@autional/shared 0.0.0-stage → 0.1.0-rc.33

package/src/components/__tests__/TenantRootRedirect.test.tsx

@@ -0,0 +1,180 @@
+// @vitest-environment jsdom
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
+
+// ============================================================
+// F-W7-a：TenantRootRedirect 的裸根 slug 解析
+//  - slug 解析**唯一权威 = 公开租户名单**（id → name，name 即 slug）
+//  - 会话 store 的 tenants[].name 是**展示名**（"Demo Tenant"），拼进 URL 会落
+//    /Demo%20Tenant/ → 404（回归修复；与 auth 站 8859e4d pickSessionSlug 同口径）
+//  - 有会话但公开名单未返回：等待，不抢跑漏斗 brand
+// ============================================================
+
+const { mockState } = vi.hoisted(() => ({
+	mockState: {
+		currentTenantId: null as string | null,
+		// 会话 store 的租户（展示名口径）——回归锁：组件若回退用它，断言必红
+		storeTenants: [] as Array<{ id: string; name: string; role: string }>,
+		replace: vi.fn(),
+	},
+}));
+
+vi.mock('../../hooks/useAuth', async (importOriginal) => ({
+	...(await importOriginal<typeof import('../../hooks/useAuth')>()),
+	useCurrentTenantId: () => mockState.currentTenantId,
+	useTenants: () => mockState.storeTenants,
+}));
+
+import { TenantRootRedirect } from '../TenantRootRedirect';
+import { getPortalUrl } from '../../config';
+
+function wrapper(children: ReactNode) {
+	return (
+		<QueryClientProvider
+			client={new QueryClient({ defaultOptions: { queries: { retry: false, gcTime: Infinity } } })}
+		>
+			{children}
+		</QueryClientProvider>
+	);
+}
+
+function stubTenantList(items: unknown[]) {
+	vi.stubGlobal(
+		'fetch',
+		vi.fn().mockResolvedValue({
+			ok: true,
+			status: 200,
+			json: async () => ({ code: 0, message: 'success', items, total: items.length }),
+		}),
+	);
+}
+
+function expectedBrandFunnel() {
+	return `${getPortalUrl('brand')}/?redirect=${encodeURIComponent(
+		window.location.origin + window.location.pathname,
+	)}`;
+}
+
+/** 剥除 authTrace 面包屑（rt=）后比较；rt 装饰本身由专门断言锁定。 */
+function withoutRt(url: string): string {
+	const u = new URL(url, 'http://trace.invalid');
+	u.searchParams.delete('rt');
+	return u.pathname + u.search;
+}
+
+const originalWindowLocation = window.location;
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	mockState.currentTenantId = null;
+	mockState.storeTenants = [];
+	window.history.pushState({}, '', '/');
+	delete (window as any).__APP_CONFIG__;
+
+	// replace 拦截 + 关键读取面委托真身（pushState 后仍反映当前值）
+	delete (window as any).location;
+	(window as any).location = Object.defineProperties(
+		{},
+		{
+			...Object.getOwnPropertyDescriptors(originalWindowLocation),
+			protocol: { get: () => originalWindowLocation.protocol, configurable: true },
+			hostname: { get: () => originalWindowLocation.hostname, configurable: true },
+			origin: { get: () => originalWindowLocation.origin, configurable: true },
+			href: { get: () => originalWindowLocation.href, configurable: true },
+			pathname: { get: () => originalWindowLocation.pathname, configurable: true },
+			replace: { get: () => mockState.replace, configurable: true },
+		},
+	);
+});
+
+afterEach(() => {
+	if (window.location !== originalWindowLocation) {
+		Object.defineProperty(window, 'location', { value: originalWindowLocation, writable: true });
+	}
+	cleanup();
+	vi.unstubAllGlobals();
+});
+
+describe('TenantRootRedirect 裸根漏斗', () => {
+	it('有会话 + 名单命中 → 跳 /<slug>/，且 slug 取自公开名单（非展示名）', async () => {
+		mockState.currentTenantId = 't1';
+		// 会话 store 里是展示名（老缺陷来源）——组件不得使用
+		mockState.storeTenants = [{ id: 't1', name: 'Demo Tenant', role: 'owner' }];
+		stubTenantList([{ id: 't1', name: 'demo', display_name: 'Demo Tenant' }]);
+
+		render(wrapper(<TenantRootRedirect />));
+
+		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
