@autional/shared 0.0.0-stage → 0.1.0-rc.32

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@autional/shared",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0-rc.32",
+  "description": "Autional shared layer — API client, auth, types, hooks, utils",
+  "license": "AGPL-3.0",
+  "main": "./src/index.ts",
+  "module": "./src/index.ts",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./branding": "./src/branding/index.ts",
+    "./slug-from-url": "./src/auth/slug-from-url.ts",
+    "./generated/api": "./src/generated/api.ts",
+    "./generated/types": "./src/generated/types.ts",
+    "./generated/queries": "./src/generated/queries.ts",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "src"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@opentelemetry/api": "1.9.1",
+    "@tanstack/react-query": "5.100.9",
+    "@types/lodash-es": "4.17.12",
+    "@types/node": "26.1.2",
+    "@types/react": "19.2.14",
+    "@types/react-dom": "19.2.3",
+    "axios": "1.16.0",
+    "lodash-es": "4.18.1",
+    "zustand": "5.0.13"
+  },
+  "devDependencies": {
+    "@testing-library/jest-dom": "6.9.1",
+    "@testing-library/react": "16.3.2",
+    "jsdom": "29.1.1",
+    "react": "19.2.5",
+    "react-dom": "19.2.5",
+    "typescript": "5.8.3",
+    "vite": "6.4.2",
+    "vitest": "3.2.0",
+    "@autional/tsconfig": "0.1.0-rc"
+  },
+  "peerDependencies": {
+    "react": ">=18.0.0",
+    "react-dom": ">=18.0.0"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
 }

