docs: freeze v1.2 permission baseline

2026-10-25 08:36:39 +08:00
parent d51c4c6a76
commit a3bd1e8a95
4 changed files with 166 additions and 0 deletions
@@ -0,0 +1,69 @@
+package com.danyang.match.platform.deployment;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Locks the V1.2 role/scope baseline before implementation tasks consume it. */
+class PermissionBaselineContractTest {
+
+    private static final Path ROOT = Path.of(".");
+    private static final Path MATRIX = ROOT.resolve("docs/v12/V1.2-角色权限与前端入口矩阵.md");
+    private static final Path DECISIONS = ROOT.resolve("docs/governance/decision-register.md");
+    private static final Path V070 = ROOT.resolve("backend/src/main/resources/db/migration/V070__remove_matchmaker_cross_domain_permissions.sql");
+    private static final Path V071 = ROOT.resolve("backend/src/main/resources/db/migration/V071__remove_matchmaker_review_permissions.sql");
+
+    @Test
+    void matrixFreezesRolesScopesMenusAndForbiddenOperations() throws Exception {
+        String matrix = Files.readString(MATRIX);
+        for (String role : new String[]{"user", "matchmaker", "matchmaker_leader", "platform_admin", "super_admin",
+                "reviewer", "activity_manager", "risk_operator", "organization_admin", "counselor",
+                "counseling_manager", "service_station_operator", "content_editor", "data_viewer"}) {
+            assertTrue(matrix.contains("`" + role + "`"), "矩阵缺少角色: " + role);
+        }
+        assertAll(
+                () -> assertTrue(matrix.contains("本人有效 `matchmaker_assignments`")),
+                () -> assertTrue(matrix.contains("本人所属组织内")),
+                () -> assertTrue(matrix.contains("平台范围")),
+                () -> assertTrue(matrix.contains("review.process")),
+                () -> assertTrue(matrix.contains("counseling.service.assign/process")),
+                () -> assertTrue(matrix.contains("service_appointment.assign/confirm/complete")),
+                () -> assertTrue(matrix.contains("activity.review_registration")),
+                () -> assertTrue(matrix.contains("counseling.note.view")),
+                () -> assertTrue(matrix.contains("代用户决策")),
+                () -> assertTrue(matrix.contains("userId")),
+                () -> assertTrue(matrix.contains("403"))
+        );
+    }
+
+    @Test
+    void historicalRevocationsAreExplicitlySupersededByTheDecision() throws Exception {
+        String matrix = Files.readString(MATRIX);
+        String decisions = Files.readString(DECISIONS);
+        String v070 = Files.readString(V070);
+        String v071 = Files.readString(V071);
+        assertAll(
+                () -> assertTrue(matrix.contains("V070、V071 是在本需求确认前形成的收敛迁移")),
+                () -> assertTrue(matrix.contains("不得通过修改历史迁移文件解决冲突")),
+                () -> assertTrue(decisions.contains("V1.2 工作台权限冲突裁决（2026-10-25）")),
+                () -> assertTrue(v070.contains("DELETE FROM role_permissions")),
+                () -> assertTrue(v071.contains("DELETE FROM role_permissions"))
+        );
+    }
+
+    @Test
+    void matchmakerBaselineDoesNotGrantSensitiveOrUserDecisionPermissions() throws Exception {
+        String matrix = Files.readString(MATRIX);
+        assertAll(
+                () -> assertTrue(matrix.contains("`matchmaker.assign`")),
+                () -> assertTrue(matrix.contains("`counseling.note.view`")),
+                () -> assertTrue(matrix.contains("资格原始佐证")),
+                () -> assertTrue(matrix.contains("Like/Pass")),
+                () -> assertTrue(matrix.contains("未发布资料 revision 不得进入展示、推荐、匹配、红娘服务或统计"))
+        );
+        assertFalse(matrix.contains("matchmaker` | 平台范围"), "普通红娘不能被定义为平台范围");
+    }
+}