@autional/shared 0.0.0-stage → 0.1.0-rc.33

package/src/hooks/__tests__/useBootstrap.test.tsx

@@ -0,0 +1,91 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { renderHook, cleanup } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+
+// ============================================================
+// F-W5b 回归锁：useBootstrap 无会话时必须 'idle'，不得 'loading'
+//  —— platform-console LayoutWrapper 以 bootstrap==='loading' 挡 Outlet，
+//     而 RequireAuth（唯一登录交棒点）在 Outlet 内 ⇒ 无会话冷启动永停 Spin。
+// ============================================================
+
+const { mockQueries } = vi.hoisted(() => ({
+	mockQueries: {
+		perms: { data: undefined as unknown, isError: false },
+		tenants: { data: undefined as unknown, isError: false },
+	},
+}));
+
+vi.mock('../../auth/auth-queries', () => ({
+	usePermissionsQuery: () => mockQueries.perms,
+	useTenantsQuery: () => mockQueries.tenants,
+}));
+
+import { useBootstrap } from '../useBootstrap';
+import { useAuthStore } from '../../auth/store';
+
+const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+
+function wrapper({ children }: { children: React.ReactNode }) {
+	return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>;
+}
+
+function resetAuthStore(): void {
+	useAuthStore.setState({
+		user: null,
+		accessToken: null,
+		refreshToken: null,
+		tenants: [],
+		currentTenantId: null,
+		permissions: [],
+		isAuthenticated: false,
+	});
+	window.localStorage.clear();
+}
+
+describe('useBootstrap（F-W5b 无会话语义）', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		resetAuthStore();
+		mockQueries.perms = { data: undefined, isError: false };
+		mockQueries.tenants = { data: undefined, isError: false };
+	});
+
+	afterEach(() => {
+		cleanup();
+		resetAuthStore();
+	});
+
+	it('无 token → idle（回归锁：返回 loading 会让 Layout 消费者永停 Spin）', () => {
+		const { result } = renderHook(() => useBootstrap(), { wrapper });
+		expect(result.current).toBe('idle');
+		expect(result.current).not.toBe('loading');
+	});
+
+	it('无 token 且 store 残留数据 → 仍 idle（登出/切换租户后的残态不得冒充 ready）', () => {
+		useAuthStore.setState({
+			accessToken: null,
+			permissions: ['user.read'],
+			tenants: [{ id: 't1', name: 'demo', role: 'member' }],
+		});
+		const { result } = renderHook(() => useBootstrap(), { wrapper });
+		expect(result.current).toBe('idle');
+	});
+
+	it('有 token + store 已缓存权限与租户 → ready', () => {
+		useAuthStore.setState({
+			accessToken: 'token-xyz',
+			permissions: ['user.read'],
+			tenants: [{ id: 't1', name: 'demo', role: 'member' }],
+		});
+		const { result } = renderHook(() => useBootstrap(), { wrapper });
+		expect(result.current).toBe('ready');
+	});
+
+	it('有 token 但查询尚未到达 → loading（保持既有等待语义）', () => {
+		useAuthStore.setState({ accessToken: 'token-xyz' });
+		const { result } = renderHook(() => useBootstrap(), { wrapper });
+		expect(result.current).toBe('loading');
+	});
+});

