@autional/shared 0.0.0-stage → 0.1.0-rc.33

package/src/hooks/__tests__/usePortalCatalog.test.tsx

@@ -0,0 +1,301 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { renderHook, waitFor, cleanup } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { usePortalCatalog, PLATFORM_TENANT_ID } from '../usePortalCatalog';
+import { useAuthStore } from '../../auth/store';
+import { apiClient } from '../../api/client';
+
+/** 每测试独立 QueryClient（同一 wrapper 引用，避免缓存跨用例串扰） */
+function makeWrapper() {
+	const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+	return function Wrapper({ children }: { children: React.ReactNode }) {
+		return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+	};
+}
+
+function resetAuthStore(): void {
+	useAuthStore.setState({
+		user: null,
+		accessToken: null,
+		refreshToken: null,
+		tenants: [],
+		currentTenantId: null,
+		permissions: [],
+		isAuthenticated: false,
+	});
+	window.localStorage.clear();
+}
+
+/**
+ * 桩 apiClient.get（axios 层）。
+ * 解析值形状 = 响应拦截器处理后的产物（unwrapped + camelCase）：
+ * - {code,items} → {items,...}；{code,data} → data 本体
+ */
+let getMock: ReturnType<typeof vi.fn>;
+
+const GET_URL = (call: number) => String(getMock.mock.calls[call]![0]);
+const GET_CONFIG = (call: number) => getMock.mock.calls[call]![1] as { params: Record<string, string> };
+
+describe('usePortalCatalog', () => {
+	beforeEach(() => {
+		resetAuthStore();
+		useAuthStore.setState({ accessToken: 'test-token' });
+		getMock = vi.fn();
+		vi.spyOn(apiClient, 'get').mockImplementation(getMock as unknown as typeof apiClient.get);
+	});
+
+	afterEach(() => {
+		cleanup();
+		resetAuthStore();
+		vi.restoreAllMocks();
+	});
+
+	it('self 端点：items 形状解析、默认排除 auth/landing/authenticator、order 升序、URL 按 slug 拼装', async () => {
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'auth', name: 'Sign-in', order: 1 },
+					{ code: 'user', name: '用户门户', order: 3 },
+					{ code: 'admin', name: '管理控制台', order: 1 },
+					{ code: 'landing', name: 'Home', order: 9 },
+					{ code: 'authenticator', name: '验证器', order: 2 },
+				],
+			},
+		});
+		const { result } = renderHook(
+			() => usePortalCatalog({ tenantId: 't1', slug: 'acme-corp', role: 'admin' }),
+			{ wrapper: makeWrapper() },
+		);
+		await waitFor(() => expect(result.current.isLoading).toBe(false));
+
+		expect(getMock).toHaveBeenCalledTimes(1);
+		expect(GET_URL(0)).toBe('/tenant/api/v1/tenants/t1/applications');
+		expect(GET_CONFIG(0).params).toEqual({
+			type: 'portal',
+			is_platform: 'true',
+			status: 'active',
+		});
+
+		// allPortals：可见集合、保持服务端顺序
+		expect(result.current.allPortals.map((p) => p.code)).toEqual(['user', 'admin']);
+		// portals：order 升序（admin=1, user=3）
+		expect(result.current.portals.map((p) => p.code)).toEqual(['admin', 'user']);
+		const admin = result.current.portals.find((p) => p.code === 'admin')!;
+		expect(admin.url).toBe('http://admin.localhost/acme-corp');
+		expect(result.current.isError).toBe(false);
+	});
+
+	it('data[] 数组形状容错（部分路径直出数组）', async () => {
+		getMock.mockResolvedValue({ data: [{ code: 'user', name: '用户门户', order: 2 }] });
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1' }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.portals).toHaveLength(1));
+		expect(result.current.portals[0]!.code).toBe('user');
+	});
+
+	it('业务失败（code!==0）→ isError 且不产出条目', async () => {
+		getMock.mockResolvedValue({ data: { code: 40000503, message: 'plane forbidden' } });
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1' }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.isError).toBe(true));
+		expect(result.current.portals).toEqual([]);
+		expect(result.current.allPortals).toEqual([]);
+	});
+
+	it('请求异常（axios reject，如 403/网络失败）→ isError（平面错配可降级）', async () => {
+		getMock.mockRejectedValue(new Error('Request failed with status code 403'));
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1' }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.isError).toBe(true));
+	});
+
+	it('tenantId / token / enabled 任一缺省 → 不发请求', async () => {
+		renderHook(() => usePortalCatalog({ tenantId: null }), { wrapper: makeWrapper() });
