feat(web): require login only for candidates and system

tests/test_web_server.py

@@ -65,6 +65,15 @@ def test_readonly_routes_and_static():
             assert status == 200 and health["ok"] is True
             assert health["data"]["preview"] is False
 
+            status, _, payload = running.json("/api/session")
+            assert status == 200
+            assert payload["data"]["auth_enabled"] is False
+            assert payload["data"]["authenticated"] is True
+            status, _, payload = running.json("/api/candidates")
+            assert status == 200 and payload["ok"] is True
+            status, _, payload = running.json("/api/system")
+            assert status == 200 and payload["ok"] is True
+
             status, _, overview = running.json("/api/overview")
             assert status == 200 and overview["ok"] is True
             assert overview["data"]["data_date"] == "2026-10-31"
@@ -169,16 +178,38 @@ def test_readonly_routes_and_static():
 
 def test_token_auth_and_login():
     with tempfile.TemporaryDirectory() as tmp:
-        running = RunningServer(tmp, token="secret-token")
+        running = RunningServer(tmp, token="test-token")
         try:
+            # 公共页面与公共 API 访客可见
             status, _, body = running.json("/api/overview")
+            assert status == 200 and body["ok"] is True
+            status, _, body = running.json("/api/videos")
+            assert status == 200 and body["ok"] is True
+            status, _, body = running.json("/api/fans?days=7")
+            assert status == 200 and body["ok"] is True
+            status, _, payload = running.request("/")
+            assert status == 200 and b"<html" in payload.lower()
+            status, _, payload = running.request("/rank")
+            assert status == 200 and b"<html" in payload.lower()
+
+            # 候选与系统需要登录
+            status, _, body = running.json("/api/candidates")
             assert status == 401 and body["error"]["code"] == "unauthorized"
+            status, _, body = running.json("/api/system")
+            assert status == 401
+            status, headers, _ = running.request("/candidates")
+            assert status == 303 and headers["Location"] == "/login?next=/candidates"
+            status, headers, _ = running.request("/system")
+            assert status == 303 and headers["Location"] == "/login?next=/system"
 
-            status, headers, _ = running.request("/")
-            assert status == 303 and headers["Location"] == "/login"
+            status, _, body = running.json("/api/session")
+            assert status == 200
+            assert body["data"]["auth_enabled"] is True
+            assert body["data"]["authenticated"] is False
 
-            status, _, payload = running.request("/login")
+            status, _, payload = running.request("/login?next=/candidates")
             assert status == 200 and b"web.auth_token" in payload
+            assert b"action=\"/login?next=/candidates\"" in payload
 
             status, _, _ = running.request(
                 "/login",
@@ -189,28 +220,30 @@ def test_token_auth_and_login():
             assert status == 401
 
             status, headers, _ = running.request(
-                "/login",
+                "/login?next=/candidates",
                 method="POST",
                 headers={"Content-Type": "application/x-www-form-urlencoded"},
-                body="token=secret-token",
+                body="token=test-token",
             )
-            assert status == 303
+            assert status == 303 and headers["Location"] == "/candidates"
             cookie = headers["Set-Cookie"].split(";", 1)[0]
             assert cookie.startswith("rb_session=")
 
-            status, _, body = running.json("/api/overview", headers={"Cookie": cookie})
+            status, _, body = running.json("/api/candidates", headers={"Cookie": cookie})
+            assert status == 200 and body["ok"] is True
+            status, _, body = running.json("/api/system", headers={"Cookie": cookie})
             assert status == 200 and body["ok"] is True
-
             status, _, body = running.json(
-                "/api/overview", headers={"Authorization": "Bearer secret-token"}
+                "/api/candidates", headers={"Authorization": "Bearer test-token"}
             )
             assert status == 200
 
             tampered = cookie[:-1] + ("0" if cookie[-1] != "0" else "1")
-            status, _, _ = running.json("/api/overview", headers={"Cookie": tampered})
+            status, _, _ = running.json("/api/candidates", headers={"Cookie": tampered})
             assert status == 401
+            status, _, body = running.json("/api/overview", headers={"Cookie": tampered})
+            assert status == 200
 
-            # 健康检查始终匿名
             status, _, _ = running.json("/api/health")
             assert status == 200
         finally: