@csntgao/uni-base 0.1.0

package/packages/web-components/tests/uniplat-base-application-ticket.test.ts

@@ -0,0 +1,233 @@
+// @vitest-environment happy-dom
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY,
+  UNIPLAT_APPLICATION_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY,
+  exchangeUniplatBaseApplicationTicket,
+} from '../src'
+import {
+  createExternalApplicationTicketLaunchResult,
+  resolveUniplatBaseApplicationEntryUrl,
+} from '../src/uniplat-base-application-ticket'
+
+const serviceBaseUrl = 'https://api.example.com/api/general/project/uniplat_base/service'
+const exchangeEndpoint = `${serviceBaseUrl}/anonymous/application.identity/exchange_application_ticket`
+const applicationTicket = 'ticket_for_target_exchange_123456789'
+
+describe('exchangeUniplatBaseApplicationTicket()', () => {
+  afterEach(() => {
+    window.history.replaceState(null, '', '/')
+    vi.restoreAllMocks()
+  })
+
+  it('cleans the fragment before exchanging the ticket and hands JWT only to Host', async () => {
+    window.history.replaceState(
+      null,
+      '',
+      `/application/callback?source=switcher#${UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY}=${applicationTicket}`,
+    )
+    const accessToken = 'target.application.jwt'
+    const setAccessToken = vi.fn(async (token: string) => {
+      void token
+    })
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      void input
+      void init
+      expect(window.location.hash).toBe('')
+      expect(window.location.pathname).toBe('/application/callback')
+      expect(window.location.search).toBe('?source=switcher')
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: { token: accessToken, application_name: 'HrSaas' },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+
+    await expect(
+      exchangeUniplatBaseApplicationTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken,
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).resolves.toBe(true)
+
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    const [url, init] = fetchMock.mock.calls[0]!
+    expect(url).toBe(exchangeEndpoint)
+    expect(init?.method).toBe('POST')
+    expect(init?.credentials).toBe('omit')
+    expect(init?.body).toBe(JSON.stringify({ ticket: applicationTicket }))
+    expect(new Headers(init?.headers).has('authorization')).toBe(false)
+    expect(setAccessToken).toHaveBeenCalledWith(accessToken)
+    expect(window.location.href).not.toContain(applicationTicket)
+    expect(JSON.stringify(setAccessToken.mock.calls)).toContain(accessToken)
+  })
+
+  it('does nothing when the target page has no application ticket', async () => {
+    const fetchMock = vi.fn()
+    const setAccessToken = vi.fn()
+
+    await expect(
+      exchangeUniplatBaseApplicationTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken,
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).resolves.toBe(false)
+
+    expect(fetchMock).not.toHaveBeenCalled()
+    expect(setAccessToken).not.toHaveBeenCalled()
+  })
+
+  it('forwards source_system transparently and logs the same complete ticket when read and submitted', async () => {
+    const sourceSystem = 'ae-employee'
+    window.history.replaceState(
+      null,
+      '',
+      `/application/callback#keep=value&${UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY}=${applicationTicket}&${UNIPLAT_APPLICATION_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY}=${sourceSystem}`,
+    )
+    const consoleInfo = vi.spyOn(console, 'info').mockImplementation(() => undefined)
+    const fetchMock = vi.fn(async (_input: RequestInfo | URL, init?: RequestInit) => {
+      expect(window.location.hash).toBe('#keep=value')
+      expect(init?.body).toBe(
+        JSON.stringify({
+          ticket: applicationTicket,
+          source_system: sourceSystem,
+          application_name: 'HrSaas',
+        }),
+      )
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: { token: 'target.application.jwt', application_name: 'HrSaas' },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+
+    await expect(
+      exchangeUniplatBaseApplicationTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken: vi.fn(),
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).resolves.toBe(true)
+
+    expect(consoleInfo).not.toHaveBeenCalled()
+    expect(window.location.href).not.toContain(applicationTicket)
+    expect(window.location.href).not.toContain(sourceSystem)
+  })
+
+  it('returns only a stable error and still removes an invalid ticket from the URL', async () => {
+    window.history.replaceState(
+      null,
+      '',
+      `/application/callback#${UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY}=${applicationTicket}`,
+    )
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({ rescode: 403, msg: 'internal ticket store details', data: {} }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+    )
+    const setAccessToken = vi.fn()
+
+    const error = await exchangeUniplatBaseApplicationTicket({