+		const url = String(mockState.replace.mock.calls[0][0]);
+		expect(url).toContain('rt=localhost.funnel-slug.');
+		expect(withoutRt(url)).toBe('/demo/');
+		expect(url).not.toContain('Demo%20Tenant');
+		expect(url).not.toContain('Demo');
+	});
+
+	it('名单项只有 slug 字段（无 name）→ 回退 slug', async () => {
+		mockState.currentTenantId = 't1';
+		stubTenantList([{ id: 't1', slug: 'demo-fallback' }]);
+
+		render(wrapper(<TenantRootRedirect />));
+
+		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
+		expect(withoutRt(String(mockState.replace.mock.calls[0][0]))).toBe('/demo-fallback/');
+	});
+
+	it('有会话但名单未返回（加载中）→ 等待，不抢跑 brand 漏斗', async () => {
+		mockState.currentTenantId = 't1';
+		vi.stubGlobal('fetch', vi.fn().mockReturnValue(new Promise(() => {})));
+
+		render(wrapper(<TenantRootRedirect />));
+
+		await new Promise((r) => setTimeout(r, 60));
+		expect(mockState.replace).not.toHaveBeenCalled();
+	});
+
+	it('无会话 → 漏斗 brand（带 redirect=当前 origin+pathname）', async () => {
+		stubTenantList([{ id: 't1', name: 'demo' }]);
+
+		render(wrapper(<TenantRootRedirect />));
+
+		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
+		expect(withoutRt(String(mockState.replace.mock.calls[0][0]))).toBe(withoutRt(expectedBrandFunnel()));
+	});
+
+	it('有会话但名单无匹配（陈旧会话）→ 漏斗 brand', async () => {
+		mockState.currentTenantId = 't-unknown';
+		stubTenantList([{ id: 't1', name: 'demo' }]);
+
+		render(wrapper(<TenantRootRedirect />));
+
+		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
+		expect(withoutRt(String(mockState.replace.mock.calls[0][0]))).toBe(withoutRt(expectedBrandFunnel()));
+	});
+
+	it('名单接口失败（返回空数组）→ 有会话按无匹配处理，漏斗 brand（不卡死）', async () => {
+		mockState.currentTenantId = 't1';
+		vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('network down')));
+
+		render(wrapper(<TenantRootRedirect />));
+
+		await waitFor(() => expect(mockState.replace).toHaveBeenCalled());
+		expect(withoutRt(String(mockState.replace.mock.calls[0][0]))).toBe(withoutRt(expectedBrandFunnel()));
+	});
+
+	it('门户不可派生（IP 主机，如 127.0.0.1 静态托管）→ 不导航，保持当前页（不炸 ErrorBoundary）', async () => {
+		stubTenantList([{ id: 't1', name: 'demo' }]);
+		Object.defineProperties(window.location, {
+			hostname: { get: () => '127.0.0.1', configurable: true },
+			origin: { get: () => 'http://127.0.0.1:18951', configurable: true },
+			protocol: { get: () => 'http:', configurable: true },
+		});
+
+		render(wrapper(<TenantRootRedirect />));
+
+		await new Promise((r) => setTimeout(r, 80));
+		expect(mockState.replace).not.toHaveBeenCalled();
+	});
+});

package/src/config/__tests__/portal-resolver.test.ts

@@ -0,0 +1,302 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { getRootDomain, getPortalUrl } from '../index';
+
+// ─── getRootDomain (pure function, no mock needed) ───
+
+describe('getRootDomain', () => {
+	it.each([
+		// [hostname, expected]
+		['app.iam.tianv.local', 'iam.tianv.local'],
+		['auth.iam.tianv.local', 'iam.tianv.local'],
+		['app.iam.tianv.com', 'iam.tianv.com'],
+		['auth.iam.tianv.com', 'iam.tianv.com'],
+		['app.autional.com', 'autional.com'],
+		['auth.autional.com', 'autional.com'],
+		['iam.tianv.com', 'tianv.com'], // root domain itself
+		['127.0.0.1', '127.0.0.1'], // IP address
+		['localhost', 'localhost'], // localhost
+	])('hostname=%s → %s', (hostname, expected) => {
+		expect(getRootDomain(hostname)).toBe(expected);
+	});
+});
+
+// ─── getPortalUrl (requires window mock) ───
+
+const LOCAL_CONFIG = {
+	VITE_PORTAL_CONFIG: {
+		auth: { host: 'auth', base: '' },
+		landing: { host: '', base: '' },
+		admin: { host: 'app', base: '/admin' },
+		developer: { host: 'app', base: '/developer' },
