fix(test-round): 测试清单一批 bug 修复 + 团队月限额持久化
后端: - accounts: 团队级月限额持久化(Team.monthly_credit_limit 三态 + PATCH/GET /api/auth/team/settings/,刷新不丢,PMC#12);头像上传 500→502 可读错误; 设备下线真失效(删并重建 token,旧 token 401) - assets: 审核类目加 model_portrait,消除三视图"无需审核"误报 - ai/projects/products: 模特已有三视图复用、产品三视图同步回商品库 (metadata.view=three_view)、真人模特三视图回写 前端: - 商品图删除判断改用真实图片数;团队成员弹窗禁点外部关闭 - 图片预览骨架铺满占位;平台套图左侧栏折叠改导航同款;收件箱长文换行对齐 - 团队月限额改真落库(乐观更新+失败回滚) 测试:新增 TeamSettingsTests(5 条),accounts 全套 36 tests 通过;前端 build 0 error Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
zyc
@@ -0,0 +1,20 @@
|
||||
# Generated by Django 5.1.15 on 2026-06-29 10:44
|
||||
|
||||
from django.db import migrations, models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
("accounts", "0006_teammember_daily_credit_limit_and_more"),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.AddField(
|
||||
model_name="team",
|
||||
name="monthly_credit_limit",
|
||||
field=models.DecimalField(
|
||||
blank=True, decimal_places=2, default=None, max_digits=12, null=True
|
||||
),
|
||||
),
|
||||
]
|
||||
@@ -32,6 +32,9 @@ class Team(TimeStampedModel):
|
||||
name = models.CharField(max_length=128)
|
||||
status = models.CharField(max_length=24, choices=Status.choices, default=Status.ACTIVE)
|
||||
owner = models.ForeignKey(User, on_delete=models.PROTECT, related_name="owned_teams")
|
||||
# 团队级月限额(超管在团队页设置,自然月重置)。语义三态,与成员级 0=不限 不同:
|
||||
# None = 未设置(前端按成员月度额度累加作团队月限额)· -1 = 不限 · >=0 = 固定上限。
|
||||
monthly_credit_limit = models.DecimalField(max_digits=12, decimal_places=2, null=True, blank=True, default=None)
|
||||
|
||||
def __str__(self) -> str:
|
||||
return self.name
|
||||
|
||||
@@ -38,7 +38,7 @@ class LoginSessionSerializer(serializers.ModelSerializer):
|
||||
class TeamSerializer(serializers.ModelSerializer):
|
||||
class Meta:
|
||||
model = Team
|
||||
fields = ["id", "name", "status", "owner", "created_at", "updated_at"]
|
||||
fields = ["id", "name", "status", "owner", "monthly_credit_limit", "created_at", "updated_at"]
|
||||
read_only_fields = ["id", "status", "owner", "created_at", "updated_at"]
|
||||
|
||||
|
||||
|
||||
@@ -404,3 +404,171 @@ class ValidateInviteTests(TestCase):
|
||||
self.assertEqual(r.status_code, 200)
|
||||
self.assertFalse(r.data["valid"])
|
||||
|
||||
|
||||
class AvatarUploadTests(TestCase):
|
||||
"""bug(9):上传新头像点「确认使用」弹 500。真因之一=对象存储上传异常裸抛 500;
|
||||
现改为捕获后回 502 + 人话,成功路径回 200 + 新 avatar_url。"""
|
||||
|
||||
def setUp(self):
|
||||
from rest_framework.authtoken.models import Token
|
||||
|
||||
self.user = User.objects.create_user(username="av-user", password="strong-password")
|
||||
self.token = Token.objects.create(user=self.user)
|
||||
self.client = APIClient()
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f"Token {self.token.key}")
|
||||
|
||||
def _png(self):
|
||||
from django.core.files.uploadedfile import SimpleUploadedFile
|
||||
|
||||
# 1x1 PNG 字节(够 multipart 上传,内容无所谓,storage 被 mock)
|
||||
png = (
|
||||
b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01"
|
||||
b"\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\nIDATx\x9cc\x00"
|
||||
b"\x01\x00\x00\x05\x00\x01\r\n-\xb4\x00\x00\x00\x00IEND\xaeB`\x82"
|
||||
)
|
||||
return SimpleUploadedFile("avatar.png", png, content_type="image/png")
|
||||
|
||||
def test_upload_success_returns_200_and_sets_url(self):
|
||||
from unittest import mock
|
||||
|
||||
with mock.patch("apps.assets.storage.TosStorage") as MockStorage:
|
||||
inst = MockStorage.return_value
|
||||
inst.upload_fileobj.return_value = None
|
||||
inst.public_url.return_value = "https://bucket.example.com/users/x/avatar/abc.png"
