test(auth): verify initial role grants in PostgreSQL

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

openspec/changes/configure-auth-and-initial-roles/proposal.md

@@ -25,4 +25,4 @@ Issue #923 需要让采用外部身份认证的部署方分别关闭本地密码
 
 ## Status
 
-本变更记录已确认的产品边界和待实现验收条件；尚未实施。
+已按本变更实现功能，并完成相关单测、PostgreSQL 并发测试和本地 Compose/浏览器验收。真实第三方 OAuth 登录未在本地预览中接入，准入与角色授予由服务测试覆盖。

openspec/changes/configure-auth-and-initial-roles/tasks.md

@@ -9,7 +9,7 @@
 - [x] 在本地登录、direct 本地认证、注册和密码管理服务端入口执行对应开关；关闭密码登录时一并阻止会直接建会话的本地注册。
 - [x] 在 OAuth 普通准入允许后的首次 ACTIVE 账号创建事务中匹配并消费角色规则，首次主体包含新角色。
 - [x] 在统一身份核心的 `LEGACY`、`SHADOW`、`ACTIVE` 模式下核对公开 OAuth 接入点；保持旧身份绑定写入权威与同邮箱不自动合并的现有行为（`OAuthLoginFlowServiceTest`、`IdentityBindingServiceTest`）。
-- [ ] 保持已有账号、准入拒绝、未验证邮箱、停用规则、并发首次登录和人工角色修改的既定行为。
+- [x] 保持已有账号、准入拒绝、未验证邮箱、停用规则、并发首次登录和人工角色修改的既定行为（OAuth 和授权单测、PostgreSQL 并发首次登录与人工撤权测试）。
 
 ## 3. API 与 Web
 
@@ -20,6 +20,6 @@
 
 ## 4. 验收
 
-- [ ] 验证两个开关的四种组合、直接 API 绕过尝试、已有会话、DB 故障与多实例设置可见性。
-- [ ] 验证首次登录授权、准入优先、已有账号不补授权、同邮箱独立账号、邮箱验证、规则停用、角色人工修改和并发首次登录。
-- [ ] 验证一次性部署初始化、角色规则删除后重启、非超管越权、审计记录和浏览器页面流程。
+- [x] 验证两个开关的四种组合、直接 API 绕过尝试、已有会话、DB 故障与多实例设置可见性（本地 Compose HTTP 实测；DB 故障与两个服务实例读取使用 `LocalAuthSettingsServiceTest`）。
+- [x] 验证首次登录授权、准入优先、已有账号不补授权、同邮箱独立账号、邮箱验证、规则停用、角色人工修改和并发首次登录（OAuth/授权单测与 PostgreSQL 真实事务测试；本地 Compose 未接入真实外部 IdP）。
+- [x] 验证一次性部署初始化、角色规则删除后重启、非超管越权、审计记录和浏览器页面流程（初始化单测、Compose 权限与审计实测、Playwright 浏览器操作）。

server/skillhub-app/src/test/java/com/iflytek/skillhub/repository/SystemAuthSettingsPostgresTest.java

@@ -3,26 +3,45 @@ package com.iflytek.skillhub.repository;
 import static org.assertj.core.api.Assertions.assertThat;
 
 import com.iflytek.skillhub.auth.repository.RoleRepository;
+import com.iflytek.skillhub.auth.repository.IdentityBindingRepository;
+import com.iflytek.skillhub.auth.repository.UserRoleBindingRepository;
+import com.iflytek.skillhub.auth.identity.IdentityBindingService;
+import com.iflytek.skillhub.auth.oauth.OAuthClaims;
+import com.iflytek.skillhub.auth.rbac.PlatformPrincipal;
 import com.iflytek.skillhub.auth.settings.ExternalRoleGrantRule;
 import com.iflytek.skillhub.auth.settings.ExternalRoleGrantRuleRepository;
+import com.iflytek.skillhub.auth.settings.InitialExternalRoleGrantService;
 import com.iflytek.skillhub.auth.settings.SystemSetting;
 import com.iflytek.skillhub.auth.settings.SystemSettingRepository;
+import com.iflytek.skillhub.domain.audit.AuditLogService;
+import com.iflytek.skillhub.domain.namespace.GlobalNamespaceMembershipService;
 import com.iflytek.skillhub.domain.user.UserAccount;
 import com.iflytek.skillhub.domain.user.UserAccountRepository;
+import com.iflytek.skillhub.domain.user.UserStatus;
 import jakarta.persistence.EntityManager;
 import java.util.Map;
 import java.util.UUID;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase;
 import org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest;
 import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.DynamicPropertyRegistry;
 import org.springframework.test.context.DynamicPropertySource;
 import org.testcontainers.containers.PostgreSQLContainer;
 import org.testcontainers.junit.jupiter.Container;
 import org.testcontainers.junit.jupiter.Testcontainers;
+import org.springframework.transaction.PlatformTransactionManager;
+import org.springframework.transaction.annotation.Propagation;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.transaction.support.TransactionTemplate;
+
+import static org.mockito.Mockito.mock;
 
