From 729c77e98b1ad61bb02707e7f43a65d7b4b6c721 Mon Sep 17 00:00:00 2001
From: zikai <1621362626@qq.com>
Date: Mon, 27 Jul 2026 14:17:16 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E9=9A=90=E8=97=8F=20PDF=20=E7=94=A8?=
 =?UTF-8?q?=E6=88=B7=E9=A1=B5=E7=9A=84=E7=AE=A1=E7=90=86=E9=A1=B5=E5=85=A5?=
 =?UTF-8?q?=E5=8F=A3=EF=BC=8C=E5=87=AD=E6=8D=AE=E6=94=B9=E4=B8=BA=20?=
 =?UTF-8?q?=E8=B4=A6=E5=8F=B7a=20/=2066511315?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pdf.html 移除页脚"管理页"链接：管理页入口对普通用户隐藏，
  仅管理员知晓 /pdf-admin 直达路径（权限同 /files 文件浏览页，
  复用 require_docs_auth Basic Auth）
- test_pdf_service.py 同步测试凭据为 a/66511315

注：实际凭据存放于 config.yaml 的 docs 段（git-ignored，仅本机 root 持有），
本次仅隐藏入口；管理页鉴权机制（require_docs_auth）此前已与
文件浏览页 /files 完全一致，无需改动。
---
 static/pdf.html           |  2 +-
 tests/test_pdf_service.py | 15 +++++++++------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/static/pdf.html b/static/pdf.html
index adf770d..d0f0c2c 100644
--- a/static/pdf.html
+++ b/static/pdf.html
@@ -36,7 +36,7 @@
     <div class="skel">加载中…</div>
   </div>
 
-  <p class="foot"><a class="link" href="/pdf-admin">管理页</a> · zikai file service</p>
+  <p class="foot">zikai file service</p>
 </div>
 <script src="/static/common.js"></script>
 <script src="/static/pdf.js"></script>
diff --git a/tests/test_pdf_service.py b/tests/test_pdf_service.py
index e6a184e..f577bfb 100644
--- a/tests/test_pdf_service.py
+++ b/tests/test_pdf_service.py
@@ -153,6 +153,10 @@ def _wait_done(client, job_id, cookie, timeout=60):
     raise AssertionError(f"任务未在 {timeout}s 内完成，最后状态: {last}")
 
 
+# 管理页 Basic Auth 凭据（与 config.yaml 的 docs 段保持一致）
+ADMIN_AUTH = ("a", "66511315")
+
+
 # ---------------- 测试 ----------------
 
 
@@ -240,8 +244,7 @@ class TestDeleteSemantics:
         assert lst.json()["total"] == 0
 
         # 管理页仍可见且标注已删除
-        admin_auth = ("admin", "testpass123")
-        al = client.get("/api/admin/pdf/jobs", auth=admin_auth)
+        al = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
         assert al.status_code == 200
         items = al.json()["items"]
         assert any(it["id"] == job_id and it["user_deleted"] is True for it in items)
@@ -252,20 +255,20 @@ class TestDeleteSemantics:
         assert dl.status_code == 404
 
         # 管理员硬删
-        ad = client.delete(f"/api/admin/pdf/jobs/{job_id}", auth=admin_auth)
+        ad = client.delete(f"/api/admin/pdf/jobs/{job_id}", auth=ADMIN_AUTH)
         assert ad.status_code == 200
         assert ad.json()["deleted"] is True
 
         # 管理页也不再可见
-        al2 = client.get("/api/admin/pdf/jobs", auth=admin_auth)
+        al2 = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
         assert not any(it["id"] == job_id for it in al2.json()["items"])
 
     def test_admin_requires_auth(self, client):
         r = client.get("/api/admin/pdf/jobs")
         assert r.status_code == 401
-        r = client.get("/api/admin/pdf/jobs", auth=("admin", "wrong"))
+        r = client.get("/api/admin/pdf/jobs", auth=("a", "wrong"))
         assert r.status_code == 401
-        r = client.get("/api/admin/pdf/jobs", auth=("admin", "testpass123"))
+        r = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
         assert r.status_code == 200
 
     def test_user_cannot_access_others_job(self, client):