@autional-cn/shared 0.1.0-rc.2 → 0.1.0-rc.4

package/src/components/TenantRootRedirect.tsx

@@ -1,6 +1,7 @@
 import { useEffect, useMemo } from 'react';
 import { useCurrentTenantId } from '../hooks/useAuth';
 import { getPortalUrl } from '../config';
+import { traceRedirect } from '../auth/auth-trace';
 import { usePublicTenantSlugs } from './TenantIndexGuard';
 
 /**
@@ -29,7 +30,7 @@ export function TenantRootRedirect() {
 		if (typeof window === 'undefined') return;
 		if (slug) {
 			const base = window.location.pathname.replace(/\/+$/, '');
-			window.location.replace(`${base}/${slug}/`);
+			traceRedirect(`${base}/${slug}/`, { reason: 'funnel-slug' });
 			return;
 		}
 		// 有会话但公开名单尚未返回：等待（名单是 slug 唯一权威，不得抢跑漏斗 brand）。
@@ -38,7 +39,7 @@ export function TenantRootRedirect() {
 		const target = `${getPortalUrl('brand')}/?redirect=${encodeURIComponent(
 			window.location.origin + window.location.pathname,
 		)}`;
-		window.location.replace(target);
+		traceRedirect(target, { reason: 'funnel-brand' });
 	}, [slug, currentTenantId, tenantsLoaded]);
 
 	return null;

package/src/components/__tests__/RequireAuth.test.tsx

@@ -55,8 +55,33 @@ import { getPortalUrl } from '../../config';
 
 const originalWindowLocation = window.location;
 
+/**
+ * 每例取全新模块实例：auth-trace 的模块级重入抑制（pending）与「停留」复位
+ * 是同页语义，跨用例泄漏会让后续 interstitial 被静默抑制（假红/假绿）。
+ */
+async function freshRequireAuth() {
+	vi.resetModules();
+	const mod = await import('../RequireAuth');
+	return mod.RequireAuth;
+}
+
+/** authTrace 的提示条/确认页挂在 document.body（非 React 树），手动清理防跨用例残留。 */
+function cleanupAuthTraceNodes() {
+	document.getElementById('auth-trace-notice')?.remove();
+	document.getElementById('auth-trace-confirm')?.remove();
+}
+
+function clickGoNow(): void {
+	const btn = Array.from(document.querySelectorAll<HTMLButtonElement>('#auth-trace-notice button')).find(
+		(b) => b.textContent === '立即前往',
+	);
+	expect(btn).toBeTruthy();
+	btn!.click();
+}
+
 beforeEach(() => {
 	vi.clearAllMocks();
+	document.documentElement.lang = 'zh-CN';
 	mockState.machineStatus = 'unauthenticated';
 	mockState.tenantRoute = {
 		slug: null,
@@ -85,22 +110,30 @@ afterEach(() => {
 	}
 	// vitest globals 未开启 ⇒ RTL 不会自动 cleanup，手动清理防跨用例 DOM 污染
 	cleanup();
+	cleanupAuthTraceNodes();
 });
 
 describe('RequireAuth 未登录出口', () => {
-	it('无可用 client_id → 跳 auth 登录页并带 from_requireauth=1', async () => {
+	it('无可用 client_id → 提示条（可停留）后跳 auth 登录页并带 from_requireauth=1', async () => {
+		const RequireAuthFresh = await freshRequireAuth();
+
 		render(
-			<RequireAuth>
+			<RequireAuthFresh>
 				<div>protected</div>
-			</RequireAuth>,
+			</RequireAuthFresh>,
 		);
 
+		// 层①：被动弹登录先出提示条（不再静默整页弹走）
+		await waitFor(() => expect(document.getElementById('auth-trace-notice')).toBeTruthy());
+		clickGoNow();
+
 		await waitFor(() => {
 			expect(mockState.replace).toHaveBeenCalled();
 		});
 		const url = String(mockState.replace.mock.calls[0][0]);
 		expect(url).toContain('from_requireauth=1');
 		expect(url).toContain('redirect=');
+		expect(url).toContain('rt=localhost.unauthenticated.');
 		expect(url.startsWith(getPortalUrl('auth'))).toBe(true);
 		expect(mockState.initiate).not.toHaveBeenCalled();
 	});
@@ -230,12 +263,16 @@ describe('RequireAuth F-W6 确定性 404 闸门', () => {
 
 	it('非 unknownSlug（网络错误 fail-open）→ 维持原漏斗（回归锁）', async () => {
 		// 默认 tenantRoute: notFound=true, unknownSlug=false —— 即 by-slug 网络错误场景
+		const RequireAuthFresh = await freshRequireAuth();
+
 		render(
-			<RequireAuth notFound={<div data-testid="tenant-404">no such tenant</div>}>
+			<RequireAuthFresh notFound={<div data-testid="tenant-404">no such tenant</div>}>
 				<div>protected</div>
-			</RequireAuth>,
+			</RequireAuthFresh>,
 		);
 
+		await waitFor(() => expect(document.getElementById('auth-trace-notice')).toBeTruthy());
+		clickGoNow();
 		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
 		const url = String(mockState.replace.mock.calls[0][0]);
 		expect(url).toContain('from_requireauth=1');

package/src/components/__tests__/TenantRootRedirect.test.tsx

@@ -58,6 +58,13 @@ function expectedBrandFunnel() {
 	)}`;
 }
 
+/** 剥除 authTrace 面包屑（rt=）后比较；rt 装饰本身由专门断言锁定。 */
+function withoutRt(url: string): string {
+	const u = new URL(url, 'http://trace.invalid');
+	u.searchParams.delete('rt');
+	return u.pathname + u.search;
+}
+
 const originalWindowLocation = window.location;
 
 beforeEach(() => {
@@ -102,7 +109,8 @@ describe('TenantRootRedirect 裸根漏斗', () => {
 
