test(e2e): Phase 23B — rebuild E2E infrastructure; fix 6 real prod defects it exposed

Phase 23 closed as PARTIAL: fake coverage was gone, but the E2E layer itself was still empty — no conftest.py anywhere, ~15 fixtures that never existed, 6 files crashing at import on os.environ["E2E_PASSWORD"], and CI never ran E2E. STATUS's "10 E2E files / ~80+ cases ✅" described files that had never executed. Infrastructure delivered: - tests/e2e/conftest.py: ApiClient (trust_env=False — a host http_proxy turns localhost calls into 502), operator_token(username) / new_user / admin_token fixtures, and a session probe that calls pytest.exit(4) when the stack is unreachable. NOT skip: skip would launder "did not run" into "passed". - pytest.ini, tests/e2e/requirements.txt, and tests/e2e/sql/ seed_e2e_operators.sql — migrations contain NO operator seed at all, so a fresh database has zero logins; the seed creates 6 e2e accounts with role bindings, idempotent, password injected via `psql -v pwd`. - CI job `e2e`: compose up -> poll /health/live (timeout = fail) -> seed -> pytest -> always teardown. Gate D-23-D is now closed. - 8 E2E files migrated off import-time env reads; tautological assertions (`x == t or not x`), a counselor token standing in for content_editor, and a bare `status_code == 200` claiming to prove INV-020 were replaced with real permission/behavior assertions. Six real production defects found only by running against real PostgreSQL (H2 has zero coverage for all of them): - D-23B-A (Critical): stale V042__add_appointment_operator_register_permission.sql left in target/classes; src had replaced it with V042__add_service_location_ announcements.sql. Packing without clean put two V042 in the jar -> Flyway "Found more than one migration with version 042" -> app would not start. Guard added: testBuildOutputHasNoDuplicateMigrationVersions scans build output (src is clean, so only this catches it). - D-23B-B (High): non-UUID path variable reached the DB -> 500 + leaked `invalid input syntax for type uuid`. Now rejected at the controller. - D-23B-C (High): 6 E2E files raised KeyError at import -> never collected. - D-23B-E (Critical): permissions = 48, role_permissions for super_admin = 18, matchmaker = 0. V015's "grant all to super_admin" was a point-in-time snapshot; the 30 permissions added later were never granted. On a fresh stack an admin cannot create a service station and matchmakers can do nothing. V044 restores super_admin to its documented definition (not an expansion); the matchmaker permission set needs a product decision and is left as a residual. - D-23B-I (Medium): IllegalArgumentException (e.g. invalid activity type) was unmapped -> 500. Now BAD_REQUEST. - D-23B-J (High): `operator does not exist: uuid = character varying` — Java ids are String, columns are uuid, PostgreSQL does not implicitly cast in comparisons. Fixed at the source with JDBC `stringtype=unspecified` (docker profile); production datasource comes from deploy env and needs the same. One judgement retracted: an initial read suggested service_appointment.register was missing. It is not — the endpoint uses service.assisted_registration, seeded in V029, and the code deliberately avoids a duplicate permission. Nothing was changed on that basis. Verification: 33 E2E passed against a live stack; unreachable stack and a missing operator password both exit 4 (never skip/pass); backend regression 656 / 0 failures / 0 errors / 3 skipped (baseline 655, +1 guard, negatively validated by injecting a duplicate V042 -> exactly one test turned red).
2026-09-18 13:50:19 +08:00
parent ae1bd2b734
commit 730dddde30
22 changed files with 891 additions and 506 deletions
@@ -1,124 +1,58 @@
 """
-E2E 测试：Phase 13A - 公益婚恋咨询与婚前辅导
-验证 INV-012（Counselor assigned scope）等不变量
+婚恋咨询 / 婚前辅导 E2E（咨询主流程）。
+
+迁移说明：原文件依赖 3 个环境变量（import 期即 KeyError → 从未被收集执行），
+并直连 psycopg2 校验通知落库，且用不存在的固定 ID 做断言。
+现统一改为 conftest fixture + 真实 API；数据库断言交后端集成测试，E2E 只走 HTTP。
 """
-import os
 import pytest
-import requests

-BASE_URL = "http://localhost:8085/api/v1"
-E2E_PASSWORD = os.environ["E2E_PASSWORD"]
-E2E_USER_TOKEN = os.environ["E2E_USER_TOKEN"]
-E2E_DB_PASSWORD = os.environ["E2E_DB_PASSWORD"]
-
-def get_user_token():
-    return E2E_USER_TOKEN
-
-def get_counselor_token():
-    r = requests.post(f"{BASE_URL}/auth/operator/login", json={"username": "counselor01", "password": E2E_PASSWORD})
-    return r.json()["data"]["accessToken"]
-
-def auth_header(token):
-    return {"Authorization": f"Bearer {token}"}
+pytestmark = pytest.mark.e2e


-# ---- P13A-T05: 获取咨询介绍 ----
-def test_get_counseling_intro():
-    r = requests.get(f"{BASE_URL}/counseling/services/intro")
-    assert r.status_code == 200
-    data = r.json()["data"]
-    assert isinstance(data, list)
-    assert len(data) >= 3
-    types = {item["type"] for item in data}
-    assert "relationship_guidance" in types
-    assert "premarital_guidance" in types
+def test_counseling_intro_lists_guidance_types(api, user_token):
+    data = api.ok("GET", "/counseling/services/intro", token=user_token)
+    assert isinstance(data, list) and len(data) >= 2, f"咨询介绍异常：{data}"
+    types = {item.get("type") for item in data}
+    for expected in ("relationship_guidance", "premarital_guidance"):
+        assert expected in types, f"咨询介绍缺少 {expected}：{sorted(types)}"


