@allbluecn/web-app 0.3.0

package/src/server/__tests__/entitlements.license.test.ts

@@ -0,0 +1,203 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import {
+  requireFeature,
+  getEntitlements,
+  FeatureForbiddenError,
+} from '../entitlements'
+
+const services = vi.hoisted(() => new Map<string, unknown>())
+
+vi.mock('@/server/pro-services', () => ({
+  getProService: (key: string) => services.get(key) ?? null,
+  isProEdition: () => services.size > 0,
+}))
+
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: vi.fn(),
+}))
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    user: {
+      findUnique: vi.fn(),
+    },
+    workspace: {
+      findUnique: vi.fn(),
+      findFirst: vi.fn(),
+      count: vi.fn(),
+    },
+    plan: { findUnique: vi.fn(), findFirst: vi.fn() },
+  },
+}))
+
+vi.mock('@/server/entitlements-token-client', () => ({
+  readVerifiedEntitlements: vi.fn().mockResolvedValue(null),
+}))
+
+import { getProService } from '../pro-services'
+import { requireAuth } from '@/server/auth-helpers'
+import { prisma } from '@allbluecn/database'
+
+const licenseVerify = vi.fn()
+const billingGetEffectivePlan = vi.fn()
+
+function mockLicenseModule() {
+  services.set('license', {
+    verify: (...args: unknown[]) => licenseVerify(...args),
+  })
+}
+
+function mockSaasSessionAndWorkspace() {
+  ;(requireAuth as ReturnType<typeof vi.fn>).mockResolvedValue({
+    user: { id: 'u1' },
+  })
+  ;(prisma.user.findUnique as ReturnType<typeof vi.fn>).mockResolvedValue({
+    defaultWorkspaceId: 'ws1',
+  })
+  ;(prisma.workspace.findUnique as ReturnType<typeof vi.fn>).mockResolvedValue({
+    ownerId: 'u1',
+  })
+  services.set('billing', {
+    getEffectivePlan: (...args: unknown[]) => billingGetEffectivePlan(...args),
+  })
+}
+
+describe('requireFeature license 仲裁', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    services.set('hostedAi', {})
+    services.set('license', null)
+    services.set('billing', null)
+  })
+
+  it('not_activated（SaaS 未配 LICENSE_KEY）不拦截——落回 Subscription 仲裁后放行', async () => {
+    mockLicenseModule()
+    mockSaasSessionAndWorkspace()
+    licenseVerify.mockResolvedValue({
+      valid: false,
+      reason: 'not_activated',
+      license: null,
+      daysUntilExpiry: null,
+      inGracePeriod: false,
+    })
+    billingGetEffectivePlan.mockResolvedValue({
+      planName: 'pro',
+      features: { hostedAi: true },
+    })
+    await expect(requireFeature(undefined, 'hostedAi' as never)).resolves.toBeUndefined()
+    expect(licenseVerify).toHaveBeenCalledTimes(1)
+    expect(billingGetEffectivePlan).toHaveBeenCalledTimes(1)
+  })
+
+  it('license 有效且 features 含该功能 → 放行（不走 billing）', async () => {
+    mockLicenseModule()
+    licenseVerify.mockResolvedValue({
+      valid: true,
+      reason: 'ok',
+      license: { features: { hostedAi: true }, seats: 50 },
+      daysUntilExpiry: 100,
+      inGracePeriod: false,
+    })
+    await expect(requireFeature(undefined, 'hostedAi' as never)).resolves.toBeUndefined()
+    expect(billingGetEffectivePlan).not.toHaveBeenCalled()
