@finebi/finebi-cli 1.6.1 → 1.6.2

package/templates/web-app/tests/bundle.test.mjs

@@ -1,19 +1,19 @@
-import assert from 'node:assert/strict';
-import {test} from 'node:test';
-import {build} from 'vite';
-
-test('production entry defers charts and optional controls and only bundles supported date locales',async()=>{
-  const result=await build({logLevel:'silent',build:{write:false}});
-  const chunks=result.output.filter(item=>item.type==='chunk');
-  const initial=new Set();
-  const visit=chunk=>{if(initial.has(chunk))return;initial.add(chunk);for(const name of chunk.imports){const imported=chunks.find(c=>c.fileName===name);if(imported)visit(imported);}};
-  chunks.filter(c=>c.isEntry).forEach(visit);
-  const initialModules=[...initial].flatMap(c=>Object.keys(c.modules));
-  assert.ok(!initialModules.some(id=>/node_modules\/(echarts|zrender)\//.test(id)),'ECharts must not be an entry dependency');
-  assert.ok(!initialModules.some(id=>/node_modules\/(antd|@rc-component\/picker)\//.test(id)),'optional filter UI must not be an entry dependency');
-  const modules=chunks.flatMap(c=>Object.keys(c.modules));
-  assert.ok(!modules.some(id=>id.includes('/tests/browser/')),'browser fixtures and their fetch replacement must not enter production');
-  const locales=new Set(modules.flatMap(id=>{const match=id.match(/date-fns\/locale\/([^/]+)/);return match?[match[1]]:[];}));
-  assert.deepEqual([...locales].filter(name=>!['en-US','zh-CN','_lib','en-US.js','zh-CN.js'].includes(name)),[],'do not bundle unused calendar languages');
-  for(const type of ['Bar','Line','Pie'])assert.ok(chunks.some(c=>c.isDynamicEntry&&Object.keys(c.modules).some(id=>id.endsWith(`/charts/${type}.tsx`))),`${type} has an independent lazy entry`);
-});
+import assert from 'node:assert/strict';
+import {test} from 'node:test';
+import {build} from 'vite';
+
+test('production entry defers charts and optional controls and only bundles supported date locales',async()=>{
+  const result=await build({logLevel:'silent',build:{write:false}});
+  const chunks=result.output.filter(item=>item.type==='chunk');
+  const initial=new Set();
+  const visit=chunk=>{if(initial.has(chunk))return;initial.add(chunk);for(const name of chunk.imports){const imported=chunks.find(c=>c.fileName===name);if(imported)visit(imported);}};
+  chunks.filter(c=>c.isEntry).forEach(visit);
+  const initialModules=[...initial].flatMap(c=>Object.keys(c.modules));
+  assert.ok(!initialModules.some(id=>/node_modules\/(echarts|zrender)\//.test(id)),'ECharts must not be an entry dependency');
+  assert.ok(!initialModules.some(id=>/node_modules\/(antd|@rc-component\/picker)\//.test(id)),'optional filter UI must not be an entry dependency');
+  const modules=chunks.flatMap(c=>Object.keys(c.modules));
+  assert.ok(!modules.some(id=>id.includes('/tests/browser/')),'browser fixtures and their fetch replacement must not enter production');
+  const locales=new Set(modules.flatMap(id=>{const match=id.match(/date-fns\/locale\/([^/]+)/);return match?[match[1]]:[];}));
+  assert.deepEqual([...locales].filter(name=>!['en-US','zh-CN','_lib','en-US.js','zh-CN.js'].includes(name)),[],'do not bundle unused calendar languages');
+  for(const type of ['Bar','Line','Pie'])assert.ok(chunks.some(c=>c.isDynamicEntry&&Object.keys(c.modules).some(id=>id.endsWith(`/charts/${type}.tsx`))),`${type} has an independent lazy entry`);
+});

package/templates/web-app/tests/cockpit.test.mjs

@@ -1,73 +1,73 @@
-import assert from 'node:assert/strict';
-import {after,test} from 'node:test';
-import {createServer} from 'vite';
-import {createElement} from 'react';
-import {renderToStaticMarkup} from 'react-dom/server';
