536 lines
17 KiB
Python
536 lines
17 KiB
Python
"""OA 实例评论：附件枚举与引用校验"""
|
|
import json
|
|
import unittest
|
|
from datetime import datetime
|
|
|
|
from app.services.oa_instance_comment import (
|
|
enumerate_form_attachments,
|
|
normalize_attachment_refs,
|
|
)
|
|
|
|
|
|
class TestEnumerateFormAttachments(unittest.TestCase):
|
|
def test_groups_upload_fields(self):
|
|
schema = {
|
|
"rule": [
|
|
{
|
|
"type": "upload",
|
|
"field": "files",
|
|
"title": "附件",
|
|
},
|
|
{"type": "input", "field": "name", "title": "名称"},
|
|
]
|
|
}
|
|
form = {
|
|
"files": [
|
|
{"url": "https://x/a.pdf", "name": "a.pdf"},
|
|
{"url": "https://x/b.pdf", "name": "b.pdf"},
|
|
],
|
|
"name": "demo",
|
|
}
|
|
items = enumerate_form_attachments(schema, form)
|
|
self.assertEqual(len(items), 1)
|
|
self.assertEqual(items[0]["fieldKey"], "files")
|
|
self.assertEqual(items[0]["fieldLabel"], "附件")
|
|
self.assertEqual(len(items[0]["files"]), 2)
|
|
self.assertEqual(items[0]["files"][0]["fileName"], "a.pdf")
|
|
|
|
def test_skips_empty_upload(self):
|
|
schema = {"rule": [{"type": "fcUpload", "field": "f", "title": "F"}]}
|
|
self.assertEqual(enumerate_form_attachments(schema, {"f": []}), [])
|
|
|
|
|
|
class TestNormalizeAttachmentRefs(unittest.TestCase):
|
|
def test_accepts_valid_ref(self):
|
|
schema = {"rule": [{"type": "upload", "field": "files", "title": "附件"}]}
|
|
form = {"files": [{"url": "https://x/a.pdf", "name": "a.pdf"}]}
|
|
out = normalize_attachment_refs(
|
|
schema,
|
|
form,
|
|
[{"fieldKey": "files", "url": "https://x/a.pdf", "fileName": "wrong"}],
|
|
)
|
|
self.assertEqual(out[0]["fileName"], "a.pdf")
|
|
self.assertEqual(out[0]["fieldLabel"], "附件")
|
|
|
|
def test_rejects_foreign_url(self):
|
|
from app.services.oa_engine import OaEngineError
|
|
|
|
schema = {"rule": [{"type": "upload", "field": "files", "title": "附件"}]}
|
|
form = {"files": [{"url": "https://x/a.pdf", "name": "a.pdf"}]}
|
|
with self.assertRaises(OaEngineError):
|
|
normalize_attachment_refs(
|
|
schema,
|
|
form,
|
|
[{"fieldKey": "files", "url": "https://evil/x.pdf"}],
|
|
)
|
|
|
|
def test_marks_form_ref_source(self):
|
|
schema = {"rule": [{"type": "upload", "field": "files", "title": "附件"}]}
|
|
form = {"files": [{"url": "https://x/a.pdf", "name": "a.pdf"}]}
|
|
out = normalize_attachment_refs(
|
|
schema,
|
|
form,
|
|
[{"url": "https://x/a.pdf"}],
|
|
)
|
|
self.assertEqual(out[0]["source"], "form")
|
|
|
|
def test_accepts_tenant_upload_and_uses_stored_name(self):
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import sessionmaker
|
|
from app.models.models import BizAttachment
|
|
|
|
engine = create_engine("sqlite:///:memory:")
|
|
BizAttachment.__table__.create(engine)
|
|
db = sessionmaker(bind=engine)()
|
|
db.add(
|
|
BizAttachment(
|
|
id="att1",
|
|
original_name="note.pdf",
|
|
file_url="oa-approval/note.pdf",
|
|
tenant_no="t1",
|
|
create_dept_id="",
|
|
)
|
|
)
|
|
db.commit()
|
|
out = normalize_attachment_refs(
|
|
None,
|
|
{},
|
|
[{"source": "upload", "url": "oa-approval/note.pdf", "fileName": "hack.pdf"}],
|
|
db=db,
|
|
tenant_no="t1",
|
|
)
|
|
self.assertEqual(out[0]["source"], "upload")
|
|
self.assertEqual(out[0]["fileName"], "note.pdf")
|
|
self.assertEqual(out[0]["fieldKey"], "")
|
|
db.close()
|
|
|
|
def test_rejects_upload_from_other_tenant_or_unknown_url(self):
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import sessionmaker
|
|
