feat(admin): Phase 0 平台超管基础 — is_platform_admin + IsPlatformAdmin + create_platform_admin(admin/admin123) + AdminAuditLog + Admin 后台外壳与路由 gating

后端:User.is_platform_admin + migration;权限类 IsPlatformAdmin;管理命令建 admin/admin123(幂等); AdminAuditLog 模型 + log_admin_action() helper;me/login 对无团队超管优雅返回 team=null;UserSerializer 暴露标志。前端:routes/admin 后台外壳(分组侧栏 + 概览 + 占位)、/admin 路由解析与 gating(超管直落、非超管纠回)、侧栏平台入口、admin-page.css(仅 token)、IconKitSvg 补图标。测试:accounts 11/11 单测过;无头 e2e _admin-p0.mjs 全断言过 + 0 console error;tsc+build 绿。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-19 20:49:34 +08:00
parent 8fc3870fa3
commit 443023a1a9
21 changed files with 907 additions and 12 deletions
@@ -116,3 +116,86 @@ class InvitationFlowTests(TestCase):
        gen2 = joiner_client.post("/api/auth/team/invitations/", {"role": "member"}, format="json")
        self.assertEqual(gen2.status_code, 403)

+
+class PlatformAdminTests(TestCase):
+    """Phase 0:平台超管基础 —— 管理命令 / 权限类 / 登录 me 返回标志且团队为空。"""
+
+    def test_create_platform_admin_command(self):
+        from django.core.management import call_command
+
+        call_command("create_platform_admin")
+        admin = User.objects.get(username="admin")
+        self.assertTrue(admin.is_platform_admin)
+        self.assertTrue(admin.is_staff)
+        self.assertEqual(admin.status, User.Status.ACTIVE)
+        self.assertTrue(admin.check_password("admin123"))
+
+    def test_create_platform_admin_idempotent_no_password_reset(self):
+        from django.core.management import call_command
+
+        call_command("create_platform_admin", "--username", "root", "--password", "rootpass1")
+        # 二次执行不带 --reset-password:不应覆盖已设密码
+        call_command("create_platform_admin", "--username", "root", "--password", "different2")
+        admin = User.objects.get(username="root")
+        self.assertTrue(admin.is_platform_admin)
+        self.assertTrue(admin.check_password("rootpass1"))
+        # 带 --reset-password 才重置
+        call_command("create_platform_admin", "--username", "root", "--password", "fresh3pass", "--reset-password")
+        admin.refresh_from_db()
+        self.assertTrue(admin.check_password("fresh3pass"))
+
+    def test_login_returns_flag_and_null_team_for_teamless_admin(self):
+        from django.core.management import call_command
+
+        call_command("create_platform_admin")
+        client = APIClient()
+        r = client.post("/api/auth/login/", {"username": "admin", "password": "admin123"}, format="json")
+        self.assertEqual(r.status_code, 200)
+        self.assertTrue(r.data["user"]["is_platform_admin"])
+        self.assertIsNone(r.data["team"])
+
+    def test_me_returns_platform_admin_flag(self):
+        from django.core.management import call_command
+
+        call_command("create_platform_admin")
+        client = APIClient()
+        login = client.post("/api/auth/login/", {"username": "admin", "password": "admin123"}, format="json")
+        client.credentials(HTTP_AUTHORIZATION=f"Token {login.data['token']}")
+        me = client.get("/api/auth/me/")
+        self.assertEqual(me.status_code, 200)
+        self.assertTrue(me.data["user"]["is_platform_admin"])
+        self.assertIsNone(me.data["team"])
+
+    def test_is_platform_admin_permission(self):
+        from rest_framework.test import APIRequestFactory
+
+        from apps.accounts.permissions import IsPlatformAdmin
+
+        admin = User.objects.create_user(username="padmin", password="strong-pass-1", is_platform_admin=True)
+        normal = User.objects.create_user(username="normal-user", password="strong-pass-1")
+        perm = IsPlatformAdmin()
+        factory = APIRequestFactory()
+        request = factory.get("/api/admin/ping/")
+
+        request.user = admin
+        self.assertTrue(perm.has_permission(request, None))
+
+        request.user = normal
+        self.assertFalse(perm.has_permission(request, None))
+
+        # 被停用的超管也拒绝
+        admin.status = User.Status.DISABLED
+        admin.save(update_fields=["status"])
+        request.user = admin
+        self.assertFalse(perm.has_permission(request, None))
+
+    def test_normal_register_user_is_not_platform_admin(self):
+        client = APIClient()
+        r = client.post(
+            "/api/auth/register/",
+            {"username": "regular-owner", "password": "strong-password", "team_name": "Reg Team"},
+            format="json",
+        )
+        self.assertEqual(r.status_code, 201)
+        self.assertFalse(r.data["user"]["is_platform_admin"])
+