package/src/hooks/__tests__/useCurrentRole.test.tsx

@@ -0,0 +1,122 @@
+// @vitest-environment jsdom
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { renderHook, act, cleanup } from '@testing-library/react';
+import { useAuthStore } from '../../auth/store';
+import { useCurrentRole } from '../useCurrentRole';
+
+const TENANTS = [
+	{ id: 'tenant-a', name: 'Tenant A', role: 'admin' },
+	{ id: 'tenant-b', name: 'Tenant B', role: 'member' },
+];
+
+/** 重置 store + localStorage，避免跨用例污染（AC-002 约定） */
+function resetAuthStore(): void {
+	useAuthStore.setState({
+		user: null,
+		accessToken: null,
+		refreshToken: null,
+		tenants: [],
+		currentTenantId: null,
+		permissions: [],
+		isAuthenticated: false,
+	});
+	window.localStorage.clear();
+}
+
+describe('useCurrentRole (AC-002 响应式，zustand selector 订阅 store 本身)', () => {
+	beforeEach(() => {
+		resetAuthStore();
+	});
+
+	afterEach(() => {
+		cleanup();
+		resetAuthStore();
+	});
+
+	it('初始空 store → null', () => {
+		const { result } = renderHook(() => useCurrentRole());
+		expect(result.current).toBeNull();
+	});
+
+	it('渲染后直写 store（setState）→ re-render + 新值', () => {
+		const { result } = renderHook(() => useCurrentRole());
+		expect(result.current).toBeNull();
+
+		act(() => {
+			useAuthStore.setState({ tenants: TENANTS, currentTenantId: 'tenant-a' });
+		});
+		expect(result.current).toBe('admin');
+
+		act(() => {
+			useAuthStore.setState({ currentTenantId: 'tenant-b' });
+		});
+		expect(result.current).toBe('member');
+	});
+
+	it('updateTenants / updateCurrentTenant action 后重渲染新值', () => {
+		const { result } = renderHook(() => useCurrentRole());
+		expect(result.current).toBeNull();
+
+		act(() => {
+			useAuthStore.getState().setTenants(TENANTS);
+		});
+		expect(result.current).toBeNull(); // 有租户但未选 → 不猜测
+
+		act(() => {
+			useAuthStore.getState().setCurrentTenant('tenant-b');
+		});
+		expect(result.current).toBe('member');
+
+		act(() => {
+			useAuthStore.getState().switchTenant('tenant-a');
+		});
+		expect(result.current).toBe('admin');
+	});
+
+	it('logout 清空（tenants [] / currentTenantId null）→ null', () => {
+		const { result } = renderHook(() => useCurrentRole());
+
+		act(() => {
+			useAuthStore.setState({ tenants: TENANTS, currentTenantId: 'tenant-a' });
+		});
+		expect(result.current).toBe('admin');
+
+		act(() => {
+			useAuthStore.getState().clearAuth();
+		});
+		expect(result.current).toBeNull();
+	});
+
+	it('selector 原语稳定：无关字段变更不触发 re-render（Object.is 比较）', () => {
+		let renderCount = 0;
+		const { result } = renderHook(() => {
+			renderCount++;
+			return useCurrentRole();
+		});
+
+		act(() => {
+			useAuthStore.setState({ tenants: TENANTS, currentTenantId: 'tenant-a' });
+		});
+		expect(result.current).toBe('admin');
+		const afterRoleSet = renderCount;
+
+		// 无关字段变更（permissions）→ selector 结果相同 → 不 re-render
+		act(() => {
+			useAuthStore.setState({ permissions: ['tenant:user:read'] });
+		});
+		expect(result.current).toBe('admin');
+		expect(renderCount).toBe(afterRoleSet);
+
+		// 相同 role、不同数组引用 → 返回值仍是 string 原语 → 不 re-render
+		act(() => {
+			useAuthStore.setState({
+				tenants: [
+					{ id: 'tenant-a', name: 'Tenant A', role: 'admin' },
+					{ id: 'tenant-b', name: 'Tenant B', role: 'member' },
+				],
+			});
+		});
+		expect(result.current).toBe('admin');
+		expect(renderCount).toBe(afterRoleSet);
+	});
+});

package/src/hooks/__tests__/useCurrentTenantIdOr.test.tsx

@@ -0,0 +1,38 @@
+// @vitest-environment jsdom
+import { describe, it, expect, beforeEach } from 'vitest';
+import { renderHook } from '@testing-library/react';
+import { useAuthStore } from '../../auth/store';
+import { useCurrentTenantIdOr } from '../useCurrentTenantIdOr';
+
+// 这个 hook 存在的理由就是**回落链的三段**，所以三段各验一条：
+//   已选租户 → 用它；未选但列表非空 → tenants[0]（BUG-013 的修法）；都没有 → 调用方给的 fallback。
+// 顺带锁死「同名两种语义」那个坑：platform 原来直接返回 fallback、不取 tenants[0]。
+const T = (id: string) => ({ id, name: id, role: 'admin' });
+
+describe('useCurrentTenantIdOr', () => {
+	beforeEach(() => {
+		useAuthStore.setState({ currentTenantId: null, tenants: [] } as never);
+	});
+
+	it('已选租户时用当前租户', () => {
+		useAuthStore.setState({ currentTenantId: 't-current', tenants: [T('t-current'), T('t-other')] } as never);
+		const { result } = renderHook(() => useCurrentTenantIdOr('fallback'));
+		expect(result.current).toBe('t-current');
+	});
+
+	it('未选租户但列表非空：回落 tenants[0]（不直接用 fallback）', () => {
+		useAuthStore.setState({ currentTenantId: null, tenants: [T('t-first'), T('t-second')] } as never);
+		const { result } = renderHook(() => useCurrentTenantIdOr('fallback'));
+		expect(result.current).toBe('t-first');
+	});
+
+	it('连租户列表都空：才用调用方给的 fallback', () => {
+		const { result } = renderHook(() => useCurrentTenantIdOr('fallback'));
+		expect(result.current).toBe('fallback');
+	});
+
+	it('fallback 传空串时得到空串（「无租户」的一种显式表示）', () => {
+		const { result } = renderHook(() => useCurrentTenantIdOr(''));
+		expect(result.current).toBe('');
+	});
+});

