from __future__ import annotations from collections.abc import Generator from datetime import UTC, datetime, timedelta from decimal import Decimal import pytest from auth_helpers import install_legacy_header_auth_override from fastapi import FastAPI, HTTPException from fastapi.testclient import TestClient from sqlalchemy import create_engine, select from sqlalchemy.orm import Session, sessionmaker from sqlalchemy.pool import StaticPool from app.api.deps import CurrentUserContext, get_db from app.api.v1.endpoints.agent_runs import router as agent_runs_router from app.api.v1.endpoints.analytics import router as analytics_router from app.db.base import Base from app.models.agent_run import AgentRun, AgentToolCall from app.models.budget import BudgetAllocation from app.models.expense_case import ExpenseCase, ExpenseCaseLink from app.models.financial_record import ExpenseClaim from app.services.finance_dashboard import FinanceDashboardService from app.services.finance_dashboard_access_policy import FinanceDashboardAccessPolicy from app.services.finance_dashboard_scope import resolve_finance_dashboard_data_scope from app.services.finance_dashboard_snapshot import ( FINANCE_DASHBOARD_TASK_TYPE, FinanceDashboardSnapshotService, ) def _session_factory() -> sessionmaker[Session]: engine = create_engine( "sqlite+pysqlite:///:memory:", connect_args={"check_same_thread": False}, poolclass=StaticPool, ) Base.metadata.create_all(bind=engine) return sessionmaker(bind=engine, autoflush=False, autocommit=False) def _claim( *, claim_id: str, claim_no: str, amount: str, tenant_id: str = "default", ) -> ExpenseClaim: now = datetime.now(UTC) return ExpenseClaim( id=claim_id, tenant_id=tenant_id, claim_no=claim_no, employee_name=f"employee-{claim_id}", department_name="财务部", expense_type="travel", reason="tenant scope test", location="上海", amount=Decimal(amount), invoice_count=1, occurred_at=now - timedelta(hours=2), submitted_at=now - timedelta(hours=1), status="paid", approval_stage="payment", risk_flags_json=[], hermes_risk_flag=False, created_at=now - timedelta(hours=2), updated_at=now - timedelta(minutes=30), ) def _link_claim(db: Session, claim: ExpenseClaim, *, tenant_id: str) -> None: expense_case = ExpenseCase( id=f"case-{claim.id}", tenant_id=tenant_id, case_no=f"CASE-{claim.claim_no}", scene_code="travel", title=f"{claim.claim_no} case", current_stage="completed", status="completed", ) db.add(expense_case) db.flush() db.add( ExpenseCaseLink( tenant_id=tenant_id, expense_case_id=expense_case.id, resource_type="expense_claim", resource_id=claim.id, relation_type="reimbursement", ) ) def _seed_tenant_claim( db: Session, *, tenant_id: str, claim_id: str, claim_no: str, amount: str, ) -> ExpenseClaim: claim = _claim( claim_id=claim_id, claim_no=claim_no, amount=amount, tenant_id=tenant_id, ) db.add(claim) db.flush() _link_claim(db, claim, tenant_id=tenant_id) return claim def _seed_finance_snapshot_run( db: Session, *, run_id: str, tenant_id: str | None, amount: str, route_data_scope: str | None = None, ) -> None: route_json = { "task_type": FINANCE_DASHBOARD_TASK_TYPE, "snapshot_key": f"snapshot-{run_id}", "snapshot_payload": { "tenant_marker": tenant_id or "legacy-unscoped", "amount": amount, }, } ontology_json = {"scenario": "finance_dashboard"} if tenant_id is not None: expected_scope = resolve_finance_dashboard_data_scope(tenant_id) route_json["tenant_id"] = tenant_id route_json["data_scope"] = route_data_scope or expected_scope ontology_json["tenant_id"] = tenant_id