+  })
+
+  it('license 有效但 features 不含该功能 → FeatureForbiddenError', async () => {
+    mockLicenseModule()
+    licenseVerify.mockResolvedValue({
+      valid: true,
+      reason: 'ok',
+      license: { features: {}, seats: 50 },
+      daysUntilExpiry: 100,
+      inGracePeriod: false,
+    })
+    await expect(requireFeature(undefined, 'hostedAi' as never)).rejects.toBeInstanceOf(
+      FeatureForbiddenError,
+    )
+  })
+
+  it('license 过期（reason: expired）→ FeatureForbiddenError（部署启用了 license）', async () => {
+    mockLicenseModule()
+    licenseVerify.mockResolvedValue({
+      valid: false,
+      reason: 'expired',
+      license: { features: { hostedAi: true }, seats: 50 },
+      daysUntilExpiry: 0,
+      inGracePeriod: false,
+    })
+    await expect(requireFeature(undefined, 'hostedAi' as never)).rejects.toBeInstanceOf(
+      FeatureForbiddenError,
+    )
+  })
+
+  it('oss tier 功能不走 license 仲裁（直接放行）', async () => {
+    mockLicenseModule()
+    await expect(requireFeature(undefined, 'byokAi' as never)).resolves.toBeUndefined()
+    expect(licenseVerify).not.toHaveBeenCalled()
+  })
+})
+
+describe('getEntitlements license 下发', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    services.set('hostedAi', {})
+    services.set('license', null)
+    services.set('billing', null)
+  })
+
+  it('license 有效 → source=license，enabled 取 license.features', async () => {
+    mockLicenseModule()
+    licenseVerify.mockResolvedValue({
+      valid: true,
+      reason: 'ok',
+      license: {
+        key: 'k',
+        customerName: 'c',
+        customerEmail: 'c@x.com',
+        plan: 'enterprise',
+        seats: 50,
+        features: { hostedAi: true },
+        issuedAt: new Date(),
+        expiresAt: null,
+      },
+      daysUntilExpiry: null,
+      inGracePeriod: false,
+    })
+    const result = await getEntitlements(undefined)
+    expect(result.source).toBe('license')
+    expect(result.planName).toBe('enterprise-license')
+    expect(result.enabled.hostedAi).toBe(true)
+  })
+
+  it('license 启用但无效（expired）→ source=license，全部功能锁定', async () => {
+    mockLicenseModule()
+    licenseVerify.mockResolvedValue({
+      valid: false,
+      reason: 'expired',
+      license: null,
+      daysUntilExpiry: 0,
+      inGracePeriod: false,
+    })
+    const result = await getEntitlements(undefined)
+    expect(result.source).toBe('license')
+    expect(Object.values(result.enabled).every((v) => v === false)).toBe(true)
+  })
+
+  it('not_activated → 不走 license 分支（SaaS：落回 subscription/oss-fallback）', async () => {
+    mockLicenseModule()
+    mockSaasSessionAndWorkspace()
+    licenseVerify.mockResolvedValue({
+      valid: false,
+      reason: 'not_activated',
+      license: null,
+      daysUntilExpiry: null,
+      inGracePeriod: false,
+    })
+    billingGetEffectivePlan.mockResolvedValue({
+      planName: 'pro',
+      features: {},
+    })
+    const result = await getEntitlements(undefined)
+    expect(result.source).toBe('subscription')
+  })
+})

