fix(permission): revoke inherited tunnel access after group unbind/removal

go-backend/internal/http/handler/mutations.go

@@ -1713,10 +1713,19 @@ func (h *Handler) groupUserAssign(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer func() { _ = tx.Rollback() }()
+	previousUserIDs, err := queryInt64ListTx(tx, `SELECT user_id FROM user_group_user WHERE user_group_id = ?`, req.GroupID)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
 	_, _ = tx.Exec(`DELETE FROM user_group_user WHERE user_group_id = ?`, req.GroupID)
 	for _, uid := range req.UserIDs {
 		_, _ = tx.Exec(`INSERT INTO user_group_user(user_group_id, user_id, created_time) VALUES(?, ?, ?) ON CONFLICT DO NOTHING`, req.GroupID, uid, time.Now().UnixMilli())
 	}
+	if err := revokeGroupGrantsForRemovedUsersTx(tx, req.GroupID, previousUserIDs, req.UserIDs); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
 	if err := tx.Commit(); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
@@ -1748,10 +1757,35 @@ func (h *Handler) groupPermissionRemove(w http.ResponseWriter, r *http.Request)
 	if id <= 0 {
 		return
 	}
+	tx, err := h.repo.DB().Begin()
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	defer func() { _ = tx.Rollback() }()
+
 	var ug, tg int64
-	_ = h.repo.DB().QueryRow(`SELECT user_group_id, tunnel_group_id FROM group_permission WHERE id = ?`, id).Scan(&ug, &tg)
+	err = tx.QueryRow(`SELECT user_group_id, tunnel_group_id FROM group_permission WHERE id = ?`, id).Scan(&ug, &tg)
-	_, _ = h.repo.DB().Exec(`DELETE FROM group_permission WHERE id = ?`, id)
+	if err != nil && err != sql.ErrNoRows {
-	_, _ = h.repo.DB().Exec(`DELETE FROM group_permission_grant WHERE user_group_id = ? AND tunnel_group_id = ?`, ug, tg)
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+
+	if _, err := tx.Exec(`DELETE FROM group_permission WHERE id = ?`, id); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
+	if err == nil {
+		if err := revokeGroupPermissionPairTx(tx, ug, tg); err != nil {
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
 	response.WriteJSON(w, response.OKEmpty())
 }
 
@@ -1908,6 +1942,144 @@ func queryInt64List(db *store.DB, q string, args ...interface{}) ([]int64, error
 	return out, rows.Err()
 }
 
+func queryInt64ListTx(tx *store.Tx, q string, args ...interface{}) ([]int64, error) {
+	rows, err := tx.Query(q, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]int64, 0)
+	for rows.Next() {
+		var v int64
+		if err := rows.Scan(&v); err != nil {
+			return nil, err
+		}
+		out = append(out, v)
+	}
+	return out, rows.Err()
+}
+
+func revokeGroupGrantsForRemovedUsersTx(tx *store.Tx, userGroupID int64, previousUserIDs, currentUserIDs []int64) error {
+	currentSet := make(map[int64]struct{}, len(currentUserIDs))
+	for _, uid := range currentUserIDs {
+		if uid > 0 {
+			currentSet[uid] = struct{}{}
+		}
+	}
+
+	removedUserIDs := make([]int64, 0)
+	for _, uid := range previousUserIDs {
+		if uid <= 0 {
+			continue
+		}
+		if _, ok := currentSet[uid]; !ok {
+			removedUserIDs = append(removedUserIDs, uid)
+		}
+	}
+	if len(removedUserIDs) == 0 {
+		return nil
+	}
+
+	for _, userID := range removedUserIDs {
+		rows, err := tx.Query(`
+			SELECT g.user_tunnel_id, g.created_by_group
+			FROM group_permission_grant g
+			JOIN user_tunnel ut ON ut.id = g.user_tunnel_id
+			WHERE g.user_group_id = ? AND ut.user_id = ?
