优化客服账号标签管理

tests/test_account_sensitive_fields.py

@@ -6,10 +6,12 @@ os.environ.setdefault("APP_ENCRYPTION_KEY", "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODl
 
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
+from fastapi import HTTPException
 
 from web.backend.database import Base
 from web.backend.models import Account, User
-from web.backend.routers.accounts import list_accounts
+from web.backend.routers.accounts import list_accounts, set_account_tag
+from web.backend.schemas import AccountTag
 
 
 class AccountSensitiveFieldsTests(unittest.TestCase):
@@ -68,6 +70,30 @@ class AccountSensitiveFieldsTests(unittest.TestCase):
         self.assertEqual(item.email, "account@example.com")
         self.assertEqual(item.email_password, "email-password")
 
+    def test_support_can_only_change_tags_on_assigned_accounts(self):
+        support = User(username="support", password_hash="hash", role="support")
+        other_support = User(username="other-support", password_hash="hash", role="support")
+        self.session.add_all([support, other_support])
+        self.session.commit()
+        assigned = Account(
+            username="assigned", password="password", email="assigned@example.com",
+            email_password="mail-password", assigned_to=support.id,
+        )
+        other = Account(
+            username="other", password="password", email="other@example.com",
+            email_password="mail-password", assigned_to=other_support.id,
+        )
+        self.session.add_all([assigned, other])
+        self.session.commit()
+
+        set_account_tag(assigned.id, AccountTag(tag="客服组"), db=self.session, current=support)
+        self.session.refresh(assigned)
+        self.assertEqual(assigned.tag, "客服组")
+
+        with self.assertRaises(HTTPException) as context:
+            set_account_tag(other.id, AccountTag(tag="越权"), db=self.session, current=support)
+        self.assertEqual(context.exception.status_code, 404)
+
 
 if __name__ == "__main__":
     unittest.main()