-const server=await createServer({configFile:false,cacheDir:'temp/vite-cockpit-tests',server:{middlewareMode:true,hmr:false}});
-after(()=>server.close());
-const client=await server.ssrLoadModule('/src/finebi/client.ts');
-const data=await server.ssrLoadModule('/src/services/table-data.ts');
-const queries=await server.ssrLoadModule('/src/services/widget-queries.ts');
-const {Widget}=await server.ssrLoadModule('/src/components/Widget.tsx');
-const config={schemaVersion:'1',title:'Test',basePath:'/bi',layout:'cockpit',dashboardId:'r',directoryEntryId:'directory',maxRows:1000,pageSize:8,
-  widgets:[{entryId:'a',name:'A',type:'table',filterNames:['month']},{entryId:'b',name:'B',type:'table',filterNames:[]}],filters:[{name:'month',label:'月份',type:'month'}]};
-const native={previewResult:{resultType:'DETAIL',header:[],items:[],size:10,row:0,hasNext:false}};
-test('retry is only exposed after a settled failure, never while an initial request is pending',()=>{
-  const props={binding:config.widgets[0],pageSize:8,onRetry:()=>{}};
-  assert.doesNotMatch(renderToStaticMarkup(createElement(Widget,{...props,state:{loading:true}})),/重试组件/);
-  assert.match(renderToStaticMarkup(createElement(Widget,{...props,state:{loading:false,error:new Error('fixture')}})),/重试组件/);
-});
-test('directory source and verified per-widget scope survive individual queries, never falling back',async()=>{
-  const sent=[];
-  const fetcher=async(url,init)=>{sent.push({url,...JSON.parse(init.body)});return new Response(JSON.stringify({success:true,data:{a:native,b:native}}));};
-  await client.queryWidget(config,config.widgets[0],{month:'2024-02'},undefined,fetcher);
-  await client.queryWidget(config,config.widgets[1],{month:'2024-02'},undefined,fetcher);
-  assert.deepEqual(sent.map(s=>s.reportEntryId),['directory','directory']);
-  assert.deepEqual(sent.map(s=>s.widgetIds),[['a'],['b']]);
-  assert.deepEqual(sent.map(s=>s.refer),[{month:['2024-02']},{}]);
-  let calls=0;
-  await assert.rejects(client.queryWidget(config,config.widgets[0],{},undefined,async()=>{calls++;return new Response('{}',{status:403});}),e=>e.code==='PERMISSION_DENIED');
-  assert.equal(calls,1);
-});
-test('component loader limits concurrency, publishes independent failures and respects cancellation',async()=>{
-  const updates=[];let active=0,peak=0;
-  const many={...config,widgets:[...config.widgets,...Array.from({length:6},(_,i)=>({entryId:'extra-'+i,name:'Extra',type:'table'}))]};
-  await queries.loadWidgets(many,{},new AbortController().signal,(id,state)=>updates.push([id,state]),async(_url,init)=>{
-    active++;peak=Math.max(peak,active);await new Promise(r=>setTimeout(r,5));active--;
-    const id=JSON.parse(init.body).widgetIds[0];return id==='a'?new Response('{}',{status:500}):new Response(JSON.stringify({success:true,data:{[id]:native}}));
-  });
-  assert.equal(peak,3);assert.ok(updates.find(([id,s])=>id==='0:a'&&s.error));assert.ok(updates.find(([id,s])=>id==='1:b'&&s.result));
-  const controller=new AbortController();controller.abort();let calls=0;
-  await queries.loadWidgets(config,{},controller.signal,()=>assert.fail('no stale update'),async()=>{calls++;});assert.equal(calls,0);
-});
-test('same native widget can have separate display scopes; aborted old responses publish nothing',async()=>{
-  const duplicate={...config,widgets:[config.widgets[0],{...config.widgets[0],filterNames:[]}]};
-  const complete=[];
-  await queries.loadWidgets(duplicate,{month:'2024-02'},new AbortController().signal,(key,state)=>{if(state.result)complete.push(key);},async()=>new Response(JSON.stringify({success:true,data:{a:native}})));
-  assert.deepEqual(complete.sort(),['0:a','1:a']);
