后端开发完成

backend/tests/test_user.py

@@ -0,0 +1,156 @@
+def test_get_users_admin(client, admin_token):
+    """测试管理员获取用户列表"""
+    response = client.get(
+        "/api/users",
+        headers={"Authorization": f"Bearer {admin_token}"}
+    )
+    assert response.status_code == 200
+    assert len(response.json()) >= 3
+
+
+def test_get_users_non_admin(client, marketing_token):
+    """测试非管理员获取用户列表（权限不足）"""
+    response = client.get(
+        "/api/users",
+        headers={"Authorization": f"Bearer {marketing_token}"}
+    )
+    assert response.status_code == 403
+    assert "Not enough permissions" in response.json()["detail"]
+
+
+def test_create_user_admin(client, admin_token):
+    """测试管理员创建用户"""
+    new_user = {
+        "username": "new_test_user",
+        "password": "new_password",
+        "department": "Test Department",
+        "role": "other"
+    }
+    response = client.post(
+        "/api/users",
+        json=new_user,
+        headers={"Authorization": f"Bearer {admin_token}"}
+    )
+    assert response.status_code == 200
+    assert response.json()["username"] == "new_test_user"
+    assert response.json()["department"] == "Test Department"
+    assert response.json()["role"] == "other"
+
+
+def test_create_user_non_admin(client, marketing_token):
+    """测试非管理员创建用户（权限不足）"""
+    new_user = {
+        "username": "new_test_user",
+        "password": "new_password",
+        "department": "Test Department",
+        "role": "other"
+    }
+    response = client.post(
+        "/api/users",
+        json=new_user,
+        headers={"Authorization": f"Bearer {marketing_token}"}
+    )
+    assert response.status_code == 403
+    assert "Not enough permissions" in response.json()["detail"]
+
+
+def test_create_user_existing_username(client, admin_token):
+    """测试创建用户 - 用户名已存在"""
+    new_user = {
+        "username": "test_admin",
+        "password": "new_password",
+        "department": "Test Department",
+        "role": "other"
+    }
+    response = client.post(
+        "/api/users",
+        json=new_user,
+        headers={"Authorization": f"Bearer {admin_token}"}
+    )
+    assert response.status_code == 400
+    assert "Username already registered" in response.json()["detail"]
+
+
+def test_update_user_admin(client, admin_token):
+    """测试管理员更新用户"""
+    # 先获取用户ID，选择一个非管理员用户
+    response = client.get(
+        "/api/users",
+        headers={"Authorization": f"Bearer {admin_token}"}
+    )
+    users = response.json()
+    
+    # 找到一个非管理员用户
+    user_id = None
+    for user in users:
+        if user["role"] != "admin":
+            user_id = user["id"]
+            break
+    
+    assert user_id is not None, "No non-admin user found for update"
+    
+    # 更新用户
+    update_data = {
+        "password": "updated_password",
+        "department": "Updated Department",
+        "role": "other"
+    }
+    response = client.put(
+        f"/api/users/{user_id}",
+        json=update_data,
+        headers={"Authorization": f"Bearer {admin_token}"}
+    )
+    assert response.status_code == 200
+    assert response.json()["department"] == "Updated Department"
+    assert response.json()["role"] == "other"
+
+
+def test_update_user_non_admin(client, marketing_token):
+    """测试非管理员更新用户（权限不足）"""
+    # 先获取用户ID
+    response = client.get(
+        "/api/users",
+        headers={"Authorization": f"Bearer {marketing_token}"}
+    )
+    assert response.status_code == 403
+
+
+def test_delete_user_admin(client, admin_token):
+    """测试管理员删除用户"""
+    # 先创建一个新的测试用户
+    new_user = {
+        "username": "delete_test_user",
+        "password": "delete_password",
+        "department": "Test Department",
+        "role": "other"
+    }
+    create_response = client.post(
+        "/api/users",
+        json=new_user,
+        headers={"Authorization": f"Bearer {admin_token}"}
+    )
+    
+    # 确保创建用户成功
+    assert create_response.status_code == 200
+    user_id = create_response.json()["id"]
+    
+    # 删除用户
+    response = client.delete(
+        f"/api/users/{user_id}",
+        headers={"Authorization": f"Bearer {admin_token}"}
+    )
+    
+    # 确保删除用户成功
+    assert response.status_code == 200
+    assert "User deleted successfully" in response.json()["message"]
+
+
+def test_delete_user_non_admin(client, marketing_token):
+    """测试非管理员删除用户（权限不足）"""
+    # 假设用户ID为1
+    response = client.delete(
+        "/api/users/1",
+        headers={"Authorization": f"Bearer {marketing_token}"}
+    )
+    assert response.status_code == 403
+    assert "Not enough permissions" in response.json()["detail"]