package/src/api/__tests__/contract.test.ts

@@ -0,0 +1,172 @@
+// TASK-AB1-28（fix-admin-b1-guard-contract / AC-AB1-51）：apiClient 拦截器契约 T1 回归锁。
+//
+// 断言口径 —— **全部 7 组均走真实拦截器**（只替换 axios adapter：请求拦截器之后最末环；
+// 零 interceptor mock、零 spy 替换 setupInterceptors —— 供审查方逐组核对）。
+// 锁定 client.ts 实际行为：
+//   请求侧 :51-58（config.data / config.params → snakeCaseKeys）；响应侧 :81-105（信封装配 + camelCaseKeys）。
+// 组清单：
+//   G1 params：pageSize/currentPage → page_size/current_page（:56-58）
+//   G2 请求体：camel 嵌套对象/数组 → snake 深转换（:51-53）
+//   G3 透传：limit/keyword 未声明参数不被误信改写（snake 转换仅大写字母加 _，无语义改写）
+//   G4 响应深 camel：snake → camel 递归（:105）
+//   G5 信封：{code,message,data} → data 直给（:85-87；信封键不残留）
+//   G6 items 分支：{code,items,total,pagination} → {items,total,pagination}（:89-95）
+//   G7 简单分支：{code,message}（无 data/items）→ 整体返回（:97-99）+ raw_key → rawKey 代表样本
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { apiClient } from '../client';
+
+interface CapturedCall {
+	method: string;
+	url: string;
+	params?: Record<string, unknown>;
+	body?: Record<string, unknown>;
+}
+
+let captured: CapturedCall[];
+let originalAdapter: unknown;
+let respond: (config: unknown) => unknown;
+
+function installCaptureAdapter() {
+	originalAdapter = apiClient.defaults.adapter;
+	apiClient.defaults.adapter = (async (config: any) => {
+		let body: Record<string, unknown> | undefined;
+		if (typeof config.data === 'string' && config.data.length > 0) {
+			body = JSON.parse(config.data);
+		} else if (config.data && typeof config.data === 'object') {
+			body = config.data as Record<string, unknown>;
+		}
+		captured.push({
+			method: String(config.method || 'get').toLowerCase(),
+			url: String(config.url || ''),
+			params: config.params,
+			body,
+		});
+		return { data: respond(config), status: 200, statusText: 'OK', headers: {}, config };
+	}) as any;
+}
+
+describe('apiClient 拦截器契约（AC-AB1-51 · T1 护栏）', () => {
+	beforeEach(() => {
+		captured = [];
+		respond = () => ({ code: 0, message: 'success', timestamp: '2026-10-04T00:00:00Z' });
+		installCaptureAdapter();
+	});
+
+	afterEach(() => {
+		apiClient.defaults.adapter = originalAdapter as any;
+	});
+
+	it('G1 请求 params：camel → snake（pageSize → page_size），走真实拦截器', async () => {
+		await apiClient.get('/contract/probe', { params: { pageSize: 20, currentPage: 2 } });
+		expect(captured).toHaveLength(1);
+		expect(captured[0].params).toEqual({ page_size: 20, current_page: 2 });
+	});
+
+	it('G2 请求体：camel 嵌套对象/数组 → snake 深转换，走真实拦截器', async () => {
+		await apiClient.post('/contract/probe', {
+			userProfile: { displayName: '张三', nestedArray: [{ itemId: 1, subLevel: { deepKey: true } }] },
+			totalCount: 3,
+		});
+		expect(captured).toHaveLength(1);
+		expect(captured[0].body).toEqual({
+			user_profile: {
+				display_name: '张三',
+				nested_array: [{ item_id: 1, sub_level: { deep_key: true } }],
