89 lines
3.3 KiB
Python
89 lines
3.3 KiB
Python
"""合规正文：隐私政策 / 使用条款 / 网站声明。"""
|
|
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.core.config import get_settings
|
|
from app.core.security import create_access_token
|
|
|
|
|
|
@pytest.fixture
|
|
def client(monkeypatch):
|
|
monkeypatch.setenv("JWT_SECRET", "test-secret-must-be-32-characters!")
|
|
monkeypatch.setenv("API_PAYLOAD_ENCRYPT", "false")
|
|
get_settings.cache_clear()
|
|
if not get_settings().database_url.strip():
|
|
pytest.skip("DATABASE_URL 为空")
|
|
from app.main import create_app
|
|
|
|
with TestClient(create_app()) as api:
|
|
yield api
|
|
get_settings.cache_clear()
|
|
|
|
|
|
def _staff() -> dict[str, str]:
|
|
return {"Authorization": f"Bearer {create_access_token('1', 'staff')}"}
|
|
|
|
|
|
def test_legal_pages_publish_filter_placeholder_and_footer_links(client):
|
|
staff = _staff()
|
|
try:
|
|
for key, placeholder in (
|
|
("privacy", "隐私政策整理中"),
|
|
("terms", "使用条款整理中"),
|
|
("statement", "网站声明整理中"),
|
|
):
|
|
empty = client.get(f"/api/site/legal/{key}")
|
|
assert empty.status_code == 200, empty.text
|
|
assert placeholder in empty.text
|
|
|
|
home = client.get("/api/site/home")
|
|
assert home.status_code == 200, home.text
|
|
labels = [item["label"] for item in home.json()["compliance"]["links"]]
|
|
assert labels == ["隐私政策", "使用条款", "网站声明"]
|
|
assert all(item["navigation"] == "sameWindow" for item in home.json()["compliance"]["links"])
|
|
assert home.json()["compliance"]["links"][0]["url"] == "/legal/privacy"
|
|
assert "隐私政策、使用条款与网站声明整理中" not in home.text
|
|
|
|
saved = client.put(
|
|
"/api/admin/legal/privacy",
|
|
headers=staff,
|
|
json={
|
|
"published": True,
|
|
"bodyHtml": "<p>我们如何处理个人信息</p><script>alert(1)</script>",
|
|
},
|
|
)
|
|
assert saved.status_code == 200, saved.text
|
|
|
|
public = client.get("/api/site/legal/privacy")
|
|
assert public.status_code == 200, public.text
|
|
assert public.json()["title"] == "隐私政策"
|
|
assert "我们如何处理个人信息" in public.json()["bodyHtml"]
|
|
lowered = public.json()["bodyHtml"].lower()
|
|
assert "script" not in lowered
|
|
assert "alert" not in lowered
|
|
assert "隐私政策整理中" not in public.text
|
|
|
|
rejected = client.put(
|
|
"/api/admin/legal/privacy",
|
|
headers={"Authorization": f"Bearer {create_access_token('1', 'member')}"},
|
|
json={"published": True, "bodyHtml": "<p>会员不得改</p>"},
|
|
)
|
|
assert rejected.status_code in (401, 403)
|
|
assert "会员不得改" not in client.get("/api/site/legal/privacy").text
|
|
|
|
cleared = client.put(
|
|
"/api/admin/legal/privacy",
|
|
headers=staff,
|
|
json={"published": False, "bodyHtml": "<p></p>"},
|
|
)
|
|
assert cleared.status_code == 200, cleared.text
|
|
assert "隐私政策整理中" in client.get("/api/site/legal/privacy").text
|
|
finally:
|
|
for key in ("privacy", "terms", "statement"):
|
|
client.put(
|
|
f"/api/admin/legal/{key}",
|
|
headers=staff,
|
|
json={"published": False, "bodyHtml": "<p></p>"},
|
|
)
|