+      serviceBaseUrl,
+      applicationName: 'HrSaas',
+      setAccessToken,
+      fetch: fetchMock as typeof fetch,
+    }).catch((reason: unknown) => reason)
+
+    expect(String(error)).toBe('Error: Application ticket exchange failed')
+    expect(String(error)).not.toContain('internal ticket')
+    expect(window.location.hash).toBe('')
+    expect(setAccessToken).not.toHaveBeenCalled()
+  })
+
+  it('exposes only a recognized target federated error message', async () => {
+    window.history.replaceState(
+      null,
+      '',
+      `/application/callback#${UNIPLAT_APPLICATION_TICKET_FRAGMENT_KEY}=${applicationTicket}&source_system=ae-employee`,
+    )
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({
+            rescode: 999,
+            error_code: 'FEDERATED_IDENTITY_NOT_READY',
+            msg: '用户或组织关系尚未同步，请联系管理员后重新登录',
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+    )
+
+    await expect(
+      exchangeUniplatBaseApplicationTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken: vi.fn(),
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).rejects.toThrow('用户或组织关系尚未同步，请联系管理员后重新登录')
+  })
+})
+
+describe('resolveUniplatBaseApplicationEntryUrl()', () => {
+  it('resolves a relative entry against the current document before ticket signing', () => {
+    window.history.replaceState(null, '', '/host/page')
+
+    expect(resolveUniplatBaseApplicationEntryUrl('/personal')).toBe(
+      new URL('/personal', document.baseURI).href,
+    )
+  })
+
+  it('rejects credentialed or fragment entry URLs before ticket signing', () => {
+    expect(() =>
+      resolveUniplatBaseApplicationEntryUrl('https://user@example.com/personal'),
+    ).toThrow('Application entry URL is invalid')
+    expect(() =>
+      resolveUniplatBaseApplicationEntryUrl('https://example.com/personal#fragment'),
+    ).toThrow('Application entry URL is invalid')
+  })
+})
+
+describe('createExternalApplicationTicketLaunchResult()', () => {
+  const redirectUrl =
+    `http://a.web.test.hrs100.cn/oidc-redirect` +
+    `#uniplat_application_ticket=${applicationTicket}` +
+    '&source_system=ae-employee&application_name=HRS100'
+
+  it('accepts the backend redirect only when ticket and target application stay bound', () => {
+    expect(
+      createExternalApplicationTicketLaunchResult(redirectUrl, applicationTicket, 15, 'HRS100'),
+    ).toEqual({ url: redirectUrl })
+  })
+
+  it('rejects mismatched or extended external redirect fragments', () => {
+    expect(() =>
+      createExternalApplicationTicketLaunchResult(
+        redirectUrl.replace('application_name=HRS100', 'application_name=Other'),
+        applicationTicket,
+        15,
+        'HRS100',
+      ),
+    ).toThrow('External application redirect URL is invalid')
+    expect(() =>
+      createExternalApplicationTicketLaunchResult(
+        `${redirectUrl}&unexpected=value`,
+        applicationTicket,
+        15,
+        'HRS100',
+      ),
+    ).toThrow('External application redirect URL is invalid')
+  })
+})

package/packages/web-components/tests/uniplat-base-identity-ticket.test.ts

@@ -0,0 +1,226 @@
+// @vitest-environment happy-dom
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY,
+  UNIPLAT_IDENTITY_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY,
+  loginWithUniplatBaseIdentityTicket,
+} from '../src'
+import { createIdentityTicketLaunchResult } from '../src/uniplat-base-identity-ticket'
+
+const serviceBaseUrl = 'https://api.example.com/api/general/project/uniplat_base/service'
+const loginEndpoint = `${serviceBaseUrl}/anonymous/application.identity/login_with_ticket`
+const identityTicket = 'identity_ticket_for_login_1234567890'
+const sourceSystem = 'ae-employee'
+
+describe('loginWithUniplatBaseIdentityTicket()', () => {
+  afterEach(() => {
+    window.history.replaceState(null, '', '/')
+    vi.restoreAllMocks()
+  })
+
+  it('uses the configured application and clears only identity ticket fragment fields', async () => {
+    window.history.replaceState(
+      null,
+      '',
+      `/callback?from=workbench#keep=value&${UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY}=${identityTicket}&${UNIPLAT_IDENTITY_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY}=${sourceSystem}&application=Untrusted`,
+    )
+    const accessToken = 'target.identity.jwt'
+    const setAccessToken = vi.fn(async (token: string) => {
+      void token
+    })
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      void input
+      void init
+      expect(window.location.hash).toBe('#keep=value&application=Untrusted')
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: { token: accessToken, application_name: 'HrSaas' },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+
+    await expect(
+      loginWithUniplatBaseIdentityTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken,
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).resolves.toBe(true)
+
+    const [url, init] = fetchMock.mock.calls[0]!
+    expect(url).toBe(loginEndpoint)
+    expect(init?.method).toBe('POST')
+    expect(init?.credentials).toBe('omit')
+    expect(init?.body).toBe(
+      JSON.stringify({
+        application: 'HrSaas',
+        ticket: identityTicket,
+        source_system: sourceSystem,
+      }),
+    )
+    expect(String(init?.body)).not.toContain('client_id')
+    expect(String(init?.body)).not.toContain('Untrusted')
+    expect(new Headers(init?.headers).has('authorization')).toBe(false)
+    expect(setAccessToken).toHaveBeenCalledWith(accessToken)
+    expect(window.location.href).not.toContain(identityTicket)
+    expect(window.location.href).not.toContain(sourceSystem)
+  })
+
+  it('omits source_system when the fragment does not provide it', async () => {
+    window.history.replaceState(
+      null,
+      '',
+      `/callback#${UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY}=${identityTicket}`,
+    )
+    const fetchMock = vi.fn(async (_input: RequestInfo | URL, init?: RequestInit) => {
+      expect(init?.body).toBe(
+        JSON.stringify({ application: 'OfficialWebsite', ticket: identityTicket }),
+      )
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: { token: 'local.identity.jwt', application_name: 'OfficialWebsite' },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+
+    await expect(
+      loginWithUniplatBaseIdentityTicket({
+        serviceBaseUrl,
+        applicationName: 'OfficialWebsite',
+        setAccessToken: vi.fn(),
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).resolves.toBe(true)
+  })
+
+  it('does nothing when the URL has no identity ticket', async () => {
+    const fetchMock = vi.fn()
+    const setAccessToken = vi.fn()
+    await expect(
+      loginWithUniplatBaseIdentityTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken,
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).resolves.toBe(false)
+    expect(fetchMock).not.toHaveBeenCalled()
+    expect(setAccessToken).not.toHaveBeenCalled()
+  })
+
+  it('removes an invalid ticket before returning a stable error', async () => {
+    window.history.replaceState(
+      null,
+      '',
+      `/callback#keep=value&${UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY}=invalid`,
+    )
+    const setAccessToken = vi.fn()
+    await expect(
+      loginWithUniplatBaseIdentityTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken,
+        fetch: vi.fn() as typeof fetch,
+      }),
+    ).rejects.toThrow('身份票据登录失败')
+    expect(window.location.hash).toBe('#keep=value')
+    expect(setAccessToken).not.toHaveBeenCalled()
+  })
+
+  it('does not persist a JWT for a mismatched response application', async () => {
+    window.history.replaceState(
+      null,
+      '',
+      `/callback#${UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY}=${identityTicket}`,
+    )
+    const setAccessToken = vi.fn()
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({
+            rescode: 0,
+            data: { token: 'wrong.application.jwt', application_name: 'Other' },
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+    )
+    await expect(
+      loginWithUniplatBaseIdentityTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken,
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).rejects.toThrow('身份票据登录失败')
+    expect(setAccessToken).not.toHaveBeenCalled()
+  })
+
+  it('exposes only recognized identity ticket error messages', async () => {
+    window.history.replaceState(
+      null,
+      '',
+      `/callback#${UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY}=${identityTicket}`,
+    )
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({
+            rescode: 999,
+            error_code: 'IDENTITY_TICKET_IDENTITY_NOT_READY',
+            msg: '用户或组织关系尚未就绪',
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+    )
+    await expect(
+      loginWithUniplatBaseIdentityTicket({
+        serviceBaseUrl,
+        applicationName: 'HrSaas',
+        setAccessToken: vi.fn(),
+        fetch: fetchMock as typeof fetch,
+      }),
+    ).rejects.toThrow('用户或组织关系尚未就绪')
+  })
+})
+
+describe('createIdentityTicketLaunchResult()', () => {
+  it('uses the selected entry URL and authoritative source system', () => {
+    expect(
+      createIdentityTicketLaunchResult(
+        'https://target.example.com/application',
+        identityTicket,
+        15,
+        sourceSystem,
+      ),
+    ).toEqual({
+      url:
+        `https://target.example.com/application#${UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY}=${identityTicket}` +
+        `&${UNIPLAT_IDENTITY_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY}=${sourceSystem}`,
+    })
+  })
+
+  it('rejects missing source system or a non-15-second lifetime', () => {
+    expect(() =>
+      createIdentityTicketLaunchResult(
