mirror of
https://github.com/dartdavros/chatballs.git
synced 2026-10-05 01:14:58 +03:00
AndreyandClaude Fable 5.1
1a61780dec
- каталог code/custocrm → code/chatballs; CLI custocrm → chatballs; пакеты hub_platform → chatballs, hub_backend → chatballs_backend (app labels прежние) - переменные CUS_* и CUSTOCRM_* → CHATBALLS_*; образы chatballs-*; compose-проект и база chatballs (были edevs_hub); роли Postgres chatballs_* (были custocrm_*); схема RLS chatballs и GUC chatballs.organization_id; cookie chatballs_* - CI: APP_DIR code/chatballs, DEPLOY_ROOT /opt/chatballs - deploy/migrate/rename-to-chatballs.sh — миграция существующей установки без потери данных: остановка старого проекта, .env (с резервной копией), переименование суперпользователя initdb через временную роль, остальных ролей, базы, схемы и функции RLS; проверено на локальном стеке - dev-стек хранит Postgres в bind-mount data/postgres, как prod (именованный том compose.dev был устаревшим снимком и вводил в заблуждение) - снятие демо удаляет объекты, созданные поверх демо-данных тестировавшим (звонки по демо-диалогу), вместо падения на PROTECT - реальные домены *.custocrm.ru и идентификаторы документов не тронуты Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
92 lines
3.2 KiB
Python
92 lines
3.2 KiB
Python
from django.core.exceptions import PermissionDenied
|
|
|
|
from chatballs.ai.knowledge_policy import (
|
|
employee_can_manage_categories,
|
|
employee_can_read_knowledge,
|
|
employee_can_write_knowledge,
|
|
require_knowledge_create,
|
|
)
|
|
from chatballs.ai.knowledge_policy_test_base import KnowledgePolicyTestBase
|
|
from chatballs.ai.models import Knowledge
|
|
from chatballs.ai.selectors import (
|
|
knowledge_for_employee,
|
|
writable_knowledge_for_employee,
|
|
)
|
|
|
|
|
|
class KnowledgePolicyTests(KnowledgePolicyTestBase):
|
|
def _all_ids(self) -> set[int]:
|
|
return {
|
|
self.shared.id,
|
|
self.sales_only.id,
|
|
self.support_only.id,
|
|
self.disabled.id,
|
|
}
|
|
|
|
def test_read_policy_is_tenant_safe_and_role_based(self) -> None:
|
|
for context in (self.owner_context, self.admin_context):
|
|
visible_ids = set(
|
|
knowledge_for_employee(context=context).values_list("id", flat=True)
|
|
)
|
|
self.assertEqual(visible_ids, self._all_ids())
|
|
self.assertEqual(
|
|
list(knowledge_for_employee(context=self.employee_context)), []
|
|
)
|
|
self.assertFalse(
|
|
employee_can_read_knowledge(
|
|
context=self.employee_context, knowledge=self.shared
|
|
)
|
|
)
|
|
other_knowledge = Knowledge.objects.create(
|
|
organization=self.other_organization,
|
|
category=self.other_category,
|
|
title="Other tenant",
|
|
)
|
|
self.assertFalse(
|
|
employee_can_read_knowledge(
|
|
context=self.owner_context, knowledge=other_knowledge
|
|
)
|
|
)
|
|
|
|
def test_write_policy_is_role_based(self) -> None:
|
|
admin_writable_ids = set(
|
|
writable_knowledge_for_employee(context=self.admin_context).values_list(
|
|
"id", flat=True
|
|
)
|
|
)
|
|
self.assertEqual(admin_writable_ids, self._all_ids())
|
|
self.assertEqual(
|
|
list(writable_knowledge_for_employee(context=self.employee_context)), []
|
|
)
|
|
self.assertTrue(
|
|
employee_can_write_knowledge(
|
|
context=self.owner_context, knowledge=self.shared
|
|
)
|
|
)
|
|
self.assertFalse(
|
|
employee_can_write_knowledge(
|
|
context=self.employee_context, knowledge=self.sales_only
|
|
)
|
|
)
|
|
other_knowledge = Knowledge.objects.create(
|
|
organization=self.other_organization,
|
|
category=self.other_category,
|
|
title="Other tenant",
|
|
)
|
|
self.assertFalse(
|
|
employee_can_write_knowledge(
|
|
context=self.owner_context, knowledge=other_knowledge
|
|
)
|
|
)
|
|
|
|
def test_create_and_category_policy_require_manage_role(self) -> None:
|
|
require_knowledge_create(context=self.owner_context)
|
|
require_knowledge_create(context=self.admin_context)
|
|
with self.assertRaises(PermissionDenied):
|
|
require_knowledge_create(context=self.employee_context)
|
|
self.assertTrue(employee_can_manage_categories(context=self.owner_context))
|
|
self.assertTrue(employee_can_manage_categories(context=self.admin_context))
|
|
self.assertFalse(
|
|
employee_can_manage_categories(context=self.employee_context)
|
|
)
|