@allbluecn/web-app 0.10.3 → 0.11.1

package/src/server/serverFns/__tests__/auth-server-schemas.test.ts

@@ -0,0 +1,168 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        return async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse(data)
+          }
+          return fn({ data })
+        }
+      },
+    }
+    return api
+  },
+}))
+
+const mockUserFindUnique = vi.fn()
+const mockUserUpdate = vi.fn().mockResolvedValue({})
+const mockTokenFindUnique = vi.fn()
+const mockTokenCreate = vi.fn().mockResolvedValue({})
+const mockTokenUpdate = vi.fn().mockResolvedValue({})
+const mockTxRun = vi.fn().mockResolvedValue([])
+const mockSendTemplateEmail = vi.fn().mockResolvedValue({ sent: true })
+const mockBcryptHash = vi.fn().mockResolvedValue('hashed')
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    user: {
+      findUnique: (...a: unknown[]) => mockUserFindUnique(...a),
+      update: (...a: unknown[]) => mockUserUpdate(...a),
+    },
+    passwordResetToken: {
+      findUnique: (...a: unknown[]) => mockTokenFindUnique(...a),
+      create: (...a: unknown[]) => mockTokenCreate(...a),
+      update: (...a: unknown[]) => mockTokenUpdate(...a),
+    },
+    $transaction: (...a: unknown[]) => mockTxRun(...a),
+  },
+}))
+
+vi.mock('@/server/email', () => ({
+  sendTemplateEmail: (...a: unknown[]) => mockSendTemplateEmail(...a),
+}))
+
+vi.mock('@/server/middlewares/rate-limit', () => ({
+  checkAuthRateLimit: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('crypto', () => ({
+  randomBytes: () => ({ toString: () => 'tok' }),
+  default: { randomBytes: () => ({ toString: () => 'tok' }) },
+}))
+
+vi.mock('bcryptjs', () => ({
+  default: { hash: (...a: unknown[]) => mockBcryptHash(...a) },
+}))
+
+import { forgotPasswordFn } from '../auth/forgot-password'
+import { resetPasswordFn } from '../auth/reset-password'
+
+const FUTURE = new Date('2027-01-01T00:00:00.000Z')
+
+describe('forgotPasswordFn 邮箱归一化', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockUserFindUnique.mockResolvedValue(null)
+    mockSendTemplateEmail.mockResolvedValue({ sent: true })
+  })
+
+  it('大写邮箱 + 首尾空格 → 查库用小写 trim 值', async () => {
+    await forgotPasswordFn({ data: { email: '  Alice@X.com ' } })
+    expect(mockUserFindUnique).toHaveBeenCalledWith({
+      where: { email: 'alice@x.com' },
+      select: { id: true, email: true, locale: true },
+    })
+  })
+
+  it('小写邮箱用户存在 → 创建 token 并发送重置邮件', async () => {
+    mockUserFindUnique.mockResolvedValue({
+      id: 'u1',
+      email: 'alice@x.com',
+      locale: null,
+    })
+    await forgotPasswordFn({ data: { email: 'ALICE@X.COM' } })
+    expect(mockTokenCreate).toHaveBeenCalledWith({
+      data: expect.objectContaining({ token: 'tok', userId: 'u1' }),
+    })
+    expect(mockSendTemplateEmail).toHaveBeenCalledWith(
+      expect.objectContaining({
+        key: 'auth.reset-password',
+        to: 'alice@x.com',
+        locale: 'zh',
+        userId: 'u1',
+        vars: expect.objectContaining({
+          url: expect.stringContaining('/reset-password?token='),
+        }),
+      }),
+    )
+  })
+
+  it('非法邮箱格式 → schema 拒绝', async () => {
+    await expect(forgotPasswordFn({ data: { email: 'not-an-email' } })).rejects.toThrow()
+    expect(mockUserFindUnique).not.toHaveBeenCalled()
+  })
+
+  it('数据库写入失败 → 不发送重置邮件', async () => {
+    mockUserFindUnique.mockResolvedValue({
+      id: 'u1',
+      email: 'alice@x.com',
