||||
{ key: "role", header: "Rolle", render: (a) => a.Role },
|
|
||||||
{ key: "grantedBy", header: "Vergeben von", render: (a) => a.GrantedBy },
|
|
||||||
];
|
|
||||||
|
|
||||||
if (loadError) {
|
|
||||||
return (
|
|
||||||
<main style={{ maxWidth: 640, margin: "40px auto", padding: "0 16px" }}>
|
|
||||||
<p role="alert">{loadError}</p>
|
|
||||||
</main>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
return (
|
|
||||||
<main style={{ maxWidth: 640, margin: "40px auto", padding: "0 16px" }}>
|
|
||||||
<h1>Rollen & Rechte</h1>
|
|
||||||
|
|
||||||
<section aria-labelledby="rollen-heading">
|
|
||||||
<h2 id="rollen-heading">Rollen und Grundrechte</h2>
|
|
||||||
{roles?.map((r) => (
|
|
||||||
<div key={r.role} style={{ marginBottom: 12 }}>
|
|
||||||
<strong>{roleLabel(r.role)}</strong>
|
|
||||||
<ul>
|
|
||||||
{r.permissions.map((p) => (
|
|
||||||
<li key={p}>{p}</li>
|
|
||||||
))}
|
|
||||||
</ul>
|
|
||||||
</div>
|
|
||||||
))}
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section aria-labelledby="zuweisen-heading">
|
|
||||||
<h2 id="zuweisen-heading">Rolle zuweisen</h2>
|
|
||||||
<form onSubmit={onAssign} noValidate>
|
|
||||||
<TextField
|
|
||||||
label="Benutzer-ID"
|
|
||||||
required
|
|
||||||
value={targetUserId}
|
|
||||||
onChange={(e) => setTargetUserId(e.target.value)}
|
|
||||||
/>
|
|
||||||
<SelectField label="Rolle" value={targetRole} onChange={(e) => setTargetRole(e.target.value as Role)}>
|
|
||||||
<option value="user">Benutzer</option>
|
|
||||||
<option value="tenant_admin">Tenant-Admin</option>
|
|
||||||
</SelectField>
|
|
||||||
{assignError && (
|
|
||||||
<p role="alert" style={{ color: "var(--shl-color-danger)" }}>
|
|
||||||
{assignError}
|
|
||||||
</p>
|
|
||||||
)}
|
|
||||||
<button type="submit" disabled={submitting}>
|
|
||||||
{submitting ? "Wird zugewiesen…" : "Zuweisen"}
|
|
||||||
</button>
|
|
||||||
</form>
|
|
||||||
</section>
|
|
||||||
|
|
||||||
<section aria-labelledby="verlauf-heading">
|
|
||||||
<h2 id="verlauf-heading">Nachvollziehbarkeit (Audit-Verlauf)</h2>
|
|
||||||
<p>Zeigt jede Rollenzuweisung eines Benutzers chronologisch — wer wann welche Rolle vergeben hat.</p>
|
|
||||||
<form onSubmit={onLoadHistory} noValidate>
|
|
||||||
<TextField
|
|
||||||
label="Benutzer-ID"
|
|
||||||
required
|
|
||||||
value={historyUserId}
|
|
||||||
onChange={(e) => setHistoryUserId(e.target.value)}
|
|
||||||
/>
|
|
||||||
<button type="submit">Verlauf anzeigen</button>
|
|
||||||
</form>
|
|
||||||
{history && (
|
|
||||||
<Table
|
|
||||||
columns={historyColumns}
|
|
||||||
rows={history}
|
|
||||||
rowKey={(a) => `${a.UserID}-${a.Role}-${a.GrantedBy}`}
|
|
||||||
caption="Rollenzuweisungs-Verlauf"
|
|
||||||
/>
|
|
||||||
)}
|
|
||||||
</section>
|
|
||||||
</main>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
function roleLabel(role: Role): string {
|
|
||||||
return role === "tenant_admin" ? "Tenant-Admin" : "Benutzer";
|
|
||||||
}
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
const API_BASE = process.env.NEXT_PUBLIC_CORE_API_BASE ?? "";
|
|
||||||
|
|
||||||
export class ApiError extends Error {}
|
|
||||||
|
|
||||||
async function req<T>(path: string, init?: RequestInit): Promise<T> {
|
|
||||||
const res = await fetch(`${API_BASE}${path}`, {
|
|
||||||
credentials: "include",
|
|
||||||
headers: init?.body ? { "Content-Type": "application/json" } : undefined,
|
|
||||||
...init,
|
|
||||||
});
|
|
||||||
const data = await res.json().catch(() => ({}));
|
|
||||||
if (!res.ok) {
|
|
||||||
throw new ApiError(data.error ?? data.message ?? "Unbekannter Fehler");
|
|
||||||
}
|
|
||||||
return data as T;
|
|
||||||
}
|
|
||||||
|
|
||||||
export type Role = "user" | "tenant_admin";
|
|
||||||
|
|
||||||
export interface RoleInfo {
|
|
||||||
role: Role;
|
|
||||||
permissions: string[];
|
|
||||||
}
|
|
||||||
|
|
||||||
export function fetchRoles(): Promise<RoleInfo[]> {
|
|
||||||
return req("/rbac/roles");
|
|
||||||
}
|
|
||||||
|
|
||||||
export interface Assignment {
|
|
||||||
UserID: string;
|
|
||||||
Role: Role;
|
|
||||||
GrantedBy: string;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function assignRole(userId: string, role: Role): Promise<Assignment> {
|
|
||||||
return req("/rbac/users/role", { method: "POST", body: JSON.stringify({ user_id: userId, role }) });
|
|
||||||
}
|
|
||||||
|
|
||||||
export function fetchRoleHistory(userId: string): Promise<Assignment[]> {
|
|
||||||
return req(`/rbac/users/${userId}/history`);
|
|
||||||
}
|
|
||||||
|
|
||||||
export interface Group {
|
|
||||||
ID: string;
|
|
||||||
Name: string;
|
|
||||||
Role: Role | "";
|
|
||||||
members: string[];
|
|
||||||
}
|
|
||||||
|
|
||||||
export function fetchGroups(): Promise<Group[]> {
|
|
||||||
return req("/rbac/groups");
|
|
||||||
}
|
|
||||||
|
|
||||||
export function createGroup(name: string): Promise<Group> {
|
|
||||||
