document-management/backend/tests/dms/test_admin_login_switch.py

"""超级管理员登录开关（安全需求7）：

- 登录：开关关闭时 admin 按用户不存在处理，报错与密码错误完全一致（同一出口）；
- 创建：开关关闭时拒绝创建 admin 用户名，报"不能创建该名称的用户"
  而非"用户名已存在"，不泄露系统中存在该账号。

不依赖测试库：登录用例将审计落库置空；创建用例的拦截发生在事务开启之前。
"""

from __future__ import annotations

from types import SimpleNamespace

import pytest

from dms.common.errors import InvalidArgumentError
from dms.services import user_service


@pytest.fixture()
def admin_login_off(flask_app, monkeypatch):
    flask_app.config["DMS_ALLOW_ADMIN_LOGIN"] = False
    # admin 拦截走"用户名不存在"出口：审计落库置空，全程不触测试库
    monkeypatch.setattr(
        "dms.api.v1.auth.record_login_failure", lambda **kwargs: None
    )
    yield flask_app
    flask_app.config["DMS_ALLOW_ADMIN_LOGIN"] = True


def test_login_blocked_admin_reports_invalid_credentials(admin_login_off):
    """开关关闭：admin 正确/错误密码一律 INVALID_CREDENTIALS，与密码错误同形。"""
    client = admin_login_off.test_client()
    response = client.post(
        "/api/v1/auth/login",
        json={"username": "admin", "password": "whatever", "keepSignedIn": False},
    )
    assert response.status_code == 401
    assert response.get_json()["code"] == "INVALID_CREDENTIALS"


def test_create_admin_username_rejected_when_disabled(flask_app, monkeypatch):
    """开关关闭：创建 admin 报"不能创建该名称的用户"，而非"用户名已存在"。"""
    flask_app.config["DMS_ALLOW_ADMIN_LOGIN"] = False
    monkeypatch.setattr(
        user_service, "get_auth_context", lambda: SimpleNamespace(user_id=1)
    )
    payload = {
        "username": "admin",
        "realName": "冒名者",
        "initialPassword": "Passw0rd!2024",
        "organizationId": "1",
        "roleCode": "USER",
        "roleId": "2",
        "securityLevel": "PUBLIC",
        "status": "ENABLED",
    }
    try:
        with flask_app.app_context(), pytest.raises(InvalidArgumentError) as exc:
            user_service.create_user(payload)
        assert "不能创建该名称的用户" in str(exc.value)
    finally:
        flask_app.config["DMS_ALLOW_ADMIN_LOGIN"] = True