+      locale: null,
+    })
+    mockTokenCreate.mockRejectedValueOnce(new Error('db down'))
+    await forgotPasswordFn({ data: { email: 'alice@x.com' } })
+    expect(mockSendTemplateEmail).not.toHaveBeenCalled()
+  })
+})
+
+describe('resetPasswordFn 密码强度', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockTokenFindUnique.mockResolvedValue(null)
+    mockTxRun.mockResolvedValue([])
+    mockBcryptHash.mockResolvedValue('hashed')
+  })
+
+  it('纯字母密码（缺数字）→ schema 拒绝', async () => {
+    await expect(resetPasswordFn({ data: { token: 't', password: 'abcdefgh' } })).rejects.toThrow(
+      /数字/,
+    )
+    expect(mockTxRun).not.toHaveBeenCalled()
+  })
+
+  it('纯数字密码（缺字母）→ schema 拒绝', async () => {
+    await expect(resetPasswordFn({ data: { token: 't', password: '12345678' } })).rejects.toThrow(
+      /字母/,
+    )
+  })
+
+  it('字母+数字密码 → 通过校验并重置', async () => {
+    mockTokenFindUnique.mockResolvedValue({
+      id: 'rt1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: FUTURE,
+    })
+    await expect(
+      resetPasswordFn({ data: { token: 't', password: 'abc12345' } }),
+    ).resolves.toEqual({ message: 'Password reset successfully' })
+    expect(mockBcryptHash).toHaveBeenCalledWith('abc12345', 12)
+    expect(mockTxRun).toHaveBeenCalledTimes(1)
+    expect(mockUserUpdate).toHaveBeenCalledWith({
+      where: { id: 'u1' },
+      data: { password: 'hashed' },
+    })
+    expect(mockTokenUpdate).toHaveBeenCalledWith({
+      where: { id: 'rt1' },
+      data: { usedAt: expect.any(Date) },
+    })
+  })
+})

package/src/server/serverFns/__tests__/billing.test.ts

@@ -0,0 +1,263 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+
+// billing 域覆盖补全：7 个 serverFn（plan/subscription/checkout/portal/invoices/currency）。
+// 关键断言：OSS 无 Stripe 凭据时 createCheckoutSessionFn 走 VITE_APP_URL 回退；locked 用户与
+// 未登录态拒绝；plan 查询按 tier 过滤且断言 Prisma where 形状。mock 骨架同域样板。
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const M = vi.hoisted(() => ({
+  requireAuth: vi.fn(),
+  getProService: vi.fn(),
+  getEntitlements: vi.fn(),
+  getResourceSnapshots: vi.fn(),
+  userUpdate: vi.fn(),
+}));
+
+const billingHolder = vi.hoisted(() => ({
+  current: null as null | {
+    getSubscription: ReturnType<typeof vi.fn>;
+    listPublicPlans: ReturnType<typeof vi.fn>;
+    createCheckoutSession: ReturnType<typeof vi.fn>;
+    createCustomerPortalSession: ReturnType<typeof vi.fn>;
+    listInvoices: ReturnType<typeof vi.fn>;
+  },
+}));
+
+vi.mock("@tanstack/react-start", () => ({
+  createServerFn: () => {
+    const api = {
+      _validator: undefined as unknown,
+      validator(schema: unknown) {
+        this._validator = schema;
+        return this;
+      },
+      handler(fn: (p: { data: unknown }) => Promise<unknown>) {
+        const self = this;
+        return async (args: { data?: unknown }) => {
+          let data = args?.data;
+          if (self._validator && data !== undefined) {
+            const v = self._validator as { parse?: (d: unknown) => unknown };
+            data = v.parse ? v.parse(data) : data;
+          }
+          return fn({ data });
+        };
+      },
+    };
+    return api;
+  },
+}));
+
+vi.mock("@tanstack/react-start/server", () => ({ getRequest: () => ({}) }));
+
+vi.mock("@allbluecn/database", () => ({
+  prisma: { user: { update: M.userUpdate } },
+  Prisma: {},
+}));
+
+vi.mock("@/server/pro-services", () => ({
