feat(core): Wave 3.5 邀请制后端 — Invitation 模型 + 端点 + register 改造(只生成迁移不apply)

- Invitation 模型:team/code(TEAM-XXXX-XXXX唯一)/role/email/月额度/created_by/expires_at(7天)/ used_by/used_at/status(pending/used/revoked/expired);迁移 accounts/0003(未 apply 远程库,rule 3) - RegisterSerializer 加 invite_code:有效码→幂等 get_or_create 成员+标used+跳过额度发放; 无码→开新团队当 owner+试用额度(原逻辑);邀请 role 不许 OWNER 降级 ADMIN;不存在/已用/过期→400 - 端点 /api/auth/team/invitations/(GET列/POST生成)+ <id>/revoke/;权限复用 can_manage_team(超管/团管) 验证: django check 0;apps.accounts 测试 5/5 OK —— 含「凭码加入同团队/角色额度对/不重复发额度/ 未知码400/普通成员生成403」。认证定调:username 为主标识、不用邮箱注册。 ⚠️ Invitation 迁移需用户低峰 apply 到远程 MySQL,前端生成码 e2e 才能跑(逻辑已被测试证)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-19 12:31:14 +08:00
parent 9643f9ba5e
commit ba855cc219
6 changed files with 282 additions and 17 deletions
@@ -47,3 +47,72 @@ class AuthApiTests(TestCase):
        self.assertEqual(genesis.first().amount, trial)
        self.assertEqual(genesis.first().balance_after, trial)  # 流水终点 == 账户余额,可对账

+
+class InvitationFlowTests(TestCase):
+    def _register(self, client, username, **extra):
+        return client.post(
+            "/api/auth/register/",
+            {"username": username, "password": "strong-password", **extra},
+            format="json",
+        )
+
+    def test_invite_join_same_team_no_duplicate_credits(self):
+        from apps.accounts.models import Invitation
+
+        owner_client = APIClient()
+        r = self._register(owner_client, "inv-owner", team_name="Owner Team")
+        self.assertEqual(r.status_code, 201)
+        team = Team.objects.get(name="Owner Team")
+        accounts_before = CreditAccount.objects.filter(team=team).count()
+        ledgers_before = CreditLedger.objects.filter(team=team).count()
+
+        # 超管生成邀请码
+        owner_client.credentials(HTTP_AUTHORIZATION=f"Token {r.data['token']}")
+        gen = owner_client.post(
+            "/api/auth/team/invitations/",
+            {"role": "member", "monthly_credit_limit": "500"},
+            format="json",
+        )
+        self.assertEqual(gen.status_code, 201)
+        code = gen.data["code"]
+        self.assertTrue(code.startswith("TEAM-"))
+
+        # 新用户凭码注册
+        r2 = self._register(APIClient(), "inv-joiner", invite_code=code)
+        self.assertEqual(r2.status_code, 201)
+        joiner = User.objects.get(username="inv-joiner")
+
+        # 进的是同一团队、角色对、active、额度对
+        member = TeamMember.objects.get(team=team, user=joiner)
+        self.assertEqual(member.role, TeamMember.Role.MEMBER)
+        self.assertEqual(member.status, TeamMember.Status.ACTIVE)
+        self.assertEqual(member.monthly_credit_limit, Decimal("500"))
+        # 没开新团队
+        self.assertFalse(Team.objects.filter(owner=joiner).exists())
+        # 关键:不重复发额度 —— 团队 CreditAccount/ledger 数量不变
+        self.assertEqual(CreditAccount.objects.filter(team=team).count(), accounts_before)
+        self.assertEqual(CreditLedger.objects.filter(team=team).count(), ledgers_before)
+        # 邀请标 used
+        inv = Invitation.objects.get(code=code)
+        self.assertEqual(inv.status, Invitation.Status.USED)
+        self.assertEqual(inv.used_by, joiner)
+
+    def test_register_with_unknown_invite_rejected(self):
+        r = self._register(APIClient(), "bad-inv", invite_code="TEAM-ABCD-EFGH")
+        self.assertEqual(r.status_code, 400)
+        self.assertFalse(User.objects.filter(username="bad-inv").exists())
+
+    def test_invite_generate_requires_manage_permission(self):
+        owner_client = APIClient()
+        ro = self._register(owner_client, "perm-owner", team_name="Perm Team")
+        owner_client.credentials(HTTP_AUTHORIZATION=f"Token {ro.data['token']}")
+        gen = owner_client.post("/api/auth/team/invitations/", {"role": "member"}, format="json")
+        code = gen.data["code"]
+
+        joiner_client = APIClient()
+        rj = self._register(joiner_client, "perm-member", invite_code=code)
+        # 普通成员尝试生成邀请码 → 403
+        joiner_client.credentials(HTTP_AUTHORIZATION=f"Token {rj.data['token']}")
+        gen2 = joiner_client.post("/api/auth/team/invitations/", {"role": "member"}, format="json")
+        self.assertEqual(gen2.status_code, 403)
+