feat(auth): JWT(HS256 stdlib) + RBAC(owner/admin/viewer) + API key + 密码 hash；config 校验

internal/auth/role_test.go

@@ -0,0 +1,95 @@
+package auth
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestParseRole_Valid(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		in   string
+		want Role
+	}{
+		{"owner", "owner", RoleOwner},
+		{"admin", "admin", RoleAdmin},
+		{"viewer", "viewer", RoleViewer},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := ParseRole(tc.in)
+			if err != nil {
+				t.Fatalf("ParseRole(%q) error: %v", tc.in, err)
+			}
+			if got != tc.want {
+				t.Errorf("ParseRole(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestParseRole_Invalid(t *testing.T) {
+	t.Parallel()
+	if _, err := ParseRole("superuser"); err == nil {
+		t.Fatal("expected error for unknown role, got nil")
+	} else if !errors.Is(err, ErrInvalidRole) {
+		t.Fatalf("error = %v, want ErrInvalidRole", err)
+	}
+}
+
+func TestRole_Valid(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		role Role
+		want bool
+	}{
+		{"owner", RoleOwner, true},
+		{"admin", RoleAdmin, true},
+		{"viewer", RoleViewer, true},
+		{"empty", "", false},
+		{"unknown", Role("god"), false},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := tc.role.Valid(); got != tc.want {
+				t.Errorf("Role(%q).Valid() = %v, want %v", tc.role, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestHasRole_Hierarchy(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name     string
+		role     Role
+		required Role
+		want     bool
+	}{
+		{"owner satisfies owner", RoleOwner, RoleOwner, true},
+		{"owner satisfies admin", RoleOwner, RoleAdmin, true},
+		{"owner satisfies viewer", RoleOwner, RoleViewer, true},
+		{"admin satisfies admin", RoleAdmin, RoleAdmin, true},
+		{"admin satisfies viewer", RoleAdmin, RoleViewer, true},
+		{"admin fails owner", RoleAdmin, RoleOwner, false},
+		{"viewer satisfies viewer", RoleViewer, RoleViewer, true},
+		{"viewer fails admin", RoleViewer, RoleAdmin, false},
+		{"viewer fails owner", RoleViewer, RoleOwner, false},
+		{"invalid fails viewer", Role("x"), RoleViewer, false},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := HasRole(tc.role, tc.required); got != tc.want {
+				t.Errorf("HasRole(%q,%q) = %v, want %v", tc.role, tc.required, got, tc.want)
+			}
+		})
+	}
+}