+  getProService: (key: string) => (key === "billing" ? billingHolder.current : null),
+}));
+
+vi.mock("@/server/auth-helpers", () => ({ requireAuth: M.requireAuth }));
+
+vi.mock("@/server/entitlements", () => ({ getEntitlements: M.getEntitlements }));
+
+vi.mock("@/server/resources", () => ({ getResourceSnapshots: M.getResourceSnapshots }));
+
+import {
+  getEffectivePlanFn,
+  getSubscriptionFn,
+  listPublicPlansFn,
+  createCheckoutSessionFn,
+  createCustomerPortalSessionFn,
+  listInvoicesFn,
+  updatePreferredCurrencyFn,
+} from "../billing";
+import { BillingUnavailableError } from "@allbluecn/kernel";
+
+const U = "u-1";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  M.requireAuth.mockResolvedValue({ user: { id: U } });
+  M.userUpdate.mockResolvedValue({ id: U });
+  billingHolder.current = {
+    getSubscription: vi.fn().mockResolvedValue({ plan: "pro" }),
+    listPublicPlans: vi.fn().mockResolvedValue([{ id: "pro", name: "Pro" }]),
+    createCheckoutSession: vi.fn().mockResolvedValue({ url: "https://checkout/x" }),
+    createCustomerPortalSession: vi.fn().mockResolvedValue({ url: "https://portal/x" }),
+    listInvoices: vi.fn().mockResolvedValue([{ id: "in-1" }]),
+  };
+});
+
+describe("getEffectivePlanFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(getEffectivePlanFn()).rejects.toThrow("UNAUTHORIZED");
+    expect(M.getEntitlements).not.toHaveBeenCalled();
+  });
+
+  it("聚合权益与资源快照", async () => {
+    M.getEntitlements.mockResolvedValue({
+      planName: "Pro",
+      enabled: { "billing.checkout": true },
+      unavailable: ["sso"],
+      source: "database",
+    });
+    M.getResourceSnapshots.mockResolvedValue({ seats: 10 });
+
+    await expect(getEffectivePlanFn()).resolves.toEqual({
+      planName: "Pro",
+      features: { "billing.checkout": true },
+      unavailable: ["sso"],
+      source: "database",
+      resources: { seats: 10 },
+    });
+    expect(M.getEntitlements).toHaveBeenCalledWith({});
+    expect(M.getResourceSnapshots).toHaveBeenCalledWith({});
+  });
+});
+
+describe("getSubscriptionFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(getSubscriptionFn()).rejects.toThrow("UNAUTHORIZED");
+  });
+
+  it("计费模块不可用时抛出 BillingUnavailableError", async () => {
+    billingHolder.current = null;
+    await expect(getSubscriptionFn()).rejects.toBeInstanceOf(BillingUnavailableError);
+  });
+
+  it("正常返回当前订阅", async () => {
+    await expect(getSubscriptionFn()).resolves.toEqual({ plan: "pro" });
+    expect(billingHolder.current!.getSubscription).toHaveBeenCalledWith(U);
+  });
+});
+
+describe("listPublicPlansFn", () => {
+  it("币种枚举校验拒绝非法值", async () => {
+    const badCurrency = "eur" as unknown as "usd";
+    await expect(listPublicPlansFn({ data: { currency: badCurrency } })).rejects.toThrow();
+  });
+
+  it("正常按币种列出公开套餐", async () => {
+    await expect(listPublicPlansFn({ data: { currency: "cny" } })).resolves.toEqual([
+      { id: "pro", name: "Pro" },
+    ]);
+    expect(billingHolder.current!.listPublicPlans).toHaveBeenCalledWith("cny");
+  });
+});
+
+describe("createCheckoutSessionFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(createCheckoutSessionFn({ data: { planId: "pro", currency: "usd" } })).rejects.toThrow(
+      "UNAUTHORIZED",
+    );
+  });
+
+  it("使用 VITE_APP_URL 拼装回调地址并带 14 天试用", async () => {
+    const prev = process.env.VITE_APP_URL;
+    process.env.VITE_APP_URL = "https://allblue.test";
