@autional-cn/shared 0.1.0-rc

package/src/components/__tests__/TenantIndexGuard.test.tsx

@@ -0,0 +1,218 @@
+// @vitest-environment jsdom
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { render, screen, cleanup, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+import { TenantIndexGuard, usePublicTenantSlugs } from '../TenantIndexGuard';
+
+function createQueryClient() {
+	return new QueryClient({
+		defaultOptions: {
+			queries: { retry: false, gcTime: Infinity },
+		},
+	});
+}
+
+function wrapper(children: ReactNode) {
+	return <QueryClientProvider client={createQueryClient()}>{children}</QueryClientProvider>;
+}
+
+/** mock fetch 返回 items 数组的 ListResponse */
+function stubFetch(items: unknown[], ok = true, status = 200) {
+	vi.stubGlobal(
+		'fetch',
+		vi.fn().mockResolvedValue({
+			ok,
+			status,
+			json: async () => ({ code: 0, message: 'success', items, total: items.length }),
+		}),
+	);
+}
+
+function stubFetchData(items: unknown[]) {
+	vi.stubGlobal(
+		'fetch',
+		vi.fn().mockResolvedValue({
+			ok: true,
+			status: 200,
+			json: async () => ({ code: 0, message: 'success', data: items }),
+		}),
+	);
+}
+
+function stubFetchReject() {
+	vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('network down')));
+}
+
+function stubFetchNonOk() {
+	vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: false, status: 500 }));
+}
+
+function stubFetchBadShape() {
+	vi.stubGlobal(
+		'fetch',
+		vi.fn().mockResolvedValue({
+			ok: true,
+			status: 200,
+			json: async () => ({ foo: 'bar' }),
+		}),
+	);
+}
+
+function setPath(path: string) {
+	window.history.pushState({}, '', path);
+}
+
+describe('usePublicTenantSlugs（响应契约解析）', () => {
+	beforeEach(() => {
+		setPath('/acme-corp');
+	});
+
+	afterEach(() => {
+		cleanup();
+		vi.unstubAllGlobals();
+	});
+
+	it('ListResponse 用 items 字段 → 返回租户数组（修复回归）', async () => {
+		stubFetch([
+			{ id: '1', name: 'acme-corp' },
+			{ id: '2', name: 'beta-inc' },
+		]);
+		let result: unknown[] | undefined;
+		function Harness() {
+			const q = usePublicTenantSlugs();
+			result = q.data;
+			return null;
+		}
+		render(wrapper(<Harness />));
+		await waitFor(() =>
+			expect(result).toEqual([
+				{ id: '1', name: 'acme-corp' },
+				{ id: '2', name: 'beta-inc' },
+			]),
+		);
+	});
+
+	it('旧 data 字段兼容 → 返回租户数组', async () => {
+		stubFetchData([{ id: '1', name: 'acme-corp' }]);
+		let result: unknown[] | undefined;
+		function Harness() {
+			const q = usePublicTenantSlugs();
+			result = q.data;
+			return null;
+		}
+		render(wrapper(<Harness />));
+		await waitFor(() => expect(result).toEqual([{ id: '1', name: 'acme-corp' }]));
+	});
+
+	it('API 非 200 → 返回空数组（放行语义）', async () => {
+		stubFetchNonOk();
+		let result: unknown[] | undefined;
+		function Harness() {
+			const q = usePublicTenantSlugs();
+			result = q.data;
+			return null;
+		}
+		render(wrapper(<Harness />));
+		await waitFor(() => expect(result).toEqual([]));
+	});
+
+	it('网络异常 → 返回空数组', async () => {
+		stubFetchReject();
+		let result: unknown[] | undefined;
+		function Harness() {
+			const q = usePublicTenantSlugs();
+			result = q.data;
+			return null;
+		}
+		render(wrapper(<Harness />));
+		await waitFor(() => expect(result).toEqual([]));
+	});
+
+	it('响应无 items/data 且非数组 → 返回空数组', async () => {
+		stubFetchBadShape();
+		let result: unknown[] | undefined;