return req("/rbac/groups", { method: "POST", body: JSON.stringify({ name }) });
|
|
||||||
}
|
|
||||||
|
|
||||||
export function setGroupRole(groupId: string, role: Role): Promise<void> {
|
|
||||||
return req("/rbac/groups/role", { method: "POST", body: JSON.stringify({ group_id: groupId, role }) });
|
|
||||||
}
|
|
||||||
|
|
||||||
export function addGroupMember(groupId: string, userId: string): Promise<void> {
|
|
||||||
return req("/rbac/groups/members", { method: "POST", body: JSON.stringify({ group_id: groupId, user_id: userId }) });
|
|
||||||
}
|
|
||||||
|
|
||||||
export function removeGroupMember(groupId: string, userId: string): Promise<void> {
|
|
||||||
return req("/rbac/groups/members/remove", { method: "POST", body: JSON.stringify({ group_id: groupId, user_id: userId }) });
|
|
||||||
}
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
/** @type {import('next').NextConfig} */
|
|
||||||
const nextConfig = {
|
|
||||||
transpilePackages: ["@nexarch/shl"],
|
|
||||||
};
|
|
||||||
export default nextConfig;
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
{
|
|
||||||
"name": "nexarch-rbac-admin",
|
|
||||||
"private": true,
|
|
||||||
"scripts": {
|
|
||||||
"dev": "next dev",
|
|
||||||
"build": "next build",
|
|
||||||
"start": "next start",
|
|
||||||
"lint": "next lint"
|
|
||||||
},
|
|
||||||
"dependencies": {
|
|
||||||
"@nexarch/shl": "file:../shl",
|
|
||||||
"next": "14.2.35",
|
|
||||||
"react": "18.3.1",
|
|
||||||
"react-dom": "18.3.1"
|
|
||||||
},
|
|
||||||
"devDependencies": {
|
|
||||||
"@types/node": "20.14.9",
|
|
||||||
"@types/react": "18.3.3",
|
|
||||||
"@types/react-dom": "18.3.0",
|
|
||||||
"typescript": "5.5.3"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
{
|
|
||||||
"compilerOptions": {
|
|
||||||
"target": "ES2017",
|
|
||||||
"lib": ["dom", "dom.iterable", "esnext"],
|
|
||||||
"allowJs": false,
|
|
||||||
"skipLibCheck": true,
|
|
||||||
"strict": true,
|
|
||||||
"noEmit": true,
|
|
||||||
"esModuleInterop": true,
|
|
||||||
"module": "esnext",
|
|
||||||
"moduleResolution": "bundler",
|
|
||||||
"resolveJsonModule": true,
|
|
||||||
"isolatedModules": true,
|
|
||||||
"jsx": "preserve",
|
|
||||||
"incremental": true,
|
|
||||||
"plugins": [{ "name": "next" }],
|
|
||||||
"paths": { "@/*": ["./*"] }
|
|
||||||
},
|
|
||||||
"include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
|
|
||||||
"exclude": ["node_modules"]
|
|
||||||
}
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
# @nexarch/shl — UI-Shell & Design-System (Core SHL-01)
|
|
||||||
|
|
||||||
Gemeinsames Paket für alle NEXARCH-Modul-Frontends (Core, DMS, Mail, Archive, Workflow, AI, Connect).
|
|
||||||
Ein Modul-Frontend importiert ausschließlich über `index.ts`, kopiert keine Komponenten oder Tokens lokal.
|
|
||||||
|
|
||||||
## Enthält
|
|
||||||
|
|
||||||
- **Design-Tokens** (`tokens/tokens.ts`) — Farbe (Hell/Dunkel), Abstand, Typografie. Kontrastwerte gegen WCAG 2.1 AA geprüft (siehe `__tests__/tokens.test.ts`).
|
|
||||||
- **Theming** (`theme/ThemeProvider.tsx`) — zentrale Hell/Dunkel-Umschaltung, respektiert `prefers-color-scheme`, persistiert in `localStorage`.
|
|
||||||
- **i18n-Rahmen** (`i18n/i18n.tsx`) — Umschaltmechanismus Deutsch/Englisch. Modul-Frontends registrieren ihre fachlichen Textbausteine über `registerMessages()`, statt einen eigenen Mechanismus zu bauen.
|
|
||||||
- **Basis-Komponenten** (`components/`) — `Shell` (Layout + Navigation), `Table`, `Dialog`, `TextField`/`SelectField`/`CheckboxField`, `Toast`. Alle mit WCAG-2.1-AA-Grundlage (Tastaturbedienung, ARIA-Attribute, Fokus-Management).
|
|
||||||
|
|
||||||
## Verwendung in einem Modul-Frontend
|
|
||||||
|
|
||||||
```tsx
|
|
||||||
import { ThemeProvider, I18nProvider, ToastProvider, Shell } from "@nexarch/shl";
|
|
||||||
|
|
||||||
export default function RootLayout({ children }: { children: React.ReactNode }) {
|
|
||||||
return (
|
|
||||||
<ThemeProvider>
|
|
||||||
<I18nProvider initialLocale="de">
|
|
||||||
<ToastProvider>
|
|
||||||
<Shell modules={[]} tenantLabel="Mandant XY">
|
|
||||||
{children}
|
|
||||||
</Shell>
|
|
||||||
</ToastProvider>
|
|
||||||
</I18nProvider>
|
|
||||||
</ThemeProvider>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
## Bekannter offener Punkt
|
|
||||||
|
|
||||||
Die vier bereits gebauten Core-Frontends (`TEN-05`, `LIC-04`, `AUD-04`, `OPS-02`) sind vor diesem Paket entstanden und binden es noch nicht ein — Retrofit ist der nächste Schritt, siehe `nexarch-state.json`.
|
|
||||||
|
|
||||||
## Tests
|
|
||||||
|
|
||||||
Ausführung auf dem Test-Host (nicht lokal, siehe Projekt-Testinfrastruktur):
|
|
||||||
|
|
||||||
```bash
|
|
||||||
npm install
|
|
||||||
npm test
|
|
||||||
npm run typecheck
|
|
||||||
```
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
// Prüfung: Tastaturbedienung der Basis-Komponenten funktioniert (SHL-01 Prüfung 2).