+		platform: { host: 'platform', base: '' },
+		status: { host: 'status', base: '' },
+		trust: { host: 'trust', base: '' },
+		user: { host: 'user', base: '' },
+		authenticator: { host: 'authenticator', base: '' },
+		security: { host: 'app', base: '/security' },
+	},
+};
+
+const COM_CONFIG = {
+	VITE_PORTAL_CONFIG: {
+		...LOCAL_CONFIG.VITE_PORTAL_CONFIG,
+	},
+};
+
+describe('getPortalUrl', () => {
+	beforeEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	describe('with VITE_PORTAL_CONFIG + .local domain', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.iam.tianv.local',
+					protocol: 'https:',
+					origin: 'https://app.iam.tianv.local',
+				},
+				__APP_CONFIG__: LOCAL_CONFIG,
+			});
+		});
+
+		it('resolves auth to auth.* subdomain', () => {
+			expect(getPortalUrl('auth')).toBe('https://auth.iam.tianv.local');
+		});
+
+		it('resolves landing to root domain', () => {
+			expect(getPortalUrl('landing')).toBe('https://iam.tianv.local');
+		});
+
+		it('resolves app-* portals to app.* subdomain with base path', () => {
+			expect(getPortalUrl('admin')).toBe('https://app.iam.tianv.local/admin');
+			expect(getPortalUrl('developer')).toBe('https://app.iam.tianv.local/developer');
+			expect(getPortalUrl('security')).toBe('https://app.iam.tianv.local/security');
+		});
+
+		it('resolves platform to its own subdomain', () => {
+			expect(getPortalUrl('platform')).toBe('https://platform.iam.tianv.local');
+		});
+
+		it('resolves status to its own subdomain', () => {
+			expect(getPortalUrl('status')).toBe('https://status.iam.tianv.local');
+		});
+
+		it('resolves trust to its own subdomain', () => {
+			expect(getPortalUrl('trust')).toBe('https://trust.iam.tianv.local');
+		});
+
+		it('resolves user to its own subdomain', () => {
+			expect(getPortalUrl('user')).toBe('https://user.iam.tianv.local');
+		});
+
+		it('resolves authenticator to its own subdomain', () => {
+			expect(getPortalUrl('authenticator')).toBe('https://authenticator.iam.tianv.local');
+		});
+	});
+
+	describe('with VITE_PORTAL_CONFIG + .com domain', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.iam.tianv.com',
+					protocol: 'https:',
+					origin: 'https://app.iam.tianv.com',
+				},
+				__APP_CONFIG__: COM_CONFIG,
+			});
+		});
+
+		it('resolves auth to auth.*.com subdomain', () => {
+			expect(getPortalUrl('auth')).toBe('https://auth.iam.tianv.com');
+		});
+
+		it('resolves admin to app.*.com/admin', () => {
+			expect(getPortalUrl('admin')).toBe('https://app.iam.tianv.com/admin');
+		});
+
+		it('resolves platform to platform.*.com', () => {
+			expect(getPortalUrl('platform')).toBe('https://platform.iam.tianv.com');
+		});
+	});
+
+	describe('with VITE_PORTAL_CONFIG + autional.com domain', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.autional.com',
+					protocol: 'https:',
+					origin: 'https://app.autional.com',
+				},
+				__APP_CONFIG__: COM_CONFIG,
+			});
+		});
+
+		it('resolves auth to auth.autional.com', () => {
+			expect(getPortalUrl('auth')).toBe('https://auth.autional.com');
+		});
+
+		it('resolves admin to app.autional.com/admin', () => {
+			expect(getPortalUrl('admin')).toBe('https://app.autional.com/admin');
+		});
+
+		it('resolves landing to autional.com', () => {
+			expect(getPortalUrl('landing')).toBe('https://autional.com');
+		});
+	});
+
+	describe('fallback when VITE_PORTAL_CONFIG is absent (old env.js)', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.iam.tianv.local',
+					protocol: 'https:',
+					origin: 'https://app.iam.tianv.local',
+				},
+				__APP_CONFIG__: {
+					VITE_AUTH_PAGES_URL: 'https://auth.iam.tianv.com',