+		function Harness() {
+			const q = usePublicTenantSlugs();
+			result = q.data;
+			return null;
+		}
+		render(wrapper(<Harness />));
+		await waitFor(() => expect(result).toEqual([]));
+	});
+});
+
+describe('TenantIndexGuard（P0-2 slug 白名单守卫）', () => {
+	const children = <div data-testid="children">Home</div>;
+	const notFound = <div data-testid="notfound">404</div>;
+
+	beforeEach(() => {
+		setPath('/acme-corp');
+	});
+
+	afterEach(() => {
+		cleanup();
+		vi.unstubAllGlobals();
+	});
+
+	it('slug 在白名单 → 渲染 children', async () => {
+		stubFetch([{ id: '1', name: 'acme-corp' }]);
+		render(wrapper(<TenantIndexGuard notFound={notFound}>{children}</TenantIndexGuard>));
+		await waitFor(() => expect(screen.getByTestId('children')).toBeInTheDocument());
+		expect(screen.queryByTestId('notfound')).toBeNull();
+	});
+
+	it('slug 不在白名单 → 渲染 notFound（修复回归：无效 slug 此前错误渲染首页）', async () => {
+		stubFetch([{ id: '1', name: 'acme-corp' }]);
+		setPath('/nonexistent-tenant');
+		render(wrapper(<TenantIndexGuard notFound={notFound}>{children}</TenantIndexGuard>));
+		await waitFor(() => expect(screen.getByTestId('notfound')).toBeInTheDocument());
+		expect(screen.queryByTestId('children')).toBeNull();
+	});
+
+	it('白名单为空数组 → 放行渲染 children（API 挂掉时退化为不拦截）', async () => {
+		stubFetch([]);
+		setPath('/any-slug');
+		render(wrapper(<TenantIndexGuard notFound={notFound}>{children}</TenantIndexGuard>));
+		await waitFor(() => expect(screen.getByTestId('children')).toBeInTheDocument());
+	});
+
+	it('URL 多段路径 → 直接 notFound（basename 已剥离 slug，内部必为未知段）', () => {
+		setPath('/acme-corp/xyz');
+		render(wrapper(<TenantIndexGuard notFound={notFound}>{children}</TenantIndexGuard>));
+		expect(screen.getByTestId('notfound')).toBeInTheDocument();
+		expect(screen.queryByTestId('children')).toBeNull();
+	});
+
+	it('加载中 → 渲染 loading 占位', async () => {
+		let resolveFetch: (v: unknown) => void;
+		const pending = new Promise((res) => {
+			resolveFetch = res;
+		});
+		vi.stubGlobal('fetch', vi.fn().mockReturnValue(pending));
+		setPath('/acme-corp');
+		const loading = <div data-testid="loading">Loading...</div>;
+		render(
+			wrapper(
+				<TenantIndexGuard notFound={notFound} loading={loading}>
+					{children}
+				</TenantIndexGuard>,
+			),
+		);
+		expect(screen.getByTestId('loading')).toBeInTheDocument();
+		await resolveFetch!({
+			ok: true,
+			status: 200,
+			json: async () => ({ code: 0, items: [{ id: '1', name: 'acme-corp' }] }),
+		});
+		await waitFor(() => expect(screen.getByTestId('children')).toBeInTheDocument());
+	});
+
+	it('空 slug（根路径 /）→ 渲染 children', async () => {
+		stubFetch([{ id: '1', name: 'acme-corp' }]);
+		setPath('/');
+		render(wrapper(<TenantIndexGuard notFound={notFound}>{children}</TenantIndexGuard>));
+		await waitFor(() => expect(screen.getByTestId('children')).toBeInTheDocument());
+	});
+});

package/src/config/__tests__/portal-resolver.test.ts

@@ -0,0 +1,247 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { getRootDomain, getPortalUrl } from '../index';
+
+// ─── getRootDomain (pure function, no mock needed) ───
+
+describe('getRootDomain', () => {
+	it.each([
+		// [hostname, expected]
+		['app.iam.tianv.local', 'iam.tianv.local'],
+		['auth.iam.tianv.local', 'iam.tianv.local'],
+		['app.iam.tianv.com', 'iam.tianv.com'],
+		['auth.iam.tianv.com', 'iam.tianv.com'],