|
|
||||||
import { describe, expect, it, vi } from "vitest";
|
|
||||||
import { fireEvent, render, screen } from "@testing-library/react";
|
|
||||||
import { Dialog } from "../components/Dialog";
|
|
||||||
import { I18nProvider } from "../i18n/i18n";
|
|
||||||
|
|
||||||
function renderDialog(onClose: () => void) {
|
|
||||||
return render(
|
|
||||||
<I18nProvider>
|
|
||||||
<Dialog open titleId="test-title" title="Test-Dialog" onClose={onClose}>
|
|
||||||
<button type="button">Erste Aktion</button>
|
|
||||||
<button type="button">Zweite Aktion</button>
|
|
||||||
</Dialog>
|
|
||||||
</I18nProvider>,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
describe("Dialog: Tastaturbedienung", () => {
|
|
||||||
it("schließt sich bei ESC", () => {
|
|
||||||
const onClose = vi.fn();
|
|
||||||
renderDialog(onClose);
|
|
||||||
fireEvent.keyDown(document, { key: "Escape" });
|
|
||||||
expect(onClose).toHaveBeenCalledOnce();
|
|
||||||
});
|
|
||||||
|
|
||||||
it("setzt den Fokus beim Öffnen auf das erste fokussierbare Element", () => {
|
|
||||||
renderDialog(vi.fn());
|
|
||||||
const closeButton = screen.getByRole("button", { name: /schließen/i });
|
|
||||||
expect(document.activeElement).toBe(closeButton);
|
|
||||||
});
|
|
||||||
|
|
||||||
it("ist als modaler Dialog mit Titel-Referenz ausgezeichnet", () => {
|
|
||||||
renderDialog(vi.fn());
|
|
||||||
const dialog = screen.getByRole("dialog");
|
|
||||||
expect(dialog).toHaveAttribute("aria-modal", "true");
|
|
||||||
expect(dialog).toHaveAttribute("aria-labelledby", "test-title");
|
|
||||||
});
|
|
||||||
});
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
// Prüfung: Kontrastwerte erfüllen mindestens AA (SHL-01 Prüfung 3 / Akzeptanzkriterium 4).
|
|
||||||
import { describe, expect, it } from "vitest";
|
|
||||||
import { colorTokens } from "../tokens/tokens";
|
|
||||||
|
|
||||||
// WCAG-2.1-AA-Kontrastberechnung (relative Luminanz, sRGB) — keine externe Abhängigkeit nötig.
|
|
||||||
function relLuminance(hex: string): number {
|
|
||||||
const rgb = [1, 3, 5].map((i) => parseInt(hex.slice(i, i + 2), 16) / 255);
|
|
||||||
const [r, g, b] = rgb.map((c) => (c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4));
|
|
||||||
return 0.2126 * r + 0.7152 * g + 0.0722 * b;
|
|
||||||
}
|
|
||||||
|
|
||||||
function contrastRatio(a: string, b: string): number {
|
|
||||||
const l1 = relLuminance(a);
|
|
||||||
const l2 = relLuminance(b);
|
|
||||||
const [lighter, darker] = l1 > l2 ? [l1, l2] : [l2, l1];
|
|
||||||
return (lighter + 0.05) / (darker + 0.05);
|
|
||||||
}
|
|
||||||
|
|
||||||
describe("Design-Tokens: WCAG 2.1 AA Kontrast", () => {
|
|
||||||
for (const scheme of ["light", "dark"] as const) {
|
|
||||||
const c = colorTokens[scheme];
|
|
||||||
|
|
||||||
it(`${scheme}: textPrimary auf background erfüllt AA (>= 4.5:1)`, () => {
|
|
||||||
expect(contrastRatio(c.textPrimary, c.background)).toBeGreaterThanOrEqual(4.5);
|
|
||||||
});
|
|
||||||
|
|
||||||
it(`${scheme}: textSecondary auf surface erfüllt AA (>= 4.5:1)`, () => {
|
|
||||||
expect(contrastRatio(c.textSecondary, c.surface)).toBeGreaterThanOrEqual(4.5);
|
|
||||||
});
|
|
||||||
|
|
||||||
it(`${scheme}: accentContrast auf accent erfüllt AA (>= 4.5:1)`, () => {
|
|
||||||
expect(contrastRatio(c.accentContrast, c.accent)).toBeGreaterThanOrEqual(4.5);
|
|
||||||
});
|
|
||||||
|
|
||||||
it(`${scheme}: dangerContrast auf danger erfüllt AA (>= 4.5:1)`, () => {
|
|
||||||
expect(contrastRatio(c.dangerContrast, c.danger)).toBeGreaterThanOrEqual(4.5);
|
|
||||||
});
|
|
||||||
}
|
|
||||||
});
|
|
||||||
@@ -1,88 +0,0 @@
|
|||||||
"use client";
|
|
||||||
|
|
||||||
// Dialog-Basis-Komponente — SHL-01. WCAG 2.1 AA: Fokus-Falle, ESC schließt, Tastaturbedienung vollständig.
|
|
||||||
|
|
||||||
import { useEffect, useRef } from "react";
|
|
||||||
import type { ReactNode } from "react";
|
|
||||||
import { useI18n } from "../i18n/i18n";
|
|
||||||
|
|
||||||
const FOCUSABLE_SELECTOR =
|
|
||||||
'a[href], button:not([disabled]), textarea:not([disabled]), input:not([disabled]), select:not([disabled]), [tabindex]:not([tabindex="-1"])';
|
|
||||||
|
|
||||||
export interface DialogProps {
|
|
||||||
open: boolean;
|
|
||||||
onClose: () => void;
|
|
||||||
titleId: string;
|
|
||||||
title: string;
|
|
||||||
children: ReactNode;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function Dialog({ open, onClose, titleId, title, children }: DialogProps) {
|
|
||||||
const { t } = useI18n();
|
|
||||||
const dialogRef = useRef<HTMLDivElement>(null);
|
|
||||||
const previouslyFocused = useRef<HTMLElement | null>(null);
|
|
||||||
|
|
||||||
useEffect(() => {
|
|
||||||
if (!open) return;
|
|
||||||
previouslyFocused.current = document.activeElement as HTMLElement | null;
|
|
||||||
|
|
||||||
const node = dialogRef.current;
|
|
||||||
const focusables = node?.querySelectorAll<HTMLElement>(FOCUSABLE_SELECTOR);
|
|
||||||
focusables?.[0]?.focus();
|
|
||||||
|
|
||||||
function handleKeyDown(event: KeyboardEvent) {
|
|
||||||
if (event.key === "Escape") {
|
|
||||||
onClose();
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (event.key !== "Tab" || !node) return;
|
|
||||||
|
|
||||||
const items = Array.from(node.querySelectorAll<HTMLElement>(FOCUSABLE_SELECTOR));
|
|
||||||
if (items.length === 0) return;
|
|
||||||
const first = items[0];
|
|
||||||
const last = items[items.length - 1];
|
|
||||||
|
|
||||||
if (event.shiftKey && document.activeElement === first) {
|
|
||||||
event.preventDefault();
|
|
||||||
last.focus();
|
|
||||||
} else if (!event.shiftKey && document.activeElement === last) {
|
|
||||||
event.preventDefault();
|
|
||||||
first.focus();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
document.addEventListener("keydown", handleKeyDown);
|
|
||||||
return () => {
|
|
||||||
document.removeEventListener("keydown", handleKeyDown);
|
|
||||||
previouslyFocused.current?.focus();
|
|
||||||
};
|
|
||||||
}, [open, onClose]);
|
|
||||||
|
|
||||||
if (!open) return null;
|
|
||||||
|
|
||||||
return (
|
|
||||||
<div
|
|
||||||
className="shl-dialog-backdrop"
|
|
||||||
role="presentation"
|
|
||||||
onMouseDown={(event) => {
|
|
||||||
if (event.target === event.currentTarget) onClose();
|
|
||||||
}}
|
|
||||||
>
|
|
||||||
<div
|
|
||||||
ref={dialogRef}
|
|
||||||
className="shl-dialog"
|
|
||||||
role="dialog"
|
|
||||||
aria-modal="true"
|
|
||||||
aria-labelledby={titleId}
|
|
||||||
>
|
|
||||||
<div className="shl-dialog-header">
|
|
||||||
<h2 id={titleId}>{title}</h2>
|
|
||||||
<button type="button" onClick={onClose} aria-label={t("shl.dialog.close")}>
|
|
||||||
×
|
|
||||||
</button>
|
|
||||||
</div>
|
|
||||||
<div className="shl-dialog-body">{children}</div>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,98 +0,0 @@
|
|||||||
// Formularelemente-Basis-Komponenten — SHL-01. WCAG: jedes Feld hat verknüpftes <label>,
|
|
||||||
// Fehler werden per aria-describedby + aria-invalid angebunden, nicht nur farblich markiert.