+		`, userGroupID, userID)
+		if err != nil {
+			return err
+		}
+
+		groupCreatedTunnelIDs := make(map[int64]struct{})
+		for rows.Next() {
+			var userTunnelID int64
+			var createdByGroup int
+			if err := rows.Scan(&userTunnelID, &createdByGroup); err != nil {
+				rows.Close()
+				return err
+			}
+			if createdByGroup == 1 && userTunnelID > 0 {
+				groupCreatedTunnelIDs[userTunnelID] = struct{}{}
+			}
+		}
+		if err := rows.Err(); err != nil {
+			rows.Close()
+			return err
+		}
+		rows.Close()
+
+		if _, err := tx.Exec(`
+			DELETE FROM group_permission_grant
+			WHERE user_group_id = ?
+			  AND user_tunnel_id IN (SELECT id FROM user_tunnel WHERE user_id = ?)
+		`, userGroupID, userID); err != nil {
+			return err
+		}
+
+		for userTunnelID := range groupCreatedTunnelIDs {
+			var remaining int
+			if err := tx.QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&remaining); err != nil {
+				return err
+			}
+			if remaining == 0 {
+				if _, err := tx.Exec(`DELETE FROM user_tunnel WHERE id = ?`, userTunnelID); err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func revokeGroupPermissionPairTx(tx *store.Tx, userGroupID, tunnelGroupID int64) error {
+	rows, err := tx.Query(`
+		SELECT user_tunnel_id, created_by_group
+		FROM group_permission_grant
+		WHERE user_group_id = ? AND tunnel_group_id = ?
+	`, userGroupID, tunnelGroupID)
+	if err != nil {
+		return err
+	}
+
+	groupCreatedTunnelIDs := make(map[int64]struct{})
+	for rows.Next() {
+		var userTunnelID int64
+		var createdByGroup int
+		if err := rows.Scan(&userTunnelID, &createdByGroup); err != nil {
+			rows.Close()
+			return err
+		}
+		if createdByGroup == 1 && userTunnelID > 0 {
+			groupCreatedTunnelIDs[userTunnelID] = struct{}{}
+		}
+	}
+	if err := rows.Err(); err != nil {
+		rows.Close()
+		return err
+	}
+	rows.Close()
+
+	if _, err := tx.Exec(`DELETE FROM group_permission_grant WHERE user_group_id = ? AND tunnel_group_id = ?`, userGroupID, tunnelGroupID); err != nil {
+		return err
+	}
+
+	for userTunnelID := range groupCreatedTunnelIDs {
+		var remaining int
+		if err := tx.QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&remaining); err != nil {
+			return err
+		}
+		if remaining == 0 {
+			if _, err := tx.Exec(`DELETE FROM user_tunnel WHERE id = ?`, userTunnelID); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
 func queryPairs(db *store.DB, q string, args ...interface{}) ([][2]int64, error) {
 	rows, err := db.Query(q, args...)
