fix: allow manage users to access management APIs

tests/test_api_authorization.py

@@ -8,13 +8,19 @@ from fastapi import HTTPException
 from starlette.requests import Request
 from starlette.responses import Response
 
+from app.api.endpoints import dashboard as dashboard_endpoint
+from app.api.endpoints import history as history_endpoint
 from app.api.endpoints import login as login_endpoint
 from app.api.endpoints import plugin as plugin_endpoint
+from app.api.endpoints import site as site_endpoint
+from app.api.endpoints import storage as storage_endpoint
 from app.api.endpoints import system as system_endpoint
+from app.api.endpoints import transfer as transfer_endpoint
 from app.api.endpoints import user as user_endpoint
-from app.api.endpoints import dashboard as dashboard_endpoint
 from app.core.security import verify_resource_token
 from app.db.user_oper import (
+    get_current_active_manage_user,
+    get_current_active_manage_user_async,
     get_current_active_superuser,
     get_current_active_superuser_async,
     get_current_active_user_async,
@@ -75,6 +81,43 @@ def test_plugin_dashboard_endpoints_require_superuser():
     assert _dependency_of(plugin_endpoint.plugin_dashboard, "_") is get_current_active_superuser
 
 
+def test_manage_page_endpoints_accept_manage_permission():
+    """管理页面接口允许具备 manage 权限的普通用户访问。"""
+    sync_endpoints = [
+        storage_endpoint.list_files,
+        storage_endpoint.mkdir,
+        storage_endpoint.delete,
+        storage_endpoint.download,
+        storage_endpoint.image,
+        storage_endpoint.rename,
+        site_endpoint.update_cookie_by_body,
+        site_endpoint.update_cookie,
+        site_endpoint.refresh_userdata,
+        history_endpoint.delete_transfer_history,
+        history_endpoint.ai_redo_transfer_history,
+        history_endpoint.batch_ai_redo_transfer_history,
+        transfer_endpoint.match_manual_transfer_target_path,
+        transfer_endpoint.manual_transfer,
+        transfer_endpoint.recommend_episode_format,
+    ]
+    async_endpoints = [
+        site_endpoint.read_sites,
+        site_endpoint.add_site,
+        site_endpoint.update_site,
+        site_endpoint.update_sites_priority,
+        site_endpoint.read_userdata_latest,
+        site_endpoint.read_userdata,
+        site_endpoint.site_resource,
+        site_endpoint.read_site,
+        site_endpoint.delete_site,
+    ]
+
+    for endpoint in sync_endpoints:
+        assert _dependency_of(endpoint, "_") is get_current_active_manage_user
+    for endpoint in async_endpoints:
+        assert _dependency_of(endpoint, "_") is get_current_active_manage_user_async
+
+
 def test_system_public_setting_allows_only_non_sensitive_keys(monkeypatch):
     """公开系统设置接口只能读取明确列入白名单的非敏感配置。"""
     calls = []