新增 /profiles/me、/me/stats、/me/clouds 快捷路由，放开 stats 本人查看权限

tests/test_profiles.py

@@ -112,6 +112,30 @@ def test_get_user_clouds_public(client: TestClient, monkeypatch) -> None:
         assert item["status"] == "approved"
 
 
+def test_get_my_clouds_via_me(client: TestClient, monkeypatch) -> None:
+    info = register_and_confirm(
+        client, monkeypatch,
+        f"myclouds-{uuid.uuid4().hex[:8]}@example.com",
+        "myclouds1", "me 云图",
+    )
+    client.post(
+        "/api/v1/clouds",
+        headers=bearer(info["token"]),
+        files={"image": ("cloud.png", png_bytes(), "image/png")},
+        data={"cloud_type_id": "1", "is_hidden": "false"},
+    )
+    r = client.get("/api/v1/profiles/me/clouds", headers=bearer(info["token"]))
+    assert r.status_code == 200
+    assert r.json()["total"] >= 1
+    # 本人可以看到 pending 状态
+    assert r.json()["items"][0]["status"] == "pending"
+
+
+def test_get_my_clouds_via_me_unauthenticated(client: TestClient) -> None:
+    r = client.get("/api/v1/profiles/me/clouds")
+    assert r.status_code == 401
+
+
 def test_get_user_clouds_as_owner(client: TestClient, monkeypatch) -> None:
     info = register_and_confirm(
         client, monkeypatch,
@@ -139,17 +163,72 @@ def test_get_nonexistent_user_clouds(client: TestClient) -> None:
 
 
 # ---------------------------------------------------------------------------
-# stats (admin only)
+# /me profile shortcut
 # ---------------------------------------------------------------------------
 
 
+def test_get_my_profile_via_me(client: TestClient, monkeypatch) -> None:
+    info = register_and_confirm(
+        client, monkeypatch,
+        f"me-prof-{uuid.uuid4().hex[:8]}@example.com",
+        "meprof12", "me 资料",
+    )
+    r = client.get("/api/v1/profiles/me", headers=bearer(info["token"]))
+    assert r.status_code == 200
+    assert r.json()["username"] == "me 资料"
+    assert r.json()["id"] == info["user_id"]
+
+
+def test_get_my_profile_via_me_unauthenticated(client: TestClient) -> None:
+    r = client.get("/api/v1/profiles/me")
+    assert r.status_code == 401
+
+
+# ---------------------------------------------------------------------------
+# stats
+# ---------------------------------------------------------------------------
+
+
+def test_get_my_stats_via_me(client: TestClient, monkeypatch) -> None:
+    info = register_and_confirm(
+        client, monkeypatch,
+        f"mestats-{uuid.uuid4().hex[:8]}@example.com",
+        "mestatsp", "me 统计",
+    )
+    client.post(
+        "/api/v1/clouds",
+        headers=bearer(info["token"]),
+        files={"image": ("cloud.png", png_bytes(), "image/png")},
+        data={"cloud_type_id": "1", "is_hidden": "false"},
+    )
+    r = client.get("/api/v1/profiles/me/stats", headers=bearer(info["token"]))
+    assert r.status_code == 200
+    body = r.json()
+    assert body["cloud_count"] == 1
+    assert body["username"] == "me 统计"
+    assert body["user_id"] == info["user_id"]
+
+
+def test_get_my_stats_via_user_id(client: TestClient, monkeypatch) -> None:
+    info = register_and_confirm(
+        client, monkeypatch,
+        f"selfstats-{uuid.uuid4().hex[:8]}@example.com",
+        "selfstat", "自统计",
+    )
+    r = client.get(
+        f"/api/v1/profiles/{info['user_id']}/stats",
+        headers=bearer(info["token"]),
+    )
+    assert r.status_code == 200
+    assert r.json()["user_id"] == info["user_id"]
+
+
 def test_get_user_stats_admin(client: TestClient, monkeypatch) -> None:
     info = register_and_confirm(
         client, monkeypatch,
         f"stats-{uuid.uuid4().hex[:8]}@example.com",
         "statspass", "统计用户",
     )
-    # upload one cloud and approve it, upload another pending
     ur1 = client.post(
         "/api/v1/clouds",
         headers=bearer(info["token"]),
@@ -176,15 +255,20 @@ def test_get_user_stats_admin(client: TestClient, monkeypatch) -> None:
     assert body["username"] == "统计用户"
 
 
-def test_get_user_stats_non_admin(client: TestClient, monkeypatch) -> None:
-    info = register_and_confirm(
+def test_get_user_stats_other_user_forbidden(client: TestClient, monkeypatch) -> None:
+    info_a = register_and_confirm(
         client, monkeypatch,
-        f"stats-na-{uuid.uuid4().hex[:8]}@example.com",
-        "statsnap", "非管理员统计",
+        f"stats-a-{uuid.uuid4().hex[:8]}@example.com",
+        "statsapp1", "A 的统计",
+    )
+    info_b = register_and_confirm(
+        client, monkeypatch,
+        f"stats-b-{uuid.uuid4().hex[:8]}@example.com",
+        "statsbpp2", "B 的统计",
     )
     r = client.get(
-        f"/api/v1/profiles/{info['user_id']}/stats",
-        headers=bearer(info["token"]),
+        f"/api/v1/profiles/{info_a['user_id']}/stats",
+        headers=bearer(info_b["token"]),
     )
     assert r.status_code == 403