Archived
snowy-yang
9df0028195
迁移端点：
- POST /api/v1/download（单曲：file 后台任务 / json 同步交付+结算）
- POST /api/v1/download/batch_zip（按去重歌曲数计费）
- POST /api/v1/podcast/download、/podcast/download/batch_zip
- 新增 web/billing.py（预扣+开账同事务 / 只退 open 行 / rename 承接）
与 web/tasks_registry.py（任务登记/容量闸/账本撞名重试，与 main 同口径）
- worker 仍复用 main 既有实现（无 flask 依赖），账本与交付语义不变
修复我引入的真实缺陷：
- download 参数校验分支（ID/音质/格式非法）漏退款 → 预扣泄漏。改为统一 _fail() 退款
- web/routers/{auth,register}.py 在导入期绑定 deps.secret_key，导致 patch web.deps.secret_key
无效、且测试顺序相关。改为调用期 deps.secret_key() 解析
测试：tests/test_download_billing.py 7 项沙箱用例如实断言账本守恒
（预扣必退、无 open 行残留、次数不足不建任务）；
全套 pytest 69/69（顺序无关）；ruff All checks passed；pyright 0 errors；奇偶 36/36。
112 lines
4.1 KiB
Python
112 lines
4.1 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""登录/会话端点测试（沙箱库，不触碰生产 data/site.db）。
|
|
|
|
覆盖：密码错误、正常用户登录签发可用 Cookie、管理员转 2FA 票据、
|
|
退出登录递增 login_seq、heartbeat 次数校验。
|
|
"""
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
import auth_system as auth
|
|
import core.db as db
|
|
|
|
SECRET = 'auth-test-secret'
|
|
USER_PW = 'UserPass123'
|
|
ADMIN_PW = 'AdminPass123'
|
|
|
|
|
|
@pytest.fixture()
|
|
def app_env(tmp_path, monkeypatch):
|
|
"""沙箱站点库 + 独立密钥，隔离生产数据。"""
|
|
db_path = tmp_path / 'site.db'
|
|
monkeypatch.setattr(auth, 'DATA_DIR', tmp_path)
|
|
monkeypatch.setattr(auth, 'DB_PATH', db_path)
|
|
monkeypatch.setattr(auth, 'BACKUP_DIR', tmp_path / 'backups')
|
|
monkeypatch.setattr(auth, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
|
|
monkeypatch.setattr(db, 'DATA_DIR', tmp_path)
|
|
monkeypatch.setattr(db, 'DB_PATH', db_path)
|
|
auth.init_db()
|
|
|
|
conn = auth.get_conn()
|
|
conn.execute('INSERT INTO users (username, password_hash, salt, role, duration_seconds, '
|
|
'status, login_seq, created_at) VALUES (?,?,?,?,?,1,0,?)',
|
|
('normaluser', auth._hash_new(USER_PW), '', 'user', 97, 1730000000))
|
|
conn.execute('INSERT INTO users (username, password_hash, salt, role, duration_seconds, '
|
|
'status, login_seq, created_at, email) VALUES (?,?,?,?,?,1,0,?,?)',
|
|
('bossuser', auth._hash_new(ADMIN_PW), '', 'admin', -1, 1730000000,
|
|
'boss@example.com'))
|
|
conn.commit()
|
|
conn.close()
|
|
|
|
monkeypatch.setattr('web.deps.secret_key', lambda: SECRET)
|
|
|
|
# 清空登录失败锁定/2FA 的模块级内存态，避免测试间串扰
|
|
import auth_routes
|
|
auth_routes._LOGIN_FAILS.clear()
|
|
auth_routes._LOGIN_FAIL_LOGGED.clear()
|
|
auth_routes._ADMIN_2FA.clear()
|
|
|
|
from web.app import create_app
|
|
return TestClient(create_app())
|
|
|
|
|
|
def test_wrong_password(app_env):
|
|
r = app_env.post('/api/v1/auth/login', json={'username': 'normaluser', 'password': 'nope'})
|
|
assert r.status_code == 400
|
|
assert r.json()['success'] is False
|
|
assert 'session' not in r.cookies
|
|
|
|
|
|
def test_user_login_issues_working_cookie(app_env):
|
|
r = app_env.post('/api/v1/auth/login', json={'username': 'normaluser', 'password': USER_PW})
|
|
assert r.status_code == 200
|
|
body = r.json()
|
|
assert body['success'] is True
|
|
assert body['data']['redirect'] == 'user'
|
|
assert 'session' in r.cookies
|
|
|
|
# 用签发的 Cookie 访问受保护端点，应放行
|
|
r2 = app_env.post('/api/v1/auth/heartbeat', json={})
|
|
assert r2.status_code == 200
|
|
assert r2.json()['data']['duration_text'] == '97 次'
|
|
|
|
|
|
def test_admin_login_returns_2fa_ticket(app_env):
|
|
r = app_env.post('/api/v1/auth/login', json={'username': 'bossuser', 'password': ADMIN_PW})
|
|
assert r.status_code == 200
|
|
data = r.json()['data']
|
|
assert data['admin_2fa'] is True
|
|
assert data['ticket']
|
|
assert 'session' not in r.cookies # 管理员不在此建立会话
|
|
|
|
|
|
def test_logout_bumps_login_seq_and_clears(app_env):
|
|
app_env.post('/api/v1/auth/login', json={'username': 'normaluser', 'password': USER_PW})
|
|
conn = auth.get_conn()
|
|
seq_before = conn.execute(
|
|
"SELECT login_seq FROM users WHERE username='normaluser'").fetchone()[0]
|
|
conn.close()
|
|
r = app_env.post('/api/v1/auth/logout', json={})
|
|
assert r.status_code == 200
|
|
conn = auth.get_conn()
|
|
seq_after = conn.execute(
|
|
"SELECT login_seq FROM users WHERE username='normaluser'").fetchone()[0]
|
|
conn.close()
|
|
assert seq_after == seq_before + 1
|
|
# 旧 Cookie 失效
|
|
r2 = app_env.post('/api/v1/auth/heartbeat', json={})
|
|
assert r2.status_code == 401
|
|
|
|
|
|
def test_heartbeat_expired_credits(app_env):
|
|
conn = auth.get_conn()
|
|
conn.execute("UPDATE users SET duration_seconds=0 WHERE username='normaluser'")
|
|
conn.commit()
|
|
conn.close()
|
|
r = app_env.post('/api/v1/auth/login', json={'username': 'normaluser', 'password': USER_PW})
|
|
assert r.status_code == 200
|
|
r2 = app_env.post('/api/v1/auth/heartbeat', json={})
|
|
assert r2.status_code == 401
|
|
assert r2.json().get('error_code') == 'expired'
|