-  const controller=new AbortController(),updates=[];
-  await queries.loadWidgets(config,{},controller.signal,(_key,state)=>updates.push(state),async()=>{controller.abort();return new Response(JSON.stringify({success:true,data:{a:native,b:native}}));});
-  assert.ok(updates.every(s=>s.loading));
-});
-const cell=(value,state='AVAILABLE',display=value)=>({value,display,state,reason:null});
-const dataset={id:'main',returnedRowCount:4,columns:[{fieldId:'x',key:'c0',name:'名字',type:'STRING'},{fieldId:'v',key:'c1',name:'金额',type:'DECIMAL'}],rows:[
-  {kind:'DATA',cells:[cell('=HYPERLINK("x")'),cell('9007199254740993.01')]},
-  {kind:'DATA',cells:[cell('B'),cell('9007199254740993.02','AVAILABLE','9,007,199,254,740,993.02元')]},
-  {kind:'UNKNOWN',cells:[cell('C'),cell(null,'RESTRICTED','***')]},
-  {kind:'DATA',cells:[cell('D'),cell(null,'NULL',null)]},
-]};
-test('loaded table sorts decimals exactly, filters and exports matching rows with safe CSV and explicit states',()=>{
-  assert.equal(data.compareDecimal('9007199254740993.01','9007199254740993.02'),-1);
-  assert.equal(data.compareDecimal('-1.001e3','-1001'),0);
-  assert.equal(data.compareDecimal('1e-10','0.00000000009'),1);
-  assert.equal(data.compareDecimal('1.20','1.2'),0);
-  assert.equal(data.compareDecimal('1200','1.2e3'),0);
-  assert.equal(data.compareDecimal('-0.001200','-1.2e-3'),0);
-  const rows=data.tableRows(dataset,{search:'',sort:{fieldId:'v',direction:'desc'},filters:{}});
-  assert.equal(rows[0].cells[0].value,'B');assert.equal(rows[1].cells[0].value,'=HYPERLINK("x")');
-  const filtered=data.tableRows(dataset,{search:'',filters:{x:'B'}});assert.equal(filtered.length,1);
-  const csv=data.tableCsv(dataset,rows);
-  assert.match(csv,/'=HYPERLINK/);assert.match(csv,/受限/);assert.doesNotMatch(csv,/\*\*\*/);assert.match(csv,/UNKNOWN/);
-  assert.match(data.tableCsv(dataset,filtered),/9,007,199/);
-  assert.throws(()=>data.tableRows(dataset,{search:'',filters:{missing:'x'}}),/字段/);
-});
+import assert from 'node:assert/strict';
+import {after,test} from 'node:test';
+import {createServer} from 'vite';
+import {createElement} from 'react';
+import {renderToStaticMarkup} from 'react-dom/server';
+const server=await createServer({configFile:false,cacheDir:'temp/vite-cockpit-tests',server:{middlewareMode:true,hmr:false}});
+after(()=>server.close());
+const client=await server.ssrLoadModule('/src/finebi/client.ts');
+const data=await server.ssrLoadModule('/src/services/table-data.ts');
+const queries=await server.ssrLoadModule('/src/services/widget-queries.ts');
+const {Widget}=await server.ssrLoadModule('/src/components/Widget.tsx');
+const config={schemaVersion:'1',title:'Test',basePath:'/bi',layout:'cockpit',dashboardId:'r',directoryEntryId:'directory',maxRows:1000,pageSize:8,
+  widgets:[{entryId:'a',name:'A',type:'table',filterNames:['month']},{entryId:'b',name:'B',type:'table',filterNames:[]}],filters:[{name:'month',label:'月份',type:'month'}]};
+const native={previewResult:{resultType:'DETAIL',header:[],items:[],size:10,row:0,hasNext:false}};
+test('retry is only exposed after a settled failure, never while an initial request is pending',()=>{
+  const props={binding:config.widgets[0],pageSize:8,onRetry:()=>{}};
+  assert.doesNotMatch(renderToStaticMarkup(createElement(Widget,{...props,state:{loading:true}})),/重试组件/);
+  assert.match(renderToStaticMarkup(createElement(Widget,{...props,state:{loading:false,error:new Error('fixture')}})),/重试组件/);
+});
+test('directory source and verified per-widget scope survive individual queries, never falling back',async()=>{
+  const sent=[];
