feat: 增加操作审计与受控下载

tests/test_api_operations.py

@@ -0,0 +1,47 @@
+"""操作审计日志接口测试。"""
+from unittest.mock import AsyncMock, patch
+
+
+@patch("backend.services.build_queue.build_queue")
+def test_build_creation_is_recorded_and_visible_to_admin(mock_queue, client, tmp_config):
+    mock_queue.submit = AsyncMock()
+    response = client.post("/api/tasks", json={"app_id": "1", "scheme_id": "1", "build_type": "Ad_Hoc"})
+    assert response.status_code == 200
+
+    summary = client.get("/api/operations/summary")
+    assert summary.status_code == 200
+    assert summary.json()["action_counts"]["build_created"] == 1
+
+    logs = client.get("/api/operations").json()
+    assert logs[0]["username"] == "admin"
+    assert logs[0]["action"] == "build_created"
+
+
+def test_download_link_is_recorded(client, tmp_config):
+    from backend.database import SessionLocal
+    from backend.models import Task
+    db = SessionLocal()
+    db.add(Task(id="download-task", app_id="1", app_name="测试App", build_type="App_Store", scheme_id="1", scheme_name="readoor31", status="completed", oss_url="https://files.example.com/app.ipa"))
+    db.commit()
+    db.close()
+
+    with patch("backend.services.distribution.get_published_download_url", return_value="https://signed.example.com/app.ipa?signature=1"):
+        response = client.get("/api/tasks/download-task/download-link")
+    assert response.status_code == 200
+    assert "signature=1" in response.json()["url"]
+    assert client.get("/api/operations").json()[0]["action"] == "ipa_download_requested"
+
+
+def test_regular_user_cannot_view_operation_logs(client):
+    from backend.database import SessionLocal
+    from backend.models import User
+    from backend.security import hash_password
+    db = SessionLocal()
+    db.add(User(id="regular-user", username="reader", password_hash=hash_password("reader-password"), is_admin=False))
+    db.commit()
+    db.close()
+
+    login = client.post("/api/auth/login", json={"username": "reader", "password": "reader-password"})
+    client.headers.update({"Authorization": f"Bearer {login.json()['token']}"})
+    assert client.get("/api/operations").status_code == 403
+    assert client.get("/api/operations/summary").status_code == 403