-# ---- P13A-T06: 申请咨询 ----
-def test_create_counseling():
-    token = get_user_token()
-    r = requests.post(
-        f"{BASE_URL}/counseling/services",
-        headers=auth_header(token),
-        json={"serviceType": "relationship_guidance", "userRequestSummary": "恋爱沟通困难"}
+def test_create_counseling_is_user_self_and_pending(api, user_token):
+    """用户端创建咨询：source 必须恒为 user_self，不可由请求体伪造。"""
+    data = api.ok(
+        "POST",
+        "/counseling/services",
+        token=user_token,
+        json={"serviceType": "relationship_guidance", "userRequestSummary": "恋爱沟通困难"},
    )
-    assert r.status_code == 200
-    data = r.json()["data"]
    assert data["status"] == "pending"
    assert data["serviceType"] == "relationship_guidance"
-    assert data["requestSource"] == "user_self"
-    counseling_id = data["id"]
-
-    # 验证通知已发送（通过查询数据库）
-    import psycopg2
-    conn = psycopg2.connect(f"dbname=danyang_match user=postgres password={E2E_DB_PASSWORD} host=localhost port=5434")
-    cur = conn.cursor()
-    cur.execute("SELECT COUNT(*) FROM notifications WHERE business_id = %s AND type = 'counseling'", (counseling_id,))
-    count = cur.fetchone()[0]
-    assert count >= 1
-    cur.close()
-    conn.close()
+    assert data["requestSource"] == "user_self", f"来源被污染：{data}"


-# ---- P13A-T07: 获取我的咨询列表 ----
-def test_get_my_counselings():
-    token = get_user_token()
-    r = requests.get(f"{BASE_URL}/counseling/services", headers=auth_header(token))
-    assert r.status_code == 200
-    assert isinstance(r.json()["data"], list)
+def test_my_counseling_list_is_accessible(api, user_token):
+    api.ok("POST", "/counseling/services", token=user_token,
+           json={"serviceType": "relationship_guidance", "userRequestSummary": "列表用例"})
+    data = api.ok("GET", "/counseling/services", token=user_token)
+    assert isinstance(data, list)


-# ---- P13A-T08: 咨询详情（无权访问他人记录） ----
-def test_counseling_detail_no_access():
-    token = get_user_token()
-    # 尝试访问不属于自己的咨询
-    r = requests.get(f"{BASE_URL}/counseling/services/non-existent-id", headers=auth_header(token))
-    assert r.status_code in (400, 404)
-
-
-# ---- P13A-T09: 取消咨询 ----
-def test_cancel_counseling():
-    token = get_user_token()
-    # 先创建再取消
-    create_r = requests.post(
-        f"{BASE_URL}/counseling/services",
-        headers=auth_header(token),
-        json={"serviceType": "emotional_support", "userRequestSummary": "测试取消"}
+def test_cancel_counseling(api, user_token):
+    created = api.ok(
+        "POST",
+        "/counseling/services",
+        token=user_token,
+        json={"serviceType": "emotional_support", "userRequestSummary": "测试取消"},
    )
-    counseling_id = create_r.json()["data"]["id"]
-    cancel_r = requests.post(
-        f"{BASE_URL}/counseling/services/{counseling_id}/cancel",
-        headers=auth_header(token)
+    cancelled = api.ok(
+        "POST", f"/counseling/services/{created['id']}/cancel", token=user_token
    )
-    assert cancel_r.status_code == 200
-    assert cancel_r.json()["data"]["status"] == "cancelled"
+    assert cancelled["status"] == "cancelled", f"取消后状态错误：{cancelled}"


-# ---- INV-012: Counselor只能访问分配给自己的服务 ----
-def test_counselor_assigned_scope():
-    counselor_token = get_counselor_token()
-    # Counselor 只能看到分配给自己的
-    r = requests.get(f"{BASE_URL}/counseling/services/operator/assigned", headers=auth_header(counselor_token))
-    assert r.status_code == 200
-    # 不应包含未分配给自己的记录
-    # （假设数据库中 counselor01 没有被分配的记录，返回空列表）
-    assert isinstance(r.json()["data"], list)
-
-
-# ---- INV-013: Matchmaker不能读取Counseling正文 ----
-# Phase 23 KEEP-VERIFY（2026-09-18）：原 test_matchmaker_cannot_read_counseling_body
-# 的函数体为 `pass` 空壳（注释自述「在当前测试框架下简化验证」），从未真实断言过任何权限，
-# 却在 docs/STATUS.md 中被计为 P23-T06「咨询 E2E ✅」的一部分。
-# 计划 Phase 23 Gate「不允许 skip/pass 空壳」→ 已移除该空壳。
-#
-# INV-013 现由后端真实行为用例覆盖：
-#   backend/.../invariants/V11InvariantsTest#inv013MatchmakerCannotReadCounselingBody
-#   走真实 CounselingService.getDetail：断言 Matchmaker 读到的 user_request_summary 为 null，
-#   并以「assigned Counselor 能读到正文」作反证，避免全局脱敏造成的假阳性；
-#   已通过负向注入验证（把 isMatchmaker 分支改为返回全文 → 该用例精准变红）。
-#
-# E2E 层待补场景：用真实红娘 token 调用咨询详情接口并断言被拒。
-
-
-if __name__ == "__main__":
-    pytest.main([__file__, "-v"])
+def test_counselor_assigned_list_is_scoped(api, operator_token):
+    """INV-012：咨询师只能看到分配给自己的服务（列表必须可访问且为列表）。"""
+    token = operator_token("e2e_counselor")
+    data = api.ok("GET", "/counseling/services/operator/assigned", token=token)
+    assert isinstance(data, list)