+  const fetcher=async(url,init)=>{sent.push({url,...JSON.parse(init.body)});return new Response(JSON.stringify({success:true,data:{a:native,b:native}}));};
+  await client.queryWidget(config,config.widgets[0],{month:'2024-02'},undefined,fetcher);
+  await client.queryWidget(config,config.widgets[1],{month:'2024-02'},undefined,fetcher);
+  assert.deepEqual(sent.map(s=>s.reportEntryId),['directory','directory']);
+  assert.deepEqual(sent.map(s=>s.widgetIds),[['a'],['b']]);
+  assert.deepEqual(sent.map(s=>s.refer),[{month:['2024-02']},{}]);
+  let calls=0;
+  await assert.rejects(client.queryWidget(config,config.widgets[0],{},undefined,async()=>{calls++;return new Response('{}',{status:403});}),e=>e.code==='PERMISSION_DENIED');
+  assert.equal(calls,1);
+});
+test('component loader limits concurrency, publishes independent failures and respects cancellation',async()=>{
+  const updates=[];let active=0,peak=0;
+  const many={...config,widgets:[...config.widgets,...Array.from({length:6},(_,i)=>({entryId:'extra-'+i,name:'Extra',type:'table'}))]};
+  await queries.loadWidgets(many,{},new AbortController().signal,(id,state)=>updates.push([id,state]),async(_url,init)=>{
+    active++;peak=Math.max(peak,active);await new Promise(r=>setTimeout(r,5));active--;
+    const id=JSON.parse(init.body).widgetIds[0];return id==='a'?new Response('{}',{status:500}):new Response(JSON.stringify({success:true,data:{[id]:native}}));
+  });
+  assert.equal(peak,3);assert.ok(updates.find(([id,s])=>id==='0:a'&&s.error));assert.ok(updates.find(([id,s])=>id==='1:b'&&s.result));
+  const controller=new AbortController();controller.abort();let calls=0;
+  await queries.loadWidgets(config,{},controller.signal,()=>assert.fail('no stale update'),async()=>{calls++;});assert.equal(calls,0);
+});
+test('same native widget can have separate display scopes; aborted old responses publish nothing',async()=>{
+  const duplicate={...config,widgets:[config.widgets[0],{...config.widgets[0],filterNames:[]}]};
+  const complete=[];
+  await queries.loadWidgets(duplicate,{month:'2024-02'},new AbortController().signal,(key,state)=>{if(state.result)complete.push(key);},async()=>new Response(JSON.stringify({success:true,data:{a:native}})));
+  assert.deepEqual(complete.sort(),['0:a','1:a']);
+  const controller=new AbortController(),updates=[];
+  await queries.loadWidgets(config,{},controller.signal,(_key,state)=>updates.push(state),async()=>{controller.abort();return new Response(JSON.stringify({success:true,data:{a:native,b:native}}));});
+  assert.ok(updates.every(s=>s.loading));
+});
+const cell=(value,state='AVAILABLE',display=value)=>({value,display,state,reason:null});
+const dataset={id:'main',returnedRowCount:4,columns:[{fieldId:'x',key:'c0',name:'名字',type:'STRING'},{fieldId:'v',key:'c1',name:'金额',type:'DECIMAL'}],rows:[
+  {kind:'DATA',cells:[cell('=HYPERLINK("x")'),cell('9007199254740993.01')]},
+  {kind:'DATA',cells:[cell('B'),cell('9007199254740993.02','AVAILABLE','9,007,199,254,740,993.02元')]},
+  {kind:'UNKNOWN',cells:[cell('C'),cell(null,'RESTRICTED','***')]},
+  {kind:'DATA',cells:[cell('D'),cell(null,'NULL',null)]},
+]};
+test('loaded table sorts decimals exactly, filters and exports matching rows with safe CSV and explicit states',()=>{
+  assert.equal(data.compareDecimal('9007199254740993.01','9007199254740993.02'),-1);
+  assert.equal(data.compareDecimal('-1.001e3','-1001'),0);
+  assert.equal(data.compareDecimal('1e-10','0.00000000009'),1);
+  assert.equal(data.compareDecimal('1.20','1.2'),0);
+  assert.equal(data.compareDecimal('1200','1.2e3'),0);
+  assert.equal(data.compareDecimal('-0.001200','-1.2e-3'),0);
+  const rows=data.tableRows(dataset,{search:'',sort:{fieldId:'v',direction:'desc'},filters:{}});