package/src/hooks/__tests__/useLogout.test.tsx

@@ -0,0 +1,61 @@
+// @vitest-environment jsdom
+// ============================================================
+// AUTH-40：useLogout 落点口径锁——
+//  ① 缺省回程 = 捕获的当前 URL（EntryRouter 据此解析租户 → /<slug>/login）
+//  ② returnUrl 覆盖：裸 /logout 无 URL 租户段时由调用方补回上下文
+//  ③ 顺序契约：先终结会话（AuthService.logout）再导航
+// ============================================================
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { renderHook } from '@testing-library/react';
+
+const { mockLogout, mockTraceRedirect } = vi.hoisted(() => ({
+	mockLogout: vi.fn(() => Promise.resolve()),
+	mockTraceRedirect: vi.fn(),
+}));
+
+vi.mock('../../auth/service', () => ({ AuthService: { logout: mockLogout } }));
+vi.mock('../../auth/auth-trace', () => ({ traceRedirect: mockTraceRedirect }));
+vi.mock('../../config', () => ({
+	getPortalUrl: (portal: string) => (portal === 'auth' ? 'https://auth.example.com' : ''),
+}));
+
+import { useLogout } from '../useLogout';
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	window.history.replaceState(null, '', '/demo/dashboard');
+});
+
+describe('useLogout 落点口径（AUTH-40）', () => {
+	it('缺省：回程 = 当前 URL（带租户段），先登出后导航', async () => {
+		const { result } = renderHook(() => useLogout());
+		result.current();
+
+		await vi.waitFor(() => expect(mockTraceRedirect).toHaveBeenCalledTimes(1));
+		expect(mockLogout).toHaveBeenCalledTimes(1);
+
+		const [url, opts] = mockTraceRedirect.mock.calls[0];
+		expect(url).toBe(
+			'https://auth.example.com/?redirect=' +
+				encodeURIComponent('http://localhost:3000/demo/dashboard') +
+				'&logout=1',
+		);
+		expect(opts).toMatchObject({ reason: 'logout', assign: true });
+		expect(mockLogout.mock.invocationCallOrder[0]).toBeLessThan(
+			mockTraceRedirect.mock.invocationCallOrder[0] as number,
+		);
+	});
+
+	it('returnUrl 覆盖：裸 /logout 用调用方补回的租户上下文（无渲染页 URL 依赖）', async () => {
+		const { result } = renderHook(() => useLogout({ returnUrl: '/demo/dashboard' }));
+		result.current();
+
+		await vi.waitFor(() => expect(mockTraceRedirect).toHaveBeenCalledTimes(1));
+		const [url] = mockTraceRedirect.mock.calls[0];
+		expect(url).toBe(
+			'https://auth.example.com/?redirect=' +
+				encodeURIComponent('/demo/dashboard') +
+				'&logout=1',
+		);
+	});
+});