 		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
 		const url = String(mockState.replace.mock.calls[0][0]);
-		expect(url).toBe('/demo/');
+		expect(url).toContain('rt=localhost.funnel-slug.');
+		expect(withoutRt(url)).toBe('/demo/');
 		expect(url).not.toContain('Demo%20Tenant');
 		expect(url).not.toContain('Demo');
 	});
@@ -114,7 +122,7 @@ describe('TenantRootRedirect 裸根漏斗', () => {
 		render(wrapper(<TenantRootRedirect />));
 
 		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
-		expect(String(mockState.replace.mock.calls[0][0])).toBe('/demo-fallback/');
+		expect(withoutRt(String(mockState.replace.mock.calls[0][0]))).toBe('/demo-fallback/');
 	});
 
 	it('有会话但名单未返回（加载中）→ 等待，不抢跑 brand 漏斗', async () => {
@@ -133,7 +141,7 @@ describe('TenantRootRedirect 裸根漏斗', () => {
 		render(wrapper(<TenantRootRedirect />));
 
 		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
-		expect(String(mockState.replace.mock.calls[0][0])).toBe(expectedBrandFunnel());
+		expect(withoutRt(String(mockState.replace.mock.calls[0][0]))).toBe(withoutRt(expectedBrandFunnel()));
 	});
 
 	it('有会话但名单无匹配（陈旧会话）→ 漏斗 brand', async () => {
@@ -143,7 +151,7 @@ describe('TenantRootRedirect 裸根漏斗', () => {
 		render(wrapper(<TenantRootRedirect />));
 
 		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
-		expect(String(mockState.replace.mock.calls[0][0])).toBe(expectedBrandFunnel());
+		expect(withoutRt(String(mockState.replace.mock.calls[0][0]))).toBe(withoutRt(expectedBrandFunnel()));
 	});
 
 	it('名单接口失败（返回空数组）→ 有会话按无匹配处理，漏斗 brand（不卡死）', async () => {
@@ -153,6 +161,6 @@ describe('TenantRootRedirect 裸根漏斗', () => {
 		render(wrapper(<TenantRootRedirect />));
 
 		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
-		expect(String(mockState.replace.mock.calls[0][0])).toBe(expectedBrandFunnel());
+		expect(withoutRt(String(mockState.replace.mock.calls[0][0]))).toBe(withoutRt(expectedBrandFunnel()));
 	});
 });

package/src/hooks/useLogout.ts

@@ -6,6 +6,7 @@
 
 import { useCallback } from 'react';
 import { buildLogoutUrl } from '../auth/roles';
+import { traceRedirect } from '../auth/auth-trace';
 
 /**
  * 统一的登出 Hook
@@ -26,7 +27,8 @@ export function useLogout() {
 
 			// buildLogoutUrl = auth 域裸根 + `logout=1` 登出意图标记：入口路由据此先
 			// 终结会话再落 brand，而不是把带会话的回程当普通深链直送登录页（会静默重登）。
-			window.location.href = buildLogoutUrl(currentUrl);
+			// funnel：用户主动行为，静默直跳（assign 保持原 href 历史语义）；仅记 trace。
+			traceRedirect(buildLogoutUrl(currentUrl), { reason: 'logout', assign: true });
 		};
 		performLogout();
 	}, []);

package/src/index.ts

@@ -25,6 +25,8 @@ export { generatePKCE, generateCodeChallenge } from './auth/pkce';
 export type { PKCEPair } from './auth/pkce';
 export { initiateOAuthLogin, handleOAuthCallback, isOAuthEnabled } from './auth/oauth-login';
 export { buildLoginUrl } from './auth/roles';
+export { traceRedirect, traceEvent, traceDump } from './auth/auth-trace';
+export type { AuthTraceEntry, AuthTraceRedirectOptions } from './auth/auth-trace';
 
 // Types
 export type {
@@ -161,13 +163,16 @@ export type { TenantIndexGuardProps } from './components/TenantIndexGuard';
 export { buildTenantUrls } from './auth/build-tenant-urls';
 export { resolvePortalBasename } from './config/resolve-basename';
 
-// 这里原来有 4 行 re-export：GeneratedApi / ApiGenerated / GeneratedTypes / ApiTypes，
-// 全部指向 @autional-cn/api-generated。2026-09 实测：**全舰队 0 处使用它们**
-// （唯一的出现就是这 4 行自己），而它们正是那份 file: 依赖的唯一消费者。
-// 删掉之后 shared 才能作为 npm 包发布——否则发布出去的清单里会留着一条
-// file:../../scripts/generate/api-generated-package，消费方永远解析不到。
-// 真正的生成代码走的是 @autional-cn/shared/generated/{api,types,queries}（src/generated/*），
-// 五个子路径里全舰队都在用的是那一组，不是这一组。
+// 生成代码的命名空间再导出（GeneratedApi / ApiGenerated / GeneratedTypes / ApiTypes）。
+// 说明：这 4 行原先指向 @autional-cn/api-generated —— 那是各站逐站副本里用
+// file:../../scripts/generate/api-generated-package 提供的本地包，一旦 shared 走 npm 发布
+// 就必然解析不到（authenticator / security 的 tsc 就是这么炸的：TS2305 has no exported member）。
+// 本包内的 src/generated/* 是同一份生成结果，因此改指包内相对路径；
+// 消费方实际用到的类型面由逐站 tsc 验证。
+export * as GeneratedApi from './generated/api';
+export * as GeneratedTypes from './generated/types';
+export * as ApiGenerated from './generated/api';
+export * as ApiTypes from './generated/types';
 
 // Branding（租户品牌 → CSS 变量 / favicon / customCss）
 export {