@autional-cn/shared 0.1.0-rc.5 → 0.1.0-rc.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autional-cn/shared",
-  "version": "0.1.0-rc.5",
+  "version": "0.1.0-rc.7",
   "description": "Autional shared layer — API client, auth, types, hooks, utils",
   "license": "AGPL-3.0",
   "main": "./src/index.ts",

package/src/api/__tests__/namespace.test.ts

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest';
+import { needsNamespaceHeader } from '../namespace';
+
+describe('needsNamespaceHeader', () => {
+	it('密钥 admin 组端点（列表/子路径/查询）需注 X-Namespace', () => {
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/detail?key=a/b')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/batch-delete')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/policy')).toBe(true);
+	});
+
+	it('非密钥 admin 端点不注头', () => {
+		expect(needsNamespaceHeader('/notification/api/v1/admin/announcements')).toBe(false);
+		expect(needsNamespaceHeader('/tenant/api/v1/admin/tenants')).toBe(false);
+	});
+
+	it('secret 公开面/internal 面不注头（前端不消费）', () => {
+		expect(needsNamespaceHeader('/secret/public/jwt/public-key')).toBe(false);
+		expect(needsNamespaceHeader('/secret/api/v1/secret/public/transmission/public-key')).toBe(false);
+		expect(needsNamespaceHeader('/api/v1/internal/secret/jwt/keys')).toBe(false);
+	});
+
+	it('相对路径缺省（undefined/空）不注头', () => {
+		expect(needsNamespaceHeader(undefined)).toBe(false);
+		expect(needsNamespaceHeader('')).toBe(false);
+	});
+});

package/src/api/client.ts

@@ -9,9 +9,10 @@
 import axios, { AxiosError } from 'axios';
 import type { AxiosInstance, InternalAxiosRequestConfig } from 'axios';
 import { camelCaseKeys, snakeCaseKeys } from '../utils/case';
-import { getApiBaseUrl } from '../config';
+import { API_NAMESPACE, getApiBaseUrl } from '../config';
 import { getTraceParentHeader } from './trace';
 import { ENTRY_PLANE_HEADER, resolveEntryPlane } from './entry-plane';
+import { NAMESPACE_HEADER, needsNamespaceHeader } from './namespace';
 import { AuthService } from '../auth/service';
 
 function setupInterceptors(instance: AxiosInstance) {
@@ -39,6 +40,11 @@ function setupInterceptors(instance: AxiosInstance) {
 			config.headers['X-Tenant-ID'] = tenantId;
 		}
 
+		// secret 管理面（§13-A P1-B）：admin 组端点 fail-closed 要求 X-Namespace ∈ S
+		if (needsNamespaceHeader(config.url)) {
+			config.headers[NAMESPACE_HEADER] = API_NAMESPACE;
+		}
+
 		// 请求体 camelCase → snake_case 转换（后端 Go 期望 snake_case）
 		if (config.data && typeof config.data === 'object' && !(config.data instanceof FormData)) {
 			config.data = snakeCaseKeys(config.data);

package/src/api/namespace.ts

@@ -0,0 +1,14 @@
+/**
+ * secret 服务管理面 namespace（§13-A P1-B / SEC-204/207）：
+ * `/secret/api/v1/admin*` 端点 fail-closed 要求 `X-Namespace ∈ 实例服务集合 S`
+ * （NamespaceMiddleware，缺头/未服务 → 400）。值取部署配置 VITE_API_NAMESPACE
+ * （见 config，缺省 "dev" 与服务端 DefaultNamespace 对称）。
+ */
+
+export const NAMESPACE_HEADER = 'X-Namespace';
+
+export const SECRET_ADMIN_PATH_PREFIX = '/secret/api/v1/admin';
+
+export function needsNamespaceHeader(url?: string): boolean {
+	return !!url && url.includes(SECRET_ADMIN_PATH_PREFIX);
+}

package/src/config/index.ts

@@ -356,6 +356,10 @@ export function getPLATFORM_CONSOLE_URL(): string {
 }
 export const API_BASE_URL = getEnv('VITE_API_BASE_URL', '/bff');
 