+        'https://target.example.com/application',
+        identityTicket,
+        14,
+        sourceSystem,
+      ),
+    ).toThrow('Identity ticket response is invalid')
+    expect(() =>
+      createIdentityTicketLaunchResult(
+        'https://target.example.com/application',
+        identityTicket,
+        15,
+        '',
+      ),
+    ).toThrow('Identity ticket response is invalid')
+  })
+})

package/packages/web-components/tests/uniplat-base-organization-onboarding-transport.test.ts

@@ -0,0 +1,227 @@
+// @vitest-environment happy-dom
+
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createUniplatBaseOrganizationOnboardingTransport,
+  OrganizationOnboardingTransportError,
+} from '../src'
+
+const serviceBaseUrl = 'https://api.example.com/api/general/project/uniplat_base/service'
+const createEndpoint = `${serviceBaseUrl}/system.org/create_organization`
+
+async function captureTransportError(
+  request: Promise<unknown>,
+): Promise<OrganizationOnboardingTransportError> {
+  try {
+    await request
+  } catch (error) {
+    expect(error).toBeInstanceOf(OrganizationOnboardingTransportError)
+    return error as OrganizationOnboardingTransportError
+  }
+  throw new Error('Expected organization onboarding transport to fail')
+}
+
+describe('createUniplatBaseOrganizationOnboardingTransport()', () => {
+  it('creates an enterprise with the current JWT only in the Authorization header', async () => {
+    const token = 'obviously-fake-onboarding-jwt'
+    const getAccessToken = vi.fn(async () => token)
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      void input
+      void init
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: {
+            oid: '136',
+            eid: '2048',
+            team_name: '星河科技',
+            customer_name: '北京星河科技有限公司',
+            organization_type: 'enterprise',
+            verification_status: 'unverified',
+          },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+    const transport = createUniplatBaseOrganizationOnboardingTransport({
+      serviceBaseUrl,
+      getAccessToken,
+      fetch: fetchMock as typeof fetch,
+    })
+
+    await expect(
+      transport.createEnterprise({
+        organizationName: ' 星河科技 ',
+        enterpriseName: ' 北京星河科技有限公司 ',
+        unifiedSocialCreditCode: '91110108ma01abc123',
+      }),
+    ).resolves.toEqual({
+      id: '136',
+      name: '北京星河科技有限公司',
+      type: 'enterprise',
+    })
+
+    expect(getAccessToken).toHaveBeenCalledTimes(1)
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    const [url, init] = fetchMock.mock.calls[0]!
+    expect(url).toBe(createEndpoint)
+    expect(init?.method).toBe('POST')
+    expect(init?.credentials).toBe('include')
+    expect(init?.cache).toBe('no-store')
+    expect(init?.body).toBe(
+      JSON.stringify({
+        organization_type: 'enterprise',
+        team_name: '星河科技',
+        customer_name: '北京星河科技有限公司',
+        credit_code: '91110108MA01ABC123',
+      }),
+    )
+    expect(String(url)).not.toContain(token)
+    expect(String(init?.body)).not.toContain(token)
+    expect(new Headers(init?.headers).get('authorization')).toBe(`Bearer ${token}`)
+  })
+
+  it('creates a team and gets a fresh token for every request', async () => {
+    const getAccessToken = vi
+      .fn<() => Promise<string>>()
+      .mockResolvedValueOnce('obviously-fake-first-jwt')
+      .mockResolvedValueOnce('obviously-fake-second-jwt')
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      void input
+      const body = JSON.parse(String(init?.body)) as Record<string, unknown>
+      const enterprise = body.organization_type === 'enterprise'
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: enterprise
+            ? {
+                oid: 137,
+                team_name: '第二企业',
+                customer_name: '第二企业有限公司',
+                organization_type: 'enterprise',
+              }
+            : {
+                oid: 138,
+                team_name: '星河增长项目组',
+                customer_name: null,
+                organization_type: 'team',
+              },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+    const transport = createUniplatBaseOrganizationOnboardingTransport({
+      serviceBaseUrl,
+      getAccessToken,
+      fetch: fetchMock as typeof fetch,
+    })
+
+    await transport.createEnterprise({
+      organizationName: '第二企业',
+      enterpriseName: '第二企业有限公司',
+      unifiedSocialCreditCode: '91110108MA01DEF456',
+    })
+    await expect(transport.createTeam({ teamName: ' 星河增长项目组 ' })).resolves.toEqual({
+      id: '138',
+      name: '星河增长项目组',
+      type: 'team',
+    })
+
+    expect(getAccessToken).toHaveBeenCalledTimes(2)
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+    const [, firstInit] = fetchMock.mock.calls[0]!