ontology_json["data_scope"] = expected_scope db.add( AgentRun( run_id=run_id, agent="hermes", source="system_event", user_id="digital_employee", ontology_json=ontology_json, route_json=route_json, permission_level="read", status="succeeded", result_summary=f"sensitive amount {amount}", started_at=datetime.now(UTC), finished_at=datetime.now(UTC), ) ) db.flush() db.add( AgentToolCall( run_id=run_id, tool_type="database", tool_name="digital_employee.finance_dashboard.snapshot", request_json={"tenant_id": tenant_id, "amount": amount}, response_json={"secret_amount": amount}, status="succeeded", duration_ms=1, ) ) def test_finance_dashboard_isolates_claims_and_hides_legacy_budget_outside_default() -> None: now = datetime.now(UTC) session_factory = _session_factory() with session_factory() as db: db.add(_claim(claim_id="legacy-default", claim_no="CLM-LEGACY-001", amount="100.00")) _seed_tenant_claim( db, tenant_id="tenant-a", claim_id="claim-a", claim_no="CLM-TENANT-A-001", amount="200.00", ) _seed_tenant_claim( db, tenant_id="tenant-b", claim_id="claim-b", claim_no="CLM-TENANT-B-001", amount="300.00", ) db.add( BudgetAllocation( budget_no="BUD-LEGACY-DEFAULT-001", fiscal_year=now.year, period_type="year", period_key=str(now.year), department_name="财务部", subject_code="travel", subject_name="差旅费", original_amount=Decimal("10000.00"), adjusted_amount=Decimal("0.00"), status="active", warning_threshold=Decimal("80.00"), control_action="warn", ) ) db.commit() default_dashboard = FinanceDashboardService(db).build_dashboard() tenant_a_dashboard = FinanceDashboardService( db, tenant_id="tenant-a", ).build_dashboard() tenant_b_dashboard = FinanceDashboardService( db, tenant_id="tenant-b", ).build_dashboard() assert default_dashboard.totals["reimbursementCount"] == 1 assert default_dashboard.totals["reimbursementAmount"] == 100.0 assert default_dashboard.budget_summary["included"] is True assert default_dashboard.budget_summary["total"] == "¥10,000" assert tenant_a_dashboard.totals["reimbursementCount"] == 1 assert tenant_a_dashboard.totals["reimbursementAmount"] == 200.0 assert "CLM-TENANT-B-001" not in str(tenant_a_dashboard.top_claims) assert tenant_a_dashboard.budget_summary == { "ratio": 0.0, "total": "¥0", "used": "¥0", "left": "¥0", "included": False, "scope": "unavailable", "reason": "当前租户尚未接入独立预算池，预算指标未纳入统计。", } assert tenant_a_dashboard.totals["budgetUsageRate"] == 0.0 assert all( metric["detail"] == "当前租户未接入独立预算池" and metric["tone"] == "neutral" for metric in tenant_a_dashboard.budget_metrics ) assert "预算超支" not in {item["name"] for item in tenant_a_dashboard.bottlenecks} assert tenant_b_dashboard.totals["reimbursementCount"] == 1 assert tenant_b_dashboard.totals["reimbursementAmount"] == 300.0 assert tenant_b_dashboard.budget_summary["included"] is False def test_finance_dashboard_uses_structured_claim_tenant_when_legacy_link_disagrees() -> None: session_factory = _session_factory() with session_factory() as db: claim = _claim( tenant_id="tenant-a", claim_id="structured-tenant-claim", claim_no="CLM-STRUCTURED-TENANT-001", amount="456.00", ) db.add(claim) db.flush() # Case Link 是历史关联索引，不能覆盖 Claim 自身的结构化租户归属。 _link_claim(db, claim, tenant_id="tenant-b") db.commit() tenant_a_dashboard = FinanceDashboardService( db, tenant_id="tenant-a", ).build_dashboard() tenant_b_dashboard = FinanceDashboardService( db, tenant_id="tenant-b", ).build_dashboard() assert tenant_a_dashboard.totals["reimbursementCount"] == 1 assert tenant_a_dashboard.totals["reimbursementAmount"] == 456.0 assert tenant_b_dashboard.totals["reimbursementCount"] == 0 def test_finance_dashboard_snapshot_cache_is_partitioned_by_tenant_and_data_scope() -> None: session_factory = _session_factory() with session_factory() as db: _seed_tenant_claim( db, tenant_id="tenant-a", claim_id="snapshot-claim-a", claim_no="CLM-SNAPSHOT-A-001", amount="880.00", ) _seed_tenant_claim( db, tenant_id="tenant-b", claim_id="snapshot-claim-b", claim_no="CLM-SNAPSHOT-B-001", amount="990.00", ) db.commit() tenant_a_service = FinanceDashboardSnapshotService(db, tenant_id="tenant-a") tenant_b_service = FinanceDashboardSnapshotService(db, tenant_id="tenant-b") first_a = tenant_a_service.build_dashboard() first_b = tenant_b_service.build_dashboard() second_a = tenant_a_service.build_dashboard() runs = list( db.scalars( select(AgentRun).where( AgentRun.route_json["task_type"].as_string() == FINANCE_DASHBOARD_TASK_TYPE ) ).all() ) routes = [run.route_json or {} for run in runs] assert first_a.totals["reimbursementAmount"] == 880.0 assert first_b.totals["reimbursementAmount"] == 990.0 assert second_a.generated_at == first_a.generated_at assert len(runs) == 2 assert {route["tenant_id"] for route in routes} == {"tenant-a", "tenant-b"} assert all(route["data_scope"] for route in routes) assert len({route["snapshot_key"] for route in routes}) == 2 assert all(route["tenant_id"] in route["snapshot_key"] for route in routes) def test_default_scheduler_snapshot_rejects_non_default_tenant_scope() -> None: session_factory = _session_factory() with session_factory() as db: service = FinanceDashboardSnapshotService(db, tenant_id="tenant-a") with pytest.raises(ValueError, match="default 系统租户"): service.refresh_default_snapshot() @pytest.mark.parametrize("tenant_id", ["", " "]) def test_finance_dashboard_access_policy_rejects_missing_tenant_scope( tenant_id: str, ) -> None: current_user = CurrentUserContext( username="finance-without-tenant", name="Finance Without Tenant", role_codes=["finance"], is_admin=False, tenant_id=tenant_id, ) assert FinanceDashboardAccessPolicy.can_read(current_user) is False with pytest.raises(HTTPException) as exc_info: FinanceDashboardAccessPolicy.require_read(current_user) assert exc_info.value.status_code == 403 def test_finance_dashboard_endpoint_requires_finance_read_role_and_passes_tenant() -> None: session_factory = _session_factory() with session_factory() as db: _seed_tenant_claim( db, tenant_id="tenant-a", claim_id="endpoint-claim-a", claim_no="CLM-ENDPOINT-A-001", amount="1234.00", ) db.commit() app = FastAPI() app.include_router(analytics_router) install_legacy_header_auth_override(app) def override_db() -> Generator[Session, None, None]: with session_factory() as db: yield db app.dependency_overrides[get_db] = override_db client = TestClient(app) ordinary_response = client.get( "/analytics/finance-dashboard", headers={ "X-Auth-Username": "ordinary", "X-Auth-Role-Codes": "user", "X-Auth-Tenant-Id": "tenant-a", }, ) budget_monitor_response = client.get( "/analytics/finance-dashboard", headers={ "X-Auth-Username": "budget-monitor", "X-Auth-Role-Codes": "budget_monitor", "X-Auth-Tenant-Id": "tenant-a", }, ) finance_response = client.get( "/analytics/finance-dashboard", headers={ "X-Auth-Username": "finance", "X-Auth-Role-Codes": "finance", "X-Auth-Tenant-Id": "tenant-a", }, ) executive_other_tenant_response = client.get( "/analytics/finance-dashboard", headers={ "X-Auth-Username": "executive", "X-Auth-Role-Codes": "executive", "X-Auth-Tenant-Id": "tenant-b", }, ) admin_response = client.get( "/analytics/finance-dashboard", headers={ "X-Auth-Username": "admin-reader", "X-Auth-Is-Admin": "true", "X-Auth-Tenant-Id": "tenant-b", }, ) assert ordinary_response.status_code == 403 assert budget_monitor_response.status_code == 403 assert finance_response.status_code == 200 assert finance_response.json()["totals"]["reimbursementAmount"] == 1234.0 assert executive_other_tenant_response.status_code == 200 assert executive_other_tenant_response.json()["totals"]["reimbursementCount"] == 0 assert admin_response.status_code == 200 def test_agent_run_endpoint_cannot_bypass_finance_snapshot_tenant_and_role_scope() -> None: session_factory = _session_factory() with session_factory() as db: _seed_finance_snapshot_run( db, run_id="run-finance-tenant-a", tenant_id="tenant-a", amount="111.00", ) _seed_finance_snapshot_run( db, run_id="run-finance-tenant-b", tenant_id="tenant-b", amount="222.00", ) _seed_finance_snapshot_run( db, run_id="run-finance-legacy-unscoped", tenant_id=None, amount="999.00", ) _seed_finance_snapshot_run( db, run_id="run-finance-corrupt-scope", tenant_id="tenant-a", amount="777.00", route_data_scope="claims:corrupt;budget:corrupt", ) db.commit() app = FastAPI() app.include_router(agent_runs_router) install_legacy_header_auth_override(app) def override_db() -> Generator[Session, None, None]: with session_factory() as db: yield db app.dependency_overrides[get_db] = override_db client = TestClient(app) finance_a_headers = { "X-Auth-Username": "finance-a", "X-Auth-Role-Codes": "finance", "X-Auth-Tenant-Id": "tenant-a", } finance_b_headers = { "X-Auth-Username": "finance-b", "X-Auth-Role-Codes": "finance", "X-Auth-Tenant-Id": "tenant-b", } finance_a_list = client.get("/agent-runs", headers=finance_a_headers) ordinary_a_list = client.get( "/agent-runs", headers={ "X-Auth-Username": "ordinary-a", "X-Auth-Role-Codes": "user", "X-Auth-Tenant-Id": "tenant-a", }, ) assert finance_a_list.status_code == 200 assert [item["run_id"] for item in finance_a_list.json()] == ["run-finance-tenant-a"] assert ordinary_a_list.status_code == 200 assert ordinary_a_list.json() == [] allowed_detail = client.get( "/agent-runs/run-finance-tenant-a", headers=finance_a_headers, ) assert allowed_detail.status_code == 200 assert allowed_detail.json()["route_json"]["snapshot_payload"]["amount"] == "111.00" assert allowed_detail.json()["tool_calls"][0]["response_json"] == {"secret_amount": "111.00"} cross_tenant_detail = client.get( "/agent-runs/run-finance-tenant-a", headers=finance_b_headers, ) cross_tenant_admin_detail = client.get( "/agent-runs/run-finance-tenant-a", headers={ "X-Auth-Username": "admin-b", "X-Auth-Is-Admin": "true", "X-Auth-Tenant-Id": "tenant-b", }, ) same_tenant_ordinary_detail = client.get( "/agent-runs/run-finance-tenant-a", headers={ "X-Auth-Username": "ordinary-a", "X-Auth-Role-Codes": "user", "X-Auth-Tenant-Id": "tenant-a", }, ) legacy_unscoped_detail = client.get( "/agent-runs/run-finance-legacy-unscoped", headers={ "X-Auth-Username": "finance-default", "X-Auth-Role-Codes": "finance", "X-Auth-Tenant-Id": "default", }, ) corrupt_scope_detail = client.get( "/agent-runs/run-finance-corrupt-scope", headers=finance_a_headers, ) assert cross_tenant_detail.status_code == 404 assert cross_tenant_admin_detail.status_code == 404 assert same_tenant_ordinary_detail.status_code == 403 assert legacy_unscoped_detail.status_code == 404 assert corrupt_scope_detail.status_code == 404