@csntgao/uni-base 0.1.0

package/packages/web-components/tests/user-login-transport.test.ts

@@ -0,0 +1,443 @@
+// @vitest-environment happy-dom
+
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createUniplatBaseUserLoginTransport,
+  UserLoginTransportError,
+  type UniplatBaseUserLoginMetadata,
+} from '../src'
+
+describe('createUniplatBaseUserLoginTransport()', () => {
+  it('uses the SMS and application login endpoints without an image captcha', async () => {
+    const accessToken = 'obviously-fake-login-jwt'
+    const setAccessToken = vi.fn(async (token: string, metadata: UniplatBaseUserLoginMetadata) => {
+      void token
+      void metadata
+    })
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      void init
+      const data = String(input).endsWith('/login-application')
+        ? {
+            token: accessToken,
+            application_name: 'HrSaas',
+            is_new_user: true,
+            user_id: 7,
+            org_list: [{ xid: 21, name: '示例团队' }],
+          }
+        : {}
+      return new Response(JSON.stringify({ rescode: 0, data }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      })
+    })
+    const transport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      setAccessToken,
+      fetch: fetchMock as typeof fetch,
+      deviceInfo: {
+        deviceType: 'web',
+        deviceName: 'Chrome',
+        deviceId: 'host-device-123',
+        deviceBrand: 'MacIntel',
+      },
+    })
+
+    await transport.sendSmsCode({
+      mobile: '13800138000',
+    })
+    expect(
+      await transport.login({
+        mobile: '13800138000',
+        smsCode: '123456',
+        applicationName: 'HrSaas',
+      }),
+    ).toEqual({ applicationName: 'HrSaas', isNewUser: true })
+
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+    const [smsUrl, smsInit] = fetchMock.mock.calls[0]!
+    expect(smsUrl).toBe(
+      'https://api.example.com/api/general/project/uniplat_base/service/anonymous/system.user/sendVerifyCode',
+    )
+    expect(smsInit?.body).toBe(JSON.stringify({ mobile: '13800138000' }))
+    const [loginUrl, loginInit] = fetchMock.mock.calls[1]!
+    expect(loginUrl).toBe(
+      'https://api.example.com/api/general/project/uniplat_base/service/anonymous/application.identity/login-application',
+    )
+    expect(loginInit?.body).toBe(
+      JSON.stringify({
+        auth_method: 'sms',
+        mobile: '13800138000',
+        verify_code: '123456',
+        application_name: 'HrSaas',
+        client_id: 'HrSaas',
+        device_type: 'web',
+        device_name: 'Chrome',
+        device_id: 'host-device-123',
+        device_brand: 'MacIntel',
+      }),
+    )
+    expect(String(smsUrl)).not.toContain(accessToken)
+    expect(String(loginUrl)).not.toContain(accessToken)
+    expect(String(smsInit?.body)).not.toContain(accessToken)
+    expect(String(loginInit?.body)).not.toContain(accessToken)
+    expect(setAccessToken).toHaveBeenCalledWith(accessToken, {
+      application_name: 'HrSaas',
+      is_new_user: true,
+      user_id: 7,
+      org_list: [{ xid: 21, name: '示例团队' }],
+    })
+    expect(JSON.stringify(setAccessToken.mock.calls[0]?.[1])).not.toContain(accessToken)
+  })
+
+  it('does not expose backend error text', async () => {
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({
+            rescode: 500,
+            error_code: 'SMS_CODE_INVALID_OR_EXPIRED',
+            msg: 'internal stack with a credential',
+            data: {},
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+    )
+    const transport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      setAccessToken: vi.fn(),
+      fetch: fetchMock as typeof fetch,
+    })
+
+    const error = await transport
+      .login({ mobile: '13800138000', smsCode: '123456', applicationName: 'HrSaas' })
+      .catch((reason: unknown) => reason)
+    expect(error).toBeInstanceOf(Error)
+    expect(error).toBeInstanceOf(UserLoginTransportError)
+    expect((error as UserLoginTransportError).code).toBe('SMS_CODE_INVALID_OR_EXPIRED')
+    expect(String(error)).not.toContain('internal stack')
+    expect(String(error)).not.toContain('credential')
+  })
+
+  it('retains a safe organization access denial message for component display', async () => {
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({
+            rescode: 999,
+            error_code: 'ORG_ACCESS_DENIED',
+            msg: '当前用户没有可用的平台设置应用实例',
+            data: {},
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+    )
+    const transport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      setAccessToken: vi.fn(),
+      fetch: fetchMock as typeof fetch,
+    })
+
+    const error = await transport
+      .login({ mobile: '13800138000', smsCode: '123456', applicationName: 'qqxb-plat-admin' })
+      .catch((reason: unknown) => reason)
+