|
|
||||||
|
|
||||||
import { useId } from "react";
|
|
||||||
import type { InputHTMLAttributes, ReactNode, SelectHTMLAttributes } from "react";
|
|
||||||
|
|
||||||
interface FieldWrapperProps {
|
|
||||||
label: string;
|
|
||||||
error?: string;
|
|
||||||
hint?: string;
|
|
||||||
children: (ids: { inputId: string; describedBy: string | undefined }) => ReactNode;
|
|
||||||
}
|
|
||||||
|
|
||||||
function FieldWrapper({ label, error, hint, children }: FieldWrapperProps) {
|
|
||||||
const inputId = useId();
|
|
||||||
const hintId = hint ? `${inputId}-hint` : undefined;
|
|
||||||
const errorId = error ? `${inputId}-error` : undefined;
|
|
||||||
const describedBy = [hintId, errorId].filter(Boolean).join(" ") || undefined;
|
|
||||||
|
|
||||||
return (
|
|
||||||
<div className="shl-field">
|
|
||||||
<label htmlFor={inputId}>{label}</label>
|
|
||||||
{children({ inputId, describedBy })}
|
|
||||||
{hint && (
|
|
||||||
<p id={hintId} className="shl-field-hint">
|
|
||||||
{hint}
|
|
||||||
</p>
|
|
||||||
)}
|
|
||||||
{error && (
|
|
||||||
<p id={errorId} className="shl-field-error" role="alert">
|
|
||||||
{error}
|
|
||||||
</p>
|
|
||||||
)}
|
|
||||||
</div>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
export interface TextFieldProps
|
|
||||||
extends Omit<InputHTMLAttributes<HTMLInputElement>, "id" | "aria-describedby"> {
|
|
||||||
label: string;
|
|
||||||
error?: string;
|
|
||||||
hint?: string;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function TextField({ label, error, hint, ...inputProps }: TextFieldProps) {
|
|
||||||
return (
|
|
||||||
<FieldWrapper label={label} error={error} hint={hint}>
|
|
||||||
{({ inputId, describedBy }) => (
|
|
||||||
<input
|
|
||||||
id={inputId}
|
|
||||||
aria-describedby={describedBy}
|
|
||||||
aria-invalid={error ? true : undefined}
|
|
||||||
{...inputProps}
|
|
||||||
/>
|
|
||||||
)}
|
|
||||||
</FieldWrapper>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
export interface SelectFieldProps
|
|
||||||
extends Omit<SelectHTMLAttributes<HTMLSelectElement>, "id" | "aria-describedby"> {
|
|
||||||
label: string;
|
|
||||||
error?: string;
|
|
||||||
hint?: string;
|
|
||||||
children: ReactNode;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function SelectField({ label, error, hint, children, ...selectProps }: SelectFieldProps) {
|
|
||||||
return (
|
|
||||||
<FieldWrapper label={label} error={error} hint={hint}>
|
|
||||||
{({ inputId, describedBy }) => (
|
|
||||||
<select
|
|
||||||
id={inputId}
|
|
||||||
aria-describedby={describedBy}
|
|
||||||
aria-invalid={error ? true : undefined}
|
|
||||||
{...selectProps}
|
|
||||||
>
|
|
||||||
{children}
|
|
||||||
</select>
|
|
||||||
)}
|
|
||||||
</FieldWrapper>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
export interface CheckboxFieldProps
|
|
||||||
extends Omit<InputHTMLAttributes<HTMLInputElement>, "id" | "type"> {
|
|
||||||
label: string;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function CheckboxField({ label, ...inputProps }: CheckboxFieldProps) {
|
|
||||||
const inputId = useId();
|
|
||||||
return (
|
|
||||||
<div className="shl-field shl-field-checkbox">
|
|
||||||
<input id={inputId} type="checkbox" {...inputProps} />
|
|
||||||
<label htmlFor={inputId}>{label}</label>
|
|
||||||
</div>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,62 +0,0 @@
|
|||||||
"use client";
|
|
||||||
|
|
||||||
// Layout-Shell mit Navigation — SHL-01 Akzeptanzkriterium 1.
|
|
||||||
// Globale Navigation zeigt nur Module, die Core für Tenant/Benutzer freigibt (Backend entscheidet, UI blendet nur aus).
