Aislo/resources/tester/test_m02_layer_access.py

"""M02 층 권한 한 벌(PLAN 27-1c · `M02_Layer_Access`) — 나무 · 항목 · 양식 · 남의 층 목록 같은 규칙.

① `grant` 표 — 역할(일반 · 회사 관리자 · 시스템 관리자) × 층(마스터 · 자기 회사 · 남의 회사 ·
   자기 개인 · 같은 회사 남 · 다른 회사 남) = 읽기 · 수정 · 막힘.
② 임시 storage — 남의 층은 자리가 있을 때만(없으면 404 · 폴더 안 만듦) · 나무 · 양식 길 같은 답 ·
   남의 층 목록(회사 = 시스템 관리자 · 개인 = 회사 관리자 자기 회사 · 본인 뺌 · 자리 있는 것만).
"""

from __future__ import annotations

from pathlib import Path
from typing import Any

import pytest
from fastapi import HTTPException

from config import config_system
from M02_MasterTemplete import M02_Layer_Access as access
from M02_MasterTemplete import M02_MasterTemplete_Router_Items as items_router
from M02_MasterTemplete import M02_MasterTemplete_Router_Layers as layers_router
from M02_MasterTemplete import M02_MasterTemplete_Store as store
from M02_MasterTemplete import M02_Template_Layers as layers
from resources.tester.test_m02_structure import write_sample_table
from resources.tester.test_m02_tree import _app

USER = {"user_id": 42, "company_id": 7, "role": "USER", "is_master": False}
ADMIN = {**USER, "role": "ADMIN"}
MASTER = {**USER, "is_master": True}
SYSADMIN = {**USER, "role": "SYSTEM_ADMIN"}


def _answer(session: dict[str, Any], layer: str, owner: str | None) -> str:
    try:
        return "수정" if access.grant(session, layer, owner).write else "읽기"
    except HTTPException as error:
        return str(error.status_code)


def test_권한_표():
    cases = [
        ("system", None),
        ("company", None),
        ("company", "9"),
        ("personal", None),
        ("personal", "7/43"),
        ("personal", "9/90"),
    ]
    got = {
        name: [_answer(s, *c) for c in cases]
        for name, s in (
            ("일반", USER),
            ("회사관리", ADMIN),
            ("마스터", MASTER),
            ("시스템", SYSADMIN),
        )
    }
    assert got == {
        "일반": ["읽기", "읽기", "403", "수정", "403", "403"],
        "회사관리": ["읽기", "수정", "403", "수정", "수정", "403"],  # 맡은 회사(39-6)
        "마스터": ["읽기", "수정", "403", "수정", "수정", "403"],
        "시스템": ["수정", "수정", "수정", "수정", "수정", "수정"],  # 어느 회사나 맡음
    }
    # 자기 층 owner 를 적어도 같음 · 모양 틀림 400 · 회사 없음 409
    assert access.grant(USER, "personal", "7/42").write is True
    assert _answer(SYSADMIN, "personal", "9") == "400"
    assert _answer({**USER, "company_id": None}, "company", None) == "409"
    with pytest.raises(HTTPException) as caught:
        access.require(USER, "company", None, write=True)
    assert caught.value.status_code == 403


@pytest.fixture()
def world(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> dict[str, Any]:
    system = tmp_path / "system"
    system.mkdir()
    write_sample_table(system)
    monkeypatch.setattr(store, "FOLDER", system)
    monkeypatch.setattr(layers, "SYSTEM_ROOT", system)
    store.renumber()
    storage = tmp_path / "storage"
    storage.mkdir()
    monkeypatch.setattr(config_system, "STORAGE_BASE_DIR", str(storage))
    users = {42: 7, 43: 7, 44: 7, 90: 9}

    async def company_users(company_id: int) -> list[dict[str, Any]]:
        return [{"user_id": u, "name": f"u{u}"} for u, c in users.items() if c == company_id]

    async def companies() -> list[dict[str, Any]]:
        return [{"company_id": c, "name": f"c{c}"} for c in (7, 8, 9)]

    monkeypatch.setattr(layers_router, "_company_users", company_users)
    monkeypatch.setattr(layers_router, "_companies", companies)
    notes: list[tuple[int, str, str | None]] = []

    async def member(owner: str) -> bool:
        company, _, user = owner.partition("/")
        return users.get(int(user)) == int(company) if user else int(company) in (7, 8, 9)

    async def note(session: dict[str, Any], got: Any) -> None:
        notes.append((session["user_id"], got.layer, got.owner))

    monkeypatch.setattr(items_router, "_member", member)
    monkeypatch.setattr(items_router, "_note", note)
    session: dict[str, Any] = dict(USER)
    return {"client": _app(session), "session": session, "storage": storage, "notes": notes}


