102 lines
6.1 KiB
JavaScript
102 lines
6.1 KiB
JavaScript
const MODULE = 'phase3-warehouse-rbac'
|
|
const OPTIONS = { scenario: 'warehouse-role-boundary', deploymentBlocker: true }
|
|
const PHASE4_READ_CODES = [
|
|
'platform:overseas-warehouse:last-mile-order:list',
|
|
'platform:overseas-warehouse:inbound-order:list',
|
|
'platform:overseas-warehouse:relabel-order:list',
|
|
'platform:overseas-warehouse:inventory:list',
|
|
'platform:overseas-warehouse:warehouse:list',
|
|
'platform:overseas-warehouse:location:list',
|
|
'platform:overseas-warehouse:pallet:list',
|
|
'platform:overseas-business:purchase:list',
|
|
'platform:overseas-business:truck:list',
|
|
'platform:overseas-business:looseboard:list',
|
|
]
|
|
const PHASE4_WRITE_SUFFIXES = [':create', ':edit', ':status', ':export', ':adjust', ':delete', ':review']
|
|
|
|
function id(value) { return value == null ? '' : String(value) }
|
|
|
|
export async function run(context) {
|
|
const permissionsResponse = await context.request('GET', '/api/platform/v1/iam/permissions')
|
|
const permissions = context.apiSuccess(MODULE, '查询平台权限资源', permissionsResponse, '', OPTIONS)
|
|
const permissionById = new Map((Array.isArray(permissions) ? permissions : [])
|
|
.map((item) => [id(item.id), item.permissionCode]))
|
|
|
|
const controllerCodes = ['platform:firstleg:pda:view', 'platform:firstleg:pda:assign',
|
|
'platform:firstleg:pda:work', 'platform:firstleg:pda:review',
|
|
'platform:firstleg:inbound:loading:view', 'platform:firstleg:inbound:loading:edit',
|
|
'platform:firstleg:inbound:loading:complete']
|
|
const controllerPermissions = (Array.isArray(permissions) ? permissions : [])
|
|
.filter((item) => controllerCodes.includes(item.permissionCode))
|
|
context.assert(MODULE, 'PDA和装柜证据Controller权限资源完整', permissionsResponse,
|
|
controllerPermissions.length === controllerCodes.length
|
|
&& controllerPermissions.every((item) => item.builtIn === true && item.status === 'ACTIVE'),
|
|
`matched=${controllerPermissions.length}/${controllerCodes.length}`, OPTIONS)
|
|
|
|
const rolesResponse = await context.request('GET', '/api/platform/v1/iam/roles')
|
|
const roles = context.apiSuccess(MODULE, '查询三期仓库内置角色', rolesResponse, '', OPTIONS)
|
|
const warehouseRoles = new Map((Array.isArray(roles) ? roles : [])
|
|
.filter((item) => ['WAREHOUSE_OPERATOR', 'WAREHOUSE_PICKER', 'WAREHOUSE_TALLY'].includes(item.roleCode))
|
|
.map((item) => [item.roleCode, item]))
|
|
context.assert(MODULE, '操作员、拣货员、理货员三个系统角色已启用', rolesResponse,
|
|
warehouseRoles.size === 3 && [...warehouseRoles.values()]
|
|
.every((role) => role.roleType === 'SYSTEM' && role.status === 'ACTIVE'),
|
|
`roles=${[...warehouseRoles.keys()].join(',')}`, OPTIONS)
|
|
|
|
const roleCodes = (roleCode) => new Set((warehouseRoles.get(roleCode)?.permissionIds || [])
|
|
.map((permissionId) => permissionById.get(id(permissionId))).filter(Boolean))
|
|
const pickerCodes = roleCodes('WAREHOUSE_PICKER')
|
|
context.assert(MODULE, '拣货员只具备国内PDA查询作业与海外PDA入仓操作权限', rolesResponse,
