zikai/zTools2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 隐藏 PDF 用户页的管理页入口，凭据改为 账号a / 66511315

Browse Source 
- pdf.html 移除页脚"管理页"链接：管理页入口对普通用户隐藏，
  仅管理员知晓 /pdf-admin 直达路径（权限同 /files 文件浏览页，
  复用 require_docs_auth Basic Auth）
- test_pdf_service.py 同步测试凭据为 a/66511315

注：实际凭据存放于 config.yaml 的 docs 段（git-ignored，仅本机 root 持有），
本次仅隐藏入口；管理页鉴权机制（require_docs_auth）此前已与
文件浏览页 /files 完全一致，无需改动。
This commit is contained in:
zikai
2026-07-27 14:17:16 +08:00
parent 29c5462734
commit 729c77e98b
2 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
static/pdf.html
View File

@@ -36,7 +36,7 @@
<div class="skel">加载中…</div> <div class="skel">加载中…</div>
</div> </div>
<p class="foot"><a class="link" href="/pdf-admin">管理页</a> · zikai file service</p> <p class="foot">zikai file service</p>
</div> </div>
<script src="/static/common.js"></script> <script src="/static/common.js"></script>
<script src="/static/pdf.js"></script> <script src="/static/pdf.js"></script>

15
tests/test_pdf_service.py
View File

@@ -153,6 +153,10 @@ def _wait_done(client, job_id, cookie, timeout=60):
raise AssertionError(f"任务未在 {timeout}s 内完成，最后状态: {last}") raise AssertionError(f"任务未在 {timeout}s 内完成，最后状态: {last}")
# 管理页 Basic Auth 凭据（与 config.yaml 的 docs 段保持一致）
ADMIN_AUTH = ("a", "66511315")
# ---------------- 测试 ---------------- # ---------------- 测试 ----------------
@@ -240,8 +244,7 @@ class TestDeleteSemantics:
assert lst.json()["total"] == 0 assert lst.json()["total"] == 0
# 管理页仍可见且标注已删除 # 管理页仍可见且标注已删除
admin_auth = ("admin", "testpass123") al = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
al = client.get("/api/admin/pdf/jobs", auth=admin_auth)
assert al.status_code == 200 assert al.status_code == 200
items = al.json()["items"] items = al.json()["items"]
assert any(it["id"] == job_id and it["user_deleted"] is True for it in items) assert any(it["id"] == job_id and it["user_deleted"] is True for it in items)
@@ -252,20 +255,20 @@ class TestDeleteSemantics:
assert dl.status_code == 404 assert dl.status_code == 404
# 管理员硬删 # 管理员硬删
ad = client.delete(f"/api/admin/pdf/jobs/{job_id}", auth=admin_auth) ad = client.delete(f"/api/admin/pdf/jobs/{job_id}", auth=ADMIN_AUTH)
assert ad.status_code == 200 assert ad.status_code == 200
assert ad.json()["deleted"] is True assert ad.json()["deleted"] is True
# 管理页也不再可见 # 管理页也不再可见
al2 = client.get("/api/admin/pdf/jobs", auth=admin_auth) al2 = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
assert not any(it["id"] == job_id for it in al2.json()["items"]) assert not any(it["id"] == job_id for it in al2.json()["items"])
def test_admin_requires_auth(self, client): def test_admin_requires_auth(self, client):
r = client.get("/api/admin/pdf/jobs") r = client.get("/api/admin/pdf/jobs")
assert r.status_code == 401 assert r.status_code == 401
r = client.get("/api/admin/pdf/jobs", auth=("admin", "wrong")) r = client.get("/api/admin/pdf/jobs", auth=("a", "wrong"))
assert r.status_code == 401 assert r.status_code == 401
r = client.get("/api/admin/pdf/jobs", auth=("admin", "testpass123")) r = client.get("/api/admin/pdf/jobs", auth=ADMIN_AUTH)
assert r.status_code == 200 assert r.status_code == 200
def test_user_cannot_access_others_job(self, client): def test_user_cannot_access_others_job(self, client):