From 8351130b4dba61b1a6143ecb8bc6b2656a933131 Mon Sep 17 00:00:00 2001 From: Swan1127 <3444176319@qq.com> Date: Sun, 13 Sep 2026 20:22:07 +0800 Subject: [PATCH 1/2] test: preserve valid feedback workflow filters --- ...eedback_lifecycle_notifications_profile.py | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/tests/test_feedback_lifecycle_notifications_profile.py b/tests/test_feedback_lifecycle_notifications_profile.py index 5f97385..a87d985 100644 --- a/tests/test_feedback_lifecycle_notifications_profile.py +++ b/tests/test_feedback_lifecycle_notifications_profile.py @@ -185,6 +185,41 @@ def test_status_transition_is_bounded_and_admin_only(self): self.assertEqual(record['status'], 'received') self.assertEqual(SystemLog.query.filter_by(log_type='反馈状态更新').count(), 0) + def test_status_update_preserves_only_valid_admin_filters(self): + feedback_id = self.submit_feedback() + self.assertEqual(self.login('lifecycle_admin', 'admin_password').status_code, 302) + + preserved = self.client.post( + f'/admin/feedback/{feedback_id}/status', + data={ + 'status': 'triaged', + 'return_status': 'triaged', + 'return_category': 'bug', + }, + follow_redirects=False, + ) + self.assertEqual(preserved.status_code, 302) + self.assertEqual( + preserved.headers['Location'], + '/admin/feedback?status=triaged&category=bug', + ) + filtered = self.client.get(preserved.headers['Location']) + self.assertEqual(filtered.status_code, 200) + self.assertIn('状态变更通知测试'.encode('utf-8'), filtered.data) + + invalid_filter_feedback_id = self.submit_feedback() + discarded = self.client.post( + f'/admin/feedback/{invalid_filter_feedback_id}/status', + data={ + 'status': 'triaged', + 'return_status': 'not-a-status', + 'return_category': 'not-a-category', + }, + follow_redirects=False, + ) + self.assertEqual(discarded.status_code, 302) + self.assertEqual(discarded.headers['Location'], '/admin/feedback') + def test_profile_public_scope_is_explicit_and_reversible(self): self.assertEqual(self.login('lifecycle_student', 'student_password').status_code, 302) edit = self.client.get('/edit_profile') From 3b50e70536ed5adb482413d536247d96d92f48a3 Mon Sep 17 00:00:00 2001 From: Swan1127 <3444176319@qq.com> Date: Sun, 13 Sep 2026 20:39:05 +0800 Subject: [PATCH 2/2] fix: constrain feedback status actions --- routes/main.py | 12 ++- services/feedback.py | 12 +++ templates/admin_feedback.html | 20 +++-- ...eedback_lifecycle_notifications_profile.py | 80 +++++++++++++++++++ 4 files changed, 115 insertions(+), 9 deletions(-) diff --git a/routes/main.py b/routes/main.py index 7dba0fa..dd76b27 100644 --- a/routes/main.py +++ b/routes/main.py @@ -31,6 +31,7 @@ create_feedback_record, find_feedback, list_feedback, + next_feedback_status_options, save_feedback, update_feedback_status, ) @@ -1123,12 +1124,15 @@ def admin_feedback(): status_filter = '' if category_filter not in FEEDBACK_CATEGORY_LABELS: category_filter = '' + feedback_records = list_feedback( + status=status_filter or None, + category=category_filter or None, + ) + for record in feedback_records: + record['next_statuses'] = next_feedback_status_options(record.get('status')) return render_template( 'admin_feedback.html', - feedback_records=list_feedback( - status=status_filter or None, - category=category_filter or None, - ), + feedback_records=feedback_records, feedback_statuses=FEEDBACK_STATUS_OPTIONS, feedback_categories=FEEDBACK_CATEGORIES, status_filter=status_filter, diff --git a/services/feedback.py b/services/feedback.py index 8e4ac83..fcc02bb 100644 --- a/services/feedback.py +++ b/services/feedback.py @@ -45,6 +45,18 @@ } +def next_feedback_status_options(current_status: str | None) -> tuple[tuple[str, str], ...]: + """Return only the valid next workflow choices in display order.""" + + allowed_statuses = _FEEDBACK_STATUS_TRANSITIONS.get( + str(current_status or "").strip(), + set(), + ) + return tuple( + option for option in FEEDBACK_STATUS_OPTIONS if option[0] in allowed_statuses + ) + + class FeedbackValidationError(ValueError): """Raised when a feedback submission cannot be accepted safely.""" diff --git a/templates/admin_feedback.html b/templates/admin_feedback.html index f923f84..74e76a3 100644 --- a/templates/admin_feedback.html +++ b/templates/admin_feedback.html @@ -115,6 +115,12 @@ text-align: center; } + .feedback-workflow-complete { + margin: 1rem 0 0; + color: var(--medium); + font-size: 0.875rem; + } + .feedback-filters, .feedback-status-form { display: flex; @@ -251,15 +257,16 @@

{{ record.subject }}

  • {{ item.status_label }} ·
    • {% endfor %} + {% if record.next_statuses %}
    - - + {% for value, label in record.next_statuses %} + {% endfor %}
    @@ -268,8 +275,11 @@

    {{ record.subject }}

    - +
    + {% else %} +

    该反馈已关闭，不能继续修改状态。

    + {% endif %} {% else %}
    还没有收到反馈。
    diff --git a/tests/test_feedback_lifecycle_notifications_profile.py b/tests/test_feedback_lifecycle_notifications_profile.py index a87d985..66bc064 100644 --- a/tests/test_feedback_lifecycle_notifications_profile.py +++ b/tests/test_feedback_lifecycle_notifications_profile.py @@ -1,5 +1,6 @@ import json import os +import re import tempfile import unittest @@ -74,6 +75,15 @@ def submit_feedback(self): self.assertEqual(response.status_code, 302) return response.headers['Location'].rstrip('/').split('/')[-1] + def status_options_for(self, page, feedback_id): + """Return the status values rendered in one feedback item's form.""" + + action = ( + f'action="/admin/feedback/{feedback_id}/status">'.encode('utf-8') + ) + form = page.data.split(action, 1)[1].split(b'', 1)[0] + return re.findall(rb'