AiDOPWarehouse/server/Plugins/Admin.NET.Plugin.AiDOP.Tests/S8/S8MasterDataScopeGuardTests.cs

using Admin.NET.Plugin.AiDOP.Controllers.S8;
using Admin.NET.Plugin.AiDOP.Infrastructure;
using Admin.NET.Plugin.AiDOP.Service.S8;
using System.Reflection;
using Xunit;

namespace Admin.NET.Plugin.AiDOP.Tests.S8;

/// <summary>
/// S8-P0-3-MASTERDATA-TRUSTED-SCOPE-1：S8 主数据 / 操作员绑定的跨租户越权守卫。
///
/// <para>背景（2026-09-02 以普通租户账号 UATExceptionA 实测，HTTP 200）：</para>
/// <list type="bullet">
///   <item><c>GET /api/aidop/s8/config/operator-bindings</c>（不带任何参数）→ 500 行，
///         按工厂分布 {1000: 498, 1329900200002: 2}，**全部属于其它租户，本租户 0 行**；</item>
///   <item><c>GET /api/aidop/s8/config/operator-bindings?factoryRefId=1000</c> → 500 条外租户员工；</item>
///   <item><c>GET /api/aidop/s8/master-data/employees?factoryRefId=1000</c> → 500 条外租户员工工号 + 真实姓名。</item>
/// </list>
///
/// <para>根因：两个控制器都未接入 <see cref="S8TrustedScopeResolver"/>（KNOWN-ISSUES I-001 的 6 个之二），
/// 服务层用 <c>ClearFilter()</c> + **客户端传入的** <c>factoryRefId</c> 作边界，
/// 且 <c>ListAsync</c> 的该谓词还是 <c>WhereIF(factoryRefId.HasValue, …)</c> —— 可选，不传即无边界。</para>
///
/// <para>本测试锁住修复后的口径：作用域只能来自服务端认证身份；客户端 factoryRefId / tenantId
/// 不得出现在任何 Action 或 Service 签名上，杜绝「以后有人又把它接回去」。</para>
/// </summary>
public class S8MasterDataScopeGuardTests
{
    private static readonly string PluginRoot =
        Path.GetFullPath(Path.Combine(AppContext.BaseDirectory, "../../../../Admin.NET.Plugin.AiDOP"));

    private const string MasterDataSrc = "Service/S8/S8MasterDataAdapter.cs";

    private static string ReadSource(string relativePath)
    {
        var full = Path.Combine(PluginRoot, relativePath);
        Assert.True(File.Exists(full), $"源码文件不存在，路径需同步更新：{full}");
        return File.ReadAllText(full);
    }

    /// <summary>只取可执行代码行：注释里为留档会复述旧写法，不应算违规。</summary>
    private static List<string> CodeLines(string relativePath) =>
        ReadSource(relativePath)
            .Split('\n')
            .Select(l => l.Trim())
            .Where(l => !l.StartsWith("///", StringComparison.Ordinal)
                     && !l.StartsWith("//", StringComparison.Ordinal))
            .ToList();

    private static IEnumerable<MethodInfo> ActionsOf(Type controller) =>
        controller.GetMethods(BindingFlags.Instance | BindingFlags.Public | BindingFlags.DeclaredOnly);

    // ───────────────────────── 控制器层 ─────────────────────────

    /// <summary>
    /// 仍在服务的控制器必须从可信作用域取租户。
    ///
    /// <para><c>AdoS8ConfigBindingsController</c> 已整体退役（全部 Action 返回 410），
    /// 不再注入任何服务、也不再解析作用域 —— 一个不查库、不写库的墓碑入口
    /// 要作用域解析器没有意义。它的守卫改由 <see cref="OperatorBinding_IsRetired"/> 承担。</para>
    /// </summary>
    [Theory]
    [InlineData(typeof(AdoS8MasterDataController))]
    public void Controller_InjectsTrustedScopeResolver(Type controller)
    {
        var ctor = controller.GetConstructors().Single();
        Assert.Contains(ctor.GetParameters(), p => p.ParameterType == typeof(S8TrustedScopeResolver));
    }