 	if err != nil {

go-backend/tests/contract/group_permission_contract_test.go

@@ -0,0 +1,219 @@
+package contract_test
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"go-backend/internal/auth"
+)
+
+func TestGroupUserUnbindRevokesInheritedTunnelPermission(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(200, 'group_user_contract', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert test user: %v", err)
+	}
+
+	tunnelRes, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES('group-contract-tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
+	`, now, now)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read tunnel id: %v", err)
+	}
+
+	ugRes, err := repo.DB().Exec(`INSERT INTO user_group(name, created_time, updated_time, status) VALUES('ug-contract', ?, ?, 1)`, now, now)
+	if err != nil {
+		t.Fatalf("insert user_group: %v", err)
+	}
+	userGroupID, err := ugRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read user_group id: %v", err)
+	}
+
+	tgRes, err := repo.DB().Exec(`INSERT INTO tunnel_group(name, created_time, updated_time, status) VALUES('tg-contract', ?, ?, 1)`, now, now)
+	if err != nil {
+		t.Fatalf("insert tunnel_group: %v", err)
+	}
+	tunnelGroupID, err := tgRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read tunnel_group id: %v", err)
+	}
+
+	if _, err := repo.DB().Exec(`INSERT INTO tunnel_group_tunnel(tunnel_group_id, tunnel_id, created_time) VALUES(?, ?, ?)`, tunnelGroupID, tunnelID, now); err != nil {
+		t.Fatalf("insert tunnel_group_tunnel: %v", err)
+	}
+	if _, err := repo.DB().Exec(`INSERT INTO group_permission(user_group_id, tunnel_group_id, created_time) VALUES(?, ?, ?)`, userGroupID, tunnelGroupID, now); err != nil {
+		t.Fatalf("insert group_permission: %v", err)
+	}
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	bindReq := httptest.NewRequest(http.MethodPost, "/api/v1/group/user/assign", bytes.NewBufferString(`{"groupId":`+jsonNumber(userGroupID)+`,"userIds":[200]}`))
+	bindReq.Header.Set("Authorization", adminToken)
+	bindRes := httptest.NewRecorder()
+	router.ServeHTTP(bindRes, bindReq)
+	assertCode(t, bindRes, 0)
+
+	var userTunnelID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM user_tunnel WHERE user_id = 200 AND tunnel_id = ?`, tunnelID).Scan(&userTunnelID); err != nil {
+		t.Fatalf("query user_tunnel after bind: %v", err)
+	}
+
+	var grantCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&grantCount); err != nil {
+		t.Fatalf("query group_permission_grant after bind: %v", err)
+	}
+	if grantCount == 0 {
+		t.Fatalf("expected non-zero grants after bind")
+	}
+
+	unbindReq := httptest.NewRequest(http.MethodPost, "/api/v1/group/user/assign", bytes.NewBufferString(`{"groupId":`+jsonNumber(userGroupID)+`,"userIds":[]}`))
+	unbindReq.Header.Set("Authorization", adminToken)
+	unbindRes := httptest.NewRecorder()
+	router.ServeHTTP(unbindRes, unbindReq)
+	assertCode(t, unbindRes, 0)
+
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&grantCount); err != nil {
+		t.Fatalf("query group_permission_grant after unbind: %v", err)
+	}
+	if grantCount != 0 {
+		t.Fatalf("expected grants revoked after unbind, got %d", grantCount)
+	}
+
+	var userTunnelCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM user_tunnel WHERE id = ?`, userTunnelID).Scan(&userTunnelCount); err != nil {
+		t.Fatalf("query user_tunnel after unbind: %v", err)
+	}
+	if userTunnelCount != 0 {
+		t.Fatalf("expected user_tunnel revoked after unbind, got %d", userTunnelCount)
+	}
+}
+
+func TestGroupPermissionRemoveRevokesInheritedTunnelPermission(t *testing.T) {
+	secret := "contract-jwt-secret"
+	router, repo := setupContractRouter(t, secret)
+	now := time.Now().UnixMilli()
+
+	if _, err := repo.DB().Exec(`
+		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+		VALUES(201, 'group_user_permission_remove', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
+	`, now, now); err != nil {
+		t.Fatalf("insert test user: %v", err)
+	}
+
+	tunnelRes, err := repo.DB().Exec(`
+		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
+		VALUES('group-remove-tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
