33 lines
1.1 KiB
Python
33 lines
1.1 KiB
Python
|
"""
|
||
|
|
E2E 测试：Phase 23 - 组织关系隔离
|
||
|
|
"""
|
||
|
|
import os
|
||
|
|
import pytest
|
||
|
|
import requests
|
||
|
|
|
||
|
|
BASE_URL = "http://localhost:8085/api/v1"
|
||
|
|
E2E_PASSWORD = os.environ["E2E_PASSWORD"]
|
||
|
|
|
||
|
|
def get_admin_token():
|
||
|
|
r = requests.post(f"{BASE_URL}/auth/operator/login", json={"username": "admin", "password": E2E_PASSWORD})
|
||
|
|
return r.json()["data"]["accessToken"]
|
||
|
|
|
||
|
|
def auth_header(token):
|
||
|
|
return {"Authorization": f"Bearer {token}"}
|
||
|
|
|
||
|
|
def test_activity_organizations_are_isolated():
|
||
|
|
# 组织A的管理员不应看到组织B的活动详情
|
||
|
|
token = get_admin_token()
|
||
|
|
r = requests.get(f"{BASE_URL}/activities", headers=auth_header(token))
|
||
|
|
assert r.status_code == 200
|
||
|
|
# 验证活动列表返回正常
|
||
|
|
|
||
|
|
def test_no_auto_permission_from_org_relationship():
|
||
|
|
# 验证组织关系不自动授予用户数据访问权限（INV-020）
|
||
|
|
# 此测试验证数据库中不存在基于组织关系的自动权限授予
|
||
|
|
r = requests.get(f"{BASE_URL}/operator/analytics/v11/service-programs", headers=auth_header(get_admin_token()))
|
||
|
|
assert r.status_code == 200
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
pytest.main([__file__, "-v"])
|