41 lines
1.5 KiB
Python
41 lines
1.5 KiB
Python
|
"""
|
||
|
|
E2E 测试：Phase 23 - 服务站权限隔离
|
||
|
|
"""
|
||
|
|
import os
|
||
|
|
import pytest
|
||
|
|
import requests
|
||
|
|
|
||
|
|
BASE_URL = "http://localhost:8085/api/v1"
|
||
|
|
E2E_PASSWORD = os.environ["E2E_PASSWORD"]
|
||
|
|
|
||
|
|
def get_station_operator_token():
|
||
|
|
r = requests.post(f"{BASE_URL}/auth/operator/login", json={"username": "stationop", "password": E2E_PASSWORD})
|
||
|
|
return r.json()["data"]["accessToken"]
|
||
|
|
|
||
|
|
def get_counselor_token():
|
||
|
|
r = requests.post(f"{BASE_URL}/auth/operator/login", json={"username": "counselor01", "password": E2E_PASSWORD})
|
||
|
|
return r.json()["data"]["accessToken"]
|
||
|
|
|
||
|
|
def auth_header(token):
|
||
|
|
return {"Authorization": f"Bearer {token}"}
|
||
|
|
|
||
|
|
def test_station_operator_cannot_view_counseling():
|
||
|
|
token = get_station_operator_token()
|
||
|
|
r = requests.get(f"{BASE_URL}/counseling/services/operator/queue", headers=auth_header(token))
|
||
|
|
# 服务站运营人员不应有咨询队列权限，返回403或空
|
||
|
|
assert r.status_code == 403
|
||
|
|
|
||
|
|
def test_counselor_cannot_view_service_appointments():
|
||
|
|
token = get_counselor_token()
|
||
|
|
r = requests.get(f"{BASE_URL}/service-appointments/operator", headers=auth_header(token))
|
||
|
|
# Counselor只能查看自己相关的预约，不能浏览全部
|
||
|
|
assert r.status_code == 403
|
||
|
|
|
||
|
|
def test_content_editor_cannot_access_user_data():
|
||
|
|
token = get_counselor_token() # 复用counselor token模拟content_editor权限边界
|
||
|
|
r = requests.get(f"{BASE_URL}/operator/appeals/pending", headers=auth_header(token))
|
||
|
|
assert r.status_code == 403
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
pytest.main([__file__, "-v"])
|