Files
yunke/yunke-server/tests/test_api_voice_clips.py
T
浅念 c261b2bc9a fix(security): CORS限制+SSRF防护+PATCH乐观锁+accounts安全cap(4 important bugs)
- main.py + config.py: CORS origins read from Settings.cors_origins (comma-separated).
  Empty falls back to dev origin localhost:5173; never wildcard. Methods locked
  to GET/PATCH/POST; allow_credentials=False.
- scraper/media.py: download_url now passes follow_redirects=False to httpx.
  OSS URLs return 200 directly; a 3xx is treated as a download failure (caught
  by existing except clauses) instead of opening an SSRF vector to internal hosts.
- routers/voice_clips.py: PATCH /voice-clips/{id}/match accepts an optional
  If-Match header carrying the client's last-seen updated_at. On mismatch the
  row was modified by another request and the server returns 409. Without the
  header the behaviour is unchanged (backward compatible). Response now echoes
  the post-update updated_at so the client can fold it into the next request.
- routers/organization.py: /api/accounts now UNION ALLs the wechat_account and
  whatsapp_account projections at the SQL level and pushes COUNT + pagination
  (offset/limit) down to the DB. Stable ordering on (channel, account_id).
  Removes the in-memory materialization that broke at scale.

Tests: 395 passed. Added optimistic-lock coverage (If-Match accepted / stale 409 /
absent header backward-compat). Updated existing PATCH tests for the new
updated_at response field.

Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-12 11:41:30 +08:00

453 lines
16 KiB
Python

"""Tests for GET /api/voice-clips + PATCH /voice-clips/{id}/match.
Seeds 3 clips (2 wechat for user u1 at end_time 1000/3000, 1 whatsapp for u2
at end_time 2000) and asserts GET filters + ordering (``end_time desc``) +
pagination + the ``user_id``-beats-``user_real_name`` precedence rule, plus
the 手动匹配 PATCH (set + clear + name resolution + 404 path).
"""
from __future__ import annotations
from sqlalchemy.ext.asyncio import AsyncSession
from app.db.models import Customer, VoiceClip
async def _seed(session: AsyncSession) -> None:
session.add_all(
[
VoiceClip(
voice_clip_id=1,
user_id="u1",
channel="wechat",
user_real_name="Alice",
company_code="8m0atd",
start_time=900,
end_time=1000,
oss_file_name="https://oss/clip1.mp3",
mp3_duration=100,
duration_format="00:01:40",
),
VoiceClip(
voice_clip_id=2,
user_id="u2",
channel="whatsapp",
user_real_name="Bob",
company_code="8m0atd",
start_time=1900,
end_time=2000,
oss_file_name="https://oss/clip2.mp3",
mp3_duration=60,
duration_format="00:01:00",
),
VoiceClip(
voice_clip_id=3,
user_id="u1",
channel="wechat",
user_real_name="Alice",
company_code="other",
start_time=2900,
end_time=3000,
oss_file_name=None,
mp3_duration=0,
duration_format="00:00:00",
),
]
)
await session.commit()
async def test_default_list_returns_all_ordered_desc(make_client):
"""No filters -> 3 rows, ordered by ``end_time desc``."""
client = await make_client(_seed)
r = await client.get("/api/voice-clips")
assert r.status_code == 200
body = r.json()
assert body["total"] == 3
assert [it["voice_clip_id"] for it in body["items"]] == [3, 2, 1]
for key in (
"voice_clip_id",
"user_id",
"channel",
"user_real_name",
"wx_id",
"talker",
"status",
"is_send",
"company_code",
"start_time",
"end_time",
"oss_file_name",
"mp3_duration",
"duration_format",
"raw_json",
):
assert key in body["items"][0]
async def test_filter_by_user_id(make_client):
"""``?user_id=u1`` -> 2 clips for Alice."""
client = await make_client(_seed)
r = await client.get("/api/voice-clips", params={"user_id": "u1"})
assert r.status_code == 200
body = r.json()
assert body["total"] == 2
assert {it["voice_clip_id"] for it in body["items"]} == {1, 3}
async def test_user_id_takes_precedence_over_user_real_name(make_client):
"""When both ``user_id`` and ``user_real_name`` are given, user_id wins.
