release: freeze 2026-10-15 validated release baseline

tests/e2e/conftest.py

@@ -51,6 +51,9 @@ class ApiClient:
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
     ) -> requests.Response:
+        # 登录接口会设置运营 HttpOnly Cookie；无 token 用例必须真正模拟未认证请求。
+        if token is None:
+            self.session.cookies.clear()
         merged = {"Authorization": f"Bearer {token}"} if token else {}
         if headers:
             # 显式传入的头覆盖默认头（幂等键等按用例定制）
@@ -117,10 +120,17 @@ def operator_password() -> str:
 
 
 ADMIN_USERNAME = "e2e_admin"
+# 本机活栈可通过环境变量切换到已授权的演示运营账号；CI 默认仍使用 seed 账号。
+LOGIN_USERNAME = os.environ.get("E2E_OPERATOR_USERNAME", ADMIN_USERNAME)
 
 
 @pytest.fixture(scope="session")
-def admin_token(api: ApiClient, operator_password: str) -> str:
+def admin_password(operator_password: str) -> str:
+    return os.environ.get("E2E_ADMIN_PASSWORD", operator_password)
+
+
+@pytest.fixture(scope="session")
+def admin_token(api: ApiClient, operator_password: str, admin_password: str) -> str:
     """超级管理员 token。
 
     必须使用 **seed 脚本创建的账号**，而不是 `admin`。
@@ -135,10 +145,10 @@ def admin_token(api: ApiClient, operator_password: str) -> str:
     data = api.ok(
         "POST",
         "/auth/operator/login",
-        json={"username": ADMIN_USERNAME, "password": operator_password},
+        json={"username": LOGIN_USERNAME, "password": admin_password},
     )
     token = data.get("accessToken")
-    assert token, f"{ADMIN_USERNAME} 登录未返回 accessToken"
+    assert token, f"{LOGIN_USERNAME} 登录未返回 accessToken"
     return token