+		expect(getMock).not.toHaveBeenCalled();
+
+		resetAuthStore();
+		renderHook(() => usePortalCatalog({ tenantId: 't1' }), { wrapper: makeWrapper() });
+		expect(getMock).not.toHaveBeenCalled();
+
+		useAuthStore.setState({ accessToken: 'test-token' });
+		renderHook(() => usePortalCatalog({ tenantId: 't1', enabled: false }), {
+			wrapper: makeWrapper(),
+		});
+		expect(getMock).not.toHaveBeenCalled();
+	});
+
+	it('audience=admin → 管理面双入口路径（admin/security/platform 控制台）', async () => {
+		getMock.mockResolvedValue({ data: { items: [] } });
+		renderHook(() => usePortalCatalog({ tenantId: 't1', audience: 'admin' }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(getMock).toHaveBeenCalledTimes(1));
+		expect(GET_URL(0)).toBe('/tenant/api/v1/admin/tenants/t1/applications');
+	});
+
+	it('exclude 自定义：仅过滤指定 code（不叠加默认排除）', async () => {
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'admin', name: 'a', order: 1 },
+					{ code: 'auth', name: 'b', order: 2 },
+				],
+			},
+		});
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1', exclude: ['admin'] }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.allPortals).toHaveLength(1));
+		expect(result.current.allPortals[0]!.code).toBe('auth');
+	});
+
+	it('非 slug 白名单门户（status）不拼租户段', async () => {
+		getMock.mockResolvedValue({
+			data: { items: [{ code: 'status', name: '状态页', order: 1 }] },
+		});
+		const { result } = renderHook(
+			() => usePortalCatalog({ tenantId: 't1', slug: 'acme-corp' }),
+			{ wrapper: makeWrapper() },
+		);
+		await waitFor(() => expect(result.current.portals).toHaveLength(1));
+		expect(result.current.portals[0]!.url).toBe('http://status.localhost');
+	});
+
+	it('可见性（入口门禁镜像）：member 角色不可见 admin/security/platform，user/status 可见', async () => {
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'admin', name: '管理控制台', order: 1 },
+					{ code: 'security', name: '安全控制台', order: 2 },
+					{ code: 'platform', name: '平台控制台', order: 3 },
+					{ code: 'user', name: '用户门户', order: 4 },
+					{ code: 'status', name: '状态页', order: 5 },
+				],
+			},
+		});
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1', role: 'member' }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.portals).toHaveLength(2));
+		expect(result.current.portals.map((p) => p.code)).toEqual(['user', 'status']);
+		// allPortals 与 portals 同一可见集合（偏好面板不再泄露不可进门户）
+		expect(result.current.allPortals.map((p) => p.code)).toEqual(['user', 'status']);
+	});
+
+	it('可见性：管理面角色（非平台租户）可管理面门户但不可见 platform', async () => {
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'admin', name: '管理控制台', order: 1 },
+					{ code: 'security', name: '安全控制台', order: 2 },
+					{ code: 'platform', name: '平台控制台', order: 3 },
+					{ code: 'user', name: '用户门户', order: 4 },
+				],
+			},
+		});
+		const { result } = renderHook(
+			() => usePortalCatalog({ tenantId: 't1', role: 'security_admin' }),
+			{ wrapper: makeWrapper() },
+		);
+		await waitFor(() => expect(result.current.portals).toHaveLength(3));
+		expect(result.current.portals.map((p) => p.code)).toEqual(['admin', 'security', 'user']);
+	});
+
+	it('可见性：平台租户成员可见 platform（store tenants 含平台租户 ID）', async () => {
+		useAuthStore.setState({
+			tenants: [{ id: PLATFORM_TENANT_ID, name: 'platform', role: 'super_admin' }],
+			currentTenantId: PLATFORM_TENANT_ID,
+		});
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'platform', name: '平台控制台', order: 1 },
+					{ code: 'admin', name: '管理控制台', order: 2 },
+					{ code: 'user', name: '用户门户', order: 3 },
+				],
+			},
+		});
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: PLATFORM_TENANT_ID }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.portals).toHaveLength(3));
+		expect(result.current.portals.map((p) => p.code)).toEqual(['platform', 'admin', 'user']);
+	});
+
+	it('可见性：role 显式 null → 管理面门户不可见（按“无角色”过滤）', async () => {
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'admin', name: '管理控制台', order: 1 },
+					{ code: 'user', name: '用户门户', order: 2 },
+				],
+			},
+		});
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1', role: null }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.portals).toHaveLength(1));
