feat: 增加 Git 标签清单策略和接口

tests/test_admin_update_flow.py

@@ -3,6 +3,8 @@ import asyncio
 import json
 from types import SimpleNamespace
 
+from fastapi import HTTPException
+
 
 def fake_request(**kwargs):
     return SimpleNamespace(
@@ -95,6 +97,63 @@ def test_admin_login_license_and_device_issue(server_module):
     asyncio.run(run_admin_login_license_and_device_issue(server_module))
 
 
+async def run_git_tags_policy_gate(server_module, monkeypatch):
+    async with server_module.lifespan(server_module.app):
+        from app.api.routes import admin_policy, client_update, git_tags
+        from app.schemas.client_update import DeviceIssueRequest, GitTagsRequest
+        from app.schemas.policy import PolicySaveRequest
+
+        add_app("gitapp", "Git App")
+        license_key = create_license("gitapp", "stable")
+        issue_data = await client_update.issue_device(
+            fake_request(),
+            DeviceIssueRequest(
+                app_id="gitapp",
+                channel="stable",
+                license_key=license_key,
+                installation_id="install-git-tags-000001",
+                machine_hash="cd" * 32,
+            ),
+        )
+        request = fake_request(state={"device_identity": issue_data["identity"]})
+        body = GitTagsRequest(app_id="gitapp", channel="stable")
+
+        try:
+            git_tags.client_git_tags(request, body)
+            assert False, "Git tags should be blocked before the policy is enabled"
+        except HTTPException as exc:
+            assert exc.status_code == 403
+            assert exc.detail["error"] == "git_tags_disabled"
+
+        admin_policy.admin_save_policy(
+            PolicySaveRequest(
+                app_id="gitapp",
+                channel="stable",
+                valid_until="2099-12-31T23:59:59Z",
+                git_tags_enabled=True,
+            )
+        )
+        monkeypatch.setattr(
+            git_tags,
+            "load_git_tags",
+            lambda force_refresh=False: {
+                "generated_at": "2026-07-20T00:00:00Z",
+                "repo_count": 1,
+                "tag_count": 2,
+                "tags_text": "[owner/repo]\nv1.0.0\nv1.0.1\n",
+            },
+        )
+
+        result = git_tags.client_git_tags(request, body)
+        assert result["repo_count"] == 1
+        assert result["tag_count"] == 2
+        assert "v1.0.1" in result["tags_text"]
+
+
+def test_git_tags_policy_gate(server_module, monkeypatch):
+    asyncio.run(run_git_tags_policy_gate(server_module, monkeypatch))
+
+
 async def run_publish_payload_creates_version(server_module, tmp_path):
     async with server_module.lifespan(server_module.app):
         from app.api.routes import admin_version