feat: 账号凭据默认脱敏并支持主动查看

2026-08-13 16:32:49 +08:00
parent a223cb726d
commit 2e207f726c
3 changed files with 108 additions and 6 deletions
@@ -0,0 +1,73 @@
+import os
+import unittest
+
+os.environ.setdefault("DATABASE_URL", "sqlite://")
+os.environ.setdefault("APP_ENCRYPTION_KEY", "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=")
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+
+from web.backend.database import Base
+from web.backend.models import Account, User
+from web.backend.routers.accounts import list_accounts
+
+
+class AccountSensitiveFieldsTests(unittest.TestCase):
+    def setUp(self):
+        self.engine = create_engine("sqlite://")
+        Base.metadata.create_all(self.engine)
+        self.session = sessionmaker(bind=self.engine)()
+        self.admin = User(username="admin", password_hash="hash", role="super_admin")
+        self.session.add(self.admin)
+        self.session.add(Account(
+            username="account",
+            password="account-password",
+            email="account@example.com",
+            email_password="email-password",
+        ))
+        self.session.commit()
+
+    def tearDown(self):
+        self.session.close()
+        Base.metadata.drop_all(self.engine)
+        self.engine.dispose()
+
+    def test_sensitive_fields_are_hidden_by_default_even_for_admin(self):
+        result = list_accounts(
+            assigned_only=False,
+            tag=None,
+            has_cookie=False,
+            search="",
+            page=1,
+            page_size=20,
+            include_sensitive=False,
+            db=self.session,
+            current=self.admin,
+        )
+
+        item = result["items"][0]
+        self.assertIsNone(item.password)
+        self.assertIsNone(item.email)
+        self.assertIsNone(item.email_password)
+
+    def test_admin_can_explicitly_request_sensitive_fields(self):
+        result = list_accounts(
+            assigned_only=False,
+            tag=None,
+            has_cookie=False,
+            search="",
+            page=1,
+            page_size=20,
+            include_sensitive=True,
+            db=self.session,
+            current=self.admin,
+        )
+
+        item = result["items"][0]
+        self.assertEqual(item.password, "account-password")
+        self.assertEqual(item.email, "account@example.com")
+        self.assertEqual(item.email_password, "email-password")
+
+
+if __name__ == "__main__":
+    unittest.main()