+	`, now, now)
+	if err != nil {
+		t.Fatalf("insert tunnel: %v", err)
+	}
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read tunnel id: %v", err)
+	}
+
+	ugRes, err := repo.DB().Exec(`INSERT INTO user_group(name, created_time, updated_time, status) VALUES('ug-remove-contract', ?, ?, 1)`, now, now)
+	if err != nil {
+		t.Fatalf("insert user_group: %v", err)
+	}
+	userGroupID, err := ugRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read user_group id: %v", err)
+	}
+
+	tgRes, err := repo.DB().Exec(`INSERT INTO tunnel_group(name, created_time, updated_time, status) VALUES('tg-remove-contract', ?, ?, 1)`, now, now)
+	if err != nil {
+		t.Fatalf("insert tunnel_group: %v", err)
+	}
+	tunnelGroupID, err := tgRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read tunnel_group id: %v", err)
+	}
+
+	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
+	if err != nil {
+		t.Fatalf("generate admin token: %v", err)
+	}
+
+	assignTunnelReq := httptest.NewRequest(http.MethodPost, "/api/v1/group/tunnel/assign", bytes.NewBufferString(`{"groupId":`+jsonNumber(tunnelGroupID)+`,"tunnelIds":[`+jsonNumber(tunnelID)+`]}`))
+	assignTunnelReq.Header.Set("Authorization", adminToken)
+	assignTunnelRes := httptest.NewRecorder()
+	router.ServeHTTP(assignTunnelRes, assignTunnelReq)
+	assertCode(t, assignTunnelRes, 0)
+
+	assignUserReq := httptest.NewRequest(http.MethodPost, "/api/v1/group/user/assign", bytes.NewBufferString(`{"groupId":`+jsonNumber(userGroupID)+`,"userIds":[201]}`))
+	assignUserReq.Header.Set("Authorization", adminToken)
+	assignUserRes := httptest.NewRecorder()
+	router.ServeHTTP(assignUserRes, assignUserReq)
+	assertCode(t, assignUserRes, 0)
+
+	assignPermissionReq := httptest.NewRequest(http.MethodPost, "/api/v1/group/permission/assign", bytes.NewBufferString(`{"userGroupId":`+jsonNumber(userGroupID)+`,"tunnelGroupId":`+jsonNumber(tunnelGroupID)+`}`))
+	assignPermissionReq.Header.Set("Authorization", adminToken)
+	assignPermissionRes := httptest.NewRecorder()
+	router.ServeHTTP(assignPermissionRes, assignPermissionReq)
+	assertCode(t, assignPermissionRes, 0)
+
+	var permissionID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM group_permission WHERE user_group_id = ? AND tunnel_group_id = ?`, userGroupID, tunnelGroupID).Scan(&permissionID); err != nil {
+		t.Fatalf("query group_permission id: %v", err)
+	}
+
+	var userTunnelID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM user_tunnel WHERE user_id = 201 AND tunnel_id = ?`, tunnelID).Scan(&userTunnelID); err != nil {
+		t.Fatalf("query user_tunnel after assign: %v", err)
+	}
+
+	var grantCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&grantCount); err != nil {
+		t.Fatalf("query group_permission_grant after assign: %v", err)
+	}
+	if grantCount == 0 {
+		t.Fatalf("expected non-zero grants after permission assign")
+	}
+
+	removeReq := httptest.NewRequest(http.MethodPost, "/api/v1/group/permission/remove", bytes.NewBufferString(`{"id":`+jsonNumber(permissionID)+`}`))
+	removeReq.Header.Set("Authorization", adminToken)
+	removeRes := httptest.NewRecorder()
+	router.ServeHTTP(removeRes, removeReq)
+	assertCode(t, removeRes, 0)
+
+	var permissionCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission WHERE id = ?`, permissionID).Scan(&permissionCount); err != nil {
+		t.Fatalf("query group_permission after remove: %v", err)
+	}
+	if permissionCount != 0 {
+		t.Fatalf("expected group_permission removed, got %d", permissionCount)
+	}
+
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&grantCount); err != nil {
+		t.Fatalf("query group_permission_grant after remove: %v", err)
+	}
+	if grantCount != 0 {
+		t.Fatalf("expected grants removed after permission remove, got %d", grantCount)
+	}
+
+	var userTunnelCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM user_tunnel WHERE id = ?`, userTunnelID).Scan(&userTunnelCount); err != nil {
+		t.Fatalf("query user_tunnel after permission remove: %v", err)
+	}
+	if userTunnelCount != 0 {
+		t.Fatalf("expected user_tunnel revoked after permission remove, got %d", userTunnelCount)
+	}
+}