提交管理员操作一切

Tests/Store.Users.Tests/UserHttpTests.cs

@@ -239,6 +239,54 @@ public sealed class UserHttpTests : IAsyncLifetime
         Assert.Equal(0, await _context.Db.Select<Store.Users.Entities.UserTopUpQrcodeEntity>().CountAsync());
     }
 
+    [Fact]
+    public async Task GetSubUser_UsesAdminOrMainAccountScope()
+    {
+        _context.Seed("foreign-child", parent: "other");
+        using var allResponse = await _client.PostAsJsonAsync("/v1/user/GetSubUser", new { });
+        var all = await allResponse.Content.ReadFromJsonAsync<ApiResult<UserPage<UserInfo>>>();
+        Assert.Equal(HttpStatusCode.OK, allResponse.StatusCode);
+        Assert.True(all!.Success);
+        Assert.Equal(2, all.Data!.Total);
+
+        using var filteredResponse = await _client.PostAsJsonAsync("/v1/user/GetSubUser", new { parentUserName = "other" });
+        var filtered = await filteredResponse.Content.ReadFromJsonAsync<ApiResult<UserPage<UserInfo>>>();
+        Assert.True(filtered!.Success);
+        Assert.Equal("foreign-child", Assert.Single(filtered.Data!.Items).UserName);
+
+        _client.DefaultRequestHeaders.Remove("X-Test-User");
+        _client.DefaultRequestHeaders.Add("X-Test-User", "main");
+        using var ownResponse = await _client.PostAsJsonAsync("/v1/user/GetSubUser", new { });
+        var own = await ownResponse.Content.ReadFromJsonAsync<ApiResult<UserPage<UserInfo>>>();
+        Assert.True(own!.Success);
+        Assert.Equal("child", Assert.Single(own.Data!.Items).UserName);
+
+        using var forbiddenResponse = await _client.PostAsJsonAsync("/v1/user/GetSubUser", new { parentUserName = "other" });
+        Assert.Equal(HttpStatusCode.OK, forbiddenResponse.StatusCode);
+        var forbidden = await forbiddenResponse.Content.ReadFromJsonAsync<ApiResult>();
+        Assert.Equal(ResultCode.Forbidden, forbidden!.Code);
+    }
+
+    [Fact]
+    public async Task UpdateEndpoints_ApplySharedAccountManagementScope()
+    {
+        using var adminUpdate = await _client.PostAsJsonAsync("/v1/user/UpdateSubUser", new { id = _context.Child.Id, notes = "admin-update" });
+        Assert.True((await adminUpdate.Content.ReadFromJsonAsync<ApiResult<UserInfo>>())!.Success);
+        _client.DefaultRequestHeaders.Remove("X-Test-User");
+        _client.DefaultRequestHeaders.Add("X-Test-User", "main");
+        foreach (var id in new[] { _context.Main.Id, _context.Child.Id })
+        {
+            using var update = await _client.PostAsJsonAsync("/v1/user/UpdateUser", new { id, notes = "main-update" });
+            Assert.Equal(HttpStatusCode.OK, update.StatusCode);
+            Assert.True((await update.Content.ReadFromJsonAsync<ApiResult<UserInfo>>())!.Success);
+        }
+        using var forbidden = await _client.PostAsJsonAsync("/v1/user/UpdateUser", new { id = _context.Other.Id, notes = "bad" });
+        Assert.Equal(ResultCode.Forbidden, (await forbidden.Content.ReadFromJsonAsync<ApiResult>())!.Code);
+        using var reset = await _client.PostAsJsonAsync("/v1/user/ChangePassword", new { userName = "child", newPassword = "reset-password" });
+        Assert.True((await reset.Content.ReadFromJsonAsync<ApiResult>())!.Success);
+        Assert.NotNull(await _context.Authentication.Authenticate("child", "reset-password"));
+    }
+
     [Fact]
     public void ApiExplorerAndEndpointMetadata_UsePostForEveryAction()
     {