+		['app.autional.com', 'autional.com'],
+		['auth.autional.com', 'autional.com'],
+		['iam.tianv.com', 'tianv.com'], // root domain itself
+		['127.0.0.1', '127.0.0.1'], // IP address
+		['localhost', 'localhost'], // localhost
+	])('hostname=%s → %s', (hostname, expected) => {
+		expect(getRootDomain(hostname)).toBe(expected);
+	});
+});
+
+// ─── getPortalUrl (requires window mock) ───
+
+const LOCAL_CONFIG = {
+	VITE_PORTAL_CONFIG: {
+		auth: { host: 'auth', base: '' },
+		landing: { host: '', base: '' },
+		admin: { host: 'app', base: '/admin' },
+		developer: { host: 'app', base: '/developer' },
+		platform: { host: 'platform', base: '' },
+		status: { host: 'status', base: '' },
+		trust: { host: 'trust', base: '' },
+		user: { host: 'user', base: '' },
+		authenticator: { host: 'authenticator', base: '' },
+		security: { host: 'app', base: '/security' },
+	},
+};
+
+const COM_CONFIG = {
+	VITE_PORTAL_CONFIG: {
+		...LOCAL_CONFIG.VITE_PORTAL_CONFIG,
+	},
+};
+
+describe('getPortalUrl', () => {
+	beforeEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	describe('with VITE_PORTAL_CONFIG + .local domain', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.iam.tianv.local',
+					protocol: 'https:',
+					origin: 'https://app.iam.tianv.local',
+				},
+				__APP_CONFIG__: LOCAL_CONFIG,
+			});
+		});
+
+		it('resolves auth to auth.* subdomain', () => {
+			expect(getPortalUrl('auth')).toBe('https://auth.iam.tianv.local');
+		});
+
+		it('resolves landing to root domain', () => {
+			expect(getPortalUrl('landing')).toBe('https://iam.tianv.local');
+		});
+
+		it('resolves app-* portals to app.* subdomain with base path', () => {
+			expect(getPortalUrl('admin')).toBe('https://app.iam.tianv.local/admin');
+			expect(getPortalUrl('developer')).toBe('https://app.iam.tianv.local/developer');
+			expect(getPortalUrl('security')).toBe('https://app.iam.tianv.local/security');
+		});
+
+		it('resolves platform to its own subdomain', () => {
+			expect(getPortalUrl('platform')).toBe('https://platform.iam.tianv.local');
+		});
+
+		it('resolves status to its own subdomain', () => {
+			expect(getPortalUrl('status')).toBe('https://status.iam.tianv.local');
+		});
+
+		it('resolves trust to its own subdomain', () => {
+			expect(getPortalUrl('trust')).toBe('https://trust.iam.tianv.local');
+		});
+
+		it('resolves user to its own subdomain', () => {
+			expect(getPortalUrl('user')).toBe('https://user.iam.tianv.local');
+		});
+
+		it('resolves authenticator to its own subdomain', () => {
+			expect(getPortalUrl('authenticator')).toBe('https://authenticator.iam.tianv.local');
+		});
+	});
+
+	describe('with VITE_PORTAL_CONFIG + .com domain', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.iam.tianv.com',
+					protocol: 'https:',
+					origin: 'https://app.iam.tianv.com',
+				},
+				__APP_CONFIG__: COM_CONFIG,
+			});
+		});
+
+		it('resolves auth to auth.*.com subdomain', () => {
+			expect(getPortalUrl('auth')).toBe('https://auth.iam.tianv.com');
+		});
+
+		it('resolves admin to app.*.com/admin', () => {
+			expect(getPortalUrl('admin')).toBe('https://app.iam.tianv.com/admin');
+		});
+
+		it('resolves platform to platform.*.com', () => {
+			expect(getPortalUrl('platform')).toBe('https://platform.iam.tianv.com');
+		});
+	});
+
