feat: 增加演示身份下拉并保留令牌权限边界

backend/test_risk_agent_completion.py

@@ -77,6 +77,20 @@ class WorkflowTests(unittest.TestCase):
         self.assertEqual(self.call("/plans/plan-default/run","POST",{"project_id":"P2"},"manager-token").status_code,403)
         result=self.call("/plans/plan-default/run","POST",{"project_id":"XB-2026-001"},"manager-token").json()
         self.assertNotIn("configuration",result)
+    def test_demo_role_dropdown_is_gated_and_preserves_role_permissions(self):
+        header=lambda role:{"X-Xingbang-Demo-Role":role}
+        self.assertEqual(self.client.get(self.base+"/access/context",headers=header("manager")).status_code,401)
+        with patch.dict(os.environ,{"XINGBANG_DEMO_ROLE_LOGIN":"1"}):
+            for role in ("admin","reviewer","manager"):
+                response=self.client.get(self.base+"/access/context",headers=header(role))
+                self.assertEqual(response.status_code,200,response.text)
+                identity=response.json()
+                self.assertEqual(identity["role"],role)
+                self.assertTrue(identity["demo"])
+                self.assertNotIn("*",identity["projects"])
+            self.assertEqual(self.client.get(self.base+"/access/context",headers=header("owner")).status_code,401)
+            self.assertEqual(self.client.post(self.base+"/cards",headers=header("manager"),json={"name":"x"}).status_code,403)
+            self.assertEqual(self.client.post(self.base+"/cards",headers=header("reviewer"),json={"name":"x"}).status_code,403)
     def test_review_publishes_exact_version(self):
         item=self.call("/skills","POST",{"name":"新增检查","data":{"engine":"quality","inputs":["*"]}}).json()
         item["status"]="published"