+			},
+			total_count: 3,
+		});
+	});
+
+	it('G3 透传：limit/keyword 未声明参数不被误信改写（无语义转换），走真实拦截器', async () => {
+		await apiClient.get('/contract/probe', { params: { limit: 3, keyword: 'ali', pageSize: 10 } });
+		expect(captured[0].params).toEqual({ limit: 3, keyword: 'ali', page_size: 10 });
+	});
+
+	it('G4 响应：snake → camel 深递归（嵌套对象/数组），走真实拦截器', async () => {
+		respond = () => ({
+			code: 0,
+			message: 'success',
+			data: {
+				user_profile: {
+					display_name: '张三',
+					company_name: 'ACME',
+					nested_list: [{ item_id: 1, created_at: '2026-10-04T00:00:00Z' }],
+				},
+			},
+			timestamp: '2026-10-04T00:00:00Z',
+		});
+		const res = await apiClient.get('/contract/probe');
+		expect(res.data).toEqual({
+			userProfile: {
+				displayName: '张三',
+				companyName: 'ACME',
+				nestedList: [{ itemId: 1, createdAt: '2026-10-04T00:00:00Z' }],
+			},
+		});
+	});
+
+	it('G5 响应：{code,message,data} 信封解包（data 直给，信封键不残留），走真实拦截器', async () => {
+		respond = () => ({
+			code: 0,
+			message: 'success',
+			data: { raw_key: 'v' },
+			timestamp: '2026-10-04T00:00:00Z',
+		});
+		const res = await apiClient.get('/contract/probe');
+		expect(res.data).toEqual({ rawKey: 'v' });
+		expect((res.data as Record<string, unknown>).code).toBeUndefined();
+		expect((res.data as Record<string, unknown>).message).toBeUndefined();
+		expect((res.data as Record<string, unknown>).timestamp).toBeUndefined();
+	});
+
+	it('G6 响应：items 分支 {code,items,total,pagination} → 归一三键（条目深 camel），走真实拦截器', async () => {
+		respond = () => ({
+			code: 0,
+			message: 'success',
+			items: [{ raw_key: 'a', user_name: 'n' }],
+			total: 1,
+			pagination: { page: 1, page_size: 10, total_pages: 1 },
+			timestamp: '2026-10-04T00:00:00Z',
+		});
+		const res = await apiClient.get('/contract/probe');
+		expect(res.data).toEqual({
+			items: [{ rawKey: 'a', userName: 'n' }],
+			total: 1,
+			pagination: { page: 1, pageSize: 10, totalPages: 1 },
+		});
+	});
+
+	it('G7 响应：简单分支（无 data/items）整体返回 + raw_key → rawKey 代表样本，走真实拦截器', async () => {
+		respond = () => ({
+			code: 0,
+			message: 'success',
+			raw_key: 'v',
+			timestamp: '2026-10-04T00:00:00Z',
+		});
+		const res = await apiClient.get('/contract/probe');
+		expect(res.data).toEqual({
+			code: 0,
+			message: 'success',
+			rawKey: 'v',
+			timestamp: '2026-10-04T00:00:00Z',
+		});
+		expect((res.data as Record<string, unknown>).raw_key).toBeUndefined();
+	});
+
+	it('G8 请求体：缩写键 acronym-aware（U385：clientDataJSON → client_data_json，走真实拦截器）', async () => {
+		await apiClient.post('/contract/probe', {
+			clientDataJSON: 'cdj',
+			attestationObject: 'ao',
+			rawId: 'rid',
+			userID: 'u-1',
+		});
+		expect(captured).toHaveLength(1);
+		expect(captured[0].body).toEqual({
+			client_data_json: 'cdj',
+			attestation_object: 'ao',
+			raw_id: 'rid',
+			user_id: 'u-1',
+		});
+	});
+});