+// secret 管理面 namespace（§13-A P1-B）：admin 组端点要求 X-Namespace ∈ S（fail-closed）；
+// 缺省 "dev" 与服务端 DefaultNamespace（service-core cross/registry keyid.go）对称
+export const API_NAMESPACE = getEnv('VITE_API_NAMESPACE', 'dev');
+
 export function getApiBaseUrl(): string {
 	return API_BASE_URL;
 }

package/src/hooks/__tests__/useSodMode.test.tsx

@@ -0,0 +1,205 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { renderHook, cleanup, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+
+// ============================================================
+// U97 回归锁 — useSodMode 四连缺陷修复:
+//   ① URL 含 /tenant 服务段（不再是 /api/v1/... 裸径 → 网关 404）
+//   ② 请求参数为租户 ULID（不再是 slug → 后端按主键 id 查找必 404）
+//   ③ 失败不再静默吞成 'single'（返回 null；错误留在 react-query 通道）
+//   ④ 读取键为 camelCase `sodMode`（响应拦截器 camelCaseKeys 契约；
+//      读 snake_case `sod_mode` 恒 undefined —— 请求虽 200 但值被吞）
+// ============================================================
+
+vi.mock('../../api/client', () => ({
+	apiClient: { get: vi.fn() },
+}));
+
+import { apiClient } from '../../api/client';
+import { useAuthStore } from '../../auth/store';
+import { useSodMode, useIsAuditRestricted } from '../useSodMode';
+
+const mockedGet = vi.mocked(apiClient.get);
+
+/** 租户 ULID（后端 GetSodConfig 按主键查找的键） */
+const TENANT_ULID = '01M24BB8G083JHWKTXXVGWMWQA';
+/** slug 字样：URL 中不得出现（缺陷② 的负例锚点） */
+const SLUG = 'demo';
+const TENANTS = [{ id: TENANT_ULID, name: SLUG, role: 'admin' }];
+
+/** 模拟 axios 响应拦截器（api/client.ts camelCaseKeys）之后的形状 */
+function sodResponse(sodMode: 'single' | 'strict') {
+	return {
+		data: {
+			tenantId: TENANT_ULID,
+			sodMode,
+			updatedAt: '2026-09-30T00:00:00Z',
+		},
+	} as never;
+}
+
+function createWrapper() {
+	const queryClient = new QueryClient({
+		defaultOptions: { queries: { retry: false, retryDelay: 10 } },
+	});
+	return {
+		queryClient,
+		wrapper: function Wrapper({ children }: { children: React.ReactNode }) {
+			return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>;
+		},
+	};
+}
+
+/** 重置 store + localStorage，避免跨用例污染 */
+function resetAuthStore(): void {
+	useAuthStore.setState({
+		user: null,
+		accessToken: null,
+		refreshToken: null,
+		tenants: [],
+		currentTenantId: null,
+		permissions: [],
+		isAuthenticated: false,
+	});
+	window.localStorage.clear();
+}
+
+describe('useSodMode（U97 回归锁：路径服务段 / ULID 参数 / 失败不吞 / camelCase 键）', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		resetAuthStore();
+	});
+
+	afterEach(() => {
+		cleanup();
+		resetAuthStore();
+	});
+
+	it('①+②+④ 成功: URL = /tenant/api/v1/admin/tenants/<ULID>/sod-config 且读到 sodMode=strict', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockResolvedValue(sodResponse('strict'));
+
+		const { wrapper } = createWrapper();
+		const { result } = renderHook(() => useSodMode(), { wrapper });
+
+		await waitFor(() => expect(result.current).toBe('strict'));
+
+		// ① 服务段：完整路径精确断言（旧实现 /api/v1/... 裸径将 FAIL）
+		expect(mockedGet).toHaveBeenCalledWith(
+			`/tenant/api/v1/admin/tenants/${TENANT_ULID}/sod-config`,
+		);
+		const calledUrl = mockedGet.mock.calls[0][0] as string;
+		expect(calledUrl).not.toMatch(/^\/api\/v1\//);
+		// ② 参数是 ULID，不是 slug
+		expect(calledUrl).toContain(TENANT_ULID);
+		expect(calledUrl).not.toContain(`/${SLUG}/`);
+	});
+
+	it('④ 服务端返回 single → single（正常值不丢）', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockResolvedValue(sodResponse('single'));
+
+		const { wrapper } = createWrapper();
+		const { result } = renderHook(() => useSodMode(), { wrapper });
+
+		await waitFor(() => expect(result.current).toBe('single'));
+	});
+
+	it('② 无租户（currentTenantId=null）→ 不发请求，返回 null', () => {
+		const { wrapper } = createWrapper();
+		const { result } = renderHook(() => useSodMode(), { wrapper });
+
+		expect(result.current).toBeNull();
+		expect(mockedGet).not.toHaveBeenCalled();
+	});
+
+	it('③ 请求失败 → null（不吞成 single），且错误进入 query error 态（不再静默）', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockRejectedValue(new Error('Network Error'));
+
+		const { queryClient, wrapper } = createWrapper();
+		const { result } = renderHook(() => useSodMode(), { wrapper });
+
+		// retry:1（hook 显式）→ 失败重试一次后进入 error 态
+		await waitFor(
+			() => {
+				expect(queryClient.getQueryState(['sod-config', TENANT_ULID])?.status).toBe('error');
+			},
+			{ timeout: 5000 },
+		);
+		// 关键回归锁：绝不是 'single'（旧实现 catch 吞错 + `?? 'single'` 恒 single）
+		expect(result.current).toBeNull();
+		expect(result.current).not.toBe('single');
+	});
+});
+
+describe('useIsAuditRestricted（U97 消费面语义）', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		resetAuthStore();
+	});
+
+	afterEach(() => {
+		cleanup();
+		resetAuthStore();
+	});
+
+	it('strict ∧ role=admin → true（strict 模式 L2 限制生效）', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockResolvedValue(sodResponse('strict'));
+
+		const { wrapper } = createWrapper();
+		const { result } = renderHook(() => useIsAuditRestricted(), { wrapper });
+
+		await waitFor(() => expect(result.current).toBe(true));
+	});
+
+	it('strict ∧ 非 admin → false', async () => {
+		useAuthStore.setState({
+			tenants: [{ id: TENANT_ULID, name: SLUG, role: 'member' }],
+			currentTenantId: TENANT_ULID,
+			accessToken: 't',
+		});
+		mockedGet.mockResolvedValue(sodResponse('strict'));
+
+		const { queryClient, wrapper } = createWrapper();
+		const { result } = renderHook(() => useIsAuditRestricted(), { wrapper });
+
+		// 等 sod 数据确实到达（success）后再断言 —— 避免「数据未到即 false」的假绿
+		await waitFor(() => {
+			expect(queryClient.getQueryState(['sod-config', TENANT_ULID])?.status).toBe('success');
+		});
+		expect(result.current).toBe(false);
+	});
+
+	it('single（admin）→ false', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockResolvedValue(sodResponse('single'));
+
+		const { queryClient, wrapper } = createWrapper();
+		const { result } = renderHook(() => useIsAuditRestricted(), { wrapper });
+
+		await waitFor(() => {
+			expect(queryClient.getQueryState(['sod-config', TENANT_ULID])?.status).toBe('success');
+		});
+		expect(result.current).toBe(false);
+	});
+
+	it('读取失败（null 模式）→ false（不误判受限；fail-open 语义保持）', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockRejectedValue(new Error('Network Error'));
+
+		const { queryClient, wrapper } = createWrapper();
+		const { result } = renderHook(() => useIsAuditRestricted(), { wrapper });
+
+		await waitFor(
+			() => {
+				expect(queryClient.getQueryState(['sod-config', TENANT_ULID])?.status).toBe('error');
+			},
+			{ timeout: 5000 },
+		);
+		expect(result.current).toBe(false);
+	});
+});