package/src/server/__tests__/entitlements.test.ts

@@ -0,0 +1,187 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { requireFeature, FeatureUnavailableError, FeatureForbiddenError } from '../entitlements'
+
+const proSvc = vi.hoisted(() => ({}) as any)
+
+vi.mock('@/server/pro-services', () => ({
+  getProService: (key: string) => proSvc[key] ?? null,
+  isProEdition: () => Object.keys(proSvc).length > 0,
+}))
+
+vi.mock('@/server/auth-helpers', () => ({
+  requireAuth: vi.fn(),
+}))
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    user: {
+      findUnique: vi.fn(),
+    },
+    workspace: {
+      findUnique: vi.fn(),
+      findFirst: vi.fn(),
+    },
+  },
+}))
+
+vi.mock('@/server/entitlements-token-client', () => ({
+  readVerifiedEntitlements: vi.fn().mockResolvedValue(null),
+}))
+
+vi.mock('@allbluecn/shared', async (importOriginal) => {
+  const actual = await importOriginal()
+  return actual
+})
+
+import { getProService, isProEdition } from '../pro-services'
+import { requireAuth } from '@/server/auth-helpers'
+import { prisma } from '@allbluecn/database'
+
+const mockRequireAuth = requireAuth as ReturnType<typeof vi.fn>
+const mockUserFindUnique = prisma.user.findUnique as ReturnType<typeof vi.fn>
+const mockWorkspaceFindUnique = prisma.workspace.findUnique as ReturnType<typeof vi.fn>
+
+describe('requireFeature 三态门控', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    ;proSvc.hostedAi = null
+    ;proSvc.billing = null
+    mockUserFindUnique.mockReset()
+    mockWorkspaceFindUnique.mockReset()
+    mockUserFindUnique.mockResolvedValue({ defaultWorkspaceId: null })
+    mockWorkspaceFindUnique.mockResolvedValue(null)
+  })
+
+  it('oss tier 功能直接放行', async () => {
+    await expect(requireFeature(undefined, 'byokAi')).resolves.toBeUndefined()
+  })
+
+  it('模块不存在 → FeatureUnavailableError（unavailable 态）', async () => {
+    await expect(
+      requireFeature(undefined, 'hostedAi'),
+    ).rejects.toThrow(FeatureUnavailableError)
+  })
+
+  it('模块存在但无权益 → FeatureForbiddenError（locked 态）', async () => {
+    ;proSvc.hostedAi = {}
+    mockRequireAuth.mockResolvedValue({
+      user: { id: 'user-1' },
+    })
+
+    await expect(
+      requireFeature(undefined, 'hostedAi'),
+    ).rejects.toThrow(FeatureForbiddenError)
+  })
+
+  it('模块存在且订阅授权 → 放行（granted 态）', async () => {
+    ;proSvc.hostedAi = {}
+    ;proSvc.billing = {
+      getEffectivePlan: vi.fn().mockResolvedValue({
+        planName: 'pro',
+        features: {
+          byokAi: true,
+          hostedAi: true,
+          multiProvider: false,
+          versionHistory: false,
+          automation: false,
+          templates: false,
+          globalSearch: false,
+          analytics: false,
+          sso: false,
+          audit: false,
+          advancedPermissions: false,
+        },
+      }),
+    }
+
+    mockRequireAuth.mockResolvedValue({
+      user: { id: 'user-1' },
+    })
+
+    await expect(requireFeature(undefined, 'hostedAi')).resolves.toBeUndefined()
+    expect(proSvc.billing.getEffectivePlan)
+      .toHaveBeenCalledWith('user-1')
+  })
+
+  it('无 workspace 用户也能解析 plan（getEffectivePlan 直接用 userId）', async () => {
+    ;proSvc.hostedAi = {}
+    ;proSvc.billing = {
+      getEffectivePlan: vi.fn().mockResolvedValue({
+        planName: 'pro',
+        features: {
+          byokAi: true,
+          hostedAi: true,
+          multiProvider: true,
+          largePageSize: true,
+          versionHistory: true,
+          automation: true,
+          templates: false,
+          globalSearch: false,
+          analytics: false,
+          sso: false,
+          audit: false,
+          advancedPermissions: false,
+          customAgents: true,
+        },
+      }),
+    }
+
+    mockRequireAuth.mockResolvedValue({ user: { id: 'user-1' } })
+    mockUserFindUnique.mockResolvedValue({ defaultWorkspaceId: null })
+    mockWorkspaceFindUnique.mockResolvedValue(null)
+
+    await expect(requireFeature(undefined, 'hostedAi')).resolves.toBeUndefined()
+    expect(proSvc.billing.getEffectivePlan)
+      .toHaveBeenCalledWith('user-1')
+  })
+
+  it('byokAi (oss tier) 无需模块存在性检查', async () => {
+    await expect(requireFeature(undefined, 'byokAi')).resolves.toBeUndefined()
+  })
+
+  it('largePageSize (module null) OSS 部署 → FeatureForbiddenError', async () => {
+    await expect(
+      requireFeature(undefined, 'largePageSize'),
+    ).rejects.toThrow(FeatureForbiddenError)
+  })
+
+  it('largePageSize locked 用户（features 无权益）→ FeatureForbiddenError', async () => {
+    ;proSvc.billing = {
+      getEffectivePlan: vi.fn().mockResolvedValue({
+        planName: 'free',
+        features: {
+          byokAi: true,
+          largePageSize: false,
+        },
+      }),
+    }
+    mockRequireAuth.mockResolvedValue({
+      user: { id: 'user-1' },
+    })
+
+    await expect(
+      requireFeature(undefined, 'largePageSize'),
+    ).rejects.toThrow(FeatureForbiddenError)
+    expect(proSvc.billing.getEffectivePlan)
+      .toHaveBeenCalledWith('user-1')
+  })
+
+  it('largePageSize granted 用户 → 放行', async () => {
+    ;proSvc.billing = {
+      getEffectivePlan: vi.fn().mockResolvedValue({
+        planName: 'pro',
+        features: {
+          byokAi: true,
+          largePageSize: true,
+        },
+      }),
+    }
+    mockRequireAuth.mockResolvedValue({
+      user: { id: 'user-1' },
+    })
+
+    await expect(requireFeature(undefined, 'largePageSize')).resolves.toBeUndefined()
+    expect(proSvc.billing.getEffectivePlan)
+      .toHaveBeenCalledWith('user-1')
+  })
+})