package/src/api/__tests__/entry-plane.test.ts

@@ -0,0 +1,119 @@
+import { describe, it, expect } from 'vitest';
+import { resolveEntryPlane } from '../entry-plane';
+
+describe('resolveEntryPlane', () => {
+	it('redirect 指向 admin 门户主机 → admin', () => {
+		expect(resolveEntryPlane('https://admin.iam.tianv.com/dashboard', 'auth.iam.tianv.com')).toBe(
+			'admin',
+		);
+	});
+
+	it('redirect 指向 platform 门户主机 → platform', () => {
+		expect(resolveEntryPlane('https://platform.iam.tianv.com/tenants', 'auth.iam.tianv.com')).toBe(
+			'platform',
+		);
+	});
+
+	it('redirect 指向非管理门户（user）→ 回落当前主机（auth）→ api', () => {
+		expect(resolveEntryPlane('https://user.iam.tianv.com/dashboard', 'auth.iam.tianv.com')).toBe(
+			'api',
+		);
+	});
+
+	it('redirect 指向安全仪表盘主机 → admin（SOC 门户为 admin 受众）', () => {
+		expect(
+			resolveEntryPlane('https://security.iam.tianv.com/risk-dashboard', 'auth.iam.tianv.com'),
+		).toBe('admin');
+	});
+
+	it('无 redirect、当前主机为安全仪表盘 → admin', () => {
+		expect(resolveEntryPlane(null, 'security.iam.tianv.com')).toBe('admin');
+	});
+
+	it('无 redirect、当前主机为 admin 门户 → admin', () => {
+		expect(resolveEntryPlane(null, 'admin.iam.tianv.com')).toBe('admin');
+	});
+
+	it('无 redirect、当前主机为 auth 门户 → api', () => {
+		expect(resolveEntryPlane(null, 'auth.iam.tianv.com')).toBe('api');
+	});
+
+	it('redirect 为相对路径时按当前主机判定', () => {
+		expect(resolveEntryPlane('/admin/dashboard', 'platform.iam.tianv.com')).toBe('platform');
+		expect(resolveEntryPlane('/dashboard', 'auth.iam.tianv.com')).toBe('api');
+	});
+
+	it('redirect 非法时回落当前主机判定', () => {
+		expect(resolveEntryPlane('http://[invalid', 'auth.iam.tianv.com')).toBe('api');
+	});
+
+	it('主机前缀大小写不敏感、带端口仍匹配', () => {
+		expect(resolveEntryPlane('https://ADMIN.iam.tianv.com/', 'auth.iam.tianv.com')).toBe('admin');
+		expect(resolveEntryPlane('https://admin.iam.tianv.com:8443/', 'auth.iam.tianv.com')).toBe(
+			'admin',
+		);
+	});
+});
+
+// 冷启动链：同意页无会话 → `<slug>/login?redirect=<authorize URL>`（oauth-cold-start TASK-07）。
+// authorize URL 宿主是 auth 门户 ⇒ 宿主判定为空，必须下钻内嵌目标（redirect_uri / state.redirect），
+// 否则回程门户拿到的 token 平面恒为 api，admin/platform 受众端点全部 403 40000503（F-W5）。
+describe('resolveEntryPlane（authorize URL 作为登录页 redirect）', () => {
+	/** 复刻 initiateOAuthLogin 的 authorize URL 组装（oauth-login.ts）。 */
+	function authorizeUrl(params: Record<string, string>): string {
+		const qs = new URLSearchParams({ response_type: 'code', client_id: 'cid-1', ...params });
+		return `https://auth.iam.tianv.com/oauth/api/v1/oauth/authorize?${qs}`;
+	}
+
+	it('redirect_uri 指向 admin 门户回调 → admin', () => {
+		const url = authorizeUrl({
+			redirect_uri: 'https://admin.iam.tianv.com/oauth/callback',
+			state: JSON.stringify({ csrf: 'x', redirect: 'https://admin.iam.tianv.com/demo/dashboard' }),
+		});
+		expect(resolveEntryPlane(url, 'auth.iam.tianv.com')).toBe('admin');
+	});
+
+	it('redirect_uri 缺失时以 state.redirect（发起页 URL）判定 → platform', () => {
+		const url = authorizeUrl({
+			state: JSON.stringify({ csrf: 'x', redirect: 'https://platform.iam.tianv.com/tenants' }),
+		});
+		expect(resolveEntryPlane(url, 'auth.iam.tianv.com')).toBe('platform');
+	});
+
+	it('内嵌目标为安全仪表盘 → admin（SOC 门户与 admin 同平面）', () => {
+		const url = authorizeUrl({ redirect_uri: 'https://security.iam.tianv.com/oauth/callback' });
+		expect(resolveEntryPlane(url, 'auth.iam.tianv.com')).toBe('admin');
+	});
+
+	it('内嵌目标为 user 门户 / 第三方应用 → 回落 api', () => {
+		expect(
+			resolveEntryPlane(
+				authorizeUrl({ redirect_uri: 'https://user.iam.tianv.com/oauth/callback' }),
+				'auth.iam.tianv.com',
+			),
+		).toBe('api');
+		expect(
+			resolveEntryPlane(
+				authorizeUrl({ redirect_uri: 'https://app.example.com/oauth/callback' }),
+				'auth.iam.tianv.com',
+			),
+		).toBe('api');
+	});
+
+	it('state 非 JSON（旧式纯串）不抛错，按 redirect_uri 判定', () => {
+		const url = authorizeUrl({
+			redirect_uri: 'https://admin.iam.tianv.com/oauth/callback',
+			state: 'plain-state',
+		});
+		expect(resolveEntryPlane(url, 'auth.iam.tianv.com')).toBe('admin');
+	});
+
+	it('非 authorize 路径的 redirect_uri 参数不参与判定（防普通深链伪造平面）', () => {
+		expect(
+			resolveEntryPlane(
+				'https://user.iam.tianv.com/demo/?redirect_uri=https://admin.iam.tianv.com/',
+				'auth.iam.tianv.com',
+			),
+		).toBe('api');
+	});
+});

package/src/api/__tests__/namespace.test.ts

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest';
+import { needsNamespaceHeader } from '../namespace';
+
+describe('needsNamespaceHeader', () => {
+	it('密钥 admin 组端点（列表/子路径/查询）需注 X-Namespace', () => {
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/detail?key=a/b')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/batch-delete')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/policy')).toBe(true);
+	});
+
+	it('非密钥 admin 端点不注头', () => {
+		expect(needsNamespaceHeader('/notification/api/v1/admin/announcements')).toBe(false);
+		expect(needsNamespaceHeader('/tenant/api/v1/admin/tenants')).toBe(false);
+	});
+
+	it('secret 公开面/internal 面不注头（前端不消费）', () => {
+		expect(needsNamespaceHeader('/secret/public/jwt/public-key')).toBe(false);
+		expect(needsNamespaceHeader('/secret/api/v1/secret/public/transmission/public-key')).toBe(false);
+		expect(needsNamespaceHeader('/api/v1/internal/secret/jwt/keys')).toBe(false);
+	});
+
+	it('相对路径缺省（undefined/空）不注头', () => {
+		expect(needsNamespaceHeader(undefined)).toBe(false);
+		expect(needsNamespaceHeader('')).toBe(false);
+	});
+});