|
|
||||||
|
|
||||||
import type { ReactNode } from "react";
|
|
||||||
import { useI18n } from "../i18n/i18n";
|
|
||||||
import { useTheme } from "../theme/ThemeProvider";
|
|
||||||
|
|
||||||
export interface ModuleLink {
|
|
||||||
key: string;
|
|
||||||
label: string;
|
|
||||||
href: string;
|
|
||||||
active?: boolean;
|
|
||||||
}
|
|
||||||
|
|
||||||
export interface ShellProps {
|
|
||||||
modules: ModuleLink[];
|
|
||||||
tenantLabel: string;
|
|
||||||
children: ReactNode;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function Shell({ modules, tenantLabel, children }: ShellProps) {
|
|
||||||
const { scheme, toggle } = useTheme();
|
|
||||||
const { t } = useI18n();
|
|
||||||
|
|
||||||
return (
|
|
||||||
<div className="shl-shell">
|
|
||||||
<a className="shl-skip-link" href="#shl-main-content">
|
|
||||||
{t("shl.shell.skipToContent", "Zum Inhalt springen")}
|
|
||||||
</a>
|
|
||||||
<header className="shl-shell-header">
|
|
||||||
<nav aria-label={t("shl.shell.moduleNav", "Modul-Navigation")}>
|
|
||||||
<ul>
|
|
||||||
{modules.map((mod) => (
|
|
||||||
<li key={mod.key}>
|
|
||||||
<a href={mod.href} aria-current={mod.active ? "page" : undefined}>
|
|
||||||
{mod.label}
|
|
||||||
</a>
|
|
||||||
</li>
|
|
||||||
))}
|
|
||||||
</ul>
|
|
||||||
</nav>
|
|
||||||
<div className="shl-shell-context">
|
|
||||||
<span className="shl-tenant-context">{tenantLabel}</span>
|
|
||||||
<button
|
|
||||||
type="button"
|
|
||||||
onClick={toggle}
|
|
||||||
aria-label={
|
|
||||||
scheme === "light" ? t("shl.theme.toggleToDark") : t("shl.theme.toggleToLight")
|
|
||||||
}
|
|
||||||
>
|
|
||||||
{scheme === "light" ? "🌙" : "☀️"}
|
|
||||||
</button>
|
|
||||||
</div>
|
|
||||||
</header>
|
|
||||||
<main id="shl-main-content" className="shl-shell-content" tabIndex={-1}>
|
|
||||||
{children}
|
|
||||||
</main>
|
|
||||||
</div>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,83 +0,0 @@
|
|||||||
// Table-Basis-Komponente — SHL-01. WCAG: semantische <table>, scope auf Kopfzellen, sortierbare Spalten per Tastatur.
|
|
||||||
|
|
||||||
import type { ReactNode } from "react";
|
|
||||||
import { useI18n } from "../i18n/i18n";
|
|
||||||
|
|
||||||
export interface TableColumn<Row> {
|
|
||||||
key: string;
|
|
||||||
header: string;
|
|
||||||
render: (row: Row) => ReactNode;
|
|
||||||
sortable?: boolean;
|
|
||||||
}
|
|
||||||
|
|
||||||
export interface TableProps<Row> {
|
|
||||||
columns: TableColumn<Row>[];
|
|
||||||
rows: Row[];
|
|
||||||
rowKey: (row: Row) => string;
|
|
||||||
sortKey?: string;
|
|
||||||
sortDirection?: "asc" | "desc";
|
|
||||||
onSort?: (key: string) => void;
|
|
||||||
caption?: string;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function Table<Row>({
|
|
||||||
columns,
|
|
||||||
rows,
|
|
||||||
rowKey,
|
|
||||||
sortKey,
|
|
||||||
sortDirection,
|
|
||||||
onSort,
|
|
||||||
caption,
|
|
||||||
}: TableProps<Row>) {
|
|
||||||
const { t } = useI18n();
|
|
||||||
|
|
||||||
return (
|
|
||||||
<table className="shl-table">
|
|
||||||
{caption && <caption>{caption}</caption>}
|
|
||||||
<thead>
|
|
||||||
<tr>
|
|
||||||
{columns.map((column) => {
|
|
||||||
const isSorted = column.key === sortKey;
|
|
||||||
const ariaSort = column.sortable
|
|
||||||
? isSorted
|
|
||||||
? sortDirection === "asc"
|
|
||||||
? "ascending"
|
|
||||||
: "descending"
|
|
||||||
: "none"
|
|
||||||
: undefined;
|
|
||||||
return (
|
|
||||||
<th key={column.key} scope="col" aria-sort={ariaSort}>
|
|
||||||
{column.sortable ? (
|
|
||||||
<button
|
|
||||||
type="button"
|
|
||||||
onClick={() => onSort?.(column.key)}
|
|
||||||
className="shl-table-sort-button"
|
|
||||||
>
|
|
||||||
{column.header}
|
|
||||||
</button>
|
|
||||||
) : (
|
|
||||||
column.header
|
|
||||||
)}
|
|
||||||
</th>
|
|
||||||
);
|
|
||||||
})}
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
{rows.length === 0 ? (
|
|
||||||
<tr>
|
|
||||||
<td colSpan={columns.length}>{t("shl.table.noRows")}</td>
|
|
||||||
</tr>
|
|
||||||
) : (
|
|
||||||
rows.map((row) => (
|
|
||||||
<tr key={rowKey(row)}>
|
|
||||||
{columns.map((column) => (
|
|
||||||
<td key={column.key}>{column.render(row)}</td>
|
|
||||||
))}
|
|
||||||
</tr>
|
|
||||||
))
|
|
||||||
)}
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -1,67 +0,0 @@
|
|||||||
"use client";
|
|
||||||
|
|
||||||
// Toast-Basis-Komponente — SHL-01. WCAG: aria-live sorgt dafür, dass Screenreader Meldungen ansagen.
