只对一个角色开放的页面

机器翻译

本页由英文原文机器翻译而来，尚未经过母语审校，欢迎在 GitHub 上提出修改。内容如有出入，以英文原文为准。

任务： 只向管理员显示一个页面。

# Recipe: a page only the admins see; everyone else gets 403, and a visitor
# who is not signed in is sent to sign in.
paths:
  components: ./components

require_auth="true" 要求一个已登录的会话；require_role 要求 session.userRole 是列出的角色之一（多个角色用逗号分隔，require_role="admin,editor"）：

<q:component name="Reports" require_auth="true" require_role="admin">
  <h1>Reports</h1>
  <p>Only admins see this, {session.userName}.</p>
</q:component>

没有会话时，响应会重定向到 /login（用 security.login_url 修改）：

<q:component name="Login">
  <h1>Sign in</h1>
</q:component>

test:as 让测试的会话以某个角色登录，不需要密码：

<q:test name="an admin sees the page" page="/reports">
  <test:as user="ana" role="admin" />
  <test:visit />
  <test:expect status="200" text="Only admins see this, ana." />
</q:test>

<q:test name="a member is refused with 403" page="/reports">
  <test:as user="bruno" role="member" />
  <test:visit />
  <test:expect status="403" />
</q:test>

<q:test name="a visitor who is not signed in is sent to sign in" page="/reports">
  <test:visit />
  <test:expect status="302" redirect="/login" />
</q:test>

tests/reports.test.q
  PASS  an admin sees the page
  PASS  a member is refused with 403
  PASS  a visitor who is not signed in is sent to sign in
3 passed, 0 failed