package/src/api/__tests__/preflight-refresh.test.ts

@@ -0,0 +1,89 @@
+// @vitest-environment jsdom
+// U352 回归锁：预判式刷新（token 已过期 → refreshToken）成功后，必须继续走完请求注入链
+// （Authorization=新 token + X-Tenant-ID + X-Namespace + params snakeCase），
+// 不得提前 return —— 旧实现在此行 `return config` 跳过后方全部注入。
+//
+// 断言口径：走真实拦截器（只替换 axios adapter，同 contract.test.ts 先例）。
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { apiClient } from '../client';
+import { AuthService } from '../../auth/service';
+import { useAuthStore } from '../../auth/store';
+import { API_NAMESPACE } from '../../config';
+
+interface Captured {
+	url: string;
+	headers: Record<string, unknown>;
+	params?: Record<string, unknown>;
+}
+
+let captured: Captured[];
+let originalAdapter: unknown;
+
+function installCaptureAdapter() {
+	originalAdapter = apiClient.defaults.adapter;
+	apiClient.defaults.adapter = (async (config: any) => {
+		const headers = config.headers?.toJSON ? config.headers.toJSON() : { ...config.headers };
+		captured.push({
+			url: String(config.url || ''),
+			headers: headers as Record<string, unknown>,
+			params: config.params,
+		});
+		return {
+			data: { code: 0, message: 'success' },
+			status: 200,
+			statusText: 'OK',
+			headers: {},
+			config,
+		};
+	}) as any;
+}
+
+function expiredJwt(): string {
+	const payload = btoa(JSON.stringify({ exp: Math.floor(Date.now() / 1000) - 60 }));
+	return `eyJhbGciOiJIUzI1NiJ9.${payload}.sig`;
+}
+
+describe('U352: 预刷新成功后注入链完整性', () => {
+	beforeEach(() => {
+		captured = [];
+		installCaptureAdapter();
+		useAuthStore.getState().clearAuth();
+		useAuthStore.getState().setAuth(expiredJwt(), 'rt-old', {
+			id: 'u-1',
+			username: 'demo',
+		} as any);
+		useAuthStore.getState().setCurrentTenant('tenant-abc');
+	});
+
+	afterEach(() => {
+		apiClient.defaults.adapter = originalAdapter as any;
+		vi.restoreAllMocks();
+		useAuthStore.getState().clearAuth();
+	});
+
+	it('刷新成功：Authorization=新 token 且租户/namespace/snake 注入不缺席', async () => {
+		const refresh = vi.spyOn(AuthService, 'refreshToken').mockResolvedValue('FRESH-TOKEN');
+		await apiClient.get('/secret/api/v1/admin/keys', { params: { pageSize: 5 } });
+		expect(refresh).toHaveBeenCalledTimes(1);
+		expect(captured).toHaveLength(1);
+		expect(captured[0].headers['Authorization']).toBe('Bearer FRESH-TOKEN');
+		expect(captured[0].headers['X-Tenant-ID']).toBe('tenant-abc');
+		expect(captured[0].headers['X-Namespace']).toBe(API_NAMESPACE);
+		expect(captured[0].params).toEqual({ page_size: 5 });
+	});
+
+	it('刷新失败（返回 null）：回落旧 token，注入链仍完整', async () => {
+		const oldToken = useAuthStore.getState().accessToken!;
+		vi.spyOn(AuthService, 'refreshToken').mockResolvedValue(null);
+		await apiClient.get('/probe/y');
+		expect(captured[0].headers['Authorization']).toBe(`Bearer ${oldToken}`);
+		expect(captured[0].headers['X-Tenant-ID']).toBe('tenant-abc');
+	});
+
+	it('刷新抛错：吞错继续（不冒泡），仍携带旧 token 与租户头', async () => {
+		vi.spyOn(AuthService, 'refreshToken').mockRejectedValue(new Error('network'));
+		await apiClient.get('/probe/z');
+		expect(String(captured[0].headers['Authorization'])).toMatch(/^Bearer /);
+		expect(captured[0].headers['X-Tenant-ID']).toBe('tenant-abc');
+	});
+});

