release(main): 修复云端台账保存与备份重开

backend/tests/test_collaboration_service.py

@@ -4,7 +4,7 @@ import uuid
 import zipfile
 from datetime import datetime, timedelta, timezone
 from types import SimpleNamespace
-from unittest.mock import ANY, AsyncMock
+from unittest.mock import ANY, AsyncMock, call
 
 import pytest
 from fastapi import HTTPException
@@ -304,6 +304,18 @@ def test_result_download_url_is_restricted_and_public_proxy_urls_are_rewritten(m
     assert onlyoffice_collaboration_service._validate_result_url(
         "http://localhost:8888/onlyoffice/cache/result.docx?token=signed"
     ) == "http://onlyoffice/cache/result.docx?token=signed"
+    with pytest.raises(HTTPException) as mismatched_origin:
+        onlyoffice_collaboration_service._validate_result_url(
+            "https://ctms.example.com/onlyoffice/cache/result.xlsx?token=signed"
+        )
+    assert mismatched_origin.value.status_code == 422
+
+    monkeypatch.setattr(settings, "FRONTEND_PUBLIC_URL", "https://ctms.example.com")
+    assert onlyoffice_collaboration_service._validate_result_url(
+        "https://ctms.example.com/onlyoffice/cache/result.xlsx?token=signed"
+    ) == "http://onlyoffice/cache/result.xlsx?token=signed"
+
+    monkeypatch.setattr(settings, "FRONTEND_PUBLIC_URL", "http://localhost:8888")
     for value in (
         "http://backend:8000/internal/file",
         "http://onlyoffice.evil.example/cache/result.docx",
@@ -384,6 +396,89 @@ async def test_forgotten_document_command_rejects_a_damaged_backup(monkeypatch):
     assert error.value.status_code == 502
 
 
+@pytest.mark.asyncio
+async def test_document_server_info_command_returns_unique_live_users(monkeypatch):
+    key = "ctms-collab-live-key"
+    request = {}
+
+    class FakeResponse:
+        status_code = 200
+
+        @staticmethod
+        def json():
+            return {"error": 0, "key": key, "users": ["user-1", "user-1", "user-2"]}
+
+    class FakeClient:
+        async def __aenter__(self):
+            return self
+
+        async def __aexit__(self, *_args):
+            return None
+
+        async def post(self, url, *, params, json):
+            request.update(url=url, params=params, body=json)
+            return FakeResponse()
+
+    monkeypatch.setattr(
+        onlyoffice_collaboration_service.httpx,
+        "AsyncClient",
+        lambda **_kwargs: FakeClient(),
+    )
+
+    users = await onlyoffice_collaboration_service._document_server_users(key)
+
+    assert users == ["user-1", "user-2"]
+    assert request["url"] == "http://onlyoffice/command"
+    assert request["params"] == {"shardkey": key}
+    assert jwt.decode(
+        request["body"]["token"], settings.ONLYOFFICE_JWT_SECRET, algorithms=["HS256"]
+    ) == {"c": "info", "key": key}
+
+
+@pytest.mark.asyncio
+async def test_document_server_info_command_treats_unknown_key_as_no_live_users(monkeypatch):
+    class FakeResponse:
+        status_code = 200
+
+        @staticmethod
+        def json():
+            return {"error": 1}
+
+    class FakeClient:
+        async def __aenter__(self):
+            return self
+
+        async def __aexit__(self, *_args):
+            return None
+
+        async def post(self, *_args, **_kwargs):
+            return FakeResponse()
+
+    monkeypatch.setattr(
+        onlyoffice_collaboration_service.httpx,
+        "AsyncClient",
+        lambda **_kwargs: FakeClient(),
+    )
+
+    assert await onlyoffice_collaboration_service._document_server_users("retired-key") == []
+
+
+@pytest.mark.asyncio
+async def test_live_editing_session_check_filters_stale_active_rows(monkeypatch):
+    rows = SimpleNamespace(all=lambda: [
+        ("live-key", "正在编辑.xlsx"),
+        ("stale-key", "陈旧记录.xlsx"),
+    ])
+    db = SimpleNamespace(execute=AsyncMock(return_value=rows))
+    lookup = AsyncMock(side_effect=[["user-1", "user-2"], []])
+    monkeypatch.setattr(onlyoffice_collaboration_service, "_document_server_users", lookup)
+
+    active = await onlyoffice_collaboration_service.list_live_editing_sessions(db)
+
+    assert active == [("正在编辑.xlsx", 2)]
+    assert lookup.await_args_list == [call("live-key"), call("stale-key")]
+
+
 @pytest.mark.asyncio
 async def test_editor_config_grants_edit_only_after_collaboration_permission(monkeypatch, tmp_path):
     user_id = uuid.uuid4()