package/src/server/__tests__/license-routes-oss.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/server/pro-services', () => ({
+  getProService: () => null,
+  isProEdition: () => false,
+}))
+
+import { Route as activateRoute } from '@/routes/api/license/activate/route'
+import { Route as heartbeatRoute } from '@/routes/api/license/heartbeat/route'
+
+type Handler = (ctx: { request: Request }) => Promise<Response>
+
+const activateHandler = ((activateRoute as unknown) as {
+  options: { server: { handlers: { POST: Handler } } }
+}).options.server.handlers.POST
+
+const heartbeatHandler = ((heartbeatRoute as unknown) as {
+  options: { server: { handlers: { POST: Handler } } }
+}).options.server.handlers.POST
+
+describe('OSS 部署（license 模块不存在）', () => {
+  it('activate → 404', async () => {
+    const res = await activateHandler({
+      request: new Request('http://l/', { method: 'POST' }),
+    })
+    expect(res.status).toBe(404)
+  })
+
+  it('heartbeat → 404', async () => {
+    const res = await heartbeatHandler({
+      request: new Request('http://l/', { method: 'POST' }),
+    })
+    expect(res.status).toBe(404)
+  })
+})

package/src/server/__tests__/license-routes.test.ts

@@ -0,0 +1,105 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const licenseActivate = vi.fn()
+const licenseHeartbeat = vi.fn()
+
+const licenseSvc = vi.hoisted(() => ({
+  activate: (...args: unknown[]) => licenseActivate(...args),
+  verify: vi.fn(),
+  revoke: vi.fn(),
+  heartbeat: (...args: unknown[]) => licenseHeartbeat(...args),
+}))
+
+vi.mock('@/server/pro-services', () => ({
+  getProService: (key: string) => (key === 'license' ? licenseSvc : null),
+  isProEdition: () => true,
+}))
+
+import { Route as activateRoute } from '@/routes/api/license/activate/route'
+import { Route as heartbeatRoute } from '@/routes/api/license/heartbeat/route'
+
+function post(body: unknown): Request {
+  return new Request('http://localhost/api/license/x', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  })
+}
+
+type Handler = (ctx: { request: Request }) => Promise<Response>
+
+const activateHandler = ((activateRoute as unknown) as {
+  options: { server: { handlers: { POST: Handler } } }
+}).options.server.handlers.POST
+
+const heartbeatHandler = ((heartbeatRoute as unknown) as {
+  options: { server: { handlers: { POST: Handler } } }
+}).options.server.handlers.POST
+
+describe('POST /api/license/activate', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('合法请求 → 透传 license.activate 结果', async () => {
+    licenseActivate.mockResolvedValue({
+      success: true,
+      message: '激活成功',
+      instanceId: 'i1',
+    })
+    const res = await activateHandler({
+      request: post({ key: 'k.sig', fingerprint: 'fp' }),
+    })
+    expect(res.status).toBe(200)
+    expect(await res.json()).toMatchObject({
+      success: true,
+      instanceId: 'i1',
+    })
+    expect(licenseActivate).toHaveBeenCalledWith('k.sig', 'fp')
+  })
+
+  it('缺 key 或 fingerprint → 400', async () => {
+    const res = await activateHandler({ request: post({ key: '' }) })
+    expect(res.status).toBe(400)
+    expect(licenseActivate).not.toHaveBeenCalled()
+  })
+
+  it('激活失败 → 400 + message', async () => {
+    licenseActivate.mockResolvedValue({
+      success: false,
+      message: '已达席位上限 (50)',
+    })
+    const res = await activateHandler({
+      request: post({ key: 'k.sig', fingerprint: 'fp' }),
+    })
+    expect(res.status).toBe(400)
+    expect(await res.json()).toMatchObject({
+      success: false,
+      message: '已达席位上限 (50)',
+    })
+  })
+})
+
+describe('POST /api/license/heartbeat', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('带 instanceId → 200', async () => {
+    licenseHeartbeat.mockResolvedValue({ ok: true, revoked: false })
+    const res = await heartbeatHandler({
+      request: post({ instanceId: 'i1' }),
+    })
+    expect(res.status).toBe(200)
+    expect(licenseHeartbeat).toHaveBeenCalledWith('i1')
+  })
+
+  it('缺 instanceId → 400', async () => {
+    const res = await heartbeatHandler({ request: post({}) })
+    expect(res.status).toBe(400)
+  })
+
+  it('吊销实例 → 410', async () => {
+    licenseHeartbeat.mockResolvedValue({ ok: false, revoked: true })
+    const res = await heartbeatHandler({
+      request: post({ instanceId: 'i1' }),
+    })
+    expect(res.status).toBe(410)
+  })
+})

