feat(attachments): 补充附件管理接口

tests/test_file_summary_views.py

@@ -1,5 +1,6 @@
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.urls import reverse
+import json
 import pytest
 
 from review_agent.models import (
@@ -171,3 +172,89 @@ def test_batch_status_exposes_batch_and_node_errors(client, django_user_model):
     payload = response.json()
     assert payload["batch"]["error_message"] == "压缩包解压失败"
     assert payload["nodes"][0]["message"] == "未解出任何可扫描文件"
+
+
+def test_conversation_list_api_returns_owned_conversations_with_attachment_counts(client, django_user_model):
+    owner = django_user_model.objects.create_user(username="owner", password="pass")
+    other = django_user_model.objects.create_user(username="other", password="pass")
+    owned = Conversation.objects.create(user=owner, title="有附件会话")
+    Conversation.objects.create(user=other, title="其他用户会话")
+    FileAttachment.objects.create(
+        conversation=owned,
+        user=owner,
+        original_name="a.docx",
+        storage_path="x/a.docx",
+        file_size=1,
+    )
+    FileAttachment.objects.create(
+        conversation=owned,
+        user=owner,
+        original_name="deleted.docx",
+        storage_path="x/deleted.docx",
+        file_size=1,
+        upload_status=FileAttachment.UploadStatus.DELETED,
+        is_active=False,
+    )
+    client.force_login(owner)
+
+    response = client.get(reverse("review_agent_conversation_list"))
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert [item["title"] for item in payload["conversations"]] == ["有附件会话"]
+    assert payload["conversations"][0]["attachment_count"] == 1
+
+
+def test_patch_attachment_updates_name_and_active_state(client, django_user_model):
+    user = django_user_model.objects.create_user(username="owner", password="pass")
+    conversation = Conversation.objects.create(user=user, title="会话")
+    attachment = FileAttachment.objects.create(
+        conversation=conversation,
+        user=user,
+        original_name="old.docx",
+        storage_path="x/old.docx",
+        file_size=1,
+        is_active=True,
+    )
+    client.force_login(user)
+
+    response = client.patch(
+        reverse("file_summary_attachment_detail", args=[conversation.pk, attachment.pk]),
+        data=json.dumps({"original_name": "new.docx", "is_active": False}),
+        content_type="application/json",
+    )
+
+    attachment.refresh_from_db()
+    assert response.status_code == 200
+    assert attachment.original_name == "new.docx"
+    assert attachment.is_active is False
+    assert response.json()["attachment"]["original_name"] == "new.docx"
+
+
+def test_attachment_download_requires_owner_and_returns_file(client, settings, tmp_path, django_user_model):
+    settings.MEDIA_ROOT = tmp_path
+    owner = django_user_model.objects.create_user(username="owner", password="pass")
+    other = django_user_model.objects.create_user(username="other", password="pass")
+    conversation = Conversation.objects.create(user=owner, title="会话")
+    attachment_path = tmp_path / "uploads" / "a.docx"
+    attachment_path.parent.mkdir(parents=True)
+    attachment_path.write_bytes(b"attachment-content")
+    attachment = FileAttachment.objects.create(
+        conversation=conversation,
+        user=owner,
+        original_name="a.docx",
+        storage_path=str(attachment_path),
+        file_size=attachment_path.stat().st_size,
+        content_type="application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    )
+
+    client.force_login(other)
+    denied = client.get(reverse("file_summary_attachment_download", args=[conversation.pk, attachment.pk]))
+    assert denied.status_code == 404
+
+    client.force_login(owner)
+    allowed = client.get(reverse("file_summary_attachment_download", args=[conversation.pk, attachment.pk]))
+    assert allowed.status_code == 200
+    assert "attachment" in allowed["Content-Disposition"]
+    assert "a.docx" in allowed["Content-Disposition"]
+    assert b"".join(allowed.streaming_content) == b"attachment-content"