from app.models.models import BizAttachment
|
|
from app.services.oa_engine import OaEngineError
|
|
|
|
engine = create_engine("sqlite:///:memory:")
|
|
BizAttachment.__table__.create(engine)
|
|
db = sessionmaker(bind=engine)()
|
|
db.add(
|
|
BizAttachment(
|
|
id="att2",
|
|
original_name="note.pdf",
|
|
file_url="oa-approval/note.pdf",
|
|
tenant_no="other",
|
|
create_dept_id="",
|
|
)
|
|
)
|
|
db.commit()
|
|
with self.assertRaises(OaEngineError):
|
|
normalize_attachment_refs(
|
|
None,
|
|
{},
|
|
[{"source": "upload", "url": "oa-approval/note.pdf"}],
|
|
db=db,
|
|
tenant_no="t1",
|
|
)
|
|
with self.assertRaises(OaEngineError):
|
|
normalize_attachment_refs(
|
|
None,
|
|
{},
|
|
[{"source": "upload", "url": "https://evil.example/a.pdf"}],
|
|
db=db,
|
|
tenant_no="t1",
|
|
)
|
|
db.close()
|
|
|
|
|
|
class TestCommentCrud(unittest.TestCase):
|
|
def setUp(self):
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import sessionmaker
|
|
from app.models.models import OaAppVersion, OaInstance, OaInstanceComment, SysUser
|
|
|
|
self.engine = create_engine("sqlite:///:memory:")
|
|
OaAppVersion.__table__.create(self.engine)
|
|
OaInstance.__table__.create(self.engine)
|
|
OaInstanceComment.__table__.create(self.engine)
|
|
SysUser.__table__.create(self.engine)
|
|
Session = sessionmaker(bind=self.engine, autoflush=False, autocommit=False)
|
|
self.db = Session()
|
|
now = datetime.now()
|
|
schema = {
|
|
"rule": [
|
|
{"type": "upload", "field": "files", "title": "附件"},
|
|
]
|
|
}
|
|
self.db.add(
|
|
OaAppVersion(
|
|
id="v1",
|
|
app_id="app1",
|
|
version_no=1,
|
|
status="published",
|
|
is_latest_published="1",
|
|
form_schema_json=json.dumps(schema, ensure_ascii=False),
|
|
flow_tree_json="{}",
|
|
advanced_settings_json="{}",
|
|
tenant_no="zkxw",
|
|
create_dept_id="",
|
|
create_time=now,
|
|
update_time=now,
|
|
del_flag=0,
|
|
)
|
|
)
|
|
self.db.add(
|
|
OaInstance(
|
|
id="i1",
|
|
app_id="app1",
|
|
app_version_id="v1",
|
|
title="t",
|
|
status="running",
|
|
initiator_user_id="u0",
|
|
initiator_dept_id="d1",
|
|
form_data_json=json.dumps(
|
|
{"files": [{"url": "https://x/a.pdf", "name": "a.pdf"}]},
|
|
ensure_ascii=False,
|
|
),
|
|
tenant_no="zkxw",
|
|
create_dept_id="d1",
|
|
create_time=now,
|
|
update_time=now,
|
|
del_flag=0,
|
|
current_round=1,
|
|
)
|
|
)
|
|
self.db.add(
|
|
SysUser(
|
|
id="u1",
|
|
tenant_no="zkxw",
|
|
user_no="u1",
|
|
nick_name="张三",
|
|
email="",
|
|
phone_no="",
|
|
password="",
|
|
status="1",
|
|
create_dept_id="",
|
|
del_flag=0,
|
|
create_time=now,
|
|
update_time=now,
|
|
)
|
|
)
|
|
self.db.commit()
|
|
|
|
def test_create_list_revoke(self):
|
|
from app.services import oa_instance_comment as svc
|
|
|
|
row = svc.create_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
dept_id="d1",
|
|
content="请看附件",
|
|
attachment_refs=[{"fieldKey": "files", "url": "https://x/a.pdf"}],
|
|
)
|
|
self.assertEqual(row["status"], "normal")
|
|
self.assertTrue(row["canRevoke"])
|
|
self.assertEqual(len(row["attachmentRefs"]), 1)
|
|
|
|
listed = svc.list_comments(
|
|
self.db, instance_id="i1", tenant_no="zkxw", viewer_user_id="u1"
|
|
)
|
|
self.assertEqual(len(listed), 1)
|
|
|
|
revoked = svc.revoke_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
comment_id=row["id"],
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
)
|
|
self.assertEqual(revoked["status"], "revoked")
|
|
self.assertFalse(revoked["canRevoke"])