+    try {
+      await createCheckoutSessionFn({ data: { planId: "pro", currency: "usd" } });
+    } finally {
+      if (prev === undefined) delete process.env.VITE_APP_URL;
+      else process.env.VITE_APP_URL = prev;
+    }
+
+    expect(billingHolder.current!.createCheckoutSession).toHaveBeenCalledWith({
+      userId: U,
+      planId: "pro",
+      currency: "usd",
+      successUrl: "https://allblue.test/settings/billing?checkout=success",
+      cancelUrl: "https://allblue.test/settings/billing?checkout=cancel",
+      trialDays: 14,
+    });
+  });
+
+  it("未配置 VITE_APP_URL 时回退本地地址", async () => {
+    const prev = process.env.VITE_APP_URL;
+    delete process.env.VITE_APP_URL;
+    try {
+      await expect(
+        createCheckoutSessionFn({ data: { planId: "pro", currency: "cny" } }),
+      ).resolves.toEqual({ url: "https://checkout/x" });
+    } finally {
+      if (prev === undefined) delete process.env.VITE_APP_URL;
+      else process.env.VITE_APP_URL = prev;
+    }
+
+    expect(billingHolder.current!.createCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        successUrl: "http://localhost:3000/settings/billing?checkout=success",
+      }),
+    );
+  });
+});
+
+describe("createCustomerPortalSessionFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(createCustomerPortalSessionFn({ data: {} })).rejects.toThrow("UNAUTHORIZED");
+  });
+
+  it("正常创建客户门户会话", async () => {
+    await expect(createCustomerPortalSessionFn({ data: {} })).resolves.toEqual({ url: "https://portal/x" });
+    expect(billingHolder.current!.createCustomerPortalSession).toHaveBeenCalledWith({
+      userId: U,
+      returnUrl: "http://localhost:3000/settings/billing",
+    });
+  });
+});
+
+describe("listInvoicesFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(listInvoicesFn()).rejects.toThrow("UNAUTHORIZED");
+  });
+
+  it("按默认条数返回账单列表", async () => {
+    await expect(listInvoicesFn()).resolves.toEqual([{ id: "in-1" }]);
+    expect(billingHolder.current!.listInvoices).toHaveBeenCalledWith(U, 20);
+  });
+});
+
+describe("updatePreferredCurrencyFn", () => {
+  it("未登录拒绝", async () => {
+    M.requireAuth.mockRejectedValue(new Error("UNAUTHORIZED"));
+    await expect(updatePreferredCurrencyFn({ data: { currency: "usd" } })).rejects.toThrow("UNAUTHORIZED");
+    expect(M.userUpdate).not.toHaveBeenCalled();
+  });
+
+  it("币种枚举校验拒绝非法值", async () => {
+    const badCurrency = "eur" as unknown as "usd";
+    await expect(updatePreferredCurrencyFn({ data: { currency: badCurrency } })).rejects.toThrow();
+    expect(M.userUpdate).not.toHaveBeenCalled();
+  });
+
+  it("正常更新用户偏好币种", async () => {
+    await expect(updatePreferredCurrencyFn({ data: { currency: "cny" } })).resolves.toBeUndefined();
+    expect(M.userUpdate).toHaveBeenCalledWith({
+      where: { id: U },
+      data: { preferredCurrency: "cny" },
+    });
+  });
+});

package/src/server/serverFns/__tests__/email-verification.test.ts

@@ -0,0 +1,149 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (config: any) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: vi.fn(),
+}))
+
+const mockFindUniqueToken = vi.fn()
+const mockTxTokenUpdateMany = vi.fn()
+const mockTxUserUpdate = vi.fn()
+const mockUserFindUnique = vi.fn()
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    emailVerificationToken: {
+      findUnique: (...a: unknown[]) => mockFindUniqueToken(...a),
