test: 补充权限、消息与会话服务回归用例

会话读取、接管、重分配与 Socket 订阅统一校验角色、组织与可见性。

backend/tests/services/test_auth_sessions.py

@@ -0,0 +1,92 @@
+"""
+Copyright 2024-2026 ReplyPier
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+import pytest
+from uuid import uuid4
+
+from app.core.security import create_access_token, verify_token
+from app.models.auth_session import AuthSession
+from app.models.user import User
+from app.services.auth_sessions import (
+    ACCESS,
+    REFRESH,
+    issue_tokens,
+    live_payload,
+    revoke_user_sessions,
+)
+
+
+def _user(db, org, email):
+    user = User(
+        id=uuid4(),
+        email=email,
+        hashed_password="x",
+        is_active=True,
+        organization_id=org.id,
+    )
+    db.add(user)
+    db.commit()
+    return user
+
+
+@pytest.fixture
+def user(db, test_organization):
+    return _user(db, test_organization, "one@test.com")
+
+
+def test_live_payload_checks_the_token_type(db, user):
+    access, refresh = issue_tokens(db, user.id, user.organization_id)
+    db.commit()
+
+    assert live_payload(db, access, ACCESS)["sub"] == str(user.id)
+    assert live_payload(db, refresh, REFRESH)["sub"] == str(user.id)
+    assert live_payload(db, access, REFRESH) is None
+    assert live_payload(db, refresh, ACCESS) is None
+
+
+def test_live_payload_rejects_a_session_of_another_user(db, user, test_organization):
+    """A sid is only good for the user it was opened for"""
+    other = _user(db, test_organization, "two@test.com")
+    access, _ = issue_tokens(db, other.id, other.organization_id)
+    db.commit()
+    sid = verify_token(access)["sid"]
+
+    forged = create_access_token({"sub": str(user.id), "org": str(user.organization_id), "sid": sid})
+
+    assert live_payload(db, forged, ACCESS) is None
+
+
+@pytest.mark.parametrize("sid", [str(uuid4()), "not-a-uuid"])
+def test_live_payload_rejects_an_unknown_session(db, user, sid):
+    token = create_access_token({"sub": str(user.id), "org": str(user.organization_id), "sid": sid})
+
+    assert live_payload(db, token, ACCESS) is None
+
+
+def test_revoke_user_sessions_can_keep_one(db, user, test_organization):
+    other = _user(db, test_organization, "two@test.com")
+    keep, _ = issue_tokens(db, user.id, user.organization_id)
+    drop, _ = issue_tokens(db, user.id, user.organization_id)
+    bystander, _ = issue_tokens(db, other.id, other.organization_id)
+    db.commit()
+
+    revoke_user_sessions(db, user.id, keep_sid=verify_token(keep)["sid"])
+    db.commit()
+
+    assert live_payload(db, keep, ACCESS) is not None
+    assert live_payload(db, drop, ACCESS) is None
+    assert live_payload(db, bystander, ACCESS) is not None
+    assert db.query(AuthSession).filter(AuthSession.revoked_at.isnot(None)).count() == 1