refactor: centralize runtime configuration and API access policy

2026-07-22 23:35:27 +08:00
parent 51d7c067a4
commit 18aed6a80f
5 changed files with 305 additions and 147 deletions
@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+import unittest
+
+from api_access import required_role
+
+
+class ApiAccessPolicyTests(unittest.TestCase):
+    def test_member_workspaces_are_consistently_protected(self):
+        cases = {
+            ("GET", "/api/screener/setup"): "member",
+            ("GET", "/api/mentors/messages"): "member",
+            ("GET", "/api/heaven/setup"): "member",
+            ("POST", "/api/screener/run"): "member",
+            ("POST", "/api/mentors/chat"): "member",
+            ("POST", "/api/heaven/interpret"): "member",
+            ("DELETE", "/api/screener/strategies/42"): "member",
+            ("DELETE", "/api/mentors/messages"): "member",
+        }
+        for (method, path), role in cases.items():
+            with self.subTest(method=method, path=path):
+                self.assertEqual(required_role(method, path), role)
+
+    def test_shared_knowledge_mutations_require_admin(self):
+        cases = (
+            ("POST", "/api/reasons"),
+            ("POST", "/api/seat-aliases"),
+            ("POST", "/api/heaven/sector-phases"),
+            ("DELETE", "/api/heaven/sector-phases/油气开采"),
+            ("POST", "/api/backfill"),
+            ("GET", "/api/admin/settings"),
+        )
+        for method, path in cases:
+            with self.subTest(method=method, path=path):
+                self.assertEqual(required_role(method, path), "admin")
+
+    def test_personal_market_data_routes_need_login_only(self):
+        cases = (
+            ("GET", "/api/dashboard"),
+            ("GET", "/api/watchlist"),
+            ("POST", "/api/notes"),
+            ("DELETE", "/api/notes/3"),
+        )
+        for method, path in cases:
+            with self.subTest(method=method, path=path):
+                self.assertEqual(required_role(method, path), "authenticated")
+
+
+if __name__ == "__main__":
+    unittest.main()