The 云客 modal switches between the two based on whether the user edited
the staff-name box; the id is the more precise filter and wins on conflict.
Here ``user_id=u1`` (Alice) + ``user_real_name=Bob`` should still return
Alice's clips (user_id path), NOT Bob's.
"""
client = await make_client(_seed)
r = await client.get(
"/api/voice-clips", params={"user_id": "u1", "user_real_name": "Bob"}
)
assert r.status_code == 200
body = r.json()
assert body["total"] == 2
assert {it["voice_clip_id"] for it in body["items"]} == {1, 3}
async def test_filter_by_user_real_name_fuzzy(make_client):
"""``?user_real_name=ob`` -> Bob's clip only (ILIKE contains)."""
client = await make_client(_seed)
r = await client.get("/api/voice-clips", params={"user_real_name": "ob"})
assert r.status_code == 200
body = r.json()
assert body["total"] == 1
assert body["items"][0]["voice_clip_id"] == 2
async def test_filter_by_channel(make_client):
"""``?channel=whatsapp`` -> the single WA clip."""
client = await make_client(_seed)
r = await client.get("/api/voice-clips", params={"channel": "whatsapp"})
assert r.status_code == 200
body = r.json()
assert body["total"] == 1
assert body["items"][0]["voice_clip_id"] == 2
async def test_filter_by_company_code(make_client):
"""``?company_code=8m0atd`` -> 2 clips (clip 3 has 'other')."""
client = await make_client(_seed)
r = await client.get("/api/voice-clips", params={"company_code": "8m0atd"})
assert r.status_code == 200
body = r.json()
assert body["total"] == 2
assert {it["voice_clip_id"] for it in body["items"]} == {1, 2}
async def test_time_window_filter(make_client):
"""``?start=1500&end=2500`` -> only clip 2 (end_time 2000)."""
client = await make_client(_seed)
r = await client.get("/api/voice-clips", params={"start": 1500, "end": 2500})
assert r.status_code == 200
body = r.json()
assert body["total"] == 1
assert body["items"][0]["voice_clip_id"] == 2
async def test_filters_compose(make_client):
"""``user_id=u1 & start=1500`` -> only clip 3 (u1's later clip)."""
client = await make_client(_seed)
r = await client.get(
"/api/voice-clips", params={"user_id": "u1", "start": 1500}
)
assert r.status_code == 200
body = r.json()
assert body["total"] == 1
assert body["items"][0]["voice_clip_id"] == 3
async def test_pagination(make_client):
"""``page_size=1`` -> 1 item, total 3."""
client = await make_client(_seed)
r = await client.get("/api/voice-clips", params={"page": 1, "page_size": 1})
assert r.status_code == 200
body = r.json()
assert body["total"] == 3
assert len(body["items"]) == 1
assert body["items"][0]["voice_clip_id"] == 3
async def test_oss_file_name_serializes(make_client):
"""``oss_file_name`` (OSS recording URL) round-trips so the modal can
render an inline ``<audio>`` player — present when set, None when unset.
"""
client = await make_client(_seed)
r = await client.get("/api/voice-clips")
assert r.status_code == 200
by_id = {it["voice_clip_id"]: it for it in r.json()["items"]}
assert by_id[1]["oss_file_name"] == "https://oss/clip1.mp3"
assert by_id[3]["oss_file_name"] is None
async def test_raw_json_serializes_verbatim(make_client):
"""``raw_json`` round-trips the verbatim upstream record when set."""
async def seed(session: AsyncSession) -> None:
await _seed(session)
session.add(
VoiceClip(
voice_clip_id=99,
user_id="u1",
channel="wechat",
user_real_name="Alice",
start_time=5000,
end_time=5100,
raw_json={
"id": 99,
"userId": "u1",
"userRealName": "Alice",
"startTime": "5000",
"endTime": "5100",
"ossFileName": "https://oss/clip99.mp3",
"mp3Duration": 100,
"durationFormat": "00:01:40",
"companyCode": "8m0atd",
},
)
)
await session.commit()
client = await make_client(seed)
r = await client.get("/api/voice-clips", params={"user_id": "u1", "start": 5000})
assert r.status_code == 200
body = r.json()