|
|
||||||
|
|
||||||
import { createContext, useCallback, useContext, useMemo, useState } from "react";
|
|
||||||
import type { ReactNode } from "react";
|
|
||||||
import { useI18n } from "../i18n/i18n";
|
|
||||||
|
|
||||||
export type ToastVariant = "info" | "success" | "danger" | "warning";
|
|
||||||
|
|
||||||
export interface ToastMessage {
|
|
||||||
id: string;
|
|
||||||
text: string;
|
|
||||||
variant: ToastVariant;
|
|
||||||
}
|
|
||||||
|
|
||||||
interface ToastContextValue {
|
|
||||||
toasts: ToastMessage[];
|
|
||||||
push: (text: string, variant?: ToastVariant) => void;
|
|
||||||
dismiss: (id: string) => void;
|
|
||||||
}
|
|
||||||
|
|
||||||
const ToastContext = createContext<ToastContextValue | null>(null);
|
|
||||||
|
|
||||||
export function ToastProvider({ children }: { children: ReactNode }) {
|
|
||||||
const [toasts, setToasts] = useState<ToastMessage[]>([]);
|
|
||||||
const { t } = useI18n();
|
|
||||||
|
|
||||||
const dismiss = useCallback((id: string) => {
|
|
||||||
setToasts((current) => current.filter((toast) => toast.id !== id));
|
|
||||||
}, []);
|
|
||||||
|
|
||||||
const push = useCallback((text: string, variant: ToastVariant = "info") => {
|
|
||||||
const id = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
|
|
||||||
setToasts((current) => [...current, { id, text, variant }]);
|
|
||||||
}, []);
|
|
||||||
|
|
||||||
const value = useMemo(() => ({ toasts, push, dismiss }), [toasts, push, dismiss]);
|
|
||||||
|
|
||||||
return (
|
|
||||||
<ToastContext.Provider value={value}>
|
|
||||||
{children}
|
|
||||||
<div className="shl-toast-region" role="status" aria-live="polite" aria-atomic="false">
|
|
||||||
{toasts.map((toast) => (
|
|
||||||
<div key={toast.id} className={`shl-toast shl-toast-${toast.variant}`}>
|
|
||||||
<span>{toast.text}</span>
|
|
||||||
<button
|
|
||||||
type="button"
|
|
||||||
onClick={() => dismiss(toast.id)}
|
|
||||||
aria-label={t("shl.toast.dismiss")}
|
|
||||||
>
|
|
||||||
×
|
|
||||||
</button>
|
|
||||||
</div>
|
|
||||||
))}
|
|
||||||
</div>
|
|
||||||
</ToastContext.Provider>
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
export function useToast(): ToastContextValue {
|
|
||||||
const ctx = useContext(ToastContext);
|
|
||||||
if (!ctx) {
|
|
||||||
throw new Error("useToast muss innerhalb von <ToastProvider> aufgerufen werden");
|
|
||||||
}
|
|
||||||
return ctx;
|
|
||||||
}
|
|
||||||
@@ -1,75 +0,0 @@
|
|||||||
"use client";
|
|
||||||
|
|
||||||
// i18n-Rahmen (mind. Deutsch/Englisch) — SHL-01 Akzeptanzkriterium 5.
|
|
||||||
// Liefert nur den Umschaltmechanismus + Basis-Komponenten-Texte.
|
|
||||||
// Modul-Frontends liefern ihre eigenen fachlichen Textbausteine über registerMessages(),
|
|
||||||
// statt einen eigenen i18n-Mechanismus zu bauen (siehe UI-UX-KONZEPT.md Abschnitt 4).
|
|
||||||
|
|
||||||
import { createContext, useContext, useMemo, useState } from "react";
|
|
||||||
import type { ReactNode } from "react";
|
|
||||||
|
|
||||||
export type Locale = "de" | "en";
|
|
||||||
|
|
||||||
type MessageDict = Record<string, string>;
|
|
||||||
type MessageBundle = Record<Locale, MessageDict>;
|
|
||||||
|
|
||||||
const baseMessages: MessageBundle = {
|
|
||||||
de: {
|
|
||||||
"shl.dialog.close": "Schließen",
|
|
||||||
"shl.toast.dismiss": "Meldung schließen",
|
|
||||||
"shl.table.noRows": "Keine Einträge vorhanden",
|
|
||||||
"shl.theme.toggleToLight": "Helles Erscheinungsbild",
|
|
||||||
"shl.theme.toggleToDark": "Dunkles Erscheinungsbild",
|
|
||||||
},
|
|
||||||
en: {
|
|
||||||
"shl.dialog.close": "Close",
|
|
||||||
"shl.toast.dismiss": "Dismiss message",
|
|
||||||
"shl.table.noRows": "No entries",
|
|
||||||
"shl.theme.toggleToLight": "Switch to light theme",
|
|
||||||
"shl.theme.toggleToDark": "Switch to dark theme",
|
|
||||||
},
|
|
||||||
};
|
|
||||||
|
|
||||||
// Registry, in die Modul-Frontends ihre eigenen Textbausteine einhängen.
|
|
||||||
const registry: MessageBundle = { de: { ...baseMessages.de }, en: { ...baseMessages.en } };
|
|
||||||
|
|
||||||
export function registerMessages(locale: Locale, messages: MessageDict): void {
|
|
||||||
registry[locale] = { ...registry[locale], ...messages };
|
|
||||||
}
|
|
||||||
|
|
||||||
interface I18nContextValue {
|
|
||||||
locale: Locale;
|
|
||||||
setLocale: (locale: Locale) => void;
|
|
||||||
t: (key: string, fallback?: string) => string;
|
|
||||||
}
|
|
||||||
|
|
||||||
const I18nContext = createContext<I18nContextValue | null>(null);
|
|
||||||
|
|
||||||
export function I18nProvider({
|
|
||||||
initialLocale = "de",
|
|
||||||
children,
|
|
||||||
}: {
|
|
||||||
initialLocale?: Locale;
|
|
||||||
children: ReactNode;
|
|
||||||
}) {
|
|
||||||
const [locale, setLocale] = useState<Locale>(initialLocale);
|
|
||||||
|
|
||||||
const value = useMemo<I18nContextValue>(
|
|
||||||
() => ({
|
|
||||||
locale,
|
|
||||||
setLocale,
|
|
||||||
t: (key: string, fallback?: string) => registry[locale][key] ?? fallback ?? key,
|
|
||||||
}),
|
|
||||||
[locale],
|
|
||||||
);
|
|
||||||
|
|
||||||
return <I18nContext.Provider value={value}>{children}</I18nContext.Provider>;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function useI18n(): I18nContextValue {
|
|
||||||
const ctx = useContext(I18nContext);
|
|
||||||
if (!ctx) {
|
|
||||||
throw new Error("useI18n muss innerhalb von <I18nProvider> aufgerufen werden");
|
|
||||||
}
|
|
||||||
return ctx;
|
|
||||||
}
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
// Öffentliche Schnittstelle des Pakets @nexarch/shl — Modul-Frontends importieren ausschließlich hierüber,
|
|
||||||
// nicht aus internen Unterpfaden (SHL-01 Akzeptanzkriterium 2: dokumentiert, versioniert, importierbar statt kopiert).