package/src/hooks/useSodMode.ts

@@ -8,8 +8,9 @@
  *   'single' — 小客户模式（默认）: admin 可看 L1 统计 + L2 操作反馈
  *   'strict' — 大客户/受监管: admin 仅看 L1 统计摘要
  *
- * API: GET /api/v1/admin/tenants/{tenantSlug}/sod-config
- *       PUT /api/v1/admin/tenants/{tenantSlug}/sod-config
+ * API: GET /tenant/api/v1/admin/tenants/{tenantId}/sod-config   （apiClient baseURL=/bff）
+ *      PUT /tenant/api/v1/admin/tenants/{tenantId}/sod-config
+ * {tenantId} 为租户 ULID —— 后端 GetSodConfig 按租户主键（id）查找，传 slug 必 404。
  *
  * @see document/architecture/decisions/007-security-dashboard-audit.md §2.3
  */
@@ -19,49 +20,56 @@
 import { useMemo } from 'react';
 import { useQuery } from '@tanstack/react-query';
 import { apiClient } from '../api/client';
+import { API as API_PATHS } from '../constants/api-paths';
 import { extractItem } from '../utils/response';
-import { useTenantSlug } from '../auth/tenant-slug-context';
+import { useAuthStore } from '../auth/store';
 import { useCurrentRole } from './useCurrentRole';
 