assert body["total"] == 1
assert body["items"][0]["voice_clip_id"] == 99
assert body["items"][0]["raw_json"] == {
"id": 99,
"userId": "u1",
"userRealName": "Alice",
"startTime": "5000",
"endTime": "5100",
"ossFileName": "https://oss/clip99.mp3",
"mp3Duration": 100,
"durationFormat": "00:01:40",
"companyCode": "8m0atd",
}
# Seeded without an explicit raw_json -> JSON null.
r_all = await client.get("/api/voice-clips")
by_id = {it["voice_clip_id"]: it for it in r_all.json()["items"]}
assert by_id[1]["raw_json"] is None
# ---------------------------------------------------------------------------
# 手动匹配 — PATCH /api/voice-clips/{id}/match
# ---------------------------------------------------------------------------
async def _seed_with_customer(session: AsyncSession) -> None:
"""Seed 1 clip + 1 matched customer (remark='张三')."""
await _seed(session)
session.add(
Customer(
friend_id="fid_remark",
channel="wechat",
owner_account_id="wx1",
friend_remark="张三",
friend_nickname="三三",
real_name="张三真名",
)
)
await session.commit()
async def test_match_returns_payload_and_persists(make_client):
"""PATCH /match sets matched_friend_id; payload echoes it; GET sees it."""
client = await make_client(_seed_with_customer)
r = await client.patch("/api/voice-clips/1/match", json={"friend_id": "fid_remark"})
assert r.status_code == 200
body = r.json()
# Response now carries the post-update ``updated_at`` for the optimistic-
# lock flow (client folds it into the next request's ``If-Match`` header).
assert body["voice_clip_id"] == 1
assert body["matched_friend_id"] == "fid_remark"
assert "updated_at" in body
updated_at_v1 = body["updated_at"]
# The GET list now reflects the match (cross-request persistence —
# requires the PATCH to commit, not just flush).
r2 = await client.get("/api/voice-clips", params={"user_id": "u1"})
by_id = {it["voice_clip_id"]: it for it in r2.json()["items"]}
assert by_id[1]["matched_friend_id"] == "fid_remark"
# Resolved via Customer lookup: remark > nickname > real_name > friend_id.
assert by_id[1]["matched_friend_name"] == "张三"
# The other wechat clip for u1 is still unmatched.
assert by_id[3]["matched_friend_id"] is None
assert by_id[3]["matched_friend_name"] is None
return updated_at_v1 # for reuse by optimistic-lock tests below if needed
async def test_match_name_falls_back_through_nickname_real_name(make_client):
"""Name resolution: no remark -> nickname; no nickname -> real_name."""
async def seed(session: AsyncSession) -> None:
await _seed(session)
session.add_all(
[
Customer(
friend_id="fid_nick",
channel="wechat",
friend_nickname="尼克",
),
Customer(
friend_id="fid_real",
channel="wechat",
real_name="王五",
),
]
)
await session.commit()
client = await make_client(seed)
await client.patch("/api/voice-clips/1/match", json={"friend_id": "fid_nick"})
await client.patch("/api/voice-clips/3/match", json={"friend_id": "fid_real"})
r = await client.get("/api/voice-clips", params={"user_id": "u1"})
by_id = {it["voice_clip_id"]: it for it in r.json()["items"]}
assert by_id[1]["matched_friend_name"] == "尼克"
assert by_id[3]["matched_friend_name"] == "王五"
async def test_match_with_unknown_friend_id_falls_back_to_id(make_client):
"""A match pointing at a deleted/unknown customer shows the id as name."""
client = await make_client(_seed)
await client.patch(
"/api/voice-clips/1/match", json={"friend_id": "ghost_customer"}
)
r = await client.get("/api/voice-clips", params={"user_id": "u1"})
by_id = {it["voice_clip_id"]: it for it in r.json()["items"]}
assert by_id[1]["matched_friend_id"] == "ghost_customer"
assert by_id[1]["matched_friend_name"] == "ghost_customer"
async def test_unmatch_clears_friend_id(make_client):
"""PATCH with friend_id=null clears an existing match."""
