feat(application-form-fill): 新增自动填表批次模型

tests/test_file_summary_views.py

@@ -4,6 +4,7 @@ import json
 import pytest
 
 from review_agent.models import (
+    ApplicationFormFillBatch,
     Conversation,
     ExportedSummaryFile,
     FileAttachment,
@@ -109,6 +110,54 @@ def test_export_download_requires_batch_owner(client, tmp_path, django_user_mode
     assert allowed["Content-Type"].startswith("text/markdown")
 
 
+def test_export_download_checks_application_form_fill_batch_owner(client, tmp_path, django_user_model):
+    owner = django_user_model.objects.create_user(username="owner", password="pass")
+    other = django_user_model.objects.create_user(username="other", password="pass")
+    owner_conversation = Conversation.objects.create(user=owner, title="自动填表")
+    other_conversation = Conversation.objects.create(user=other, title="其他对话")
+    owner_summary = FileSummaryBatch.objects.create(
+        conversation=owner_conversation,
+        user=owner,
+        batch_no="FS-AFF-OWNER",
+        status=FileSummaryBatch.Status.SUCCESS,
+    )
+    other_summary = FileSummaryBatch.objects.create(
+        conversation=other_conversation,
+        user=other,
+        batch_no="FS-AFF-OTHER",
+        status=FileSummaryBatch.Status.SUCCESS,
+    )
+    form_batch = ApplicationFormFillBatch.objects.create(
+        conversation=owner_conversation,
+        user=owner,
+        source_summary_batch=owner_summary,
+        batch_no="AFF-DL",
+    )
+    report_path = tmp_path / "filled.docx"
+    report_path.write_bytes(b"word-content")
+    exported = ExportedSummaryFile.objects.create(
+        batch=other_summary,
+        workflow_type="application_form_fill",
+        workflow_batch_id=form_batch.pk,
+        export_category="filled_template",
+        export_type=ExportedSummaryFile.ExportType.WORD,
+        file_name="filled.docx",
+        storage_path=str(report_path),
+    )
+
+    client.force_login(other)
+    denied = client.get(reverse("file_summary_export_download", args=[exported.pk]))
+    assert denied.status_code == 404
+
+    client.force_login(owner)
+    allowed = client.get(reverse("file_summary_export_download", args=[exported.pk]))
+    assert allowed.status_code == 200
+    assert allowed["Content-Type"].startswith(
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+    )
+    assert b"".join(allowed.streaming_content) == b"word-content"
+
+
 def test_conversation_messages_returns_incremental_messages(client, django_user_model):
     owner = django_user_model.objects.create_user(username="owner", password="pass")
     other = django_user_model.objects.create_user(username="other", password="pass")