fix(test-round): 测试清单一批 bug 修复 + 团队月限额持久化
后端: - accounts: 团队级月限额持久化(Team.monthly_credit_limit 三态 + PATCH/GET /api/auth/team/settings/,刷新不丢,PMC#12);头像上传 500→502 可读错误; 设备下线真失效(删并重建 token,旧 token 401) - assets: 审核类目加 model_portrait,消除三视图"无需审核"误报 - ai/projects/products: 模特已有三视图复用、产品三视图同步回商品库 (metadata.view=three_view)、真人模特三视图回写 前端: - 商品图删除判断改用真实图片数;团队成员弹窗禁点外部关闭 - 图片预览骨架铺满占位;平台套图左侧栏折叠改导航同款;收件箱长文换行对齐 - 团队月限额改真落库(乐观更新+失败回滚) 测试:新增 TeamSettingsTests(5 条),accounts 全套 36 tests 通过;前端 build 0 error Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
zyc
@@ -404,3 +404,171 @@ class ValidateInviteTests(TestCase):
|
||||
self.assertEqual(r.status_code, 200)
|
||||
self.assertFalse(r.data["valid"])
|
||||
|
||||
|
||||
class AvatarUploadTests(TestCase):
|
||||
"""bug(9):上传新头像点「确认使用」弹 500。真因之一=对象存储上传异常裸抛 500;
|
||||
现改为捕获后回 502 + 人话,成功路径回 200 + 新 avatar_url。"""
|
||||
|
||||
def setUp(self):
|
||||
from rest_framework.authtoken.models import Token
|
||||
|
||||
self.user = User.objects.create_user(username="av-user", password="strong-password")
|
||||
self.token = Token.objects.create(user=self.user)
|
||||
self.client = APIClient()
|
||||
self.client.credentials(HTTP_AUTHORIZATION=f"Token {self.token.key}")
|
||||
|
||||
def _png(self):
|
||||
from django.core.files.uploadedfile import SimpleUploadedFile
|
||||
|
||||
# 1x1 PNG 字节(够 multipart 上传,内容无所谓,storage 被 mock)
|
||||
png = (
|
||||
b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01"
|
||||
b"\x08\x06\x00\x00\x00\x1f\x15\xc4\x89\x00\x00\x00\nIDATx\x9cc\x00"
|
||||
b"\x01\x00\x00\x05\x00\x01\r\n-\xb4\x00\x00\x00\x00IEND\xaeB`\x82"
|
||||
)
|
||||
return SimpleUploadedFile("avatar.png", png, content_type="image/png")
|
||||
|
||||
def test_upload_success_returns_200_and_sets_url(self):
|
||||
from unittest import mock
|
||||
|
||||
with mock.patch("apps.assets.storage.TosStorage") as MockStorage:
|
||||
inst = MockStorage.return_value
|
||||
inst.upload_fileobj.return_value = None
|
||||
inst.public_url.return_value = "https://bucket.example.com/users/x/avatar/abc.png"
|
||||
r = self.client.post("/api/auth/me/avatar/", {"file": self._png()}, format="multipart")
|
||||
self.assertEqual(r.status_code, 200, r.data)
|
||||
self.user.refresh_from_db()
|
||||
self.assertEqual(self.user.avatar_url, "https://bucket.example.com/users/x/avatar/abc.png")
|
||||
|
||||
def test_upload_storage_failure_returns_502_not_bare_500(self):
|
||||
from unittest import mock
|
||||
|
||||
with mock.patch("apps.assets.storage.TosStorage") as MockStorage:
|
||||
MockStorage.return_value.upload_fileobj.side_effect = RuntimeError("TOS unreachable")
|
||||
r = self.client.post("/api/auth/me/avatar/", {"file": self._png()}, format="multipart")
|
||||
self.assertEqual(r.status_code, 502)
|
||||
self.assertIn("detail", r.data)
|
||||
|
||||
def test_upload_without_file_returns_400(self):
|
||||
r = self.client.post("/api/auth/me/avatar/", {}, format="multipart")
|
||||
self.assertEqual(r.status_code, 400)
|
||||
|
||||
|
||||
class DeviceRevokeTests(TestCase):
|
||||
"""bug(10):在用设备点「下线」提示成功但实际没下线。真因=只标记 LoginSession.revoked_at
|
||||
没动 token(单 token 体系),被下线设备旧 token 仍有效。现改为旋转 token,旧 token 立即 401。"""
|
||||
|
||||
def setUp(self):
|
||||
from rest_framework.authtoken.models import Token
|
||||
|
||||
self.user = User.objects.create_user(username="dev-user", password="strong-password")
|
||||
# 模拟登录拿到 token(被下线的「目标设备」用的就是这个)
|
||||
self.token = Token.objects.create(user=self.user)
|
||||
|
||||
def test_revoke_session_invalidates_old_token(self):
|
||||
from apps.accounts.models import LoginSession
|
||||
|
||||
session = LoginSession.objects.create(user=self.user, user_agent="OtherDevice", ip_address="1.1.1.1")
|
||||
old_key = self.token.key
|
||||
|
||||
client = APIClient()
|
||||
client.credentials(HTTP_AUTHORIZATION=f"Token {old_key}")
|
||||
r = client.post(f"/api/auth/me/sessions/{session.id}/revoke/")
|
||||
self.assertEqual(r.status_code, 200)
|
||||
# 必须真正吊销:旧 token 已失效,再用它访问受保护接口应 401
|