|
||||
r = self.client.post("/api/auth/me/avatar/", {"file": self._png()}, format="multipart")
|
||||
self.assertEqual(r.status_code, 200, r.data)
|
||||
self.user.refresh_from_db()
|
||||
self.assertEqual(self.user.avatar_url, "https://bucket.example.com/users/x/avatar/abc.png")
|
||||
|
||||
def test_upload_storage_failure_returns_502_not_bare_500(self):
|
||||
from unittest import mock
|
||||
|
||||
with mock.patch("apps.assets.storage.TosStorage") as MockStorage:
|
||||
MockStorage.return_value.upload_fileobj.side_effect = RuntimeError("TOS unreachable")
|
||||
r = self.client.post("/api/auth/me/avatar/", {"file": self._png()}, format="multipart")
|
||||
self.assertEqual(r.status_code, 502)
|
||||
self.assertIn("detail", r.data)
|
||||
|
||||
def test_upload_without_file_returns_400(self):
|
||||
r = self.client.post("/api/auth/me/avatar/", {}, format="multipart")
|
||||
self.assertEqual(r.status_code, 400)
|
||||
|
||||
|
||||
class DeviceRevokeTests(TestCase):
|
||||
"""bug(10):在用设备点「下线」提示成功但实际没下线。真因=只标记 LoginSession.revoked_at
|
||||
没动 token(单 token 体系),被下线设备旧 token 仍有效。现改为旋转 token,旧 token 立即 401。"""
|
||||
|
||||
def setUp(self):
|
||||
from rest_framework.authtoken.models import Token
|
||||
|
||||
self.user = User.objects.create_user(username="dev-user", password="strong-password")
|
||||
# 模拟登录拿到 token(被下线的「目标设备」用的就是这个)
|
||||
self.token = Token.objects.create(user=self.user)
|
||||
|
||||
def test_revoke_session_invalidates_old_token(self):
|
||||
from apps.accounts.models import LoginSession
|
||||
|
||||
session = LoginSession.objects.create(user=self.user, user_agent="OtherDevice", ip_address="1.1.1.1")
|
||||
old_key = self.token.key
|
||||
|
||||
client = APIClient()
|
||||
client.credentials(HTTP_AUTHORIZATION=f"Token {old_key}")
|
||||
r = client.post(f"/api/auth/me/sessions/{session.id}/revoke/")
|
||||
self.assertEqual(r.status_code, 200)
|
||||
# 必须真正吊销:旧 token 已失效,再用它访问受保护接口应 401
|
||||
self.assertIn("token", r.data)
|
||||
self.assertNotEqual(r.data["token"], old_key)
|
||||
|
||||
stale = APIClient()
|
||||
stale.credentials(HTTP_AUTHORIZATION=f"Token {old_key}")
|
||||
self.assertEqual(stale.get("/api/auth/me/").status_code, 401)
|
||||
|
||||
# 会话被标记下线
|
||||
session.refresh_from_db()
|
||||
self.assertIsNotNone(session.revoked_at)
|
||||
|
||||
def test_revoke_unknown_session_no_op(self):
|
||||
import uuid as _uuid
|
||||
|
||||
client = APIClient()
|
||||
client.credentials(HTTP_AUTHORIZATION=f"Token {self.token.key}")
|
||||
r = client.post(f"/api/auth/me/sessions/{_uuid.uuid4()}/revoke/")
|
||||
self.assertEqual(r.status_code, 200)
|
||||
self.assertEqual(r.data.get("revoked"), 0)
|
||||
|
||||
|
||||
class TeamSettingsTests(TestCase):
|
||||
"""PMC#12:团队月限额持久化。设置后落库,刷新(重新 GET)仍在;成员不可改;清空回到「未设置」。"""
|
||||
|
||||
def _register(self, client, username, **extra):
|
||||
return client.post(
|
||||
"/api/auth/register/",
|
||||
{"username": username, "password": "strong-password", **extra},
|
||||
format="json",
|
||||
)
|
||||
|
||||
def setUp(self):
|
||||
self.owner_client = APIClient()
|
||||
r = self._register(self.owner_client, "ts-owner", team_name="TS Team", invite_code=make_create_team_code())
|
||||
self.assertEqual(r.status_code, 201)
|
||||
self.team = Team.objects.get(name="TS Team")
|
||||
self.owner_client.credentials(HTTP_AUTHORIZATION=f"Token {r.data['token']}")
|
||||
# 注册返回体里团队月限额默认未设置(null)
|
||||
self.assertIsNone(r.data["team"].get("monthly_credit_limit"))
|
||||
|
||||
def test_owner_sets_limit_persists(self):
|
||||
res = self.owner_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": 3000}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 200, res.content)
