prepare backend-only fastapi deployment

backend/tests/test_api_contract.py

@@ -6,6 +6,7 @@ from pathlib import Path
 os.environ.setdefault("DATABASE_URL", "sqlite:///./storage/test_api_contract.db")
 os.environ.setdefault("RUNTIME_MEMORY_BACKEND", "memory")
 os.environ.setdefault("LLM_MOCK_ENABLED", "true")
+os.environ.setdefault("AUTH_USER_ME_URL", "http://django-user-center.test/api/user/users/me/")
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 Path("storage").mkdir(exist_ok=True)
@@ -23,18 +24,47 @@ def run_api_contract_tests() -> None:
         return
 
     from app.main import app
+    from app.services.external_auth_service import AuthenticatedUser, ExternalAuthService
     from app.db.session import SessionLocal
     from app.models.source_case import CaseBase, CaseExamItem, ScoringRule, TraditionalCase
     from app.repositories.case_repository import CaseRepository
     from scripts.init_demo_db import init_database
 
+    async def fake_authenticate(self, request):  # noqa: ARG001
+        """测试认证：模拟 Django `/me` 返回 200 后的标准用户解析结果。"""
+        authorization = request.headers.get("Authorization")
+        if not authorization:
+            from app.core.exceptions import AppError
+
+            raise AppError("AUTH_CREDENTIAL_REQUIRED", "Authorization header is required", 401)
+        user_id = "api_user_002" if "api_user_002_token" in authorization else "api_user_001"
+        return AuthenticatedUser(
+            user_id=user_id,
+            username=f"{user_id}_name",
+            display_name="Swagger测试",
+            role="student",
+            tenant_id="1",
+            status=1,
+            profile={
+                "id": user_id,
+                "username": f"{user_id}_name",
+                "real_name": "Swagger测试",
+                "role_type": "student",
+                "institution": 1,
+                "institution_name": "测试机构",
+                "status": 1,
+            },
+        )
+
+    ExternalAuthService.authenticate = fake_authenticate
+
     init_database()
     client = TestClient(app)
-    headers = {"X-User-Id": "api_user_001", "X-Entry-Scene": "api_test"}
+    headers = {"Authorization": "Bearer api_user_001_token", "X-Entry-Scene": "api_test"}
 
     missing_user = client.get("/api/v1/agent/hello")
     assert missing_user.status_code == 401
-    assert missing_user.json()["code"] == "USER_ID_REQUIRED"
+    assert missing_user.json()["code"] == "AUTH_CREDENTIAL_REQUIRED"
 
     hello = client.get("/api/v1/agent/hello", headers=headers)
     assert hello.status_code == 200
@@ -43,7 +73,15 @@ def run_api_contract_tests() -> None:
     auth_me = client.get("/api/v1/auth/me", headers=headers)
     assert auth_me.status_code == 200
     assert auth_me.json()["data"]["user_id"] == "api_user_001"
-    assert auth_me.json()["data"]["source"] == "demo_header"
+    assert auth_me.json()["data"]["source"] == "django_user_center"
+    assert auth_me.json()["data"]["display_name"] == "Swagger测试"
+
+    openapi = client.get("/openapi.json")
+    assert openapi.status_code == 200
+    openapi_payload = openapi.json()
+    auth_me_operation = openapi_payload["paths"]["/api/v1/auth/me"]["get"]
+    assert any("HTTPBearer" in item for item in auth_me_operation.get("security", []))
+    assert "HTTPBearer" in openapi_payload["components"]["securitySchemes"]
 
     cases = client.get("/api/v1/cases", headers=headers)
     assert cases.status_code == 200
@@ -57,7 +95,10 @@ def run_api_contract_tests() -> None:
     assert created.status_code == 200
     session_id = created.json()["data"]["session_id"]
 
-    cross_user = client.get(f"/api/v1/sessions/{session_id}/order-items", headers={"X-User-Id": "api_user_002"})
+    cross_user = client.get(
+        f"/api/v1/sessions/{session_id}/order-items",
+        headers={"Authorization": "Bearer api_user_002_token", "X-Entry-Scene": "api_test"},
+    )
     assert cross_user.status_code == 404
     assert cross_user.json()["code"] == "SESSION_NOT_FOUND"