|
|
|
|
again = svc.revoke_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
comment_id=row["id"],
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
)
|
|
self.assertEqual(again["status"], "revoked")
|
|
|
|
def test_can_comment_and_revoke_when_completed(self):
|
|
from app.services import oa_instance_comment as svc
|
|
from app.models.models import OaInstance
|
|
|
|
inst = self.db.query(OaInstance).filter(OaInstance.id == "i1").one()
|
|
inst.status = "completed"
|
|
self.db.commit()
|
|
row = svc.create_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
dept_id="d1",
|
|
content="结束后仍可评论",
|
|
attachment_refs=None,
|
|
)
|
|
self.assertEqual(row["status"], "normal")
|
|
self.assertTrue(row["canRevoke"])
|
|
revoked = svc.revoke_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
comment_id=row["id"],
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
)
|
|
self.assertEqual(revoked["status"], "revoked")
|
|
|
|
|
|
class TestCommentMentionGrant(unittest.TestCase):
|
|
def setUp(self):
|
|
from sqlalchemy import create_engine
|
|
from sqlalchemy.orm import sessionmaker
|
|
from app.models.models import (
|
|
OaAppVersion,
|
|
OaInstance,
|
|
OaInstanceComment,
|
|
OaInstanceViewGrant,
|
|
OaTask,
|
|
SysUser,
|
|
)
|
|
|
|
self.engine = create_engine("sqlite:///:memory:")
|
|
for table in (
|
|
OaAppVersion.__table__,
|
|
OaInstance.__table__,
|
|
OaInstanceComment.__table__,
|
|
OaInstanceViewGrant.__table__,
|
|
OaTask.__table__,
|
|
SysUser.__table__,
|
|
):
|
|
table.create(self.engine)
|
|
Session = sessionmaker(bind=self.engine, autoflush=False, autocommit=False)
|
|
self.db = Session()
|
|
now = datetime.now()
|
|
self.db.add(
|
|
OaAppVersion(
|
|
id="v1",
|
|
app_id="app1",
|
|
version_no=1,
|
|
status="published",
|
|
is_latest_published="1",
|
|
form_schema_json="{}",
|
|
flow_tree_json="{}",
|
|
advanced_settings_json="{}",
|
|
tenant_no="zkxw",
|
|
create_dept_id="",
|
|
create_time=now,
|
|
update_time=now,
|
|
del_flag=0,
|
|
)
|
|
)
|
|
self.db.add(
|
|
OaInstance(
|
|
id="i1",
|
|
app_id="app1",
|
|
app_version_id="v1",
|
|
title="t",
|
|
status="running",
|
|
initiator_user_id="u0",
|
|
initiator_dept_id="d1",
|
|
form_data_json="{}",
|
|
tenant_no="zkxw",
|
|
create_dept_id="d1",
|
|
create_time=now,
|
|
update_time=now,
|
|
del_flag=0,
|
|
current_round=1,
|
|
)
|
|
)
|
|
for uid, name, status in (("u1", "张三", "1"), ("u2", "李四", "1"), ("u3", "王五", "0")):
|
|
self.db.add(
|
|
SysUser(
|
|
id=uid,
|
|
tenant_no="zkxw",
|
|
user_no=uid,
|
|
nick_name=name,
|
|
email="",
|
|
phone_no="",
|
|
password="",
|
|
status=status,
|
|
create_dept_id="",
|
|
del_flag=0,
|
|
create_time=now,
|
|
update_time=now,
|
|
)
|
|
)
|
|
self.db.commit()
|
|
|
|
def test_mention_grants_view_and_is_idempotent(self):
|
|
from app.models.models import OaInstanceViewGrant
|
|
from app.services import oa_instance_comment as svc
|
|
|
|
row = svc.create_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
dept_id="d1",
|
|
content="",
|
|
attachment_refs=None,
|
|
mention_user_ids=["u2", "u2", "u1"],
|
|
)
|
|
self.assertEqual(row["content"], "")
|
|
self.assertEqual([m["userId"] for m in row["mentions"]], ["u2"])
|
|
self.assertEqual(row["mentions"][0]["userName"], "李四")
|
|
grants = (
|
|
self.db.query(OaInstanceViewGrant)
|
|
.filter(OaInstanceViewGrant.del_flag == 0)
|
|
.all()
|
|
)
|
|
self.assertEqual(len(grants), 1)
|
|
self.assertEqual(grants[0].user_id, "u2")
