xinmi/internal/application/service/asset_copy_policy_test.go

package service

import (
	"testing"

	"github.com/Tencent/WeKnora/internal/accesspolicy"
	"github.com/Tencent/WeKnora/internal/types"
	"github.com/stretchr/testify/require"
)

func TestKnowledgeBaseCopyRejectsSharedSourcesAndTargets(t *testing.T) {
	repo := newFakeKBRepo()
	repo.rows["shared"] = &types.KnowledgeBase{ID: "shared", TenantID: 1, CreatorID: "alice", Name: "Shared"}
	repo.rows["owned"] = &types.KnowledgeBase{ID: "owned", TenantID: 1, CreatorID: "bob", Name: "Owned"}
	svc := newPR3KBService(repo, &fakeRegistry{}, &fakeOwnership{})
	bob := accesspolicy.WithSnapshot(instructionContext(1, "bob", types.TenantRoleContributor), &accesspolicy.Snapshot{Publications: map[string]bool{"knowledge:shared": true}})
	_, _, err := svc.CopyKnowledgeBase(bob, "shared", "")
	require.ErrorContains(t, err, "不能复制")
	_, err = svc.DuplicateKnowledgeBase(bob, "shared")
	require.ErrorContains(t, err, "不能复制")
	_, _, err = svc.CopyKnowledgeBase(bob, "owned", "shared")
	require.ErrorContains(t, err, "不能复制")
	require.Len(t, repo.rows, 2, "denied copies must not create destination rows")
	_, _, err = svc.CopyKnowledgeBase(bob, "owned", "")
	require.NoError(t, err)
	admin := instructionContext(1, "admin", types.TenantRoleAdmin)
	_, _, err = svc.CopyKnowledgeBase(admin, "shared", "")
	require.NoError(t, err)
	require.Error(t, CheckKnowledgeBaseCopyPermission(instructionContext(2, "admin", types.TenantRoleAdmin), repo.rows["shared"]))
}

func TestAgentCopyPreservesOwnerAndAdminPermissions(t *testing.T) {
	repo := &lifecycleAgentRepo{rows: map[string]*types.CustomAgent{"a": {ID: "a", TenantID: 1, CreatedBy: "alice", Name: "A", Visibility: "global", Enabled: true}}}
	svc := &customAgentService{repo: repo}
	for _, identity := range []struct {
		user string
		role types.TenantRole
	}{{"alice", types.TenantRoleContributor}, {"admin", types.TenantRoleAdmin}} {
		copy, err := svc.CopyAgent(instructionContext(1, identity.user, identity.role), "a")
		require.NoError(t, err)
		require.Equal(t, identity.user, copy.CreatedBy)
		require.Equal(t, "private", copy.Visibility)
	}
}