 export type SodMode = 'single' | 'strict';
 
+/**
+ * 响应字段为 camelCase —— axios 响应拦截器（api/client.ts）对后端
+ * `{tenant_id, sod_mode, updated_at}` 做过 camelCaseKeys 转换。
+ */
 interface SodConfigResponse {
-	tenant_id: string;
-	sod_mode: SodMode;
-	updated_at: string;
+	tenantId: string;
+	sodMode: SodMode;
+	updatedAt: string;
 }
 
 /**
- * 返回当前用户的 sod_mode。
- * 从 tenant-service 的 /api/v1/admin/tenants/{slug}/sod-config 读取。
- * 失败或未配置时默认返回 'single'。
+ * 返回当前租户的 sod_mode。
+ * 从 tenant-service 的 /admin/tenants/{ULID}/sod-config 读取（经 /bff 网关）。
+ *
+ * 返回 null 表示模式未知（无租户 / 加载中 / 请求失败）—— 不再折叠成 'single':
+ * 'single' 仅表示服务端确认的小客户模式；请求失败经 react-query 错误通道暴露。
+ * （U97: 此前路径缺 /tenant 服务段 + 传 slug + catch 吞错 + 读 snake_case 键，
+ * 四连缺陷叠加使 strict 租户的审计 L2 限制恒不生效。）
  */
-export function useSodMode(): SodMode {
-	const tenantSlug = useTenantSlug();
+export function useSodMode(): SodMode | null {
+	const tenantId = useAuthStore((s) => s.currentTenantId);
 
 	const { data: config } = useQuery<SodConfigResponse | null>({
-		queryKey: ['sod-config', tenantSlug],
-		queryFn: () => fetchSodConfig(tenantSlug),
+		queryKey: ['sod-config', tenantId],
+		queryFn: () => fetchSodConfig(tenantId),
 		staleTime: 5 * 60 * 1000, // 5 min cache
 		retry: 1,
-		enabled: !!tenantSlug,
+		enabled: !!tenantId,
 	});
 
-	return config?.sod_mode ?? 'single';
+	return config?.sodMode ?? null;
 }
 
-async function fetchSodConfig(slug: string | undefined): Promise<SodConfigResponse | null> {
-	if (!slug) return null;
-	try {
-		const res = await apiClient.get(`/api/v1/admin/tenants/${slug}/sod-config`);
-		return extractItem<SodConfigResponse>(res.data);
-	} catch {
-		return null; // 默认 single
-	}
+async function fetchSodConfig(tenantId: string | null): Promise<SodConfigResponse | null> {
+	if (!tenantId) return null;
+	// 路径须循 /<服务>/api/v1/... 惯例（U97: 此前漏 /tenant 服务段 → 网关 404）
+	const res = await apiClient.get(API_PATHS.TENANT.SOD_CONFIG(tenantId));
+	return extractItem<SodConfigResponse>(res.data);
 }
 
 /**
  * 判断当前用户在 strict 模式下是否被限制查看审计详情。
+ * 模式未知（null）时不判定为受限（维持既有 fail-open 语义）。
  */
 export function useIsAuditRestricted(): boolean {
 	const sodMode = useSodMode();

package/src/vite-env.d.ts

@@ -9,6 +9,7 @@ interface ImportMetaEnv {
 	readonly VITE_OAUTH_CLIENT_ID: string;
 	readonly VITE_AUTH_PAGES_URL: string;
 	readonly VITE_API_BASE_URL: string;
+	readonly VITE_API_NAMESPACE: string;
 	readonly VITE_AUDIT_BASE_URL: string;
 	[key: string]: string | boolean | undefined;
 }