合并 origin/master：网站游戏评分与评价

server-rs/crates/api-server/src/admin.rs

@@ -2215,6 +2215,12 @@ fn admin_permission_requirement(_method: &Method, path: &str) -> AdminPermission
         "/admin/api/editor-assets" => AnyTab(&["editor-assets"]),
         "/admin/api/assets/read-url" => AnyTab(&["editor-assets", "editor-showcase"]),
         path if path.starts_with("/admin/api/editor-showcase/") => AnyTab(&["editor-showcase"]),
+        "/admin/api/game-distribution/user-review-games" => AnyTab(&["game-reviews"]),
+        path if path == "/admin/api/game-distribution/user-reviews"
+            || path.starts_with("/admin/api/game-distribution/user-reviews/") =>
+        {
+            AnyTab(&["game-reviews"])
+        }
         path if path.starts_with("/admin/api/game-distribution/reviews") => {
             AnyTab(&["editor-showcase"])
         }
@@ -7502,6 +7508,67 @@ mod tests {
         );
     }
 
+    #[test]
+    fn game_reviews_tab_authorizes_all_user_review_routes_only() {
+        for (method, path) in [
+            (
+                Method::GET,
+                "/admin/api/game-distribution/user-review-games",
+            ),
+            (Method::GET, "/admin/api/game-distribution/user-reviews"),
+            (
+                Method::GET,
+                "/admin/api/game-distribution/user-reviews/review_1",
+            ),
+            (
+                Method::POST,
+                "/admin/api/game-distribution/user-reviews/review_1/moderation",
+            ),
+        ] {
+            assert!(enforce_admin_request_permission("owner", &[], &[], &method, path).is_ok());
+            assert!(
+                enforce_admin_request_permission(
+                    "member",
+                    &["game-reviews".into()],
+                    &[],
+                    &method,
+                    path
+                )
+                .is_ok()
+            );
+            for permissions in [
+                vec![],
+                vec!["game-management".into()],
+                vec!["editor-showcase".into()],
+            ] {
+                assert_eq!(
+                    enforce_admin_request_permission("member", &permissions, &[], &method, path)
+                        .unwrap_err()
+                        .status_code(),
+                    StatusCode::FORBIDDEN
+                );
+            }
+        }
+        for path in [
+            "/admin/api/game-distribution/reviews",
+            "/admin/api/game-distribution/games",
+            "/admin/api/game-distribution/versions/version_1/review",
+        ] {
+            assert_eq!(
+                enforce_admin_request_permission(
+                    "member",
+                    &["game-reviews".into()],
+                    &[],
+                    &Method::GET,
+                    path
+                )
+                .unwrap_err()
+                .status_code(),
+                StatusCode::FORBIDDEN
+            );
+        }
+    }
+
     #[test]
     fn wallet_consumption_reconcile_requires_its_standalone_action_permission() {
         assert!(