添加模式卡片下发

tests/e2e/test_seat_web_api.py

@@ -134,6 +134,35 @@ class SeatWebApiTests(unittest.TestCase):
             unauthenticated.open(f"{self.base_url}/api/runtime", timeout=3)
         self.assertEqual(caught.exception.code, 401)
 
+    def test_n7_mode_scene_catalog_is_public_and_read_only(self) -> None:
+        unauthenticated = urllib.request.build_opener()
+
+        with unauthenticated.open(f"{self.base_url}/n7/scenes", timeout=3) as response:
+            catalog = json.loads(response.read().decode("utf-8"))
+
+        self.assertEqual(response.status, 200)
+        self.assertEqual(response.headers["Cache-Control"], "no-store")
+        self.assertEqual(response.headers["Access-Control-Allow-Origin"], "*")
+        self.assertEqual(catalog["service"], "n7-scenes")
+        self.assertEqual(catalog["schema_version"], 1)
+        self.assertEqual(catalog["vehicle_id"], "denza_n7")
+        self.assertGreaterEqual(catalog["scene_count"], 13)
+        self.assertEqual(catalog["scene_count"], len(catalog["scenes"]))
+        office = next(scene for scene in catalog["scenes"] if scene["id"] == "office")
+        self.assertIn(office["origin"], {"preset", "customized"})
+        self.assertTrue(office["actions"])
+        self.assertIn("capability", office["actions"][0])
+        self.assertNotIn("command_flow", json.dumps(catalog, ensure_ascii=False))
+
+        preflight = urllib.request.Request(
+            f"{self.base_url}/n7/scenes",
+            method="OPTIONS",
+        )
+        with unauthenticated.open(preflight, timeout=3) as response:
+            self.assertEqual(response.status, 204)
+            self.assertEqual(response.headers["Access-Control-Allow-Origin"], "*")
+            self.assertIn("GET", response.headers["Access-Control-Allow-Methods"])
+
     def test_user_mode_delete_endpoint_removes_only_user_profiles(self) -> None:
         original_registry = self.service.mode_profiles
         with tempfile.TemporaryDirectory() as directory: