提交管理员操作一切

Tests/UserManagementSmoke/Program.cs

@@ -42,8 +42,8 @@ try
     Assert(await auth.Authenticate("main", "wrong") == null, "错误密码被接受");
     Assert(await auth.Authenticate(" main ", "legacy-password") != null, "旧密码登录失败");
     var stored = await db.Select<UserEntity>().Where(u => u.Id == main.Id).FirstAsync();
-    Assert(stored.Password != "legacy-password" && UserPassword.Verify(stored, "legacy-password"), "旧密码未升级");
-    Assert(await auth.Authenticate("main", "legacy-password") != null, "哈希密码登录失败");
+    Assert(stored.Password == "legacy-password" && UserPassword.Verify(stored, "legacy-password"), "登录不应修改已有密码");
+    Assert(await auth.Authenticate("main", "legacy-password") != null, "重复登录失败");
     var created = await users.Create(new() { UserName = "newmain", Password = "new-password" }, false, default);
     Assert(created.GroupId == 3 && created.ShopPointsPerMonth == 30 && created.Points == 0, "主账号默认值错误");
     Assert(!JsonSerializer.Serialize(created).Contains("Password", StringComparison.OrdinalIgnoreCase), "响应包含密码字段");
@@ -55,7 +55,7 @@ try
     await Reject(() => users.Create(new() { UserName = "bad-admin", Password = "password", SaLevel = 1 }, true, default));
     await Reject(() => users.Update(sub.Id, new() { ShopPointsPerMonth = 30 }, true, default));
     await Reject(() => users.GetUser(other.UserName, default));
-    await Reject(() => users.Search(new(), false, default));
+    Assert((await users.Search(new(), false, default)).Total == 2, "主账号列表范围错误");
     await Reject(() => users.Update(other.Id, new() { Notes = "tampered" }, true, default));
     await users.Update(sub.Id, new() { Notes = "" }, true, default);
     Assert((await users.Search(new(), true, default)).Total == 1, "子账号查询范围错误");
@@ -70,10 +70,10 @@ try
     await Reject(() => funds.Change(recharge, true, default));
     Assert((await db.Select<UserEntity>().Where(u => u.Id == main.Id).FirstAsync()).Points == 100, "重复请求造成重复充值");
     actor.UserName = "main";
-    await funds.Change(new() { UserName = "other", Amount = 30, Operation = "转移", RequestId = "transfer-1" }, true, default);
+    await funds.Change(new() { UserName = "child", Amount = 30, Operation = "转移", RequestId = "transfer-1" }, true, default);
     Assert((await db.Select<UserEntity>().Where(u => u.Id == main.Id).FirstAsync()).Points == 70, "转出错误");
-    Assert((await db.Select<UserEntity>().Where(u => u.Id == other.Id).FirstAsync()).Points == 30, "转入错误");
-    await Reject(() => funds.Change(new() { UserName = "other", Amount = 1000, Operation = "转移", RequestId = "overdraft" }, true, default));
+    Assert((await db.Select<UserEntity>().Where(u => u.Id == sub.Id).FirstAsync()).Points == 30, "转入错误");
+    await Reject(() => funds.Change(new() { UserName = "child", Amount = 1000, Operation = "转移", RequestId = "overdraft" }, true, default));
     Assert(await db.Select<UserPointsRecordEntity>().Where(r => r.OutTradeNo == "user:overdraft").CountAsync() == 0, "失败转账产生流水");
     actor.UserName = "admin";
     await funds.Change(new() { UserName = "main", Amount = 25.5m, Operation = "充值", RequestId = "balance-1" }, false, default);
@@ -100,14 +100,15 @@ try
     actor.UserName = "main";
     await db.Ado.ExecuteNonQueryAsync("CREATE TRIGGER reject_credit BEFORE INSERT ON points WHEN NEW.option_type = '转入' BEGIN SELECT RAISE(ABORT, 'test rollback'); END");
     bool failed = false;
-    try { await funds.Change(new() { UserName = "other", Amount = 10, Operation = "转移", RequestId = "rollback" }, true, default); }
+    try { await funds.Change(new() { UserName = "child", Amount = 10, Operation = "转移", RequestId = "rollback" }, true, default); }
     catch (Exception ex) when (ex.Message.Contains("test rollback")) { failed = true; }
     Assert(failed, "测试故障未触发");
     Assert((await db.Select<UserEntity>().Where(u => u.Id == main.Id).FirstAsync()).Points == 70, "转账失败未回滚转出账户");
-    Assert((await db.Select<UserEntity>().Where(u => u.Id == other.Id).FirstAsync()).Points == 30, "转账失败未回滚转入账户");
+    Assert((await db.Select<UserEntity>().Where(u => u.Id == sub.Id).FirstAsync()).Points == 30, "转账失败未回滚转入账户");
     Assert(await db.Select<UserPointsRecordEntity>().Where(r => r.OutTradeNo == "user:rollback").CountAsync() == 0, "转账失败未回滚流水");
     await db.Ado.ExecuteNonQueryAsync("DROP TRIGGER reject_credit");
     var messageId = await users.AddTopUpMessage(new() { Message = "银行充值待核实" }, default);
+    actor.UserName = "other";
     await Reject(() => users.UpdateTopUpMessage(new() { Id = messageId, Result = "已处理" }, default));
     actor.UserName = "other";
     Assert((await users.TopUpMessages(new(), default)).Total == 0, "充值备注越权泄漏");
@@ -125,7 +126,7 @@ try
     var shopOwner = Seed("shop-owner", 0);
     await db.Insert(new ShopEntity { UserName = shopOwner.UserName, ShopId = "test-shop" }).ExecuteAffrowsAsync();
     await Reject(() => users.Delete(shopOwner.Id, default));
-    Console.WriteLine("PASS: 用户认证、密码升级、权限隔离、主子账号、计费继承、资金事务、重复请求、超扣回滚、删除限制、参数边界。");
+    Console.WriteLine("PASS: 用户认证、登录不修改密码、权限隔离、主子账号、计费继承、资金事务、重复请求、超扣回滚、删除限制、参数边界。");
 
     UserEntity Seed(string name, short level)
     {