package/src/api/bff-client.ts

@@ -0,0 +1,94 @@
+/**
+ * BFF (Backend-For-Frontend) Auth Client
+ * 使用 httpOnly session cookie 替代 localStorage token，消除 XSS 令牌窃取风险。
+ *
+ * BFF 统一路由后：所有 API 通过 /bff/identity/api/v1/auth/* 访问。
+ */
+
+const BFF_LOGIN = '/bff/identity/api/v1/auth/login';
+const BFF_REFRESH = '/bff/identity/api/v1/auth/refresh';
+const BFF_LOGOUT = '/bff/identity/api/v1/auth/logout';
+
+interface BFFLoginResult {
+	code: number;
+	message: string;
+	data?: {
+		user?: { id: string; username?: string; email?: string };
+		expires_in?: number;
+		requires_mfa?: boolean;
+		mfa_check_reason?: string;
+		challenge_token?: string;
+		must_change_password?: boolean;
+		password_warning?: string;
+		password_expires_in?: number;
+	};
+}
+
+export async function bffLogin(
+	identity: string,
+	password: string,
+	tenantId?: string,
+): Promise<BFFLoginResult> {
+	const headers: Record<string, string> = { 'Content-Type': 'application/json' };
+	if (tenantId) {
+		headers['X-Tenant-ID'] = tenantId;
+	}
+	const resp = await fetch(BFF_LOGIN, {
+		method: 'POST',
+		headers,
+		body: JSON.stringify({ identity, password, ...(tenantId ? { tenant_id: tenantId } : {}) }),
+	});
+	if (!resp.ok) {
+		return { code: resp.status, message: `BFF unavailable (HTTP ${resp.status})` };
+	}
+	try {
+		return await resp.json();
+	} catch {
+		return { code: -1, message: 'BFF returned invalid response' };
+	}
+}
+
+export async function bffRefresh(): Promise<BFFLoginResult> {
+	const resp = await fetch(BFF_REFRESH, {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+	});
+	if (!resp.ok) {
+		return { code: resp.status, message: `BFF unavailable (HTTP ${resp.status})` };
+	}
+	try {
+		return await resp.json();
+	} catch {
+		return { code: -1, message: 'BFF returned invalid response' };
+	}
+}
+
+export async function bffLogout(): Promise<void> {
+	// BFF cookie 模式未启用时此调用无凭据可依（identity logout 必 401），不发起无意义请求。
+	// 导航归调用方（useLogout / useAuthActions.logout 自身跳转），此处只做会话吊销。
+	if (!isBFFAvailable()) return;
+	await fetch(BFF_LOGOUT, {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+	});
+}
+
+/**
+ * BFF 是否可用。
+ * 默认基于 __APP_CONFIG__ 中的 VITE_BFF_ENABLED 环境变量。
+ * 也可以在调用前通过 isBFFAvailable.override 设置（用于测试或动态切换）。
+ */
+export function isBFFAvailable(): boolean {
+	if (typeof window !== 'undefined') {
+		const cfg = (window as any).__APP_CONFIG__;
+		if (cfg?.VITE_BFF_ENABLED === 'true') return true;
+		if (cfg?.VITE_BFF_ENABLED === 'false') return false;
+	}
+	// Static override (for testing or dynamic switching)
+	if (isBFFAvailable._override !== undefined) return isBFFAvailable._override;
+	// Default: false (auth-pages opt-in via env var)
+	return false;
+}
+
+// Allow runtime override (e.g. for testing or feature-flag driven toggling)
+isBFFAvailable._override = undefined as boolean | undefined;