101 lines
5.9 KiB
PowerShell
101 lines
5.9 KiB
PowerShell
param(
|
|
[string]$MysqlPassword = "123456",
|
|
[string]$AdminPassword = "ChangeMe123!",
|
|
[string]$GatewayBaseUrl = "http://127.0.0.1:9000",
|
|
[string]$IamBaseUrl = ""
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$results = [System.Collections.Generic.List[object]]::new()
|
|
if ([string]::IsNullOrWhiteSpace($IamBaseUrl)) { $IamBaseUrl = $GatewayBaseUrl }
|
|
|
|
function Add-Result([string]$Name, [bool]$Passed, [string]$Evidence) {
|
|
$results.Add([pscustomobject]@{ Test = $Name; Passed = $Passed; Evidence = $Evidence })
|
|
Write-Host "[$(if ($Passed) { 'PASS' } else { 'FAIL' })] $Name - $Evidence"
|
|
if (-not $Passed) { throw "FAILED: $Name - $Evidence" }
|
|
}
|
|
|
|
function Invoke-Json([string]$Method, [string]$Uri, [hashtable]$Headers = @{}, [object]$Body = $null) {
|
|
$args = @{ Method = $Method; Uri = $Uri; Headers = $Headers; TimeoutSec = 10 }
|
|
if ($null -ne $Body) {
|
|
$args.ContentType = "application/json"
|
|
$args.Body = $Body | ConvertTo-Json -Depth 10
|
|
}
|
|
Invoke-RestMethod @args
|
|
}
|
|
|
|
function Decode-JwtPayload([string]$Token) {
|
|
$part = $Token.Split('.')[1].Replace('-', '+').Replace('_', '/')
|
|
switch ($part.Length % 4) { 2 { $part += '==' } 3 { $part += '=' } }
|
|
[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($part)) | ConvertFrom-Json
|
|
}
|
|
|
|
function Assert-ApiSuccess([string]$Name, [string]$Uri, [hashtable]$Headers) {
|
|
$response = Invoke-Json GET $Uri $Headers
|
|
Add-Result $Name ($response.code -eq '0') "code=$($response.code)"
|
|
}
|
|
|
|
$mysql = "D:\baiyue-runtime\mysql\server\bin\mysql.exe"
|
|
$redisCli = "D:\baiyue-runtime\redis\redis-cli.exe"
|
|
$verifySql = "D:/baiyue/iam/src/test/resources/db/verify-phase1-admin-rbac.sql"
|
|
|
|
$env:MYSQL_PWD = $MysqlPassword
|
|
$dbFailures = & $mysql '--host=127.0.0.1' '--port=3306' '--user=root' '--batch' '--raw' '--skip-column-names' "--execute=source $verifySql"
|
|
Add-Result "database seed assertions" ([string]::IsNullOrWhiteSpace(($dbFailures -join ''))) "no assertion rows"
|
|
|
|
$pong = & $redisCli -h 127.0.0.1 -p 6379 PING
|
|
Add-Result "redis connectivity" ($pong -eq 'PONG') "PING=$pong"
|
|
|
|
$nacosReady = (Invoke-WebRequest -UseBasicParsing -Uri 'http://127.0.0.1:8848/nacos/v1/console/health/readiness' -TimeoutSec 5).Content
|
|
Add-Result "nacos readiness" ($nacosReady -eq 'OK') "readiness=$nacosReady"
|
|
|
|
$nacosServices = Invoke-Json GET 'http://127.0.0.1:8848/nacos/v1/ns/service/list?pageNo=1&pageSize=50&groupName=BAIYUE&namespaceId=public'
|
|
$expectedServices = @('gateway', 'auth-service', 'iam-service', 'order-service', 'warehouse-service', 'firstleg-service', 'lastleg-service', 'audit-service')
|
|
$missingServices = @($expectedServices | Where-Object { $_ -notin $nacosServices.doms })
|
|
Add-Result "phase-one service registration" ($missingServices.Count -eq 0) "registered=$($nacosServices.count), missing=$($missingServices -join ',')"
|
|
|
|
$platformLogin = Invoke-Json POST "$GatewayBaseUrl/api/auth/login" @{} @{ username = 'platform_admin'; password = $AdminPassword }
|
|