+		expect(result.current.portals[0]!.code).toBe('user');
+	});
+
+	it('allowed_roles 叠加：存在且不含当前角色 → 隐藏（camelCase 键，apiClient 归一后形态）', async () => {
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'status', name: '状态页', order: 1, config: { portal: { allowedRoles: ['admin'] } } },
+					{ code: 'user', name: '用户门户', order: 2 },
+				],
+			},
+		});
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1', role: 'member' }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.portals).toHaveLength(1));
+		expect(result.current.portals[0]!.code).toBe('user');
+	});
+
+	it('allowed_roles 叠加：snake 原始键兼容（后端透出前的直传形态）', async () => {
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'status', name: '状态页', order: 1, config: { portal: { allowed_roles: ['admin'] } } },
+					{ code: 'user', name: '用户门户', order: 2 },
+				],
+			},
+		});
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1', role: 'member' }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.portals).toHaveLength(1));
+		expect(result.current.portals[0]!.code).toBe('user');
+	});
+
+	it('role 缺省回退 store 当前角色（useCurrentRole），平台租户成员判定不依赖当前租户', async () => {
+		useAuthStore.setState({
+			tenants: [
+				{ id: 't1', name: 'demo', role: 'super_admin' },
+				{ id: PLATFORM_TENANT_ID, name: 'platform', role: 'admin' },
+			],
+			currentTenantId: 't1',
+		});
+		getMock.mockResolvedValue({
+			data: {
+				items: [
+					{ code: 'admin', name: '管理控制台', order: 1 },
+					{ code: 'platform', name: '平台控制台', order: 2 },
+				],
+			},
+		});
+		const { result } = renderHook(() => usePortalCatalog({ tenantId: 't1' }), {
+			wrapper: makeWrapper(),
+		});
+		await waitFor(() => expect(result.current.portals).toHaveLength(2));
+		// 当前租户 t1 role=super_admin → admin 可见；另一成员租户为平台租户 → platform 可见
+		expect(result.current.portals.map((p) => p.code)).toEqual(['admin', 'platform']);
+	});
+});

package/src/hooks/__tests__/useSodMode.test.tsx

@@ -0,0 +1,205 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { renderHook, cleanup, waitFor } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+
+// ============================================================
+// U97 回归锁 — useSodMode 四连缺陷修复:
+//   ① URL 含 /tenant 服务段（不再是 /api/v1/... 裸径 → 网关 404）
+//   ② 请求参数为租户 ULID（不再是 slug → 后端按主键 id 查找必 404）
+//   ③ 失败不再静默吞成 'single'（返回 null；错误留在 react-query 通道）
+//   ④ 读取键为 camelCase `sodMode`（响应拦截器 camelCaseKeys 契约；
+//      读 snake_case `sod_mode` 恒 undefined —— 请求虽 200 但值被吞）
+// ============================================================
+
+vi.mock('../../api/client', () => ({
+	apiClient: { get: vi.fn() },
+}));
+
+import { apiClient } from '../../api/client';
+import { useAuthStore } from '../../auth/store';
+import { useSodMode, useIsAuditRestricted } from '../useSodMode';
+
+const mockedGet = vi.mocked(apiClient.get);
+
+/** 租户 ULID（后端 GetSodConfig 按主键查找的键） */
+const TENANT_ULID = '01M24BB8G083JHWKTXXVGWMWQA';
+/** slug 字样：URL 中不得出现（缺陷② 的负例锚点） */
+const SLUG = 'demo';
+const TENANTS = [{ id: TENANT_ULID, name: SLUG, role: 'admin' }];
+
+/** 模拟 axios 响应拦截器（api/client.ts camelCaseKeys）之后的形状 */
+function sodResponse(sodMode: 'single' | 'strict') {
+	return {
+		data: {
+			tenantId: TENANT_ULID,
+			sodMode,
+			updatedAt: '2026-09-30T00:00:00Z',
+		},
+	} as never;
+}
+
+function createWrapper() {
+	const queryClient = new QueryClient({
+		defaultOptions: { queries: { retry: false, retryDelay: 10 } },
+	});
+	return {
+		queryClient,
+		wrapper: function Wrapper({ children }: { children: React.ReactNode }) {
+			return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>;
+		},
+	};
+}
+
+/** 重置 store + localStorage，避免跨用例污染 */
+function resetAuthStore(): void {
+	useAuthStore.setState({
+		user: null,
+		accessToken: null,
+		refreshToken: null,
+		tenants: [],
+		currentTenantId: null,
+		permissions: [],
+		isAuthenticated: false,
+	});
+	window.localStorage.clear();
+}
+
+describe('useSodMode（U97 回归锁：路径服务段 / ULID 参数 / 失败不吞 / camelCase 键）', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		resetAuthStore();
+	});
+
+	afterEach(() => {
+		cleanup();