||||
self.assertIn("token", r.data)
|
||||
self.assertNotEqual(r.data["token"], old_key)
|
||||
|
||||
stale = APIClient()
|
||||
stale.credentials(HTTP_AUTHORIZATION=f"Token {old_key}")
|
||||
self.assertEqual(stale.get("/api/auth/me/").status_code, 401)
|
||||
|
||||
# 会话被标记下线
|
||||
session.refresh_from_db()
|
||||
self.assertIsNotNone(session.revoked_at)
|
||||
|
||||
def test_revoke_unknown_session_no_op(self):
|
||||
import uuid as _uuid
|
||||
|
||||
client = APIClient()
|
||||
client.credentials(HTTP_AUTHORIZATION=f"Token {self.token.key}")
|
||||
r = client.post(f"/api/auth/me/sessions/{_uuid.uuid4()}/revoke/")
|
||||
self.assertEqual(r.status_code, 200)
|
||||
self.assertEqual(r.data.get("revoked"), 0)
|
||||
|
||||
|
||||
class TeamSettingsTests(TestCase):
|
||||
"""PMC#12:团队月限额持久化。设置后落库,刷新(重新 GET)仍在;成员不可改;清空回到「未设置」。"""
|
||||
|
||||
def _register(self, client, username, **extra):
|
||||
return client.post(
|
||||
"/api/auth/register/",
|
||||
{"username": username, "password": "strong-password", **extra},
|
||||
format="json",
|
||||
)
|
||||
|
||||
def setUp(self):
|
||||
self.owner_client = APIClient()
|
||||
r = self._register(self.owner_client, "ts-owner", team_name="TS Team", invite_code=make_create_team_code())
|
||||
self.assertEqual(r.status_code, 201)
|
||||
self.team = Team.objects.get(name="TS Team")
|
||||
self.owner_client.credentials(HTTP_AUTHORIZATION=f"Token {r.data['token']}")
|
||||
# 注册返回体里团队月限额默认未设置(null)
|
||||
self.assertIsNone(r.data["team"].get("monthly_credit_limit"))
|
||||
|
||||
def test_owner_sets_limit_persists(self):
|
||||
res = self.owner_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": 3000}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 200, res.content)
|
||||
self.assertEqual(Decimal(res.data["monthly_credit_limit"]), Decimal("3000"))
|
||||
# 落库
|
||||
self.team.refresh_from_db()
|
||||
self.assertEqual(self.team.monthly_credit_limit, Decimal("3000"))
|
||||
# 「刷新」= 重新 GET,值仍在(PMC#12 核心)
|
||||
got = self.owner_client.get("/api/auth/team/settings/")
|
||||
self.assertEqual(Decimal(got.data["monthly_credit_limit"]), Decimal("3000"))
|
||||
|
||||
def test_unlimited_minus_one_stored_as_is(self):
|
||||
res = self.owner_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": -1}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 200, res.content)
|
||||
self.team.refresh_from_db()
|
||||
self.assertEqual(self.team.monthly_credit_limit, Decimal("-1"))
|
||||
|
||||
def test_empty_clears_to_unset(self):
|
||||
self.owner_client.patch("/api/auth/team/settings/", {"monthly_credit_limit": 3000}, format="json")
|
||||
res = self.owner_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": ""}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 200, res.content)
|
||||
self.team.refresh_from_db()
|
||||
self.assertIsNone(self.team.monthly_credit_limit)
|
||||
|
||||
def test_invalid_number_rejected(self):
|
||||
res = self.owner_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": "abc"}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 400)
|
||||
|
||||
def test_member_cannot_change_limit(self):
|
||||
self.owner_client.post(
|
||||
"/api/auth/team/members/",
|
||||
{"username": "ts-member", "password": "strong-password", "role": "member"},
|
||||
format="json",
|
||||
)
|
||||
member_client = APIClient()
|
||||
login = member_client.post(
|
||||
"/api/auth/login/", {"username": "ts-member", "password": "strong-password"}, format="json"
|
||||
)
|
||||
member_client.credentials(HTTP_AUTHORIZATION=f"Token {login.data['token']}")
|
||||
# 成员可读
|
||||
self.assertEqual(member_client.get("/api/auth/team/settings/").status_code, 200)
|
||||
# 但不可改
|
||||
res = member_client.patch(
|
||||
"/api/auth/team/settings/", {"monthly_credit_limit": 9999}, format="json"
|
||||
)
|
||||
self.assertEqual(res.status_code, 403)
|
||||
self.team.refresh_from_db()
|
||||
self.assertIsNone(self.team.monthly_credit_limit)
|
||||
|
||||
Reference in New Issue
Block a user