feat: P0/P1/P2全部功能 — 四层泳道/视角切换/KPI看板/预警/差异反打/预算/知识面板/回顾会/情景预测/Excel导入/角色权限

backend/tests/test_permissions.py

@@ -0,0 +1,108 @@
+"""角色权限模块测试 — 模块/动作/权限配置CRUD"""
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy.orm import Session
+from tests.conftest import create_test_user, get_token_for_user, auth_header
+
+
+class TestPermissionModules:
+    """模块和动作定义测试"""
+
+    BASE = "/api/cma/permissions"
+
+    def test_list_modules(self, client: TestClient, db: Session):
+        """获取模块和动作定义"""
+        create_test_user(db)
+        token = get_token_for_user(client)
+
+        resp = client.get(f"{self.BASE}/modules", headers=auth_header(token))
+        assert resp.status_code == 200
+        data = resp.json()
+        assert "modules" in data
+        assert "actions" in data
+        assert "roles" in data
+        assert len(data["modules"]) > 0
+        assert len(data["actions"]) > 0
+        # 检查是否包含核心模块
+        module_keys = [m["key"] for m in data["modules"]]
+        assert "dashboard" in module_keys
+        assert "kpis" in module_keys
+        assert "budget" in module_keys
+
+
+class TestPermissionConfig:
+    """权限配置CRUD测试"""
+
+    BASE = "/api/cma/permissions"
+
+    def test_get_config_creates_defaults(self, client: TestClient, db: Session):
+        """首次获取自动创建默认配置"""
+        create_test_user(db)
+        token = get_token_for_user(client)
+
+        resp = client.get(f"{self.BASE}/config", headers=auth_header(token))
+        assert resp.status_code == 200
+        data = resp.json()
+        assert "route_permissions" in data
+        assert "action_permissions" in data
+        assert "ceo" in data["route_permissions"]
+        assert "finance" in data["route_permissions"]
+
+    def test_update_route_permissions(self, client: TestClient, db: Session):
+        """更新路由权限"""
+        create_test_user(db)
+        token = get_token_for_user(client)
+
+        new_route = {
+            "ceo": ["dashboard", "kpis", "maps"],
+            "finance": ["dashboard", "kpis"],
+        }
+        resp = client.put(
+            f"{self.BASE}/config",
+            headers=auth_header(token),
+            json={"route_permissions": new_route},
+        )
+        assert resp.status_code == 200
+        assert resp.json()["message"] == "权限配置已更新"
+
+        # 验证已更新
+        get_resp = client.get(f"{self.BASE}/config", headers=auth_header(token))
+        assert get_resp.json()["route_permissions"] == new_route
+
+    def test_update_action_permissions(self, client: TestClient, db: Session):
+        """更新动作权限"""
+        create_test_user(db)
+        token = get_token_for_user(client)
+
+        new_actions = {
+            "ceo": ["read", "approve", "delete"],
+            "it": ["read", "write", "admin"],
+        }
+        resp = client.put(
+            f"{self.BASE}/config",
+            headers=auth_header(token),
+            json={"action_permissions": new_actions},
+        )
+        assert resp.status_code == 200
+
+        get_resp = client.get(f"{self.BASE}/config", headers=auth_header(token))
+        assert get_resp.json()["action_permissions"] == new_actions
+
+    def test_update_both_simultaneously(self, client: TestClient, db: Session):
+        """同时更新路由和动作权限"""
+        create_test_user(db)
+        token = get_token_for_user(client)
+
+        resp = client.put(
+            f"{self.BASE}/config",
+            headers=auth_header(token),
+            json={
+                "route_permissions": {"ceo": ["dashboard"]},
+                "action_permissions": {"ceo": ["read"]},
+            },
+        )
+        assert resp.status_code == 200
+
+        data = client.get(f"{self.BASE}/config", headers=auth_header(token)).json()
+        assert data["route_permissions"] == {"ceo": ["dashboard"]}
+        assert data["action_permissions"] == {"ceo": ["read"]}