WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

2026-09-22 16:19:06 +08:00
commit f7fc992f57
3929 changed files with 1006607 additions and 0 deletions
@@ -0,0 +1,41 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/Tencent/WeKnora/internal/accesspolicy"
+	"github.com/Tencent/WeKnora/internal/types"
+	"github.com/Tencent/WeKnora/internal/types/interfaces"
+)
+
+type batchAccessKBStub struct {
+	interfaces.KnowledgeBaseService
+	calls map[string]int
+}
+
+func (s *batchAccessKBStub) GetKnowledgeBaseByIDOnly(_ context.Context, id string) (*types.KnowledgeBase, error) {
+	s.calls[id]++
+	return &types.KnowledgeBase{ID: id, TenantID: 7, CreatorID: "owner"}, nil
+}
+
+func TestFilterAccessibleKnowledgeHonorsGrantAndRevocation(t *testing.T) {
+	kb := &batchAccessKBStub{calls: map[string]int{}}
+	s := &knowledgeService{kbService: kb}
+	ctx := context.WithValue(context.Background(), types.TenantIDContextKey, uint64(7))
+	ctx = context.WithValue(ctx, types.UserIDContextKey, "reader")
+	policy := &accesspolicy.Snapshot{Restricted: true, Permissions: map[string]bool{"knowledge.read": true}, Publications: map[string]bool{"knowledge:private": false, "knowledge:public": true}, Grants: map[string]bool{"knowledge:private": true}}
+	ctx = accesspolicy.WithSnapshot(ctx, policy)
+	rows := []*types.Knowledge{{ID: "one", KnowledgeBaseID: "private"}, {ID: "two", KnowledgeBaseID: "private"}, {ID: "public", KnowledgeBaseID: "public"}, {ID: "unpublished", KnowledgeBaseID: "unpublished"}, nil}
+	if got := s.filterAccessibleKnowledge(ctx, rows); len(got) != 3 || kb.calls["private"] != 1 {
+		t.Fatalf("grant should allow documents and check each KB once: %d rows, %v calls", len(got), kb.calls)
+	}
+	delete(policy.Grants, "knowledge:private")
+	if got := s.filterAccessibleKnowledge(ctx, rows); len(got) != 1 || got[0].ID != "public" {
+		t.Fatalf("revoked documents remain in batch: %v", got)
+	}
+	delete(policy.Permissions, "knowledge.read")
+	if got := s.filterAccessibleKnowledge(ctx, rows); len(got) != 0 {
+		t.Fatalf("module permission must restrict all documents: %v", got)
+	}
+}