feat(file-summary): 生成汇总报告和导出下载

tests/test_file_summary_views.py

@@ -2,7 +2,7 @@ from django.core.files.uploadedfile import SimpleUploadedFile
 from django.urls import reverse
 import pytest
 
-from review_agent.models import Conversation, FileAttachment
+from review_agent.models import Conversation, ExportedSummaryFile, FileAttachment, FileSummaryBatch
 
 
 pytestmark = pytest.mark.django_db
@@ -73,3 +73,26 @@ def test_delete_attachment_is_logical_and_scoped(client, settings, tmp_path, dja
     assert response.status_code == 200
     assert attachment.upload_status == FileAttachment.UploadStatus.DELETED
     assert attachment.is_active is False
+
+
+def test_export_download_requires_batch_owner(client, tmp_path, django_user_model):
+    owner = django_user_model.objects.create_user(username="owner", password="pass")
+    other = django_user_model.objects.create_user(username="other", password="pass")
+    conversation = Conversation.objects.create(user=owner, title="会话")
+    batch = FileSummaryBatch.objects.create(conversation=conversation, user=owner, batch_no="FS-DL")
+    report_path = tmp_path / "summary.md"
+    report_path.write_text("ok", encoding="utf-8")
+    exported = ExportedSummaryFile.objects.create(
+        batch=batch,
+        export_type=ExportedSummaryFile.ExportType.MARKDOWN,
+        file_name="summary.md",
+        storage_path=str(report_path),
+    )
+
+    client.force_login(other)
+    denied = client.get(reverse("file_summary_export_download", args=[exported.pk]))
+    assert denied.status_code == 404
+
+    client.force_login(owner)
+    allowed = client.get(reverse("file_summary_export_download", args=[exported.pk]))
+    assert allowed.status_code == 200