|
|
pickerCodes.size === 3
|
|
&& pickerCodes.has('platform:firstleg:pda:view')
|
|
&& pickerCodes.has('platform:firstleg:pda:work')
|
|
&& pickerCodes.has('lastleg:pda:operate'),
|
|
`permissions=${[...pickerCodes].sort().join(',')}`, OPTIONS)
|
|
|
|
const operatorCodes = roleCodes('WAREHOUSE_OPERATOR')
|
|
context.assert(MODULE, '操作员具备国内入仓权限与四期十项只读权限', rolesResponse,
|
|
operatorCodes.has('platform:firstleg:inbound:loading:view')
|
|
&& operatorCodes.has('platform:firstleg:inbound:loading:edit')
|
|
&& operatorCodes.size === 15
|
|
&& PHASE4_READ_CODES.every((code) => operatorCodes.has(code))
|
|
&& !operatorCodes.has('platform:firstleg:inbound:loading:complete')
|
|
&& !operatorCodes.has('platform:firstleg:pda:assign')
|
|
&& !operatorCodes.has('platform:firstleg:outbound-dispatch:confirm')
|
|
&& !operatorCodes.has('platform:firstleg:outbound-dispatch:reverse')
|
|
&& [...operatorCodes].filter((code) => code.startsWith('platform:overseas-'))
|
|
.every((code) => !PHASE4_WRITE_SUFFIXES.some((suffix) => code.endsWith(suffix))),
|
|
`permissionCount=${operatorCodes.size}`, OPTIONS)
|
|
|
|
const tallyCodes = roleCodes('WAREHOUSE_TALLY')
|
|
context.assert(MODULE, '理货员可后台维护证据和复核但不能完成装柜', rolesResponse,
|
|
tallyCodes.has('platform:firstleg:inbound:loading:view')
|
|
&& tallyCodes.has('platform:firstleg:inbound:loading:edit')
|
|
&& tallyCodes.has('platform:firstleg:pda:review')
|
|
&& tallyCodes.size === 22
|
|
&& PHASE4_READ_CODES.every((code) => tallyCodes.has(code))
|
|
&& !tallyCodes.has('platform:firstleg:inbound:loading:complete')
|
|
&& !tallyCodes.has('platform:firstleg:outbound-dispatch:confirm')
|
|
&& [...tallyCodes].filter((code) => code.startsWith('platform:overseas-'))
|
|
.every((code) => !PHASE4_WRITE_SUFFIXES.some((suffix) => code.endsWith(suffix))),
|
|
`permissionCount=${tallyCodes.size}`, OPTIONS)
|
|
|
|
context.assert(MODULE, '四期list权限同时用于列表与详情且不隐含写权限', rolesResponse,
|
|
PHASE4_READ_CODES.every((code) => code.endsWith(':list'))
|
|
&& [...operatorCodes, ...tallyCodes]
|
|
.filter((code) => code.startsWith('platform:overseas-'))
|
|
.every((code) => PHASE4_READ_CODES.includes(code)),
|
|
`phase4ReadCodes=${PHASE4_READ_CODES.length}`, OPTIONS)
|
|
|
|
context.assert(MODULE, '仓库系统角色不包含任何客户侧权限', rolesResponse,
|
|
[...operatorCodes, ...pickerCodes, ...tallyCodes]
|
|
.every((code) => code.startsWith('platform:') || code === 'lastleg:pda:operate'),
|
|
'warehouse roles may use platform:* plus the single overseas service authority lastleg:pda:operate', OPTIONS)
|
|
|
|
const unauthorized = await context.request('GET',
|
|
'/api/platform/v1/first-leg/pda-loading/tasks?cabinetNo=UNAUTHORIZED&warehouseId=1', undefined, '')
|
|
context.addStep(MODULE, '未登录访问仓库PDA任务被拒绝', unauthorized,
|
|
[401, 403].includes(unauthorized.http)
|
|
|| (unauthorized.http === 200 && ['A0401', 'A0403', '401', '403'].includes(String(unauthorized.body?.code))),
|
|
`HTTP=${unauthorized.http}, code=${unauthorized.body?.code ?? 'missing'}`, OPTIONS)
|
|
}
|