test(phase23): KEEP-VERIFY — remove 44 pass shells + fake INV tests, add shell guard
Phase 23 "可信系统测试重建 (REFACTOR)" re-audit. STATUS claimed "10 E2E
files / ~80+ cases" and "INV-011~020 ✅"; measurement showed the opposite.
D-23-A (Critical): V11InvariantsTest's 14 cases asserted only Constants
strings. INV-016 "Banner target types" actually asserted ARTICLE_STATUS_*;
INV-017 "home 8 entries" declared local arrays then asserted
firstRow.length == 4 (tautology, never called the home service);
INV-018/019/020 used appointment/article/account status constants as
stand-ins for permission and data-scope checks. Rewritten to 12 cases:
4 real service-behavior guards (INV-013 via real CounselingService.getDetail
— Matchmaker sees null userRequestSummary, with an assigned-Counselor
counter-proof so global sanitization cannot fake a pass; INV-016 reads the
production ALLOWED_TARGET_TYPES whitelist and asserts no external/http/url/
web entry; INV-017 calls real getHome and pins all 8 codes + order;
INV-019 asserts content_editor reads null), plus assertBehaviorTestExists
turning "行为验证见 XxxTest" pointers into executable Class.forName contracts.
D-23-B (High): 44 `pass` shells across 6 files in tests/e2e (4 files were
100% shells). Gate forbids skip/pass shells. Rewritten in place as honest
placeholders with the full scenario lists preserved.
D-23-C (High, residual): the pytest E2E suite is not executable at all —
no conftest.py anywhere, ~15 fixtures (api_client/verified_user/
banner_factory/...) do not exist. Only run_v11_tests.py really runs
(16 cases, needs a live stack + E2E_PASSWORD).
D-23-D (High, residual, NOT fixed): CI does not chain E2E as the plan
requires. Needs an infrastructure decision on how CI provisions a live
stack; not implemented rather than written unverified.
D-23-E (Medium): the CI migration job claimed to "验证 migration SQL 语法"
but only checked file non-emptiness, while the real syntax/baseline checks
live in MigrationValidationTest (already run by the backend job). Replaced
with a real sequence check (naming / non-empty / unique versions / no
gaps); verified by extracting the exact inline script and running it.
New gate: scripts/check-no-empty-tests.py (AST scan, blocks pass-only and
unconditionally skipped tests) + a CI test-shell-guard job. Verified both
ways: 0 findings on the real tree, 2 precise findings on injected shells.
Negative validation: 3 injected production defects (external_url in the
banner whitelist, swapped home entry order, isMatchmaker returning the full
record) turned exactly inv016/inv017/inv013 red, 9 others green, zero
unrelated failures; md5sum -c confirmed byte-identical restore.
Full regression: 655 tests / 652 passed / 0 failures / 0 errors / 3 skipped
(baseline 657; -2 because 14 vacuous cases were merged into 12). The 3
skips carry explicit reasons (2x @EnabledIfEnvironmentVariable(CI=true),
1x @Disabled "需要完整数据库连接") — none is a shell.
Phase 23 is PARTIALLY closed: fake coverage is gone, but the UAT gate
requires the end-to-end chain to actually execute, so "失败为零可进入 UAT"
is NOT claimed.
This commit is contained in:
WorkBuddy
@@ -1,73 +1,41 @@
|
||||
"""
|
||||
V1.1 婚恋咨询权限 E2E 测试骨架
|
||||
测试项目: Counselor权限隔离、红娘不可见咨询正文
|
||||
V1.1 咨询 / 服务站 / 内容编辑员权限 E2E —— 空壳已移除（Phase 23 KEEP-VERIFY，2026-09-18）
|
||||
|
||||
历史问题
|
||||
--------
|
||||
原文件 10 个测试函数**全部**为 `pass` 空壳（注释「TODO: P13A / P17 / P19 实现后完善」），
|
||||
依赖不存在的 `counselor_client` / `counseling_service_factory` / `content_editor_client`