+    const [, secondInit] = fetchMock.mock.calls[1]!
+    expect(new Headers(firstInit?.headers).get('authorization')).toBe(
+      'Bearer obviously-fake-first-jwt',
+    )
+    expect(new Headers(secondInit?.headers).get('authorization')).toBe(
+      'Bearer obviously-fake-second-jwt',
+    )
+    expect(secondInit?.body).toBe(
+      JSON.stringify({ organization_type: 'team', team_name: '星河增长项目组' }),
+    )
+  })
+
+  it.each(['ENTERPRISE_NAME_CONFLICT', 'CREDIT_CODE_CONFLICT', 'TEAM_NAME_CONFLICT'] as const)(
+    'maps the stable backend error code %s',
+    async (errorCode) => {
+      const fetchMock = vi.fn(async () => {
+        return new Response(
+          JSON.stringify({ rescode: 999, error_code: errorCode, msg: '不应透传的后端正文' }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        )
+      })
+      const transport = createUniplatBaseOrganizationOnboardingTransport({
+        serviceBaseUrl,
+        getAccessToken: () => 'obviously-fake-error-jwt',
+        fetch: fetchMock as typeof fetch,
+      })
+
+      const error = await captureTransportError(transport.createTeam({ teamName: '冲突团队' }))
+
+      expect(error?.code).toBe(errorCode)
+      expect(error?.message).toBe(errorCode)
+      expect(error?.message).not.toContain('不应透传')
+    },
+  )
+
+  it('maps unknown backend, token-provider and malformed-response failures to UNKNOWN', async () => {
+    const backendFailure = createUniplatBaseOrganizationOnboardingTransport({
+      serviceBaseUrl,
+      getAccessToken: () => 'obviously-fake-unknown-jwt',
+      fetch: vi.fn(async () => {
+        return new Response(
+          JSON.stringify({
+            rescode: 999,
+            error_code: 'ORGANIZATION_CREATE_FAILED',
+            msg: 'database stack must stay private',
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        )
+      }) as typeof fetch,
+    })
+    const tokenFailure = createUniplatBaseOrganizationOnboardingTransport({
+      serviceBaseUrl,
+      getAccessToken() {
+        throw new Error('private token provider detail')
+      },
+      fetch: vi.fn() as typeof fetch,
+    })
+    const malformedResponse = createUniplatBaseOrganizationOnboardingTransport({
+      serviceBaseUrl,
+      getAccessToken: () => 'obviously-fake-malformed-jwt',
+      fetch: vi.fn(async () => {
+        return new Response(
+          JSON.stringify({
+            rescode: 0,
+            data: { oid: '139', organization_type: 'team', team_name: '' },
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        )
+      }) as typeof fetch,
+    })
+
+    for (const transport of [backendFailure, tokenFailure, malformedResponse]) {
+      const error = await captureTransportError(transport.createTeam({ teamName: '安全团队' }))
+      expect(error?.code).toBe('UNKNOWN')
+      expect(error?.message).toBe('UNKNOWN')
+    }
+  })
+
+  it('rejects unsafe service URLs before requesting a token', () => {
+    const getAccessToken = vi.fn(() => 'obviously-fake-unused-jwt')
+    expect(() =>
+      createUniplatBaseOrganizationOnboardingTransport({
+        serviceBaseUrl: 'https://user:password@example.com/service',
+        getAccessToken,
+      }),
+    ).toThrow(TypeError)
+    expect(() =>
+      createUniplatBaseOrganizationOnboardingTransport({
+        serviceBaseUrl: 'https://api.example.com/service?jwt=unsafe',
+        getAccessToken,
+      }),
+    ).toThrow(TypeError)
+    expect(getAccessToken).not.toHaveBeenCalled()
+  })
+})