+	describe('with VITE_PORTAL_CONFIG + autional.com domain', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.autional.com',
+					protocol: 'https:',
+					origin: 'https://app.autional.com',
+				},
+				__APP_CONFIG__: COM_CONFIG,
+			});
+		});
+
+		it('resolves auth to auth.autional.com', () => {
+			expect(getPortalUrl('auth')).toBe('https://auth.autional.com');
+		});
+
+		it('resolves admin to app.autional.com/admin', () => {
+			expect(getPortalUrl('admin')).toBe('https://app.autional.com/admin');
+		});
+
+		it('resolves landing to autional.com', () => {
+			expect(getPortalUrl('landing')).toBe('https://autional.com');
+		});
+	});
+
+	describe('fallback when VITE_PORTAL_CONFIG is absent (old env.js)', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.iam.tianv.local',
+					protocol: 'https:',
+					origin: 'https://app.iam.tianv.local',
+				},
+				__APP_CONFIG__: {
+					VITE_AUTH_PAGES_URL: 'https://auth.iam.tianv.com',
+					VITE_ADMIN_CONSOLE_URL: 'https://app.iam.tianv.com/admin',
+				},
+			});
+		});
+
+		it('falls back to VITE_AUTH_PAGES_URL for auth', () => {
+			expect(getPortalUrl('auth')).toBe('https://auth.iam.tianv.com');
+		});
+
+		it('falls back to VITE_ADMIN_CONSOLE_URL for admin', () => {
+			expect(getPortalUrl('admin')).toBe('https://app.iam.tianv.com/admin');
+		});
+
+		it('falls back to origin for unknown portal', () => {
+			expect(getPortalUrl('unknown')).toBe('https://app.iam.tianv.local/unknown');
+		});
+	});
+
+	describe('tenant slug is gated by portal shape (F-W8)', () => {
+		const CN_CONFIG = {
+			VITE_PORTAL_CONFIG: {
+				auth: { host: 'auth', base: '' },
+				admin: { host: 'admin', base: '' },
+				developer: { host: 'developer', base: '' },
+				platform: { host: 'platform', base: '' },
+				status: { host: 'status', base: '' },
+				trust: { host: 'trust', base: '' },
+				user: { host: 'user', base: '' },
+				authenticator: { host: 'authenticator', base: '' },
+				security: { host: 'security', base: '' },
+				brand: { host: 'brand', base: '' },
+			},
+		};
+
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'auth.autional.cn',
+					protocol: 'https:',
+					origin: 'https://auth.autional.cn',
+				},
+				__APP_CONFIG__: CN_CONFIG,
+			});
+		});
+
+		it('appends /<slug> for tenant-scoped portals', () => {
+			expect(getPortalUrl('auth', 'demo')).toBe('https://auth.autional.cn/demo');
+			expect(getPortalUrl('admin', 'demo')).toBe('https://admin.autional.cn/demo');
+			expect(getPortalUrl('user', 'demo')).toBe('https://user.autional.cn/demo');
+			expect(getPortalUrl('security', 'demo')).toBe('https://security.autional.cn/demo');
+			expect(getPortalUrl('authenticator', 'demo')).toBe(
+				'https://authenticator.autional.cn/demo',
+			);
+		});
+
+		it('keeps domain-root portals at root even when a slug is passed', () => {
+			expect(getPortalUrl('platform', 'demo')).toBe('https://platform.autional.cn');
+			expect(getPortalUrl('status', 'demo')).toBe('https://status.autional.cn');
+			expect(getPortalUrl('trust', 'demo')).toBe('https://trust.autional.cn');
+			expect(getPortalUrl('developer', 'demo')).toBe('https://developer.autional.cn');
+			expect(getPortalUrl('brand', 'demo')).toBe('https://brand.autional.cn');
+		});
+	});
+
+	describe('tenant slug gate applies to legacy VITE_*_URL and default-table branches', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.iam.tianv.local',
