feat(oa): enumerate and validate comment form attachment refs

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_oa_instance_comment.py

@@ -0,0 +1,63 @@
+"""OA 实例评论：附件枚举与引用校验"""
+import unittest
+
+from app.services.oa_instance_comment import (
+    enumerate_form_attachments,
+    normalize_attachment_refs,
+)
+
+
+class TestEnumerateFormAttachments(unittest.TestCase):
+    def test_groups_upload_fields(self):
+        schema = {
+            "rule": [
+                {
+                    "type": "upload",
+                    "field": "files",
+                    "title": "附件",
+                },
+                {"type": "input", "field": "name", "title": "名称"},
+            ]
+        }
+        form = {
+            "files": [
+                {"url": "https://x/a.pdf", "name": "a.pdf"},
+                {"url": "https://x/b.pdf", "name": "b.pdf"},
+            ],
+            "name": "demo",
+        }
+        items = enumerate_form_attachments(schema, form)
+        self.assertEqual(len(items), 1)
+        self.assertEqual(items[0]["fieldKey"], "files")
+        self.assertEqual(items[0]["fieldLabel"], "附件")
+        self.assertEqual(len(items[0]["files"]), 2)
+        self.assertEqual(items[0]["files"][0]["fileName"], "a.pdf")
+
+    def test_skips_empty_upload(self):
+        schema = {"rule": [{"type": "fcUpload", "field": "f", "title": "F"}]}
+        self.assertEqual(enumerate_form_attachments(schema, {"f": []}), [])
+
+
+class TestNormalizeAttachmentRefs(unittest.TestCase):
+    def test_accepts_valid_ref(self):
+        schema = {"rule": [{"type": "upload", "field": "files", "title": "附件"}]}
+        form = {"files": [{"url": "https://x/a.pdf", "name": "a.pdf"}]}
+        out = normalize_attachment_refs(
+            schema,
+            form,
+            [{"fieldKey": "files", "url": "https://x/a.pdf", "fileName": "wrong"}],
+        )
+        self.assertEqual(out[0]["fileName"], "a.pdf")
+        self.assertEqual(out[0]["fieldLabel"], "附件")
+
+    def test_rejects_foreign_url(self):
+        from app.services.oa_engine import OaEngineError
+
+        schema = {"rule": [{"type": "upload", "field": "files", "title": "附件"}]}
+        form = {"files": [{"url": "https://x/a.pdf", "name": "a.pdf"}]}
+        with self.assertRaises(OaEngineError):
+            normalize_attachment_refs(
+                schema,
+                form,
+                [{"fieldKey": "files", "url": "https://evil/x.pdf"}],
+            )