$merchantLogin = Invoke-Json POST "$GatewayBaseUrl/api/auth/login" @{} @{ username = 'merchant_admin'; password = $AdminPassword }
|
|
Add-Result "platform administrator login" ($platformLogin.code -eq '0') "login success"
|
|
Add-Result "merchant administrator login" ($merchantLogin.code -eq '0') "login success"
|
|
|
|
$platformClaims = Decode-JwtPayload $platformLogin.data.accessToken
|
|
$merchantClaims = Decode-JwtPayload $merchantLogin.data.accessToken
|
|
Add-Result "platform JWT identity" (
|
|
$platformClaims.app_code -eq 'PLATFORM' -and $platformClaims.tenant_id -eq 0 -and
|
|
$platformClaims.membership_id -eq 3000001 -and 'PLATFORM_ADMIN' -in $platformClaims.roles -and
|
|
@($platformClaims.permissions).Count -eq 31
|
|
) "tenant=$($platformClaims.tenant_id), roles=$($platformClaims.roles -join ','), permissions=$(@($platformClaims.permissions).Count)"
|
|
Add-Result "merchant JWT identity" (
|
|
$merchantClaims.app_code -eq 'MERCHANT' -and $merchantClaims.tenant_id -eq 10001 -and
|
|
$merchantClaims.membership_id -eq 3000002 -and 'MERCHANT_OWNER' -in $merchantClaims.roles -and
|
|
@($merchantClaims.permissions).Count -eq 21
|
|
) "tenant=$($merchantClaims.tenant_id), roles=$($merchantClaims.roles -join ','), permissions=$(@($merchantClaims.permissions).Count)"
|
|
|
|
$platformHeaders = @{ Authorization = "Bearer $($platformLogin.data.accessToken)" }
|
|
$merchantHeaders = @{ Authorization = "Bearer $($merchantLogin.data.accessToken)" }
|
|
|
|
Assert-ApiSuccess "platform role list" "$IamBaseUrl/api/platform/v1/iam/roles" $platformHeaders
|
|
Assert-ApiSuccess "platform menu/button list" "$IamBaseUrl/api/platform/v1/iam/permissions" $platformHeaders
|
|
Assert-ApiSuccess "platform enterprise review list" "$IamBaseUrl/api/platform/v1/iam/reviews" $platformHeaders
|
|
Assert-ApiSuccess "platform first-leg order list" "$GatewayBaseUrl/api/platform/v1/orders/first-leg?tenantId=10001&page=1&size=10" $platformHeaders
|
|
Assert-ApiSuccess "platform warehouse list" "$GatewayBaseUrl/api/platform/v1/warehouse-admin?tenantId=10001&page=1&size=10" $platformHeaders
|
|
|
|
Assert-ApiSuccess "merchant enterprise profile" "$IamBaseUrl/api/merchant/v1/iam/tenant/profile" $merchantHeaders
|
|
Assert-ApiSuccess "merchant role list" "$IamBaseUrl/api/merchant/v1/iam/roles" $merchantHeaders
|
|
Assert-ApiSuccess "merchant menu/button list" "$IamBaseUrl/api/merchant/v1/iam/permissions" $merchantHeaders
|
|
Assert-ApiSuccess "merchant warehouse list" "$GatewayBaseUrl/api/merchant/v1/warehouses?page=1&size=10" $merchantHeaders
|
|
Assert-ApiSuccess "merchant first-leg order list" "$GatewayBaseUrl/api/merchant/v1/orders/first-leg?page=1&size=10" $merchantHeaders
|
|
|
|
$crossScopeStatus = 0
|
|
try {
|
|
Invoke-WebRequest -UseBasicParsing -Uri "$IamBaseUrl/api/merchant/v1/iam/tenant/profile" -Headers $platformHeaders -TimeoutSec 5 | Out-Null
|
|
$crossScopeStatus = 200
|
|
} catch {
|
|
$crossScopeStatus = [int]$_.Exception.Response.StatusCode
|
|
}
|
|
Add-Result "platform token denied from merchant APIs" ($crossScopeStatus -eq 403) "HTTP $crossScopeStatus"
|
|
|
|
$results | Format-Table -AutoSize
|
|
"PHASE1_ACCEPTANCE_PASSED=$($results.Count)"
|