Партии: фото в общем комментарии (до 10), загрузка при завершении

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/test_attachments.py

@@ -0,0 +1,101 @@
+"""Медиа партии (фото): загрузка/просмотр/удаление, валидация, лимит, запрет после финиша."""
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+
+from tests.conftest import add_group_member, csrf_headers, finish_match, login, start_match
+
+PNG = b"\x89PNG\r\n\x1a\n" + b"\x00" * 64
+
+
+def _use_tmp_uploads(monkeypatch, tmp_path) -> None:
+    from app.core.config import settings
+
+    monkeypatch.setattr(settings, "dev_upload_dir", str(tmp_path))
+
+
+def _start(client: TestClient, engine) -> tuple[dict, int, int, int]:
+    me = login(client, "Хост")
+    exps = [e["id"] for e in client.get("/api/expansions").json()]
+    gid = client.post(
+        "/api/groups", json={"name": "Группа", "expansion_ids": exps}, headers=csrf_headers(client)
+    ).json()["id"]
+    p2 = add_group_member(engine, gid, "Игрок2")
+    fids = [f["id"] for f in client.get(f"/api/groups/{gid}/factions").json()]
+    started = start_match(
+        client,
+        gid,
+        [{"user_id": me["id"], "faction_id": fids[0]}, {"user_id": p2, "faction_id": fids[1]}],
+    )
+    assert started.status_code == 200, started.text
+    return me, gid, p2, started.json()["id"]
+
+
+def _upload(client: TestClient, mid: int, name: str = "a.png", data: bytes = PNG, mime: str = "image/png"):
+    return client.post(
+        f"/api/matches/{mid}/attachments",
+        files={"file": (name, data, mime)},
+        headers=csrf_headers(client),
+    )
+
+
+def test_upload_view_delete(client: TestClient, engine, monkeypatch, tmp_path):
+    _use_tmp_uploads(monkeypatch, tmp_path)
+    me, gid, p2, mid = _start(client, engine)
+
+    r = _upload(client, mid)
+    assert r.status_code == 200, r.text
+    aid = r.json()["id"]
+    assert r.json()["url"] == f"/api/matches/{mid}/attachments/{aid}"
+
+    detail = client.get(f"/api/matches/{mid}").json()
+    assert [a["id"] for a in detail["attachments"]] == [aid]
+
+    g = client.get(f"/api/matches/{mid}/attachments/{aid}")
+    assert g.status_code == 200 and g.content == PNG
+    assert g.headers["content-type"] == "image/png"
+
+    d = client.delete(f"/api/matches/{mid}/attachments/{aid}", headers=csrf_headers(client))
+    assert d.status_code == 200, d.text
+    assert client.get(f"/api/matches/{mid}").json()["attachments"] == []
+
+
+def test_reject_non_image_and_limit(client: TestClient, engine, monkeypatch, tmp_path):
+    _use_tmp_uploads(monkeypatch, tmp_path)
+    _me, _gid, _p2, mid = _start(client, engine)
+
+    assert _upload(client, mid, "x.txt", b"nope", "text/plain").status_code == 422
+
+    for i in range(10):
+        assert _upload(client, mid, f"{i}.png").status_code == 200
+    assert _upload(client, mid, "over.png").status_code == 409
+
+
+def test_no_changes_after_finish(client: TestClient, engine, monkeypatch, tmp_path):
+    _use_tmp_uploads(monkeypatch, tmp_path)
+    me, gid, p2, mid = _start(client, engine)
+    aid = _upload(client, mid).json()["id"]
+
+    fin = finish_match(
+        client, mid, [{"user_id": me["id"], "place": 1}, {"user_id": p2, "place": 2}],
+        win_reason="objectives",
+    )
+    assert fin.status_code == 200, fin.text
+
+    # После завершения игрок не может ни добавлять, ни удалять.
+    assert _upload(client, mid).status_code == 409
+    assert client.delete(
+        f"/api/matches/{mid}/attachments/{aid}", headers=csrf_headers(client)
+    ).status_code == 409
+    # Но просмотр сохраняется.
+    assert client.get(f"/api/matches/{mid}").json()["attachments"][0]["id"] == aid
+
+
+def test_non_member_cannot_view(client: TestClient, engine, monkeypatch, tmp_path):
+    _use_tmp_uploads(monkeypatch, tmp_path)
+    _me, _gid, _p2, mid = _start(client, engine)
+    aid = _upload(client, mid).json()["id"]
+
+    login(client, "Чужак")  # не состоит в группе
+    g = client.get(f"/api/matches/{mid}/attachments/{aid}")
+    assert g.status_code in (401, 403)