feat(cloud-console): add user authentication and administration

2026-07-13 17:54:53 +08:00
parent 035b177128
commit cdef630e67
35 changed files with 4126 additions and 113 deletions
@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+from cloud.control_config import CloudControlConfig
+from cloud.database import CloudDatabase
+from cloud.schema import upgrade_database
+from cloud_api import admin_cli
+
+
+def test_admin_cli_creates_user_with_interactive_password(monkeypatch, tmp_path, capsys) -> None:
+    database_url = f"sqlite:///{(tmp_path / 'cloud.sqlite3').as_posix()}"
+    upgrade_database(database_url)
+    monkeypatch.setattr(
+        admin_cli,
+        "load_control_config",
+        lambda: CloudControlConfig(database_url=database_url),
+    )
+    answers = iter(("correct-horse-battery-staple", "correct-horse-battery-staple"))
+    monkeypatch.setattr(admin_cli, "getpass", lambda _: next(answers))
+
+    admin_cli.main(
+        [
+            "users",
+            "create",
+            "--username",
+            "admin",
+            "--display-name",
+            "Administrator",
+            "--role",
+            "admin",
+        ]
+    )
+
+    database = CloudDatabase(database_url, create_schema=False)
+    try:
+        user = database.repository.get_user_by_normalized_username("admin")
+        assert user is not None
+        assert user.role == "admin"
+        assert "correct-horse-battery-staple" not in capsys.readouterr().out
+    finally:
+        database.close()
+
+
+def test_admin_cli_rejects_password_confirmation_mismatch(monkeypatch, tmp_path) -> None:
+    database_url = f"sqlite:///{(tmp_path / 'cloud.sqlite3').as_posix()}"
+    upgrade_database(database_url)
+    monkeypatch.setattr(
+        admin_cli,
+        "load_control_config",
+        lambda: CloudControlConfig(database_url=database_url),
+    )
+    answers = iter(("correct-horse-battery-staple", "different-password"))
+    monkeypatch.setattr(admin_cli, "getpass", lambda _: next(answers))
+
+    try:
+        admin_cli.main(["users", "create", "--username", "admin", "--role", "admin"])
+    except SystemExit as error:
+        assert str(error) == "password confirmation did not match"
+    else:
+        raise AssertionError("expected password confirmation failure")
+
+    database = CloudDatabase(database_url, create_schema=False)
+    try:
+        assert database.repository.get_user_by_normalized_username("admin") is None
+    finally:
+        database.close()