package/src/hooks/__tests__/usePermission.map.test.tsx

@@ -0,0 +1,156 @@
+// @vitest-environment jsdom
+// TASK-AB1-12（fix-admin-b1-guard-contract / A-444①③ · RC-6 · D4 补二裁一）：
+// PERMISSION_MAP 映射层回归锁 —— 观测口径 = can()（hook 不暴露 effectivePerms，can 即映射结果函数）。
+// 码集 = service-rbac db/seeds/platform_rbac.go 实际 seed：
+//   security_admin（11 码）/ user_manager / member / guest。
+//
+// 覆盖：B1 裁撤（user:read 去 tenant:user:read）+ B2 裁撤（role:read 去 tenant:role:read）
+//       + D4 补源（agent/robot/device:read → tenant:nhi:read；status:read → tenant:monitor:read；
+//         oauth:read → tenant:oauth:read）+ billing 不补（负向）。
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { renderHook, act, cleanup } from '@testing-library/react';
+import { useAuthStore } from '../../auth/store';
+import { usePermission } from '../usePermission';
+
+const SECURITY_ADMIN_CODES = [
+	'audit:read',
+	'compliance:read',
+	'role:read',
+	'session:read',
+	'user:read',
+	'status:read',
+	'oauth:read',
+	'agent:read',
+	'robot:read',
+	'robot:health:read',
+	'device:read',
+];
+const USER_MANAGER_CODES = ['profile:read', 'user:create', 'user:delete', 'user:read', 'user:update'];
+const MEMBER_CODES = ['profile:read', 'user:read'];
+const GUEST_CODES = ['user:read'];
+
+/** 重置 store + localStorage，避免跨用例污染。 */
+function resetAuthStore(): void {
+	useAuthStore.setState({
+		user: null,
+		accessToken: null,
+		refreshToken: null,
+		tenants: [],
+		currentTenantId: null,
+		permissions: [],
+		isAuthenticated: false,
+	});
+	window.localStorage.clear();
+}
+
+/** 挂载 hook 并以非 admin 角色播种码集（admin 角色会走 tenant:* 前缀豁免，无法判别映射）。 */
+function mountCan(role: string, permissions: string[]) {
+	const { result } = renderHook(() => usePermission());
+	act(() => {
+		useAuthStore.setState({
+			tenants: [{ id: 'tenant-a', name: 'Tenant A', role }],
+			currentTenantId: 'tenant-a',
+			permissions,
+		});
+	});
+	return (p: string) => result.current.can(p);
+}
+
+describe('AB1-12 映射表（AC-AB1-24）', () => {
+	beforeEach(() => {
+		resetAuthStore();
+	});
+
+	afterEach(() => {
+		cleanup();
+		resetAuthStore();
+	});
+
+	describe('B1 裁撤：user:read 去掉 tenant:user:read', () => {
+		it('user_manager 经 user:create 仍见 /users（不回归）', () => {
+			const can = mountCan('user_manager', USER_MANAGER_CODES);
+			expect(can('tenant:user:read')).toBe(true);
+		});
+
+		it('user_manager 保留 user:read 的其余映射（dashboard/self:profile）', () => {
+			const can = mountCan('user_manager', USER_MANAGER_CODES);
+			expect(can('tenant:dashboard:read')).toBe(true);
+			expect(can('self:profile:read')).toBe(true);
+		});
+
+		it('member 不显 /users（仅 user:read，无映射源）', () => {
+			const can = mountCan('member', MEMBER_CODES);
+			expect(can('tenant:user:read')).toBe(false);
+		});
+
+		it('member 仍持 user:read 的保留映射（dashboard）——裁撤只摘一个目标键', () => {
+			const can = mountCan('member', MEMBER_CODES);
+			expect(can('tenant:dashboard:read')).toBe(true);
+		});
+
+		it('guest 不显 /users', () => {
+			const can = mountCan('guest', GUEST_CODES);
+			expect(can('tenant:user:read')).toBe(false);
+		});
+	});
+
+	describe('B2 裁撤：role:read 去掉 tenant:role:read', () => {
+		it('security_admin 不显 /roles 与 /role-activations（同键双面）', () => {
+			const can = mountCan('security_admin', SECURITY_ADMIN_CODES);
+			expect(can('tenant:role:read')).toBe(false);
+		});
+
+		it('security_admin 的 audit/compliance 读面不回归（audit:read 映射保留）', () => {
+			const can = mountCan('security_admin', SECURITY_ADMIN_CODES);
+			expect(can('tenant:audit:read')).toBe(true);
+			expect(can('tenant:compliance:read')).toBe(true);
+		});
+	});
+
+	describe('D4 补源：三组新映射逐码可授予', () => {
+		it('agent:read / robot:read / device:read 各自可授予 tenant:nhi:read（NHI 父键+叶）', () => {
+			for (const code of ['agent:read', 'robot:read', 'device:read']) {
+				const can = mountCan('member', [code]);
+				expect(can('tenant:nhi:read'), `code=${code}`).toBe(true);
+			}
+		});
+
+		it('status:read ⇒ tenant:monitor:read（/status）', () => {
+			const can = mountCan('security_admin', ['status:read']);
+			expect(can('tenant:monitor:read')).toBe(true);
+		});
+
+		it('oauth:read ⇒ tenant:oauth:read（/oauth-clients）', () => {
+			const can = mountCan('security_admin', ['oauth:read']);
+			expect(can('tenant:oauth:read')).toBe(true);
+		});
+
+		it('security_admin 全码集下三组补源同时生效', () => {
+			const can = mountCan('security_admin', SECURITY_ADMIN_CODES);
+			expect(can('tenant:nhi:read')).toBe(true);
+			expect(can('tenant:monitor:read')).toBe(true);
+			expect(can('tenant:oauth:read')).toBe(true);
+		});
+	});
+
+	describe('负向：不越权 + billing 不补', () => {
+		it('补源不外溢：status:read 不授予 tenant:user:read / tenant:role:read / tenant:nhi:read', () => {
+			const can = mountCan('security_admin', ['status:read']);
+			expect(can('tenant:user:read')).toBe(false);
+			expect(can('tenant:role:read')).toBe(false);
+			expect(can('tenant:nhi:read')).toBe(false);
+		});
+
+		it('billing 不补（D4 裁撤）：security_admin 全码集也拿不到 tenant:billing:read', () => {
+			const can = mountCan('security_admin', SECURITY_ADMIN_CODES);
+			expect(can('tenant:billing:read')).toBe(false);
+		});
+
+		it('security_admin 全码集下 tenant:user:read / tenant:role:read 均为 false（双裁撤复核）', () => {
+			const can = mountCan('security_admin', SECURITY_ADMIN_CODES);
+			expect(can('tenant:user:read')).toBe(false);
+			expect(can('tenant:role:read')).toBe(false);
+		});
+	});
+});