+					protocol: 'https:',
+					origin: 'https://app.iam.tianv.local',
+				},
+				__APP_CONFIG__: {
+					VITE_AUTH_PAGES_URL: 'https://auth.iam.tianv.com',
+					VITE_PLATFORM_CONSOLE_URL: 'https://platform.iam.tianv.com',
+				},
+			});
+		});
+
+		it('legacy branch: slug appended for auth, not for platform', () => {
+			expect(getPortalUrl('auth', 'demo')).toBe('https://auth.iam.tianv.com/demo');
+			expect(getPortalUrl('platform', 'demo')).toBe('https://platform.iam.tianv.com');
+		});
+
+		it('default-table branch: slug appended for user, not for status', () => {
+			expect(getPortalUrl('user', 'demo')).toBe('https://user.iam.tianv.local/demo');
+			expect(getPortalUrl('status', 'demo')).toBe('https://status.iam.tianv.local');
+		});
+	});
+});

package/src/config/__tests__/valid-redirect.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// 动态导入被测函数，避免顶层 window 依赖
+import { isValidRedirect } from '../index';
+
+describe('isValidRedirect', () => {
+	beforeEach(() => {
+		vi.stubGlobal('window', {
+			location: {
+				origin: 'https://auth.iam.tianv.local',
+				hostname: 'auth.iam.tianv.local',
+			},
+		});
+	});
+
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	it('accepts same-origin relative path', () => {
+		expect(isValidRedirect('/acme-corp/dashboard')).toBe(true);
+	});
+
+	it('accepts same-origin absolute URL', () => {
+		expect(isValidRedirect('https://auth.iam.tianv.local/acme-corp/dashboard')).toBe(true);
+	});
+
+	it('rejects protocol-relative URL (open redirect)', () => {
+		expect(isValidRedirect('//evil.com')).toBe(false);
+	});
+
+	it('rejects backslash protocol-relative variant', () => {
+		expect(isValidRedirect('/\\evil.com')).toBe(false);
+	});
+
+	it('rejects percent-encoded backslash variant', () => {
+		expect(isValidRedirect('/%5cevil.com')).toBe(false);
+	});
+
+	it('rejects external http URL not in allowlist', () => {
+		expect(isValidRedirect('https://evil.com/phish')).toBe(false);
+	});
+
+	it('rejects empty string', () => {
+		expect(isValidRedirect('')).toBe(false);
+	});
+});

package/src/config/constants.ts

@@ -0,0 +1,27 @@
+// Build-time domain constants (used by Astro SSG for SEO meta tags).
+// For runtime resolution, use getRootDomain() + getPortalUrl() from ./index.
+// Override via SITE_DOMAIN env var for multi-environment builds.
+
+function getEnv(key: string, fallback: string): string {
+	try {
+		const val = (import.meta as any).env?.[key];
+		if (val) return val;
+	} catch {
+		/* SSR may not have import.meta */
+	}
+	return fallback;
+}
+
+export const SITE_DOMAIN = getEnv('SITE_DOMAIN', 'iam.tianv.com');
+export const SITE_EMAIL = getEnv('SITE_EMAIL', 'support@autional.net');
+export const SITE_BASE_URL = `https://${SITE_DOMAIN}`;
+export const AUTH_DOMAIN = `auth.${SITE_DOMAIN}`;
+export const USER_DOMAIN = `user.${SITE_DOMAIN}`;
+export const APP_DOMAIN = `app.${SITE_DOMAIN}`;
+export const AUTHENTICATOR_DOMAIN = `authenticator.${SITE_DOMAIN}`;
+export const AUTH_BASE_URL = `https://${AUTH_DOMAIN}`;
+export const USER_BASE_URL = `https://${USER_DOMAIN}`;
+export const APP_BASE_URL = `https://${APP_DOMAIN}`;
+export const AUTHENTICATOR_BASE_URL = `https://${AUTHENTICATOR_DOMAIN}`;
+export const DEFAULT_OG_IMAGE = `${SITE_BASE_URL}/og-image.svg`;
+export const DEFAULT_LOGO = `${SITE_BASE_URL}/logo.png`;