feat: add governance management api

backend/apps/accounts/tests/test_governance_api.py

@@ -0,0 +1,87 @@
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Group
+from django.core.management import call_command
+
+from apps.accounts.models import MenuItem, UserGroup
+
+
+def login_admin(client):
+    call_command("bootstrap_governance")
+    user = get_user_model().objects.get(username="admin")
+    client.force_login(user)
+    return user
+
+
+def test_admin_manages_users_groups_roles_permissions_and_menus(client, db):
+    login_admin(client)
+
+    created_user = client.post(
+        "/api/accounts/users",
+        data={
+            "username": "support",
+            "display_name": "技术支持一号",
+            "email": "support@example.com",
+            "password": "support12345",
+            "is_active": True,
+        },
+        content_type="application/json",
+    )
+    assert created_user.status_code == 200
+    user_id = created_user.json()["id"]
+
+    user_group = client.post(
+        "/api/accounts/user-groups",
+        data={"name": "一线支持组", "code": "support_l1", "description": "处理一线工单"},
+        content_type="application/json",
+    )
+    assert user_group.status_code == 200
+    user_group_id = user_group.json()["id"]
+
+    members = client.post(
+        f"/api/accounts/user-groups/{user_group_id}/members",
+        data={"user_ids": [user_id]},
+        content_type="application/json",
+    )
+    assert members.status_code == 200
+    assert UserGroup.objects.get(id=user_group_id).users.filter(id=user_id).exists()
+
+    role = client.post(
+        "/api/accounts/roles",
+        data={"name": "工单观察员", "permission_codes": ["ticket.view"]},
+        content_type="application/json",
+    )
+    assert role.status_code == 200
+    role_id = role.json()["id"]
+
+    role_permissions = client.post(
+        f"/api/accounts/roles/{role_id}/permissions",
+        data={"permission_codes": ["ticket.view", "solution.view"]},
+        content_type="application/json",
+    )
+    assert role_permissions.status_code == 200
+    assert set(role_permissions.json()["permission_codes"]) == {"ticket.view", "solution.view"}
+
+    user_roles = client.post(
+        f"/api/accounts/users/{user_id}/roles",
+        data={"role_ids": [role_id]},
+        content_type="application/json",
+    )
+    assert user_roles.status_code == 200
+    assert Group.objects.get(id=role_id).user_set.filter(id=user_id).exists()
+
+    menus = client.get("/api/accounts/menus")
+    assert menus.status_code == 200
+    menu_id = MenuItem.objects.get(code="system.users").id
+    updated_menu = client.patch(
+        f"/api/accounts/menus/{menu_id}",
+        data={"title": "账号管理", "permission_code": "system.user.view"},
+        content_type="application/json",
+    )
+    assert updated_menu.status_code == 200
+    assert updated_menu.json()["title"] == "账号管理"
+
+
+def test_anonymous_governance_access_is_denied(client, db):
+    response = client.get("/api/accounts/users")
+
+    assert response.status_code == 401