|
||||
等 fixture（全局无 `conftest.py`），从未执行过，
|
||||
却在 `docs/STATUS.md` 中被计为 P23-T07「咨询权限 ✅」。
|
||||
|
||||
计划 Phase 23 Gate：「**不允许 skip/pass 空壳**」。
|
||||
|
||||
当前状态
|
||||
--------
|
||||
本文件现**不含任何测试函数**，pytest 收集 0 个用例。
|
||||
|
||||
仍待真实实现的场景（需求不因移除空壳而丢失）
|
||||
------------------------------------------
|
||||
1. Counselor 只能看到被分配给自己的咨询（INV-012）
|
||||
2. Counselor 不可查看其他咨询师的服务
|
||||
3. 红娘不可查看咨询正文（INV-013）
|
||||
4. 普通管理员默认不可查看咨询敏感备注
|
||||
5. 咨询管理员可分配咨询人员
|
||||
6. 咨询过程中可转交风控
|
||||
7. 服务站人员不能浏览全平台用户（INV-018）
|
||||
8. 服务站人员可处理本服务站预约
|
||||
9. 内容编辑员不能访问用户婚恋档案（INV-019）
|
||||
10. 内容编辑员可管理文章内容
|
||||
|
||||
现状补充（Phase 23 实测）
|
||||
------------------------
|
||||
- INV-012 已由 `CounselingPhase13ATest` 的 4 个真实用例覆盖；
|
||||
- INV-013 / INV-019 已由 Phase 23 新增的真实行为用例覆盖
|
||||
（`V11InvariantsTest#inv013MatchmakerCannotReadCounselingBody`、
|
||||
`V11InvariantsTest#inv019ContentEditorHasNoUserDataPermission`，
|
||||
走真实 `CounselingService.getDetail`，已通过负向注入验证）；
|
||||
- INV-018 已由 `ServiceAppointmentDataScopeTest` 覆盖。
|
||||
即：E2E 层待补，但不变量本身已有真实覆盖。
|
||||
|
||||
真实可执行的 V1.1 E2E 见：`tests/e2e/run_v11_tests.py`
|
||||
"""
|
||||
|
||||
import pytest
|
||||
|
||||
|
||||
@pytest.mark.e2e
|
||||
class TestCounselingPermission:
|
||||
"""咨询权限测试（INV-012, INV-013）"""
|
||||
|
||||
def test_counselor_only_sees_assigned_services(self, counselor_client, counseling_service_factory):
|
||||
"""Counselor只能看到被分配给自己的咨询（INV-012）"""
|
||||
# GET /api/v1/operator/counseling/services
|
||||
# TODO: P13A 实现后完善
|
||||
pass
|
||||
|
||||
def test_counselor_cannot_view_other_assigned(self, counselor_client, another_counselor_service_factory):
|
||||
"""Counselor不可查看其他咨询师的服务"""
|
||||
# TODO: P13A 实现后完善
|
||||
pass
|
||||
|
||||
def test_matchmaker_cannot_view_counseling_body(self, matchmaker_client, counseling_service_factory):
|
||||
"""红娘不可查看咨询正文（INV-013）"""
|
||||
# TODO: P13A 实现后完善
|
||||
pass
|
||||
|
||||
def test_platform_admin_cannot_view_sensitive_note(self, platform_admin_client, counseling_service_factory):
|
||||
"""普通管理员默认不可查看咨询敏感备注"""
|
||||
# TODO: P13A 实现后完善
|
||||
pass
|
||||
|
||||
def test_counseling_manager_can_assign(self, counseling_manager_client):
|
||||
"""咨询管理员可分配咨询人员"""
|
||||
# POST /api/v1/operator/counseling/services/{id}/assign
|
||||
# TODO: P13A 实现后完善
|
||||
pass
|
||||
|
||||
def test_counseling_risk_referral(self, counselor_client, counseling_service_factory):
|
||||
"""咨询过程中可转交风控"""
|
||||
# TODO: P13A + P17 实现后完善
|
||||
pass
|
||||
|
||||
|
||||
@pytest.mark.e2e
|
||||
class TestServiceAppointmentPermission:
|
||||
"""服务站预约权限测试（INV-018）"""
|
||||
|
||||
def test_service_station_operator_cannot_browse_all_users(self, station_operator_client):
|
||||
"""服务站人员不能浏览全平台用户（INV-018）"""
|
||||
# TODO: P19 实现后完善
|
||||
pass
|
||||
|
||||
def test_service_station_operator_can_process_appointments(self, station_operator_client, appointment_factory):
|
||||
"""服务站人员可处理本服务站预约"""
|
||||
# TODO: P19 实现后完善
|
||||
pass
|
||||
|
||||
|
||||
@pytest.mark.e2e
|
||||
class TestContentEditorPermission:
|
||||
"""内容编辑员权限测试（INV-019）"""
|
||||
|
||||
def test_content_editor_cannot_access_user_profiles(self, content_editor_client):
|
||||
"""内容编辑员不能访问用户婚恋档案（INV-019）"""
|
||||
# TODO: P19 实现后完善
|
||||
pass
|
||||
|
||||
def test_content_editor_can_manage_articles(self, content_editor_client):
|
||||
"""内容编辑员可管理文章内容"""
|
||||
# TODO: P19 实现后完善
|
||||
pass
|
||||
|
||||
Reference in New Issue
Block a user