✨ feat: WP-14 运营收口——诊断双授权、管理面治理、支持包、观测与自托管

- 迁移 16：diagnostic_grant（token 哈希唯一、15 分钟、单次、绑定 Run）+ user.role（user/admin 检查约束） - 诊断双授权（ADR-004）：本人签发 grant（明文 token 只返回一次，库存 SHA-256）；读取需登录态 + Hunjing-Diagnostic-Token + Purpose 三重匹配；单次消耗（重放 401）、用途不符 403、响应 no-store/private；返回观测摘要（usage/TTFT/工具轨迹）不含消息正文 - 管理面：pending 司议案列表与处置（content_removed 联动下架目标内容——治理闭环）；非管理员 403 - 脱敏支持包：统计聚合（runs/messages/tool/media 按状态），无正文无密钥 - 观测：GET /readyz（DB 连通）与 GET /metrics（Prometheus 文本，真实 SQL 聚合） - 自托管：docker/Dockerfile.backend（uv 构建）+ docker-compose.app.yml（hunjing-api + hunjing-postgres 健康依赖、密码经 .env）；Makefile 新增 selfhost-up/down、db-dump/db-restore（备份到 backups/） - 测试 94 项全绿（+3）：诊断全路径（无令牌/用途不符/成功/单次重放）、管理面处置联动、支持包与指标
2026-09-12 11:20:15 +08:00
1 parent 701c20c783
commit 21eacc8c75
@@ -1703,3 +1703,105 @@ class TestMedia:
            json={"kind": "tts", "input": {"text": "再见"}}, headers=headers
        )
        assert after.status_code == 403
+
+
+@pytest.mark.usefixtures("client")
+class TestOps:
+    async def test_diagnostic_dual_auth_flow(self, client, db) -> None:
+        headers = await login(client, "ops1@example.com")
+        cid = await _create_conversation(client, headers)
+        resp = await _post_message(client, headers, cid, "idem-ops1")
+        run_id = resp.json()["run"]["id"]
+        await _wait_run_terminal(db, run_id)
+        # 签发：明文只此一次
+        grant = await client.post(
+            f"/v1/runs/{run_id}/diagnostic-grants",
+            json={"purpose": "user_inspection"}, headers=headers,
+        )
+        assert grant.status_code == 201, grant.text
+        token = grant.json()["token"]
+        # 无令牌：401
+        no_token = await client.get(f"/v1/runs/{run_id}/diagnostics", headers=headers)
+        assert no_token.status_code == 401
+        # 用途不符：403
+        wrong = await client.get(
+            f"/v1/runs/{run_id}/diagnostics",
+            headers={**headers, "Hunjing-Diagnostic-Token": token,
+                     "Hunjing-Diagnostic-Purpose": "other"},
+        )
+        assert wrong.status_code == 403
+        # 正确读取：观测摘要 + no-store + 单次消耗
+        ok = await client.get(
+            f"/v1/runs/{run_id}/diagnostics",
+            headers={**headers, "Hunjing-Diagnostic-Token": token,
+                     "Hunjing-Diagnostic-Purpose": "user_inspection"},
+        )
+        assert ok.status_code == 200
+        assert ok.headers["cache-control"] == "no-store, private"
+        body = ok.json()
+        assert body["run"]["id"] == run_id and body["turns"]
+        # 单次：重复使用 401
+        replay = await client.get(
+            f"/v1/runs/{run_id}/diagnostics",
+            headers={**headers, "Hunjing-Diagnostic-Token": token,
+                     "Hunjing-Diagnostic-Purpose": "user_inspection"},
+        )
+        assert replay.status_code == 401
+
+    async def test_admin_moderation_resolution(self, client, db) -> None:
+        from app.models import User as UserModel
+
+        # 提权管理员（开发档直改）
+        admin_headers = await login(client, "ops-admin@example.com")
+        ordinary = await login(client, "ops-ordinary@example.com")
+        from sqlalchemy import select as sa_sel
+
+        async with db() as session:
+            admin_user = (
+                await session.execute(
+                    sa_sel(UserModel).where(UserModel.email == "ops-admin@example.com")
+                )
+            ).scalar_one()
+            admin_user.role = "admin"
+            await session.commit()
+        # 普通用户访问管理面：403
+        forbidden = await client.get("/v1/admin/moderation-cases", headers=ordinary)
+        assert forbidden.status_code == 403
+        # 举报→处置→联动下架
+        author = await login(client, "ops-author@example.com")
+        pub = await client.post(
+            "/v1/community/contents",
+            json={"kind": "post", "title": "待处置"}, headers=author,
+        )
+        content_id = pub.json()["id"]
+        report = await client.post(
+            "/v1/community/reports",
+            json={"target_type": "content", "target_id": content_id, "reason": "违规"},
+            headers=ordinary,
+        )
+        case_id = report.json()["case_id"]
+        pending = await client.get(
+            "/v1/admin/moderation-cases", headers=admin_headers
+        )
+        assert any(c["case_id"] == case_id for c in pending.json()["data"])
+        resolved = await client.post(
+            f"/v1/admin/moderation-cases/{case_id}/resolutions",
+            json={"action": "content_removed"}, headers=admin_headers,
+        )
+        assert resolved.json()["status"] == "resolved"
+        # 下架传播：内容 404
+        gone = await client.get(f"/v1/community/contents/{content_id}", headers=ordinary)
+        assert gone.status_code == 404
+
+    async def test_support_bundle_and_metrics(self, client) -> None:
+        headers = await login(client, "ops3@example.com")
+        bundle = await client.post("/v1/support/bundles", headers=headers)
+        assert bundle.status_code == 200
+        body = bundle.json()
+        assert "runs_by_status" in body and "messages_total" in body
+        assert "detail" not in body
+        metrics = await client.get("/v1/metrics")
+        assert metrics.status_code == 200
+        assert "hunjing_runs_total" in metrics.text
+        ready = await client.get("/v1/readyz")
+        assert ready.json()["status"] == "ready"