+    expect(error).toBeInstanceOf(UserLoginTransportError)
+    expect((error as UserLoginTransportError).code).toBe('ORG_ACCESS_DENIED')
+    expect((error as UserLoginTransportError).displayMessage).toBe(
+      '当前用户没有可用的平台设置应用实例',
+    )
+  })
+
+  it('keeps legacy success responses without is_new_user compatible', async () => {
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(
+          JSON.stringify({
+            rescode: 0,
+            data: { token: 'obviously-fake-legacy-jwt', application_name: 'HrSaas' },
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+    )
+    const transport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      setAccessToken: vi.fn(),
+      fetch: fetchMock as typeof fetch,
+    })
+
+    await expect(
+      transport.login({
+        mobile: '13800138000',
+        smsCode: '123456',
+        applicationName: 'HrSaas',
+      }),
+    ).resolves.toEqual({ applicationName: 'HrSaas' })
+  })
+
+  it('logs in with a password through login-application and strips credentials from metadata', async () => {
+    const accessToken = 'obviously-fake-password-login-jwt'
+    const setAccessToken = vi.fn()
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      void input
+      void init
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: {
+            token: accessToken,
+            application_name: 'OfficialWebsite',
+            is_new_user: false,
+            user_id: 7,
+          },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+    const transport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      setAccessToken,
+      fetch: fetchMock as typeof fetch,
+      deviceInfo: {
+        deviceType: 'web',
+        deviceName: 'Chrome',
+        deviceId: 'host-device-123',
+        deviceBrand: 'MacIntel',
+      },
+    })
+
+    await expect(
+      transport.loginWithPassword?.({
+        mobile: '13800138000',
+        password: 'safe-test-password',
+        applicationName: 'OfficialWebsite',
+        rememberSession: true,
+      }),
+    ).resolves.toEqual({ applicationName: 'OfficialWebsite', isNewUser: false })
+
+    const [url, init] = fetchMock.mock.calls[0]!
+    expect(url).toBe(
+      'https://api.example.com/api/general/project/uniplat_base/service/anonymous/application.identity/login-application',
+    )
+    expect(init?.body).toBe(
+      JSON.stringify({
+        auth_method: 'password',
+        mobile: '13800138000',
+        password: 'safe-test-password',
+        application_name: 'OfficialWebsite',
+        client_id: 'OfficialWebsite',
+        remember_session: true,
+        device_type: 'web',
+        device_name: 'Chrome',
+        device_id: 'host-device-123',
+        device_brand: 'MacIntel',
+      }),
+    )
+    expect(setAccessToken).toHaveBeenCalledWith(accessToken, {
+      application_name: 'OfficialWebsite',
+      is_new_user: false,
+      user_id: 7,
+    })
+    expect(JSON.stringify(setAccessToken.mock.calls[0]?.[1])).not.toContain(accessToken)
+    expect(JSON.stringify(setAccessToken.mock.calls[0]?.[1])).not.toContain('safe-test-password')
+  })
+
+  it('creates and polls a QR login before atomically saving the confirmed JWT', async () => {
+    const accessToken = 'obviously-fake-qr-login-jwt'
+    const challengeId = 'obviously-fake-qr-challenge-id-1234567890'
+    const setAccessToken = vi.fn()
+    let pollCount = 0
+    const fetchMock = vi.fn(async (_input: RequestInfo | URL, init?: RequestInit) => {
+      const body = JSON.parse(String(init?.body)) as Record<string, unknown>
+      let data: Record<string, unknown>
+      if (body.action === 'create') {
+        data = {
+          challenge_id: challengeId,
+          image_data_url: 'data:image/png;base64,b2J2aW91c2x5LWZha2UtcG5n',
+          expires_in: 120,
+          poll_interval_ms: 2000,
+        }
+      } else if (pollCount++ === 0) {
+        data = { status: 'scanned' }
+      } else {
+        data = {
+          status: 'confirmed',
+          token: accessToken,
+          application_name: 'OfficialWebsite',
+          is_new_user: false,
+          user_id: 7,
+        }
+      }
+      return new Response(JSON.stringify({ rescode: 0, data }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      })
+    })
+    const transport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      setAccessToken,
+      fetch: fetchMock as typeof fetch,
+      deviceInfo: {
+        deviceType: 'web',
+        deviceName: 'Chrome',
+        deviceId: 'host-device-123',
+        deviceBrand: 'MacIntel',
+      },
+    })
+
+    await expect(
+      transport.createQrChallenge?.({ applicationName: 'OfficialWebsite' }),
+    ).resolves.toEqual({
+      challengeId,
+      imageUrl: 'data:image/png;base64,b2J2aW91c2x5LWZha2UtcG5n',
+      expiresInSeconds: 120,
+      pollIntervalMs: 2000,
+    })