package/src/server/__tests__/permissions.test.ts

@@ -0,0 +1,69 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const fakePermissionsService = vi.hoisted(() => () => ({
+  checkPermission: vi.fn(),
+  listRoles: vi.fn(),
+  createRole: vi.fn(),
+  updateRole: vi.fn(),
+  deleteRole: vi.fn(),
+}))
+
+vi.mock('@/server/pro-services', () => ({
+  getProService: vi.fn((key: string) =>
+    key === 'permissions' ? fakePermissionsService() : null,
+  ),
+  isProEdition: () => true,
+}))
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    roleAssignment: { count: vi.fn() },
+    user: { findUnique: vi.fn() },
+  },
+}))
+
+const { getProService } = await import('../pro-services')
+const { prisma } = await import('@allbluecn/database')
+const { requirePermission, PermissionForbiddenError } = await import('../permissions')
+
+describe('requirePermission', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('permissions 服务为 null（OSS）直接放行', async () => {
+    vi.mocked(getProService).mockReturnValueOnce(null)
+    try {
+      await expect(requirePermission('u1', 'knowledge', 'write')).resolves.toBeUndefined()
+    } finally {
+      vi.mocked(getProService).mockReturnValue(fakePermissionsService() as never)
+    }
+  })
+
+  it('无 RoleAssignment 时回退 User.role（ADMIN → admin 放行）', async () => {
+    vi.mocked(prisma.roleAssignment.count).mockResolvedValue(0)
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({ role: 'ADMIN' } as never)
+    await expect(requirePermission('u1', 'knowledge', 'write')).resolves.toBeUndefined()
+    expect(getProService('permissions')!.checkPermission).not.toHaveBeenCalled()
+  })
+
+  it('无 RoleAssignment 时普通 USER 回退 write（admin 级要求被拒）', async () => {
+    vi.mocked(prisma.roleAssignment.count).mockResolvedValue(0)
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({ role: 'USER' } as never)
+    await expect(
+      requirePermission('u1', 'member', 'remove', 'admin'),
+    ).rejects.toBeInstanceOf(PermissionForbiddenError)
+  })
+
+  it('有角色且 checkPermission 返回 admin → 放行', async () => {
+    vi.mocked(prisma.roleAssignment.count).mockResolvedValue(2)
+    vi.mocked(getProService('permissions')!.checkPermission).mockResolvedValue('admin')
+    await expect(requirePermission('u1', 'knowledge', 'write')).resolves.toBeUndefined()
+  })
+
+  it('有角色但 checkPermission 返回 none → 拒绝', async () => {
+    vi.mocked(prisma.roleAssignment.count).mockResolvedValue(1)
+    vi.mocked(getProService('permissions')!.checkPermission).mockResolvedValue('none')
+    await expect(requirePermission('u1', 'knowledge', 'write')).rejects.toMatchObject({
+      name: 'PermissionForbiddenError',
+    })
+  })
+})

package/src/server/__tests__/pro-services.test.ts

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import { describe, it, expect, vi } from 'vitest'
+
+const { mockPlugins } = vi.hoisted(() => ({
+  mockPlugins: [] as Array<{ id: string; version: string; contributes: Record<string, unknown> }>,
+}))
+
+vi.mock('@/plugins/plugins.gen', () => ({
+  profile: {
+    id: 'oss',
+    plugins: mockPlugins,
+  },
+}))
+
+import { getProService, isProEdition } from '../pro-services'
+
+describe('getProService', () => {
+  it('命中贡献的 service', () => {
+    mockPlugins.push({
+      id: '@allblue-pro/billing',
+      version: '0.1.0',
+      contributes: {
+        services: { billing: { getEffectivePlan: vi.fn() } },
+      },
+    })
+    expect(getProService('billing')).toBeTypeOf('object')
+    mockPlugins.length = 0
+  })
+  it('未贡献的 feature 返回 null（OSS 降级路径）', () => {
+    expect(getProService('sso')).toBeNull()
+  })
+  it('无任何 service 贡献时返回 null', () => {
+    mockPlugins.push({
+      id: '@allbluecn/tags',
+      version: '0.0.0',
+      contributes: { routes: [] },
+    })
+    expect(getProService('billing')).toBeNull()
+    mockPlugins.length = 0
+  })
+})
+
+describe('isProEdition', () => {
+  it('有 service 贡献时为 true', () => {
+    mockPlugins.push({
+      id: '@allblue-pro/billing',
+      version: '0.1.0',
+      contributes: { services: { billing: {} } },
+    })
+    expect(isProEdition()).toBe(true)
+    mockPlugins.length = 0
+  })
+  it('无任何 service 贡献时为 false', () => {
+    mockPlugins.push({
+      id: '@allbluecn/tags',
+      version: '0.0.0',
+      contributes: { routes: [] },
+    })
+    expect(isProEdition()).toBe(false)
+    mockPlugins.length = 0
+  })
+})