leefer/caiwuzongzhang
1
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

HEL-154: 结账日联动、公司越权 POST 测试与 docs 收尾

Browse Source 
流水页范围文案改为读取 settings 的 closing_day/start_date，去掉写死顺延日；
补公司端对设置/提醒/审核写接口的 403 覆盖；从 main 恢复手册 docs 并保留 006。

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>
This commit is contained in:
施工员
2026-08-27 09:44:46 +00:00
co-authored by Cursor multica-agent
parent c4f7573653
commit fdc5616115
7 changed files with 141 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_settings_reminders.py
+38
View File
@@ -211,6 +211,44 @@ class SettingsAndRemindersTests(unittest.TestCase):
status, _ = cashier.get(path)
self.assertEqual(403, status, path)
# Company session must get 403 on admin write endpoints (settings /
# reminders / review decisions), not just GETs.
write_calls = (
("POST /api/admin/settings", lambda: cashier.post_json(
"/api/admin/settings",
{"closing_day": "10", "start_date": "2026-01-01", "auto_remind": "0", "remind_days": "3"},
)),
("POST /api/admin/reminders/send", lambda: cashier.post_json(
"/api/admin/reminders/send", {"company_id": self.company_id}
)),
("POST /api/admin/accounts/1/review", lambda: cashier.post_json(
"/api/admin/accounts/1/review", {"decision": "approve"}
)),
("POST /api/admin/transfer-events/1/decisions", lambda: cashier.post_json(
"/api/admin/transfer-events/1/decisions",
{"action": "confirm_single", "reason": "越权"},
)),
("POST /api/admin/manual-records/1/decisions", lambda: cashier.post_json(
"/api/admin/manual-records/1/decisions",
{"action": "approve_new", "reason": "越权"},
)),
("POST /api/admin/intercompany/events/1/subject-decisions", lambda: cashier.post_json(
"/api/admin/intercompany/events/1/subject-decisions",
{"subject": "other_receivable", "reason": "越权"},
)),
("POST /api/admin/intercompany/events/1/adjustments", lambda: cashier.post_json(
"/api/admin/intercompany/events/1/adjustments",
{"action": "reverse", "reason": "越权"},
)),
)
for label, call in write_calls:
status, data = call()
self.assertEqual(403, status, f"{label}: {data}")
# Settings must be unchanged after the forbidden write attempt.
status, data = self.admin.get("/api/admin/settings")
self.assertEqual(200, status)
self.assertEqual("5", as_json(data)["settings"]["closing_day"])
class SettingsModuleTests(unittest.TestCase):
"""Unit tests for the settings module on a fresh in-memory database."""