Админ: управление медиа партии (добавление/удаление в любой момент)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/test_attachments.py

@@ -91,6 +91,45 @@ def test_no_changes_after_finish(client: TestClient, engine, monkeypatch, tmp_pa
     assert client.get(f"/api/matches/{mid}").json()["attachments"][0]["id"] == aid
 
 
+def test_admin_manage_attachments_on_finished(
+    client: TestClient, engine, make_admin, monkeypatch, tmp_path
+):
+    _use_tmp_uploads(monkeypatch, tmp_path)
+    me, gid, p2, mid = _start(client, engine)
+    fin = finish_match(
+        client, mid, [{"user_id": me["id"], "place": 1}, {"user_id": p2, "place": 2}],
+        win_reason="objectives",
+    )
+    assert fin.status_code == 200, fin.text
+
+    make_admin("admin", "secret123")
+    assert client.post(
+        "/api/admin/auth/login",
+        json={"username": "admin", "password": "secret123"},
+        headers=csrf_headers(client),
+    ).status_code == 200
+
+    # Админ добавляет медиа к ЗАВЕРШЁННОЙ партии (игроку это запрещено).
+    up = client.post(
+        f"/api/admin/matches/{mid}/attachments",
+        files={"file": ("a.png", PNG, "image/png")},
+        headers=csrf_headers(client),
+    )
+    assert up.status_code == 200, up.text
+    aid = up.json()["id"]
+    assert up.json()["url"] == f"/api/admin/matches/{mid}/attachments/{aid}"
+
+    assert any(a["id"] == aid for a in client.get(f"/api/admin/matches/{mid}/attachments").json())
+    g = client.get(f"/api/admin/matches/{mid}/attachments/{aid}")
+    assert g.status_code == 200 and g.content == PNG
+
+    d = client.delete(
+        f"/api/admin/matches/{mid}/attachments/{aid}", headers=csrf_headers(client)
+    )
+    assert d.status_code == 200, d.text
+    assert client.get(f"/api/admin/matches/{mid}/attachments").json() == []
+
+
 def test_non_member_cannot_view(client: TestClient, engine, monkeypatch, tmp_path):
     _use_tmp_uploads(monkeypatch, tmp_path)
     _me, _gid, _p2, mid = _start(client, engine)