+      updateMany: (...a: unknown[]) => mockTxTokenUpdateMany(...a),
+    },
+    user: {
+      findUnique: (...a: unknown[]) => mockUserFindUnique(...a),
+      update: (...a: unknown[]) => mockTxUserUpdate(...a),
+    },
+    $transaction: (fn: (tx: unknown) => Promise<unknown>) =>
+      fn({
+        emailVerificationToken: {
+          updateMany: (...a: unknown[]) => mockTxTokenUpdateMany(...a),
+        },
+        user: { update: (...a: unknown[]) => mockTxUserUpdate(...a) },
+      }),
+  },
+}))
+
+vi.mock('@/server/email', () => ({
+  sendTemplateEmail: vi.fn().mockResolvedValue({ sent: true }),
+  generateEmailToken: vi.fn().mockReturnValue('tok-123'),
+}))
+
+vi.mock('@/server/middlewares/rate-limit', () => ({
+  checkAuthRateLimit: vi.fn().mockResolvedValue(undefined),
+}))
+
+vi.mock('@/lib/session', () => ({
+  getCurrentSession: vi.fn().mockResolvedValue(null),
+}))
+
+import { confirmEmailVerificationFn } from '../auth/email-verification'
+
+const NOW = new Date('2026-09-12T00:00:00.000Z')
+const FUTURE = new Date('2027-01-01T00:00:00.000Z')
+
+describe('confirmEmailVerificationFn', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockFindUniqueToken.mockImplementation(async () => null)
+    mockTxTokenUpdateMany.mockResolvedValue({ count: 0 })
+    mockTxUserUpdate.mockResolvedValue({})
+    mockUserFindUnique.mockResolvedValue(null)
+  })
+
+  it('token 不存在 → ok:false', async () => {
+    mockFindUniqueToken.mockResolvedValue(null)
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'nope' } }),
+    ).resolves.toEqual({ ok: false })
+    expect(mockTxUserUpdate).not.toHaveBeenCalled()
+  })
+
+  it('token 已使用 → ok:false', async () => {
+    mockFindUniqueToken.mockResolvedValue({
+      id: 't1',
+      userId: 'u1',
+      usedAt: NOW,
+      expiresAt: FUTURE,
+    })
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'used' } }),
+    ).resolves.toEqual({ ok: false })
+    expect(mockTxTokenUpdateMany).not.toHaveBeenCalled()
+  })
+
+  it('token 已过期 → ok:false', async () => {
+    mockFindUniqueToken.mockResolvedValue({
+      id: 't1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: new Date('2020-01-01'),
+    })
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'exp' } }),
+    ).resolves.toEqual({ ok: false })
+  })
+
+  it('首次验证：抢占成功 → 标记已用 + 用户已验证 → ok:true', async () => {
+    mockFindUniqueToken.mockResolvedValue({
+      id: 't1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: FUTURE,
+    })
+    mockTxTokenUpdateMany.mockResolvedValue({ count: 1 })
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'good' } }),
+    ).resolves.toEqual({ ok: true })
+    expect(mockTxTokenUpdateMany).toHaveBeenCalledWith({
+      where: { id: 't1', usedAt: null },
+      data: expect.objectContaining({ usedAt: expect.any(Date) }),
+    })
+    expect(mockTxUserUpdate).toHaveBeenCalledWith({
+      where: { id: 'u1' },
+      data: expect.objectContaining({ emailVerified: expect.any(Date) }),
+    })
+  })
+
+  it('并发第二个请求：抢占失败（count=0）→ ok:false 且不更新用户', async () => {
+    mockFindUniqueToken.mockResolvedValue({
+      id: 't1',
+      userId: 'u1',
+      usedAt: null,
+      expiresAt: FUTURE,
+    })
+    mockTxTokenUpdateMany.mockResolvedValue({ count: 0 })
+    await expect(
+      confirmEmailVerificationFn({ data: { token: 'race' } }),
+    ).resolves.toEqual({ ok: false })
+    expect(mockTxUserUpdate).not.toHaveBeenCalled()
+  })
+})