 @DataJpaTest
 @AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE)
@@ -47,6 +66,9 @@ class SystemAuthSettingsPostgresTest {
     @Autowired private ExternalRoleGrantRuleRepository rules;
     @Autowired private RoleRepository roles;
     @Autowired private UserAccountRepository users;
+    @Autowired private IdentityBindingRepository identities;
+    @Autowired private UserRoleBindingRepository userRoles;
+    @Autowired private PlatformTransactionManager transactionManager;
     @Autowired private EntityManager entityManager;
     @Autowired private JdbcTemplate jdbc;
 
@@ -91,4 +113,62 @@ class SystemAuthSettingsPostgresTest {
         assertThat(reloaded.getGrantedUserId()).isEqualTo(userId);
         assertThat(reloaded.getGrantedAt()).isNotNull();
     }
+
+    @Test
+    @Transactional(propagation = Propagation.NOT_SUPPORTED)
+    void concurrentFirstLoginConsumesRuleOnceAndDoesNotRestoreManuallyRemovedRole() throws Exception {
+        String suffix = UUID.randomUUID().toString();
+        String email = suffix + "@example.com";
+        String subject = "external-" + suffix;
+        TransactionTemplate transactions = new TransactionTemplate(transactionManager);
+        Long ruleId = transactions.execute(status -> rules.save(new ExternalRoleGrantRule(
+                "github", email, roles.findByCode("SUPER_ADMIN").orElseThrow(), "admin")).getId());
+        IdentityBindingService bindingService = new IdentityBindingService(
+                identities, users, userRoles, mock(GlobalNamespaceMembershipService.class),
+                mock(ApplicationEventPublisher.class), transactionManager,
+                new InitialExternalRoleGrantService(rules, userRoles, mock(AuditLogService.class)));
+        OAuthClaims claims = new OAuthClaims("github", subject, email, true, "admin", Map.of());
+        CountDownLatch ready = new CountDownLatch(2);
+        CountDownLatch start = new CountDownLatch(1);
+
+        try (var executor = Executors.newFixedThreadPool(2)) {
+            var first = executor.submit(() -> firstLogin(bindingService, claims, ready, start));
+            var second = executor.submit(() -> firstLogin(bindingService, claims, ready, start));
+            assertThat(ready.await(10, TimeUnit.SECONDS)).isTrue();
+            start.countDown();
+            PlatformPrincipal firstPrincipal = first.get(20, TimeUnit.SECONDS);
+            PlatformPrincipal secondPrincipal = second.get(20, TimeUnit.SECONDS);
+            assertThat(firstPrincipal.userId()).isEqualTo(secondPrincipal.userId());
+            assertThat(firstPrincipal.platformRoles()).contains("SUPER_ADMIN");
+            assertThat(secondPrincipal.platformRoles()).contains("SUPER_ADMIN");
+
+            ExternalRoleGrantRule consumed = rules.findById(ruleId).orElseThrow();
+            assertThat(consumed.getStatus()).isEqualTo(ExternalRoleGrantRule.Status.CONSUMED);
+            assertThat(consumed.getGrantedUserId()).isEqualTo(firstPrincipal.userId());
+            assertThat(identities.findByProviderCodeAndSubject("github", subject)).isPresent();
+            assertThat(userRoles.findByUserId(firstPrincipal.userId())).hasSize(1);
+            assertThat(jdbc.queryForObject("SELECT COUNT(*) FROM identity_binding WHERE provider_code = ? AND subject = ?",
+                    Long.class, "github", subject)).isEqualTo(1L);
+
+            OAuthClaims anotherSubject = new OAuthClaims("github", "other-" + suffix, email, true,
+                    "another-admin", Map.of());
+            PlatformPrincipal independent = bindingService.bindOrCreate(anotherSubject, UserStatus.ACTIVE);
+            assertThat(independent.userId()).isNotEqualTo(firstPrincipal.userId());
+            assertThat(independent.platformRoles()).doesNotContain("SUPER_ADMIN");
+            assertThat(userRoles.findByUserId(independent.userId())).isEmpty();
+
+            transactions.executeWithoutResult(status -> userRoles.deleteByUserId(firstPrincipal.userId()));
+            PlatformPrincipal returning = bindingService.bindOrCreate(claims, UserStatus.ACTIVE);
+            assertThat(returning.platformRoles()).doesNotContain("SUPER_ADMIN");
+            assertThat(userRoles.findByUserId(firstPrincipal.userId())).isEmpty();
+            assertThat(rules.findById(ruleId).orElseThrow().getGrantedUserId()).isEqualTo(firstPrincipal.userId());
+        }
+    }
+
+    private static PlatformPrincipal firstLogin(IdentityBindingService service, OAuthClaims claims,
+                                                CountDownLatch ready, CountDownLatch start) throws Exception {
+        ready.countDown();
+        if (!start.await(10, TimeUnit.SECONDS)) throw new AssertionError("Timed out waiting for first login");
+        return service.bindOrCreate(claims, UserStatus.ACTIVE);
+    }
 }