+		resetAuthStore();
+	});
+
+	it('①+②+④ 成功: URL = /tenant/api/v1/admin/tenants/<ULID>/sod-config 且读到 sodMode=strict', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockResolvedValue(sodResponse('strict'));
+
+		const { wrapper } = createWrapper();
+		const { result } = renderHook(() => useSodMode(), { wrapper });
+
+		await waitFor(() => expect(result.current).toBe('strict'));
+
+		// ① 服务段：完整路径精确断言（旧实现 /api/v1/... 裸径将 FAIL）
+		expect(mockedGet).toHaveBeenCalledWith(
+			`/tenant/api/v1/admin/tenants/${TENANT_ULID}/sod-config`,
+		);
+		const calledUrl = mockedGet.mock.calls[0][0] as string;
+		expect(calledUrl).not.toMatch(/^\/api\/v1\//);
+		// ② 参数是 ULID，不是 slug
+		expect(calledUrl).toContain(TENANT_ULID);
+		expect(calledUrl).not.toContain(`/${SLUG}/`);
+	});
+
+	it('④ 服务端返回 single → single（正常值不丢）', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockResolvedValue(sodResponse('single'));
+
+		const { wrapper } = createWrapper();
+		const { result } = renderHook(() => useSodMode(), { wrapper });
+
+		await waitFor(() => expect(result.current).toBe('single'));
+	});
+
+	it('② 无租户（currentTenantId=null）→ 不发请求，返回 null', () => {
+		const { wrapper } = createWrapper();
+		const { result } = renderHook(() => useSodMode(), { wrapper });
+
+		expect(result.current).toBeNull();
+		expect(mockedGet).not.toHaveBeenCalled();
+	});
+
+	it('③ 请求失败 → null（不吞成 single），且错误进入 query error 态（不再静默）', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockRejectedValue(new Error('Network Error'));
+
+		const { queryClient, wrapper } = createWrapper();
+		const { result } = renderHook(() => useSodMode(), { wrapper });
+
+		// retry:1（hook 显式）→ 失败重试一次后进入 error 态
+		await waitFor(
+			() => {
+				expect(queryClient.getQueryState(['sod-config', TENANT_ULID])?.status).toBe('error');
+			},
+			{ timeout: 5000 },
+		);
+		// 关键回归锁：绝不是 'single'（旧实现 catch 吞错 + `?? 'single'` 恒 single）
+		expect(result.current).toBeNull();
+		expect(result.current).not.toBe('single');
+	});
+});
+
+describe('useIsAuditRestricted（U97 消费面语义）', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		resetAuthStore();
+	});
+
+	afterEach(() => {
+		cleanup();
+		resetAuthStore();
+	});
+
+	it('strict ∧ role=admin → true（strict 模式 L2 限制生效）', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockResolvedValue(sodResponse('strict'));
+
+		const { wrapper } = createWrapper();
+		const { result } = renderHook(() => useIsAuditRestricted(), { wrapper });
+
+		await waitFor(() => expect(result.current).toBe(true));
+	});
+
+	it('strict ∧ 非 admin → false', async () => {
+		useAuthStore.setState({
+			tenants: [{ id: TENANT_ULID, name: SLUG, role: 'member' }],
+			currentTenantId: TENANT_ULID,
+			accessToken: 't',
+		});
+		mockedGet.mockResolvedValue(sodResponse('strict'));
+
+		const { queryClient, wrapper } = createWrapper();
+		const { result } = renderHook(() => useIsAuditRestricted(), { wrapper });
+
+		// 等 sod 数据确实到达（success）后再断言 —— 避免「数据未到即 false」的假绿
+		await waitFor(() => {
+			expect(queryClient.getQueryState(['sod-config', TENANT_ULID])?.status).toBe('success');
+		});
+		expect(result.current).toBe(false);
+	});
+
+	it('single（admin）→ false', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockResolvedValue(sodResponse('single'));
+
+		const { queryClient, wrapper } = createWrapper();
+		const { result } = renderHook(() => useIsAuditRestricted(), { wrapper });
+
+		await waitFor(() => {
+			expect(queryClient.getQueryState(['sod-config', TENANT_ULID])?.status).toBe('success');
+		});
+		expect(result.current).toBe(false);
+	});
+
+	it('读取失败（null 模式）→ false（不误判受限；fail-open 语义保持）', async () => {
+		useAuthStore.setState({ tenants: TENANTS, currentTenantId: TENANT_ULID, accessToken: 't' });
+		mockedGet.mockRejectedValue(new Error('Network Error'));
+
+		const { queryClient, wrapper } = createWrapper();
+		const { result } = renderHook(() => useIsAuditRestricted(), { wrapper });
+
+		await waitFor(
+			() => {
+				expect(queryClient.getQueryState(['sod-config', TENANT_ULID])?.status).toBe('error');
+			},
+			{ timeout: 5000 },
+		);
+		expect(result.current).toBe(false);
+	});
+});