fix(douyu): reject invalid activity cookies

tests/test_douyu_elite_lock_exchange.py

@@ -1,6 +1,8 @@
 import unittest
 from unittest.mock import Mock
 
+import requests
+
 from core.douyu.activity_client import DouyuActivityClient, DouyuActivityError
 
 
@@ -100,6 +102,31 @@ class EliteLockExchangeTests(unittest.TestCase):
             "page": 2, "pageSize": 20, "manualID": "manual",
         })
 
+    def test_redirect_is_not_followed_and_is_reported_without_query_values(self):
+        response = requests.Response()
+        response.status_code = 302
+        response.url = "https://www.douyu.com/japi/example?request_secret=hidden"
+        response.headers["Location"] = "https://www.douyu.com/member/login?ticket=secret"
+        self.client.session.request = Mock(return_value=response)
+        self.client.logger = Mock()
+
+        with self.assertRaisesRegex(DouyuActivityError, "Cookie 已失效，请重新登录") as caught:
+            self.client._request(
+                "get",
+                "https://www.douyu.com/japi/example?request_secret=hidden",
+                source="测试活动接口",
+            )
+
+        self.client.session.request.assert_called_once()
+        self.assertFalse(self.client.session.request.call_args.kwargs["allow_redirects"])
+        message = str(caught.exception)
+        self.assertIn("method=GET", message)
+        self.assertIn("url=https://www.douyu.com/japi/example", message)
+        self.assertIn("location=https://www.douyu.com/member/login", message)
+        self.assertNotIn("request_secret", message)
+        self.assertNotIn("ticket=secret", message)
+        self.assertIn("已拦截重定向", self.client.logger.call_args.args[0])
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_douyu_gold_recharge_channel.py

@@ -12,7 +12,7 @@ from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 
 from web.backend.database import Base
-from web.backend.models import Account, AuditLog, DouyuTask, User
+from web.backend.models import Account, AuditLog, DouyuTask, LoginTask, User
 from web.backend.routers.douyu import get_recharge_channel, supplier_recharge_callback
 from web.backend.services.douyu_runner import DouyuBatchRunner
 from web.backend.services.douyu_service import ensure_douyu_config
@@ -176,6 +176,46 @@ class DouyuGoldRechargeChannelTests(unittest.TestCase):
         self.assertEqual(self.task.status, "failed")
         self.assertEqual(self.task.message, "商品已下架")
 
+    @patch("web.backend.services.douyu_runner.check_douyu_cookie")
+    @patch("web.backend.services.douyu_runner.SessionLocal")
+    def test_invalid_cookie_skips_activity_and_marks_relogin_required(self, session_local, check_cookie):
+        login_task = LoginTask(
+            batch_id="login-batch",
+            account_id=self.account.id,
+            created_by=self.task.created_by,
+            status="success",
+            cookie="acf_uid=10001",
+        )
+        self.task.status = "planned"
+        self.session.add(login_task)
+        self.session.commit()
+        task_id = self.task.id
+        login_task_id = login_task.id
+        session_local.return_value = self.session
+        check_cookie.return_value = {
+            "valid": False,
+            "message": "鱼丸接口: 未登录；等级接口: 未登录",
+            "fish_ball": None,
+            "nickname": None,
+            "level": None,
+            "checked_at": None,
+        }
+        self.runner._execute_create_gold_qr = Mock()
+
+        self.runner._execute_one(task_id, {}, 1)
+
+        self.runner._execute_create_gold_qr.assert_not_called()
+        verify_session = sessionmaker(bind=self.engine)()
+        try:
+            task = verify_session.get(DouyuTask, task_id)
+            checked_login = verify_session.get(LoginTask, login_task_id)
+            self.assertEqual(task.status, "failed")
+            self.assertIn("Cookie 已失效，请重新登录", task.message)
+            self.assertEqual(checked_login.ck_check_status, "invalid")
+            self.assertEqual(checked_login.ck_check_result["message"], "鱼丸接口: 未登录；等级接口: 未登录")
+        finally:
+            verify_session.close()
+
     def test_supplier_callback_verifies_signature_and_updates_terminal_task(self):
         self.task.supplier_out_order_id = f"DYGFBATCHT{self.task.id}"
         self.task.result = {"recharge_channel": "supplier_api", "out_order_id": self.task.supplier_out_order_id}