|
|
self.assertEqual(grants[0].source, "comment_mention")
|
|
|
|
svc.create_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
dept_id="d1",
|
|
content="再提一次",
|
|
attachment_refs=None,
|
|
mention_user_ids=["u2"],
|
|
)
|
|
grants = (
|
|
self.db.query(OaInstanceViewGrant)
|
|
.filter(OaInstanceViewGrant.del_flag == 0)
|
|
.all()
|
|
)
|
|
self.assertEqual(len(grants), 1)
|
|
|
|
def test_rejects_empty_without_mention(self):
|
|
from app.services import oa_instance_comment as svc
|
|
from app.services.oa_engine import OaEngineError
|
|
|
|
with self.assertRaises(OaEngineError):
|
|
svc.create_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
dept_id="d1",
|
|
content=" ",
|
|
attachment_refs=None,
|
|
mention_user_ids=None,
|
|
)
|
|
|
|
def test_allows_upload_only_comment(self):
|
|
from app.models.models import BizAttachment
|
|
from app.services import oa_instance_comment as svc
|
|
|
|
BizAttachment.__table__.create(self.engine)
|
|
self.db.add(
|
|
BizAttachment(
|
|
id="att-c1",
|
|
original_name="note.pdf",
|
|
file_url="oa-approval/note.pdf",
|
|
tenant_no="zkxw",
|
|
create_dept_id="",
|
|
)
|
|
)
|
|
self.db.commit()
|
|
row = svc.create_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
dept_id="d1",
|
|
content=" ",
|
|
attachment_refs=[{"source": "upload", "url": "oa-approval/note.pdf"}],
|
|
mention_user_ids=None,
|
|
)
|
|
self.assertEqual(row["content"], "")
|
|
self.assertEqual(row["attachmentRefs"][0]["source"], "upload")
|
|
self.assertEqual(row["attachmentRefs"][0]["fileName"], "note.pdf")
|
|
|
|
def test_rejects_disabled_user(self):
|
|
from app.services import oa_instance_comment as svc
|
|
from app.services.oa_engine import OaEngineError
|
|
|
|
with self.assertRaises(OaEngineError):
|
|
svc.create_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
dept_id="d1",
|
|
content="x",
|
|
attachment_refs=None,
|
|
mention_user_ids=["u3"],
|
|
)
|
|
|
|
def test_revoke_keeps_grant_and_list_skips_participants(self):
|
|
from app.models.models import OaInstance, OaInstanceViewGrant, OaTask
|
|
from app.services import oa_instance_comment as svc
|
|
|
|
row = svc.create_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
dept_id="d1",
|
|
content="请看",
|
|
attachment_refs=None,
|
|
mention_user_ids=["u2"],
|
|
)
|
|
svc.revoke_comment(
|
|
self.db,
|
|
instance_id="i1",
|
|
comment_id=row["id"],
|
|
tenant_no="zkxw",
|
|
user_id="u1",
|
|
)
|
|
self.assertEqual(
|
|
self.db.query(OaInstanceViewGrant)
|
|
.filter(OaInstanceViewGrant.del_flag == 0)
|
|
.count(),
|
|
1,
|
|
)
|
|
self.assertEqual(
|
|
svc.list_mentioned_instance_ids(self.db, tenant_no="zkxw", user_id="u2"),
|
|
["i1"],
|
|
)
|
|
|
|
now = datetime.now()
|
|
self.db.add(
|
|
OaTask(
|
|
id="t-cc",
|
|
instance_id="i1",
|
|
task_type="cc",
|
|
assignee_user_id="u2",
|
|
status="done",
|
|
tenant_no="zkxw",
|
|
create_dept_id="",
|
|
create_time=now,
|
|
update_time=now,
|
|
del_flag=0,
|
|
round_no=1,
|
|
is_read=0,
|
|
)
|
|
)
|
|
self.db.commit()
|
|
# 即使已是抄送人，被@仍应出现在「提到我的」
|
|
self.assertEqual(
|
|
svc.list_mentioned_instance_ids(self.db, tenant_no="zkxw", user_id="u2"),
|
|
["i1"],
|
|
)
|
|
|
|
inst = self.db.query(OaInstance).filter(OaInstance.id == "i1").one()
|
|
inst.initiator_user_id = "u2"
|
|
self.db.commit()
|
|
# 即使已是发起人，被@仍应出现在「提到我的」
|
|
self.assertEqual(
|
|
svc.list_mentioned_instance_ids(self.db, tenant_no="zkxw", user_id="u2"),
|
|
["i1"],
|
|
)
|