|
|
||||||
|
|
||||||
export { colorTokens, spacing, breakpoints, typography, cssVariables } from "./tokens/tokens";
|
|
||||||
export type { ColorScheme, ColorTokens } from "./tokens/tokens";
|
|
||||||
|
|
||||||
export { ThemeProvider, useTheme, currentColors } from "./theme/ThemeProvider";
|
|
||||||
|
|
||||||
export { I18nProvider, useI18n, registerMessages } from "./i18n/i18n";
|
|
||||||
export type { Locale } from "./i18n/i18n";
|
|
||||||
|
|
||||||
export { Shell } from "./components/Shell";
|
|
||||||
export type { ShellProps, ModuleLink } from "./components/Shell";
|
|
||||||
|
|
||||||
export { Dialog } from "./components/Dialog";
|
|
||||||
export type { DialogProps } from "./components/Dialog";
|
|
||||||
|
|
||||||
export { Table } from "./components/Table";
|
|
||||||
export type { TableProps, TableColumn } from "./components/Table";
|
|
||||||
|
|
||||||
export { TextField, SelectField, CheckboxField } from "./components/FormElements";
|
|
||||||
export type { TextFieldProps, SelectFieldProps, CheckboxFieldProps } from "./components/FormElements";
|
|
||||||
|
|
||||||
export { ToastProvider, useToast } from "./components/Toast";
|
|
||||||
export type { ToastMessage, ToastVariant } from "./components/Toast";
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
{
|
|
||||||
"name": "@nexarch/shl",
|
|
||||||
"version": "0.1.0",
|
|
||||||
"private": true,
|
|
||||||
"description": "NEXARCH UI-Shell & Design-System (Core SHL-01) — gemeinsames Paket für alle Modul-Frontends.",
|
|
||||||
"main": "index.ts",
|
|
||||||
"types": "index.ts",
|
|
||||||
"scripts": {
|
|
||||||
"test": "vitest run",
|
|
||||||
"typecheck": "tsc --noEmit"
|
|
||||||
},
|
|
||||||
"peerDependencies": {
|
|
||||||
"react": "^18.3.1",
|
|
||||||
"react-dom": "^18.3.1"
|
|
||||||
},
|
|
||||||
"devDependencies": {
|
|
||||||
"@testing-library/jest-dom": "^6.4.8",
|
|
||||||
"@testing-library/react": "^16.0.0",
|
|
||||||
"@types/react": "18.3.3",
|
|
||||||
"@types/react-dom": "18.3.0",
|
|
||||||
"jsdom": "^24.1.1",
|
|
||||||
"typescript": "5.5.3",
|
|
||||||
"vitest": "^2.0.0"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,81 +0,0 @@
|
|||||||
"use client";
|
|
||||||
|
|
||||||
// Zentrales Theming (Hell/Dunkel) — SHL-01 Akzeptanzkriterium 6.
|
|
||||||
// Einzige Quelle für Hell/Dunkel-Werte; Modul-Frontends schalten nur um, bauen kein eigenes Theming.
|
|
||||||
|
|
||||||
import { createContext, useCallback, useContext, useEffect, useMemo, useState } from "react";
|
|
||||||
import type { ReactNode } from "react";
|
|
||||||
import { colorTokens, cssVariables, type ColorScheme } from "../tokens/tokens";
|
|
||||||
|
|
||||||
const STORAGE_KEY = "nexarch-shl-theme";
|
|
||||||
|
|
||||||
interface ThemeContextValue {
|
|
||||||
scheme: ColorScheme;
|
|
||||||
setScheme: (scheme: ColorScheme) => void;
|
|
||||||
toggle: () => void;
|
|
||||||
}
|
|
||||||
|
|
||||||
const ThemeContext = createContext<ThemeContextValue | null>(null);
|
|
||||||
|
|
||||||
function readStoredScheme(): ColorScheme | null {
|
|
||||||
if (typeof window === "undefined") return null;
|
|
||||||
try {
|
|
||||||
const stored = window.localStorage.getItem(STORAGE_KEY);
|
|
||||||
return stored === "light" || stored === "dark" ? stored : null;
|
|
||||||
} catch {
|
|
||||||
// localStorage kann in privaten Fenstern/eingeschränkten Kontexten fehlschlagen — kein Absturz, nur kein persistierter Zustand.
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
function systemPrefersDark(): boolean {
|
|
||||||
if (typeof window === "undefined" || !window.matchMedia) return false;
|
|
||||||
return window.matchMedia("(prefers-color-scheme: dark)").matches;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function ThemeProvider({ children }: { children: ReactNode }) {
|
|
||||||
const [scheme, setSchemeState] = useState<ColorScheme>("light");
|
|
||||||
|
|
||||||
useEffect(() => {
|
|
||||||
const stored = readStoredScheme();
|
|
||||||
setSchemeState(stored ?? (systemPrefersDark() ? "dark" : "light"));
|
|
||||||
}, []);
|
|
||||||
|
|
||||||
const setScheme = useCallback((next: ColorScheme) => {
|
|
||||||
setSchemeState(next);
|
|
||||||
try {
|
|
||||||
window.localStorage.setItem(STORAGE_KEY, next);
|
|
||||||
} catch {
|
|
||||||
// Speichern optional — Umschaltung funktioniert auch ohne Persistenz.
|
|
||||||
}
|
|
||||||
}, []);
|
|
||||||
|
|
||||||
const toggle = useCallback(() => {
|
|
||||||
setScheme(scheme === "light" ? "dark" : "light");
|
|
||||||
}, [scheme, setScheme]);
|
|
||||||
|
|
||||||
useEffect(() => {
|
|
||||||
const vars = cssVariables(scheme);
|
|
||||||
const root = document.documentElement;
|
|
||||||
for (const [key, value] of Object.entries(vars)) {
|
|
||||||
root.style.setProperty(key, value);
|
|
||||||
}
|
|
||||||
root.dataset.shlTheme = scheme;
|
|
||||||
}, [scheme]);
|
|
||||||
|
|
||||||
const value = useMemo(() => ({ scheme, setScheme, toggle }), [scheme, setScheme, toggle]);
|
|
||||||
|
|
||||||
return <ThemeContext.Provider value={value}>{children}</ThemeContext.Provider>;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function useTheme(): ThemeContextValue {
|
|
||||||
const ctx = useContext(ThemeContext);
|
|
||||||
if (!ctx) {
|
|
||||||
throw new Error("useTheme muss innerhalb von <ThemeProvider> aufgerufen werden");
|
|
||||||
}
|
|
||||||
return ctx;
|
|
||||||
}
|
|
||||||
|
|
||||||
export function currentColors(scheme: ColorScheme) {
|
|
||||||
return colorTokens[scheme];
|
|
||||||
}
|
|
||||||
@@ -1,96 +0,0 @@
|
|||||||
// Design-Tokens: einzige Quelle für Farbe, Abstand, Typografie im gesamten Frontend-Verbund.
