2026-09-10 10:58:43 +08:00
|
|
|
|
"""
|
2026-09-18 13:50:19 +08:00
|
|
|
|
V1.1 新增 Operator 角色权限边界 E2E（INV-012 / INV-018 / INV-019）。
|
|
|
|
|
|
|
|
|
|
|
|
迁移说明：原文件用 counselor 的 token 去"模拟" content_editor 的权限边界
|
|
|
|
|
|
（名不副实——测的根本不是 content_editor），且 import 期读环境变量导致收集失败。
|
|
|
|
|
|
现改为真实的角色账号。
|
2026-09-10 10:58:43 +08:00
|
|
|
|
"""
|
|
|
|
|
|
import pytest
|
|
|
|
|
|
|
2026-09-18 13:50:19 +08:00
|
|
|
|
pytestmark = pytest.mark.e2e
|
2026-09-10 10:58:43 +08:00
|
|
|
|
|
|
|
|
|
|
|
2026-09-18 13:50:19 +08:00
|
|
|
|
def test_station_operator_cannot_view_counseling_queue(api, operator_token):
|
|
|
|
|
|
"""INV-012：服务站运营人员不得进入咨询队列。"""
|
|
|
|
|
|
token = operator_token("e2e_station")
|
|
|
|
|
|
resp = api.call("GET", "/counseling/services/operator/queue", token=token)
|
|
|
|
|
|
assert resp.status_code == 403, (
|
|
|
|
|
|
f"服务站运营竟能查看咨询队列：HTTP {resp.status_code} {resp.text[:200]}"
|
|
|
|
|
|
)
|
2026-09-10 10:58:43 +08:00
|
|
|
|
|
|
|
|
|
|
|
2026-09-18 13:50:19 +08:00
|
|
|
|
def test_counselor_cannot_view_all_service_appointments(api, operator_token):
|
|
|
|
|
|
"""INV-012：咨询师不得浏览全量服务预约。"""
|
|
|
|
|
|
token = operator_token("e2e_counselor")
|
|
|
|
|
|
resp = api.call("GET", "/service-appointments/operator/list", token=token)
|
|
|
|
|
|
assert resp.status_code == 403, (
|
|
|
|
|
|
f"咨询师竟能浏览全量预约：HTTP {resp.status_code} {resp.text[:200]}"
|
|
|
|
|
|
)
|
2026-09-10 10:58:43 +08:00
|
|
|
|
|
|
|
|
|
|
|
2026-09-18 13:50:19 +08:00
|
|
|
|
def test_content_editor_cannot_access_appeals(api, operator_token):
|
|
|
|
|
|
"""INV-019：内容编辑员不得访问申诉等用户数据处理职能。"""
|
|
|
|
|
|
token = operator_token("e2e_content")
|
|
|
|
|
|
resp = api.call("GET", "/operator/appeals/pending", token=token)
|
|
|
|
|
|
assert resp.status_code == 403, (
|
|
|
|
|
|
f"内容编辑员竟能访问申诉队列：HTTP {resp.status_code} {resp.text[:200]}"
|
|
|
|
|
|
)
|
