Allow full management tokens to access token management

apps/aether-gateway/src/tests/control/admin/oauth.rs

@@ -7439,7 +7439,7 @@ async fn gateway_toggles_admin_management_token_locally_with_trusted_admin_princ
 }
 
 #[tokio::test]
-async fn gateway_rejects_management_token_principal_for_admin_management_token_routes() {
+async fn gateway_rejects_partial_management_token_for_admin_management_token_routes() {
     let upstream_hits = Arc::new(Mutex::new(0usize));
     let upstream_hits_clone = Arc::clone(&upstream_hits);
     let upstream = Router::new().route(
@@ -7453,40 +7453,61 @@ async fn gateway_rejects_management_token_principal_for_admin_management_token_r
         }),
     );
 
-    let repository = Arc::new(InMemoryManagementTokenRepository::seed(vec![
-        sample_management_token("mt-admin-1", "user-1", "alice", true),
-    ]));
+    let raw_token = "ae-management-partial-access";
+    let state = AppState::new().expect("gateway should build");
+    let admin_user = state
+        .create_local_auth_user_with_settings(
+            Some("[email protected]".to_string()),
+            true,
+            "admin".to_string(),
+            "hash".to_string(),
+            "admin".to_string(),
+            None,
+            None,
+            None,
+            None,
+        )
+        .await
+        .expect("admin user should be created")
+        .expect("admin user should exist");
+    let mut management_token = sample_management_token(
+        "mt-admin-partial",
+        &admin_user.id,
+        "management-partial",
+        true,
+    );
+    management_token.token.allowed_ips = None;
+    management_token.token.permissions = Some(json!(["admin:usage:read"]));
+    let repository = Arc::new(InMemoryManagementTokenRepository::seed_with_hashes(
+        vec![management_token],
+        vec![(
+            hash_management_token(raw_token),
+            "mt-admin-partial".to_string(),
+        )],
+    ));
 
     let (upstream_url, upstream_handle) = start_server(upstream).await;
-    let gateway = build_router_with_state(
-        AppState::new()
-            .expect("gateway should build")
-            .with_data_state_for_tests(
-                GatewayDataState::with_management_token_repository_for_tests(repository),
-            ),
-    );
+    let gateway = build_router_with_state(state.with_data_state_for_tests(
+        GatewayDataState::with_management_token_repository_for_tests(repository),
+    ));
     let (gateway_url, gateway_handle) = start_server(gateway).await;
 
     let response = reqwest::Client::new()
         .get(format!("{gateway_url}/api/admin/management-tokens"))
         .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
-        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
-        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
-        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
-        .header(
-            TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER,
-            "mt-admin-principal",
-        )
+        .bearer_auth(raw_token)
         .send()
         .await
         .expect("request should succeed");
 
     assert_eq!(response.status(), StatusCode::FORBIDDEN);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["detail"], "management token permission denied");
     assert_eq!(
-        payload["detail"],
-        "不允许使用 Management Token 管理其他 Token，请使用 Web 界面或 JWT 认证"
+        payload["required_permission"],
+        "admin:management_tokens:read"
     );
+    assert_eq!(payload["route_family"], "management_tokens_manage");
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();