|
|
||||||
// Modul-Frontends importieren diese Tokens, überschreiben sie nicht lokal (SHL-01 Akzeptanzkriterium 3).
|
|
||||||
// Kontrastwerte sind gegen WCAG 2.1 AA geprüft (Akzeptanzkriterium 1/4): mindestens 4.5:1 für Fließtext.
|
|
||||||
|
|
||||||
export type ColorScheme = "light" | "dark";
|
|
||||||
|
|
||||||
export interface ColorTokens {
|
|
||||||
background: string;
|
|
||||||
surface: string;
|
|
||||||
surfaceRaised: string;
|
|
||||||
border: string;
|
|
||||||
textPrimary: string;
|
|
||||||
textSecondary: string;
|
|
||||||
accent: string;
|
|
||||||
accentContrast: string;
|
|
||||||
danger: string;
|
|
||||||
dangerContrast: string;
|
|
||||||
success: string;
|
|
||||||
warning: string;
|
|
||||||
focusRing: string;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Kontrastwerte geprüft: textPrimary auf background/surface >= 7:1, textSecondary >= 4.5:1,
|
|
||||||
// accentContrast auf accent >= 4.5:1 (WCAG AA, siehe SHL-01 Prüfung 3).
|
|
||||||
export const colorTokens: Record<ColorScheme, ColorTokens> = {
|
|
||||||
light: {
|
|
||||||
background: "#FFFFFF",
|
|
||||||
surface: "#F5F6F8",
|
|
||||||
surfaceRaised: "#FFFFFF",
|
|
||||||
border: "#D7DBE0",
|
|
||||||
textPrimary: "#14181F",
|
|
||||||
textSecondary: "#4B5563",
|
|
||||||
accent: "#1D4ED8",
|
|
||||||
accentContrast: "#FFFFFF",
|
|
||||||
danger: "#B91C1C",
|
|
||||||
dangerContrast: "#FFFFFF",
|
|
||||||
success: "#15803D",
|
|
||||||
warning: "#B45309",
|
|
||||||
focusRing: "#1D4ED8",
|
|
||||||
},
|
|
||||||
dark: {
|
|
||||||
background: "#0F1115",
|
|
||||||
surface: "#181B21",
|
|
||||||
surfaceRaised: "#20242C",
|
|
||||||
border: "#333944",
|
|
||||||
textPrimary: "#F2F4F7",
|
|
||||||
textSecondary: "#B4BAC4",
|
|
||||||
accent: "#5B8DEF",
|
|
||||||
accentContrast: "#0F1115",
|
|
||||||
danger: "#F87171",
|
|
||||||
dangerContrast: "#0F1115",
|
|
||||||
success: "#4ADE80",
|
|
||||||
warning: "#FBBF24",
|
|
||||||
focusRing: "#5B8DEF",
|
|
||||||
},
|
|
||||||
};
|
|
||||||
|
|
||||||
export const spacing = {
|
|
||||||
xs: "4px",
|
|
||||||
sm: "8px",
|
|
||||||
md: "16px",
|
|
||||||
lg: "24px",
|
|
||||||
xl: "32px",
|
|
||||||
xxl: "48px",
|
|
||||||
} as const;
|
|
||||||
|
|
||||||
export const breakpoints = {
|
|
||||||
mobile: "0px",
|
|
||||||
tablet: "768px",
|
|
||||||
desktop: "1200px",
|
|
||||||
} as const;
|
|
||||||
|
|
||||||
export const typography = {
|
|
||||||
fontFamily: "'Inter', 'Segoe UI', system-ui, sans-serif",
|
|
||||||
fontFamilyMono: "'JetBrains Mono', ui-monospace, monospace",
|
|
||||||
sizeSm: "13px",
|
|
||||||
sizeMd: "15px",
|
|
||||||
sizeLg: "18px",
|
|
||||||
sizeXl: "24px",
|
|
||||||
lineHeight: 1.5,
|
|
||||||
weightRegular: 400,
|
|
||||||
weightMedium: 500,
|
|
||||||
weightBold: 600,
|
|
||||||
} as const;
|
|
||||||
|
|
||||||
export function cssVariables(scheme: ColorScheme): Record<string, string> {
|
|
||||||
const c = colorTokens[scheme];
|
|
||||||
const vars: Record<string, string> = {};
|
|
||||||
for (const [key, value] of Object.entries(c)) {
|
|
||||||
vars[`--shl-color-${key.replace(/([A-Z])/g, "-$1").toLowerCase()}`] = value;
|
|
||||||
}
|
|
||||||
for (const [key, value] of Object.entries(spacing)) {
|
|
||||||
vars[`--shl-spacing-${key}`] = value;
|
|
||||||
}
|
|
||||||
return vars;
|
|
||||||
}
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
{
|
|
||||||
"compilerOptions": {
|
|
||||||
"target": "ES2020",
|
|
||||||
"lib": ["dom", "dom.iterable", "esnext"],
|
|
||||||
"jsx": "react-jsx",
|
|
||||||
"module": "ESNext",
|
|
||||||
"moduleResolution": "bundler",
|
|
||||||
"strict": true,
|
|
||||||
"declaration": true,
|
|
||||||
"esModuleInterop": true,
|
|
||||||
"skipLibCheck": true,
|
|
||||||
"forceConsistentCasingInFileNames": true,
|
|
||||||
"noUnusedLocals": true,
|
|
||||||
"noUnusedParameters": true
|
|
||||||
},
|
|
||||||
"include": ["**/*.ts", "**/*.tsx"],
|
|
||||||
"exclude": ["node_modules"]
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
import { defineConfig } from "vitest/config";
|
|
||||||
|
|
||||||
export default defineConfig({
|
|
||||||
test: {
|
|
||||||
environment: "jsdom",
|
|
||||||
setupFiles: ["./vitest.setup.ts"],
|
|
||||||
},
|
|
||||||
});
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
import "@testing-library/jest-dom/vitest";
|
|
||||||
import { afterEach } from "vitest";
|
|
||||||
import { cleanup } from "@testing-library/react";
|
|
||||||
|
|
||||||
// Ohne explizites Cleanup bleiben zwischen den it()-Blöcken gerenderte Dialoge im DOM stehen
|
|
||||||
// (mehrere <html>/<body>-Bäume stapeln sich), wodurch getByRole() mehrere Treffer statt einen findet.
|
|
||||||
afterEach(() => {
|
|
||||||
cleanup();
|
|
||||||
});
|
|
||||||
Reference in New Issue
Block a user