def test_남의_층은_자리가_있을_때만_읽기(world: dict[str, Any]):
    client, session, storage = world["client"], world["session"], world["storage"]
    session.update(ADMIN)
    tree = "/api/m02/layers/personal/tree?owner=7/43"
    table = "/api/m02/layers/personal/templates/table/구조물집계표?owner=7/43"
    assert client.get(tree).status_code == 404  # 43 은 아직 아무것도 없음
    assert not (storage / "7/43").exists()  # 읽기로 남의 폴더를 만들지 않음
    (storage / "7/43/templates").mkdir(parents=True)  # 폴더만 있고 집계표 없음
    assert client.get(tree).status_code == 404
    assert client.get(table).status_code == 404
    assert client.get("/api/m02/items?layer=personal&owner=7/43").status_code == 404
    assert not any((storage / "7/43/templates").iterdir())  # 읽기로 남의 층에 뼈대를 안 씀
    session.update(user_id=43)
    assert client.get("/api/m02/layers/personal/tree").status_code == 200  # 43 첫 진입 = 뼈대
    session.update(user_id=42)
    assert client.get(tree).status_code == 200
    assert client.get(table).status_code == 200  # 양식 길도 같은 규칙
    body = {"op": "add-folder", "경로": [], "이름": "새", "판": client.get(tree).json()["판"]}
    assert client.post(tree, json=body).status_code == 200  # 맡은 회사 = 고침(39-6)
    assert world["notes"] == [(42, "personal", "7/43")]  # 남의 층 쓰기 = 시스템 로그 한 줄
    assert client.get("/api/m02/items?layer=personal&owner=7/43").status_code == 200
    session.update(USER)
    assert client.get(tree).status_code == 403
    assert client.get(table).status_code == 403
    assert (
        client.post(tree, json={**body, "이름": "몰래"}).status_code == 403
    )  # 일반 = 남 개인 막힘
    session.update(SYSADMIN)
    assert client.get(tree).status_code == 200
    body = {"op": "add-folder", "경로": [], "이름": "AS", "판": client.get(tree).json()["판"]}
    assert client.post(tree, json=body).status_code == 200  # 시스템 관리자 = 어느 회사나


def test_남의_층_첫_쓰기는_소속_확인_뒤_뼈대(world: dict[str, Any]):
    """39-6 — 폴더 없는 남의 층에 쓰면 주인이 있을 때만 뼈대 · 없는 사람 · 남의 회사 사람은 403 ·
    읽기는 여전히 뼈대를 안 만듦 · 일위대가 키는 그 층 머리(UC · UP)."""
    client, session, storage = world["client"], world["session"], world["storage"]
    session.update(ADMIN)
    add = {"op": "add-folder", "경로": [], "이름": "새", "판": ""}
    assert client.get("/api/m02/layers/personal/tree?owner=7/44").status_code == 404
    assert not (storage / "7/44").exists()
    assert client.post("/api/m02/layers/personal/tree?owner=7/99", json=add).status_code == 403
    assert not (storage / "7/99").exists()  # 없는 사람 폴더를 안 만듦
    assert client.post("/api/m02/layers/personal/tree?owner=9/90", json=add).status_code == 403
    first = client.post("/api/m02/layers/personal/tree?owner=7/44", json=add)
    assert first.status_code == 409  # 뼈대는 섰고 판이 달라 409 — 다시 읽고 고침
    assert (storage / "7/44/templates/table/구조물집계표.json").is_file()
    add["판"] = client.get("/api/m02/layers/personal/tree?owner=7/44").json()["판"]
    assert client.post("/api/m02/layers/personal/tree?owner=7/44", json=add).status_code == 200
    session.update(SYSADMIN)
    assert client.post("/api/m02/layers/company/tree?owner=5", json=add).status_code == 403
    assert not (storage / "5").exists()  # 없는 회사
    add["판"] = ""
    assert client.post("/api/m02/layers/company/tree?owner=9", json=add).status_code == 409
    assert (storage / "9/templates/table/구조물집계표.json").is_file()
    assert [n[2] for n in world["notes"]] == ["7/44"]  # 성공한 쓰기만(39-1d) · 409 · 403 은 안 남김


def test_남의_층_목록(world: dict[str, Any]):
    client, session, storage = world["client"], world["session"], world["storage"]
    for owner in ("7/43", "9/90"):  # 층 폴더가 있는 사람만 목록에
        (storage / owner / "templates").mkdir(parents=True)
    (storage / "9/templates").mkdir()
    people = "/api/m02/layers/personal/owners"
    assert client.get(people).status_code == 403  # 일반 사용자
    assert client.get("/api/m02/layers/company/owners").status_code == 403
    (storage / "7/43/templates/table").mkdir(parents=True)
    (storage / "7/43/templates/table/구조물집계표.json").write_text("{}", encoding="utf-8")
    session.update(ADMIN)
    assert client.get(people).json() == [  # 39-6 — 회사 사람 전부 · 나 맨 위 · 빈 사람 표시
        {"owner": "7/42", "name": "u42", "비어있음": True},
        {"owner": "7/43", "name": "u43", "비어있음": False},
        {"owner": "7/44", "name": "u44", "비어있음": True},
    ]
    assert not (storage / "7/44").exists()  # 목록이 폴더를 안 만듦
    assert client.get(f"{people}?company=9").status_code == 403  # 남의 회사 사람
    session.update(SYSADMIN)
    assert client.get("/api/m02/layers/company/owners").json() == [
        {"owner": "7", "name": "c7"},  # 자기 회사는 자리 없어도
        {"owner": "9", "name": "c9"},
    ]
    assert client.get(f"{people}?company=9").json() == [
        {"owner": "9/90", "name": "u90", "비어있음": True}
    ]