|
||||
self.assertEqual(Decimal(res.data["monthly_credit_limit"]), Decimal("3000"))
|
||||
# 落库
|
||||
self.team.refresh_from_db()
|
||||
self.assertEqual(self.team.monthly_credit_limit, Decimal("3000"))
|
||||
# 「刷新」= 重新 GET,值仍在(PMC#12 核心)
|
||||
got = self.owner_client.get("/api/auth/team/settings/")
|
||||
self.assertEqual(Decimal(got.data["monthly_credit_limit"]), Decimal("3000"))
|
||||
|
||||
def test_unlimited_minus_one_stored_as_is(self):
|
||||
res = self.owner_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": -1}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 200, res.content)
|
||||
self.team.refresh_from_db()
|
||||
self.assertEqual(self.team.monthly_credit_limit, Decimal("-1"))
|
||||
|
||||
def test_empty_clears_to_unset(self):
|
||||
self.owner_client.patch("/api/auth/team/settings/", {"monthly_credit_limit": 3000}, format="json")
|
||||
res = self.owner_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": ""}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 200, res.content)
|
||||
self.team.refresh_from_db()
|
||||
self.assertIsNone(self.team.monthly_credit_limit)
|
||||
|
||||
def test_invalid_number_rejected(self):
|
||||
res = self.owner_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": "abc"}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 400)
|
||||
|
||||
def test_member_cannot_change_limit(self):
|
||||
self.owner_client.post(
|
||||
"/api/auth/team/members/",
|
||||
{"username": "ts-member", "password": "strong-password", "role": "member"},
|
||||
format="json",
|
||||
)
|
||||
member_client = APIClient()
|
||||
login = member_client.post(
|
||||
"/api/auth/login/", {"username": "ts-member", "password": "strong-password"}, format="json"
|
||||
)
|
||||
member_client.credentials(HTTP_AUTHORIZATION=f"Token {login.data['token']}")
|
||||
# 成员可读
|
||||
self.assertEqual(member_client.get("/api/auth/team/settings/").status_code, 200)
|
||||
# 但不可改
|
||||
res = member_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": 9999}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 403)
|
||||
self.team.refresh_from_db()
|
||||
self.assertIsNone(self.team.monthly_credit_limit)
|
||||
|
||||
@@ -15,6 +15,7 @@ from .views import (
|
||||
team_member_detail,
|
||||
team_member_password,
|
||||
team_members,
|
||||
team_settings,
|
||||
update_avatar,
|
||||
validate_invite,
|
||||
)
|
||||
@@ -32,6 +33,7 @@ urlpatterns = [
|
||||
path("me/sessions/", login_sessions, name="auth-sessions"),
|
||||
path("me/sessions/revoke-others/", revoke_other_sessions, name="auth-sessions-revoke-others"),
|
||||
path("me/sessions/<uuid:session_id>/revoke/", revoke_login_session, name="auth-session-revoke"),
|
||||
path("team/settings/", team_settings, name="team-settings"),
|
||||
path("team/members/", team_members, name="team-members"),
|
||||
path("team/members/<uuid:member_id>/", team_member_detail, name="team-member-detail"),
|
||||
path("team/members/<uuid:member_id>/password/", team_member_password, name="team-member-password"),
|
||||
|
||||
@@ -213,12 +213,24 @@ def update_avatar(request):
|
||||
user = request.user
|
||||
suffix = Path(upload.name or "").suffix.lower() or ".png"
|
||||
object_key = f"users/{user.id}/avatar/{uuid.uuid4()}{suffix}"
|
||||
storage = TosStorage()
|
||||
storage.upload_fileobj(
|
||||
fileobj=upload.file,
|
||||
object_key=object_key,
|
||||
content_type=upload.content_type or "image/png",
|
||||
)
|
||||
# 对象存储上传是唯一会抛异常的环节(凭证/网络/桶不可达)。不捕获则裸抛 500,
|
||||
# 前端只看到「服务器错误 500」查不到真因(与全站「raise_for_status 吞 body」同类坑)。
|
||||
# 捕获后回 502 + 人话,既不掩盖问题(日志仍有栈)又让前端 toast 可读。
|