client = await make_client(_seed_with_customer)
await client.patch("/api/voice-clips/1/match", json={"friend_id": "fid_remark"})
# Now clear it.
r = await client.patch("/api/voice-clips/1/match", json={"friend_id": None})
assert r.status_code == 200
body = r.json()
assert body["voice_clip_id"] == 1
assert body["matched_friend_id"] is None
assert "updated_at" in body
r2 = await client.get("/api/voice-clips", params={"user_id": "u1"})
by_id = {it["voice_clip_id"]: it for it in r2.json()["items"]}
assert by_id[1]["matched_friend_id"] is None
assert by_id[1]["matched_friend_name"] is None
async def test_match_missing_clip_returns_404(make_client):
"""PATCH on a non-existent voice_clip_id -> 404."""
client = await make_client(_seed)
r = await client.patch(
"/api/voice-clips/999999/match", json={"friend_id": "fid_remark"}
)
assert r.status_code == 404
async def test_match_default_null_body_is_treated_as_unmatch(make_client):
"""Omitting friend_id from the body clears the match (default None)."""
client = await make_client(_seed_with_customer)
await client.patch("/api/voice-clips/1/match", json={"friend_id": "fid_remark"})
# Empty body -> body.friend_id defaults to None -> unmatch.
r = await client.patch("/api/voice-clips/1/match", json={})
assert r.status_code == 200
body = r.json()
assert body["matched_friend_id"] is None
assert "updated_at" in body
# ---------------------------------------------------------------------------
# Optimistic lock — If-Match header on PATCH /api/voice-clips/{id}/match
# ---------------------------------------------------------------------------
async def test_match_with_if_match_accepts_current_updated_at(make_client):
"""If-Match equal to the row's current ``updated_at`` is accepted (200).
The flow: GET to read the current ``updated_at`` (via a successful PATCH
echo), send that value as ``If-Match`` on the next PATCH — the server
accepts the request because the row has not changed in between.
"""
client = await make_client(_seed_with_customer)
# First PATCH establishes the match and returns the post-update timestamp.
r1 = await client.patch(
"/api/voice-clips/1/match", json={"friend_id": "fid_remark"}
)
assert r1.status_code == 200
current = r1.json()["updated_at"]
assert current is not None
# Second PATCH with If-Match=current: accepted (200), match cleared.
r2 = await client.patch(
"/api/voice-clips/1/match",
json={"friend_id": None},
headers={"If-Match": current},
)
assert r2.status_code == 200
assert r2.json()["matched_friend_id"] is None
async def test_match_with_stale_if_match_returns_409(make_client):
"""An If-Match that doesn't match the row's current ``updated_at`` -> 409.
Simulates the lost-update race: client A reads the clip, client B modifies
it (bumping ``updated_at``), then client A's PATCH carrying A's now-stale
timestamp is rejected. We force a clearly stale value rather than relying
on wall-clock drift because SQLite's ``CURRENT_TIMESTAMP`` (the dialect
compilation of ``func.now()``) has 1-second resolution and two PATCHes
inside the same second produce identical timestamps.
"""
client = await make_client(_seed_with_customer)
# First PATCH: succeeds, returns the post-update timestamp.
r1 = await client.patch(
"/api/voice-clips/1/match", json={"friend_id": "fid_remark"}
)
assert r1.status_code == 200
current = r1.json()["updated_at"]
assert current is not None
# Any string that differs from the row's current updated_at is "stale" —
# 409. We use an obviously-older timestamp so the test is deterministic.
stale = "2000-01-01T00:00:00"
assert stale != current
r2 = await client.patch(
"/api/voice-clips/1/match",
json={"friend_id": None},
headers={"If-Match": stale},
)
assert r2.status_code == 409
assert "modified" in r2.json()["detail"].lower()
async def test_match_without_if_match_is_backward_compatible(make_client):
"""No If-Match header -> no optimistic-lock check; behavior unchanged."""
client = await make_client(_seed_with_customer)
# First PATCH establishes a value.
r1 = await client.patch(
"/api/voice-clips/1/match", json={"friend_id": "fid_remark"}
)
assert r1.status_code == 200
# Second PATCH WITHOUT If-Match — accepted regardless of staleness
# (backward compatible: clients that don't send the header keep working).
r2 = await client.patch(
"/api/voice-clips/1/match", json={"friend_id": "fid_nick"}
)
assert r2.status_code == 200
assert r2.json()["matched_friend_id"] == "fid_nick"