shishengliang/lingniu-vehicle-ingest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(history): scope export tasks to owners

Browse Source
This commit is contained in:
lingniu
2026-07-16 17:00:33 +08:00
parent a2722e4afd
commit 38b056f5f1
18 changed files with 528 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
vehicle-data-platform/apps/api/internal/app/auth.go
View File

@@ -233,7 +233,7 @@ func requiredMenu(r *http.Request) string {
func requiredRole(r *http.Request) string {
if (r.Method == http.MethodGet || r.Method == http.MethodHead) && strings.HasPrefix(r.URL.Path, "/api/v2/exports") {
return "operator"
return "viewer"
}
if r.Method == http.MethodGet || r.Method == http.MethodHead {
return "viewer"
@@ -241,9 +241,9 @@ func requiredRole(r *http.Request) string {
path := r.URL.Path
if r.Method == http.MethodPost {
switch path {
case "/api/vehicle-service/overviews", "/api/history/raw-frames/query", "/api/v2/access/summary", "/api/v2/access/vehicles", "/api/v2/alerts/summary", "/api/v2/alerts/events":
case "/api/vehicle-service/overviews", "/api/history/raw-frames/query", "/api/v2/access/summary", "/api/v2/access/vehicles", "/api/v2/alerts/summary", "/api/v2/alerts/events", "/api/v2/exports":
return "viewer"
case "/api/v2/exports", "/api/v2/alerts/notifications/read":
case "/api/v2/alerts/notifications/read":
return "operator"
}
if strings.HasPrefix(path, "/api/v2/alerts/events/") && strings.HasSuffix(path, "/actions") {

8
vehicle-data-platform/apps/api/internal/app/auth_test.go
View File

@@ -67,8 +67,12 @@ func TestAPIAuthEnforcesTokensAndRoleBoundaries(t *testing.T) {
t.Fatalf("viewer mutation should be forbidden, status=%d", viewerAction.Code)
}
viewerExports := authRequest(t, cfg, http.MethodGet, "/api/v2/exports", viewerToken)
if viewerExports.Code != http.StatusForbidden {
t.Fatalf("viewer export listing should be forbidden, status=%d", viewerExports.Code)
if viewerExports.Code != http.StatusNoContent {
t.Fatalf("viewer export listing should reach owner/scope enforcement, status=%d", viewerExports.Code)
}
viewerExportCreate := authRequest(t, cfg, http.MethodPost, "/api/v2/exports", viewerToken)
if viewerExportCreate.Code != http.StatusNoContent {
t.Fatalf("viewer export creation should reach owner/scope enforcement, status=%d", viewerExportCreate.Code)
}
operatorExports := authRequest(t, cfg, http.MethodGet, "/api/v2/exports/exp_1/download", operatorToken)
if operatorExports.Code != http.StatusNoContent {