+					VITE_ADMIN_CONSOLE_URL: 'https://app.iam.tianv.com/admin',
+				},
+			});
+		});
+
+		it('falls back to VITE_AUTH_PAGES_URL for auth', () => {
+			expect(getPortalUrl('auth')).toBe('https://auth.iam.tianv.com');
+		});
+
+		it('falls back to VITE_ADMIN_CONSOLE_URL for admin', () => {
+			expect(getPortalUrl('admin')).toBe('https://app.iam.tianv.com/admin');
+		});
+
+		it('falls back to origin for unknown portal', () => {
+			expect(getPortalUrl('unknown')).toBe('https://app.iam.tianv.local/unknown');
+		});
+	});
+
+	describe('tenant slug is gated by portal shape (F-W8)', () => {
+		const CN_CONFIG = {
+			VITE_PORTAL_CONFIG: {
+				auth: { host: 'auth', base: '' },
+				admin: { host: 'admin', base: '' },
+				developer: { host: 'developer', base: '' },
+				platform: { host: 'platform', base: '' },
+				status: { host: 'status', base: '' },
+				trust: { host: 'trust', base: '' },
+				user: { host: 'user', base: '' },
+				authenticator: { host: 'authenticator', base: '' },
+				security: { host: 'security', base: '' },
+				brand: { host: 'brand', base: '' },
+			},
+		};
+
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'auth.autional.cn',
+					protocol: 'https:',
+					origin: 'https://auth.autional.cn',
+				},
+				__APP_CONFIG__: CN_CONFIG,
+			});
+		});
+
+		it('appends /<slug> for tenant-scoped portals', () => {
+			expect(getPortalUrl('auth', 'demo')).toBe('https://auth.autional.cn/demo');
+			expect(getPortalUrl('admin', 'demo')).toBe('https://admin.autional.cn/demo');
+			expect(getPortalUrl('user', 'demo')).toBe('https://user.autional.cn/demo');
+			expect(getPortalUrl('security', 'demo')).toBe('https://security.autional.cn/demo');
+			expect(getPortalUrl('authenticator', 'demo')).toBe(
+				'https://authenticator.autional.cn/demo',
+			);
+			expect(getPortalUrl('platform', 'demo')).toBe('https://platform.autional.cn/demo');
+		});
+
+		it('keeps domain-root portals at root even when a slug is passed', () => {
+			expect(getPortalUrl('status', 'demo')).toBe('https://status.autional.cn');
+			expect(getPortalUrl('trust', 'demo')).toBe('https://trust.autional.cn');
+			expect(getPortalUrl('developer', 'demo')).toBe('https://developer.autional.cn');
+			expect(getPortalUrl('brand', 'demo')).toBe('https://brand.autional.cn');
+		});
+	});
+
+	describe('tenant slug gate applies to legacy VITE_*_URL and default-table branches', () => {
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: 'app.iam.tianv.local',
+					protocol: 'https:',
+					origin: 'https://app.iam.tianv.local',
+				},
+				__APP_CONFIG__: {
+					VITE_AUTH_PAGES_URL: 'https://auth.iam.tianv.com',
+					VITE_PLATFORM_CONSOLE_URL: 'https://platform.iam.tianv.com',
+				},
+			});
+		});
+
+		it('legacy branch: slug appended for auth and platform', () => {
+			expect(getPortalUrl('auth', 'demo')).toBe('https://auth.iam.tianv.com/demo');
+			expect(getPortalUrl('platform', 'demo')).toBe('https://platform.iam.tianv.com/demo');
+		});
+
+		it('default-table branch: slug appended for user, not for status', () => {
+			expect(getPortalUrl('user', 'demo')).toBe('https://user.iam.tianv.local/demo');
+			expect(getPortalUrl('status', 'demo')).toBe('https://status.iam.tianv.local');
+		});
+	});
+
+	describe('IP host cannot derive subdomain portals (guard returns empty ⇒ callers fall back)', () => {
+		const IP_CONFIG = {
+			VITE_PORTAL_CONFIG: {
+				auth: { host: 'auth', base: '' },
+				landing: { host: '', base: '' },
+				brand: { host: 'brand', base: '' },
+			},
+		};
+
+		beforeEach(() => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: '127.0.0.1',
+					protocol: 'http:',
+					origin: 'http://127.0.0.1:18951',
