yml2213
3ce1c7a51b
- 门禁: 本地 pre-push 钩子（.git/hooks，推送前强制跑全量 pytest） - Docker: 新增 test 镜像阶段（含 dev 依赖与 tests），compose 提供 --profile test run --rm test 入口；dev.sh 支持 ./dev.sh test - 测试基建: 根目录 conftest.py 统一 DATABASE_URL/APP_ENCRYPTION_KEY， 移除 9 个测试文件内的重复 setdefault（含多余 import os） - 迁移冒烟: tests/test_migrations.py 校验链线性、脚本可编译、空库整链 upgrade head 后与 Base.metadata 表/列/索引对齐 - 修复冒烟测试发现的漂移: YybRechargeTask.task_id 冗余 index=True （唯一索引已覆盖，迁移链未建普通索引，模型与真实 schema 对齐） - alembic.ini: path_separator=os 消除弃用告警；README 补测试章节
96 lines
3.3 KiB
Python
96 lines
3.3 KiB
Python
import unittest
|
|
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import sessionmaker
|
|
from fastapi import HTTPException
|
|
|
|
from web.backend.database import Base
|
|
from web.backend.models import Account, User
|
|
from web.backend.routers.accounts import list_accounts, set_account_tag
|
|
from web.backend.schemas import AccountTag
|
|
|
|
|
|
class AccountSensitiveFieldsTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.engine = create_engine("sqlite://")
|
|
Base.metadata.create_all(self.engine)
|
|
self.session = sessionmaker(bind=self.engine)()
|
|
self.admin = User(username="admin", password_hash="hash", role="super_admin")
|
|
self.session.add(self.admin)
|
|
self.session.add(Account(
|
|
username="account",
|
|
password="account-password",
|
|
email="account@example.com",
|
|
email_password="email-password",
|
|
))
|
|
self.session.commit()
|
|
|
|
def tearDown(self):
|
|
self.session.close()
|
|
Base.metadata.drop_all(self.engine)
|
|
self.engine.dispose()
|
|
|
|
def test_sensitive_fields_are_hidden_by_default_even_for_admin(self):
|
|
result = list_accounts(
|
|
assigned_only=False,
|
|
tag=None,
|
|
has_cookie=False,
|
|
search="",
|
|
page=1,
|
|
page_size=20,
|
|
include_sensitive=False,
|
|
db=self.session,
|
|
current=self.admin,
|
|
)
|
|
|
|
item = result["items"][0]
|
|
self.assertIsNone(item.password)
|
|
self.assertIsNone(item.email)
|
|
self.assertIsNone(item.email_password)
|
|
|
|
def test_admin_can_explicitly_request_sensitive_fields(self):
|
|
result = list_accounts(
|
|
assigned_only=False,
|
|
tag=None,
|
|
has_cookie=False,
|
|
search="",
|
|
page=1,
|
|
page_size=20,
|
|
include_sensitive=True,
|
|
db=self.session,
|
|
current=self.admin,
|
|
)
|
|
|
|
item = result["items"][0]
|
|
self.assertEqual(item.password, "account-password")
|
|
self.assertEqual(item.email, "account@example.com")
|
|
self.assertEqual(item.email_password, "email-password")
|
|
|
|
def test_support_can_only_change_tags_on_assigned_accounts(self):
|
|
support = User(username="support", password_hash="hash", role="support")
|
|
other_support = User(username="other-support", password_hash="hash", role="support")
|
|
self.session.add_all([support, other_support])
|
|
self.session.commit()
|
|
assigned = Account(
|
|
username="assigned", password="password", email="assigned@example.com",
|
|
email_password="mail-password", assigned_to=support.id,
|
|
)
|
|
other = Account(
|
|
username="other", password="password", email="other@example.com",
|
|
email_password="mail-password", assigned_to=other_support.id,
|
|
)
|
|
self.session.add_all([assigned, other])
|
|
self.session.commit()
|
|
|
|
set_account_tag(assigned.id, AccountTag(tag="客服组"), db=self.session, current=support)
|
|
self.session.refresh(assigned)
|
|
self.assertEqual(assigned.tag, "客服组")
|
|
|
|
with self.assertRaises(HTTPException) as context:
|
|
set_account_tag(other.id, AccountTag(tag="越权"), db=self.session, current=support)
|
|
self.assertEqual(context.exception.status_code, 404)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|