    /// <summary>客户端不得再通过 query / route 指定作用域：这两个名字必须从 Action 签名彻底消失。</summary>
    [Theory]
    [InlineData(typeof(AdoS8ConfigBindingsController))]
    [InlineData(typeof(AdoS8MasterDataController))]
    public void ControllerActions_DoNotAcceptClientSuppliedScope(Type controller)
    {
        foreach (var action in ActionsOf(controller))
        {
            foreach (var p in action.GetParameters())
            {
                Assert.False(
                    string.Equals(p.Name, "factoryRefId", StringComparison.OrdinalIgnoreCase)
                    || string.Equals(p.Name, "factoryId", StringComparison.OrdinalIgnoreCase)
                    || string.Equals(p.Name, "tenantId", StringComparison.OrdinalIgnoreCase),
                    $"{controller.Name}.{action.Name} 仍接受客户端作用域参数 {p.Name}");
            }
        }
    }

    // ───────────────────────── 服务层签名 ─────────────────────────

    /// <summary>五个入口必须以 S8TrustedScope 作首参，且不得再出现 factoryRefId 形参。</summary>
    [Theory]
    [InlineData(typeof(S8MasterDataAdapter), "GetDepartmentsAsync")]
    // S8-SYSUSER-ONLY-1：GetEmployeesAsync → GetOperatorUsersAsync（员工下拉换成账号下拉）；
    // S8OperatorBindingService 四个入口随该服务一并退役，见 OperatorBinding_IsRetired。
    [InlineData(typeof(S8MasterDataAdapter), "GetOperatorUsersAsync")]
    [InlineData(typeof(S8MasterDataAdapter), "GetLinesAsync")]
    public void ServiceEntryPoints_TakeTrustedScopeAndRejectClientFactory(Type service, string method)
    {
        var m = service.GetMethod(method, BindingFlags.Instance | BindingFlags.Public);
        Assert.NotNull(m);

        var ps = m!.GetParameters();
        Assert.NotEmpty(ps);
        Assert.Equal(typeof(S8TrustedScope), ps[0].ParameterType);

        Assert.DoesNotContain(ps, p =>
            string.Equals(p.Name, "factoryRefId", StringComparison.OrdinalIgnoreCase)
            || string.Equals(p.Name, "factoryId", StringComparison.OrdinalIgnoreCase)
            || string.Equals(p.Name, "tenantId", StringComparison.OrdinalIgnoreCase));
    }

    // ───────────────────────── 服务层查询谓词 ─────────────────────────

    /// <summary>
    /// S8-SYSUSER-ONLY-1：绑定服务整体退役，原先三条「ClearFilter 必须收口」「SysUser 查询必须带租户」
    /// 「绑定/解绑必须按作用域绑行」的断言合并为一条 —— <b>这个写 EmployeeMaster 的写路径不得复活</b>。
    ///
    /// <para>那三条守的是同一件事：一个能把任意员工绑成本租户处理人的写入口，必须有租户边界。
    /// 现在这个入口本身不存在了，守卫的对象也就从「边界写对没有」变成「入口有没有被引回来」。</para>
    /// </summary>
    [Fact]
    public void OperatorBinding_IsRetired()
    {
        Assert.False(File.Exists(Path.Combine(PluginRoot, "Service", "S8", "S8OperatorBindingService.cs")),
            "S8OperatorBindingService 已退役，不得复活");

        var src = string.Join('\n', CodeLines("Controllers/S8/AdoS8ConfigBindingsController.cs"));
        Assert.Contains("Status410Gone", src);
        // 退役后的入口不应该还保有写主数据的能力。
        Assert.DoesNotContain("EmployeeMaster", src);
        Assert.DoesNotContain("_empRep", src);
    }

    /// <summary>主数据三个入口的边界必须来自 scope 的租户，不得来自入参、更不得退回工厂。</summary>
    [Fact]
    public void MasterData_ScopeComesFromTrustedScopeOnly()
    {
        var src = string.Join('\n', CodeLines(MasterDataSrc));

        Assert.Contains("x.TenantId == scope.TenantId", src);
        Assert.Contains("u.TenantId == scope.TenantId", src);
        Assert.DoesNotContain("x.FactoryRefId == scope.FactoryId", src);

        // 客户端参数写法必须消失。
        Assert.DoesNotContain("factoryRefId!.Value", src);
        Assert.DoesNotContain("factoryRefId.HasValue", src);
    }

}