+				},
+				__APP_CONFIG__: IP_CONFIG,
+			});
+		});
+
+		it('subdomain portals (brand/auth, with or without slug) → empty string', () => {
+			expect(getPortalUrl('brand')).toBe('');
+			expect(getPortalUrl('auth')).toBe('');
+			expect(getPortalUrl('auth', 'demo')).toBe('');
+		});
+
+		it('host-less portals stay resolvable: landing = IP root itself (legal)', () => {
+			expect(getPortalUrl('landing')).toBe('http://127.0.0.1');
+		});
+
+		it('192.168.x.x private IP: same guard', () => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: '192.168.3.201',
+					protocol: 'http:',
+					origin: 'http://192.168.3.201',
+				},
+				__APP_CONFIG__: IP_CONFIG,
+			});
+			expect(getPortalUrl('brand')).toBe('');
+		});
+
+		it('default-table branch (no env config) under IP host: same guard', () => {
+			vi.stubGlobal('window', {
+				location: {
+					hostname: '127.0.0.1',
+					protocol: 'http:',
+					origin: 'http://127.0.0.1:18951',
+				},
+			});
+			expect(getPortalUrl('brand')).toBe('');
+			expect(getPortalUrl('landing')).toBe('http://127.0.0.1');
+		});
+	});
+});

package/src/config/__tests__/valid-redirect.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// 动态导入被测函数，避免顶层 window 依赖
+import { isValidRedirect } from '../index';
+
+describe('isValidRedirect', () => {
+	beforeEach(() => {
+		vi.stubGlobal('window', {
+			location: {
+				origin: 'https://auth.iam.tianv.local',
+				hostname: 'auth.iam.tianv.local',
+			},
+		});
+	});
+
+	afterEach(() => {
+		vi.unstubAllGlobals();
+	});
+
+	it('accepts same-origin relative path', () => {
+		expect(isValidRedirect('/acme-corp/dashboard')).toBe(true);
+	});
+
+	it('accepts same-origin absolute URL', () => {
+		expect(isValidRedirect('https://auth.iam.tianv.local/acme-corp/dashboard')).toBe(true);
+	});
+
+	it('rejects protocol-relative URL (open redirect)', () => {
+		expect(isValidRedirect('//evil.com')).toBe(false);
+	});
+
+	it('rejects backslash protocol-relative variant', () => {
+		expect(isValidRedirect('/\\evil.com')).toBe(false);
+	});
+
+	it('rejects percent-encoded backslash variant', () => {
+		expect(isValidRedirect('/%5cevil.com')).toBe(false);
+	});
+
+	it('rejects external http URL not in allowlist', () => {
+		expect(isValidRedirect('https://evil.com/phish')).toBe(false);
+	});
+
+	it('rejects empty string', () => {
+		expect(isValidRedirect('')).toBe(false);
+	});
+});

package/src/config/constants.ts

@@ -0,0 +1,27 @@
+// Build-time domain constants (used by Astro SSG for SEO meta tags).
+// For runtime resolution, use getRootDomain() + getPortalUrl() from ./index.
+// Override via SITE_DOMAIN env var for multi-environment builds.
+
+function getEnv(key: string, fallback: string): string {
+	try {
+		const val = (import.meta as any).env?.[key];
+		if (val) return val;
+	} catch {
+		/* SSR may not have import.meta */
+	}
+	return fallback;
+}
+
+export const SITE_DOMAIN = getEnv('SITE_DOMAIN', 'iam.tianv.com');
+export const SITE_EMAIL = getEnv('SITE_EMAIL', 'support@autional.net');
+export const SITE_BASE_URL = `https://${SITE_DOMAIN}`;
+export const AUTH_DOMAIN = `auth.${SITE_DOMAIN}`;
+export const USER_DOMAIN = `user.${SITE_DOMAIN}`;
+export const APP_DOMAIN = `app.${SITE_DOMAIN}`;
+export const AUTHENTICATOR_DOMAIN = `authenticator.${SITE_DOMAIN}`;
+export const AUTH_BASE_URL = `https://${AUTH_DOMAIN}`;
+export const USER_BASE_URL = `https://${USER_DOMAIN}`;
+export const APP_BASE_URL = `https://${APP_DOMAIN}`;
+export const AUTHENTICATOR_BASE_URL = `https://${AUTHENTICATOR_DOMAIN}`;
+export const DEFAULT_OG_IMAGE = `${SITE_BASE_URL}/og-image.svg`;
+export const DEFAULT_LOGO = `${SITE_BASE_URL}/logo.png`;