feat(ECR-044): RhythmConfig 写面闭环并 Closed

复用 admin.explore.write、POST/PUT+审计、C端 GET /rhythm/configs、 H5 无 active 空态/失败回退；migration 000053。ExploreConfig Loop STOP，禁自动 ECR-045。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-13 20:43:08 +08:00
parent fcc7667ba3
commit 87b463b2bb
33 changed files with 1006 additions and 35 deletions
@@ -0,0 +1,116 @@
+package integration_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestExploreRhythmConfigWrite(t *testing.T) {
+	r, pool := setupAPIPool(t)
+	ctx := context.Background()
+	tok := adminLogin(t, r, "admin", "change-me")
+	devKey := fmt.Sprintf("rhythm-cfg-%d", time.Now().UnixNano())
+
+	code := fmt.Sprintf("rhythm_w_%d", time.Now().UnixNano()%1_000_000)
+	body := map[string]any{"code": code, "title": "测试节律配置", "active": true}
+	env, httpCode := doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/explore/rhythm-configs", body, tok)
+	if httpCode != 200 || env.Code != 0 {
+		t.Fatalf("create http=%d code=%d msg=%s", httpCode, env.Code, env.Message)
+	}
+	var created struct {
+		ID   string `json:"id"`
+		Code string `json:"code"`
+	}
+	_ = json.Unmarshal(env.Data, &created)
+	if created.ID == "" {
+		t.Fatal("bad create")
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM rhythm_configs WHERE id=$1`, created.ID)
+	})
+
+	_, httpCode = doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/explore/rhythm-configs", body, tok)
+	if httpCode != http.StatusConflict {
+		t.Fatalf("dup expected 409 got %d", httpCode)
+	}
+
+	env, _, httpCode = doJSONExpect(t, r, http.MethodGet, "/api/v1/rhythm/configs", nil, devKey, 0)
+	if httpCode != 200 {
+		t.Fatalf("public %d", httpCode)
+	}
+	var pub struct {
+		Items []struct {
+			Code string `json:"code"`
+		} `json:"items"`
+	}
+	_ = json.Unmarshal(env.Data, &pub)
+	found := false
+	for _, it := range pub.Items {
+		if it.Code == code {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("missing active %#v", pub.Items)
+	}
+
+	body["active"] = false
+	_, httpCode = doAdminJSON(t, r, http.MethodPut, "/api/v1/admin/explore/rhythm-configs/"+created.ID, body, tok)
+	if httpCode != 200 {
+		t.Fatalf("update %d", httpCode)
+	}
+	env, _, _ = doJSONExpect(t, r, http.MethodGet, "/api/v1/rhythm/configs", nil, devKey, 0)
+	_ = json.Unmarshal(env.Data, &pub)
+	for _, it := range pub.Items {
+		if it.Code == code {
+			t.Fatal("inactive still listed")
+		}
+	}
+
+	_, _ = pool.Exec(ctx, `UPDATE rhythm_configs SET active=false`)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `UPDATE rhythm_configs SET active=true WHERE system=true`)
+	})
+	env, _, _ = doJSONExpect(t, r, http.MethodGet, "/api/v1/rhythm/configs", nil, devKey, 0)
+	_ = json.Unmarshal(env.Data, &pub)
+	if len(pub.Items) != 0 {
+		t.Fatalf("expected empty after all inactive, got %#v", pub.Items)
+	}
+
+	var n int
+	_ = pool.QueryRow(ctx, `
+		SELECT COUNT(*) FROM admin_audit_logs
+		WHERE action IN ('explore.rhythm_config.create','explore.rhythm_config.update') AND target_id=$1`,
+		created.ID).Scan(&n)
+	if n < 2 {
+		t.Fatalf("audit %d", n)
+	}
+
+	limitedRoleID := uuid.New()
+	_, _ = pool.Exec(ctx, `INSERT INTO admin_roles(id, name, system) VALUES ($1,$2,false)`,
+		limitedRoleID, "rc_ro_"+limitedRoleID.String()[:8])
+	_, _ = pool.Exec(ctx, `INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.explore.read')`, limitedRoleID)
+	hash, _ := bcrypt.GenerateFromPassword([]byte("ro-pass"), bcrypt.DefaultCost)
+	roUser := fmt.Sprintf("rcro_%d", time.Now().UnixNano())
+	_, _ = pool.Exec(ctx, `INSERT INTO admin_accounts(username, password_hash, role_id) VALUES ($1,$2,$3)`,
+		roUser, string(hash), limitedRoleID)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, roUser)
+		_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, limitedRoleID)
+	})
+	roTok := adminLogin(t, r, roUser, "ro-pass")
+	_, httpCode = doAdminJSON(t, r, http.MethodPost, "/api/v1/admin/explore/rhythm-configs", map[string]any{
+		"code": "x_ro", "title": "no", "active": true,
+	}, roTok)
+	if httpCode != http.StatusForbidden {
+		t.Fatalf("expected 403 got %d", httpCode)
+	}
+}