+    await expect(transport.pollQrChallenge?.(challengeId, 'OfficialWebsite')).resolves.toEqual({
+      status: 'scanned',
+    })
+    await expect(transport.pollQrChallenge?.(challengeId, 'OfficialWebsite')).resolves.toEqual({
+      status: 'confirmed',
+      result: { applicationName: 'OfficialWebsite', isNewUser: false },
+    })
+
+    const requestBodies = fetchMock.mock.calls.map(([, init]) => JSON.parse(String(init?.body)))
+    expect(requestBodies).toEqual([
+      {
+        auth_method: 'qr',
+        action: 'create',
+        application_name: 'OfficialWebsite',
+        client_id: 'OfficialWebsite',
+        device_type: 'web',
+        device_name: 'Chrome',
+        device_id: 'host-device-123',
+        device_brand: 'MacIntel',
+      },
+      {
+        auth_method: 'qr',
+        action: 'poll',
+        application_name: 'OfficialWebsite',
+        client_id: 'OfficialWebsite',
+        challenge_id: challengeId,
+        device_type: 'web',
+        device_name: 'Chrome',
+        device_id: 'host-device-123',
+        device_brand: 'MacIntel',
+      },
+      {
+        auth_method: 'qr',
+        action: 'poll',
+        application_name: 'OfficialWebsite',
+        client_id: 'OfficialWebsite',
+        challenge_id: challengeId,
+        device_type: 'web',
+        device_name: 'Chrome',
+        device_id: 'host-device-123',
+        device_brand: 'MacIntel',
+      },
+    ])
+    expect(setAccessToken).toHaveBeenCalledTimes(1)
+    expect(setAccessToken).toHaveBeenCalledWith(accessToken, {
+      status: 'confirmed',
+      application_name: 'OfficialWebsite',
+      is_new_user: false,
+      user_id: 7,
+    })
+    expect(JSON.stringify(setAccessToken.mock.calls[0]?.[1])).not.toContain(challengeId)
+    expect(JSON.stringify(setAccessToken.mock.calls[0]?.[1])).not.toContain(accessToken)
+  })
+
+  it('maps QR expiry and rejection without exposing backend text', async () => {
+    const responses = [
+      {
+        rescode: 999,
+        error_code: 'QR_CHALLENGE_EXPIRED',
+        msg: 'internal expiry detail with credential',
+      },
+      {
+        rescode: 999,
+        error_code: 'QR_LOGIN_REJECTED',
+        msg: 'internal rejection detail with credential',
+      },
+    ]
+    const fetchMock = vi.fn(
+      async () =>
+        new Response(JSON.stringify(responses.shift()), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+    )
+    const transport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      applicationName: 'OfficialWebsite',
+      setAccessToken: vi.fn(),
+      fetch: fetchMock as typeof fetch,
+    })
+    const challengeId = 'obviously-fake-qr-challenge-id-1234567890'
+
+    await expect(transport.pollQrChallenge?.(challengeId)).resolves.toEqual({ status: 'expired' })
+    await expect(transport.pollQrChallenge?.(challengeId)).resolves.toEqual({ status: 'rejected' })
+  })
+
+  it('automatically reports a stable browser fingerprint device context by default', async () => {
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      void input
+      void init
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: { token: 'obviously-fake-default-device-jwt', application_name: 'HrSaas' },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+    const transport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      setAccessToken: vi.fn(),
+      fetch: fetchMock as typeof fetch,
+    })
+
+    await transport.login({
+      mobile: '13800138000',
+      smsCode: '123456',
+      applicationName: 'HrSaas',
+    })
+
+    const body = JSON.parse(String(fetchMock.mock.calls[0]?.[1]?.body)) as Record<string, unknown>
+    expect(body).toMatchObject({
+      auth_method: 'sms',
+      application_name: 'HrSaas',
+      client_id: 'HrSaas',
+      device_type: 'web',
+    })
+    expect(body.device_name).toEqual(expect.any(String))
+    expect(body.device_brand).toEqual(expect.any(String))
+    expect(body.device_id).toEqual(expect.stringMatching(/^web-/))
+
+    const secondFetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      void input
+      void init
+      return new Response(
+        JSON.stringify({
+          rescode: 0,
+          data: { token: 'obviously-fake-second-device-jwt', application_name: 'HrSaas' },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      )
+    })
+    const secondTransport = createUniplatBaseUserLoginTransport({
+      apiBaseUrl: 'https://api.example.com/api',
+      setAccessToken: vi.fn(),
+      fetch: secondFetchMock as typeof fetch,
+    })
+    await secondTransport.login({
+      mobile: '13800138000',
+      smsCode: '123456',
+      applicationName: 'HrSaas',
+    })
+    const secondBody = JSON.parse(String(secondFetchMock.mock.calls[0]?.[1]?.body)) as Record<
+      string,
+      unknown
+    >
+    expect(secondBody.device_id).toBe(body.device_id)
+  })
+})