||||
try:
|
||||
storage = TosStorage()
|
||||
storage.upload_fileobj(
|
||||
fileobj=upload.file,
|
||||
object_key=object_key,
|
||||
content_type=upload.content_type or "image/png",
|
||||
)
|
||||
except Exception as exc: # noqa: BLE001 — 对象存储故障归一成可读错误,不裸 500
|
||||
import logging
|
||||
|
||||
logging.getLogger(__name__).exception("avatar upload to TOS failed: %s", exc)
|
||||
return Response(
|
||||
{"detail": "头像上传失败,请稍后重试(对象存储不可用)"},
|
||||
status=status.HTTP_502_BAD_GATEWAY,
|
||||
)
|
||||
# 桶公读,存稳定的虚拟主机式直链(全站资产同款 public_url)——不存预签名 URL:
|
||||
# 预签名 URL 带一长串 SigV4 查询参数(常 >300 字符),会超出 avatar_url 这个 URLField
|
||||
# 的默认 max_length=200,MySQL 严格模式下 save 抛 DataError(Data too long)→ 500;
|
||||
@@ -320,6 +332,32 @@ def team_members(request):
|
||||
return Response(TeamMemberSerializer(member).data, status=status.HTTP_201_CREATED)
|
||||
|
||||
|
||||
@api_view(["GET", "PATCH"])
|
||||
@permission_classes([IsAuthenticated])
|
||||
def team_settings(request):
|
||||
"""团队级设置:目前承载「设置月限额」(团队页超管设置,刷新后持久化 · PMC#12)。
|
||||
GET 任意成员可读;PATCH 仅超管/团管(can_manage_team)。
|
||||
monthly_credit_limit 三态:null=未设置(按成员累加)· -1=不限 · >=0=固定上限。"""
|
||||
team = get_current_team(request.user)
|
||||
if request.method == "GET":
|
||||
return Response(TeamSerializer(team).data)
|
||||
|
||||
if not can_manage_team(request.user, team):
|
||||
return Response({"detail": "permission denied"}, status=status.HTTP_403_FORBIDDEN)
|
||||
|
||||
if "monthly_credit_limit" in request.data:
|
||||
raw = request.data.get("monthly_credit_limit")
|
||||
if raw is None or (isinstance(raw, str) and not raw.strip()):
|
||||
team.monthly_credit_limit = None # 清空 = 回到「未设置(按成员累加)」
|
||||
else:
|
||||
try:
|
||||
team.monthly_credit_limit = Decimal(str(raw))
|
||||
except (InvalidOperation, ValueError, TypeError):
|
||||
return Response({"monthly_credit_limit": ["invalid number"]}, status=status.HTTP_400_BAD_REQUEST)
|
||||
team.save(update_fields=["monthly_credit_limit", "updated_at"])
|
||||
return Response(TeamSerializer(team).data)
|
||||
|
||||
|
||||
@api_view(["GET", "POST"])
|
||||
@permission_classes([IsAuthenticated])
|
||||
def team_invitations(request):
|
||||
@@ -462,7 +500,14 @@ def login_sessions(request):
|
||||
@permission_classes([IsAuthenticated])
|
||||
def revoke_login_session(request, session_id):
|
||||
"""下线单个设备:把同一台设备(UA + IP)下的所有未下线会话一并下线,
|
||||
否则去重展示的一台设备点「下线」后,底层其它重复会话仍存活会再次冒出来。"""
|
||||
否则去重展示的一台设备点「下线」后,底层其它重复会话仍存活会再次冒出来。
|
||||
|
||||
关键:DRF TokenAuthentication 是「一用户一 token」(authtoken 共享一行),
|
||||
只标记 LoginSession.revoked_at 根本不动 token —— 被下线的设备仍拿着有效 token,
|
||||
继续访问畅通无阻(bug:提示「设备已下线」但实际没下线)。单 token 体系下无法
|
||||
只吊销某一台,唯一能真正下线的做法 = 旋转 token(删旧 + 发新),令所有端旧 token
|
||||
立即失效,再把新 token 发回当前设备(同 revoke_other_sessions 的思路)。
|
||||
被下线的目标设备下次请求即 401,真正离线。"""
|
||||
from django.utils import timezone
|
||||
|
||||
target = LoginSession.objects.filter(user=request.user, id=session_id).first()
|
||||
@@ -474,7 +519,12 @@ def revoke_login_session(request, session_id):
|
||||
ip_address=target.ip_address,
|
||||
revoked_at__isnull=True,
|
||||
).update(revoked_at=timezone.now())
|
||||
return Response({"revoked": updated})
|
||||
# 真正吊销:旋转用户 token(令被下线设备旧 token 立即失效),再发新 token 给当前设备。
|
||||
Token.objects.filter(user=request.user).delete()
|
||||
token, _ = Token.objects.get_or_create(user=request.user)
|
||||
# 刷新当前设备这条会话(旋转后当前设备等价于「重新登录」),避免它被自己下线后又冒出来
|
||||
record_login_session(request, request.user)
|
||||
return Response({"revoked": updated, "token": token.key})
|
||||
|
||||
|
||||
@api_view(["POST"])
|
||||
|
||||
Reference in New Issue
Block a user