+  assert.equal(rows[0].cells[0].value,'B');assert.equal(rows[1].cells[0].value,'=HYPERLINK("x")');
+  const filtered=data.tableRows(dataset,{search:'',filters:{x:'B'}});assert.equal(filtered.length,1);
+  const csv=data.tableCsv(dataset,rows);
+  assert.match(csv,/'=HYPERLINK/);assert.match(csv,/受限/);assert.doesNotMatch(csv,/\*\*\*/);assert.match(csv,/UNKNOWN/);
+  assert.match(data.tableCsv(dataset,filtered),/9,007,199/);
+  assert.throws(()=>data.tableRows(dataset,{search:'',filters:{missing:'x'}}),/字段/);
+});

package/templates/web-app/tests/field-selection.test.mjs

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import {after,test} from 'node:test';
+import {createServer as createHttpServer} from 'node:http';
+import {createServer} from 'vite';
+import {configErrors} from '../src/finebi/config.js';
+import {createDevMiddleware} from '../scripts/dev-proxy.mjs';
+const server=await createServer({configFile:false,cacheDir:'temp/vite-field-selection-tests',server:{middlewareMode:true,hmr:false}});
+after(()=>server.close());
+const {queryWidget,queryWidgets}=await server.ssrLoadModule('/src/finebi/client.ts');
+const binding={entryId:'w',name:'Table',type:'table'};
+const config={schemaVersion:'1',title:'Test',basePath:'/bi',layout:'overview',dashboardId:'r',maxRows:10,pageSize:5,widgets:[binding],filters:[]};
+const response=()=>new Response(JSON.stringify({success:true,data:{w:{previewResult:{resultType:'DETAIL',header:[],items:[],row:0}}}}));
+
+test('optional dimensionIds validates lists without confusing omission and empty selection',()=>{
+  for(const ids of [undefined,[],['city'],['sales'],['city','sales']]) {
+    const widget=ids===undefined?binding:{...binding,dimensionIds:ids};
+    assert.deepEqual(configErrors({...config,widgets:[widget]}),[]);
+  }
+  for(const ids of [null,'sales',[1],[''],[' '],[null],['sales','sales']]) {
+    assert.ok(configErrors({...config,widgets:[{...binding,dimensionIds:ids}]}).some(e=>e.includes('dimensionIds')));
+  }
+});
+
+test('binding selection reaches ordinary and published queries unchanged, including omission',async()=>{
+  for(const directoryEntryId of [undefined,'directory']) {
+    const widgets=[binding,...[[],['city'],['sales'],['city','sales']].map(dimensionIds=>({...binding,dimensionIds}))];
+    const app={...config,...(directoryEntryId?{directoryEntryId}:{}),widgets};
+    for(const widget of widgets) {
+      await queryWidget(app,widget,{},undefined,async(_url,init)=>{
+        const body=JSON.parse(init.body);
+        assert.deepEqual(body.dimensionSelections,widget.dimensionIds===undefined?undefined:{w:widget.dimensionIds});
+        assert.equal(Object.hasOwn(body,'dimensionSelections'),widget.dimensionIds!==undefined);
+        assert.equal(body.reportEntryId,directoryEntryId);
+        return response();
+      });
+    }
+    await assert.rejects(queryWidgets(app,{},undefined,()=>assert.fail('conflicting bindings must not fetch')),/selection|选择/);
+  }
+});
+
+test('invalid selection fails before browser HTTP and matching batch selections can share an instance',async()=>{
+  await assert.rejects(queryWidgets({...config,widgets:[{...binding,dimensionIds:null}]},{},undefined,()=>assert.fail('invalid config must not fetch')),/dimensionIds/);
+  const widgets=[{...binding,dimensionIds:['city','sales']},{...binding,dimensionIds:['sales','city']}];
+  await queryWidgets({...config,widgets},{},undefined,async(_url,init)=>{
+    const body=JSON.parse(init.body);assert.deepEqual(body.widgetIds,['w']);
+    assert.deepEqual(body.dimensionSelections,{w:['city','sales']});return response();
+  });
+});
+
+test('proxy preserves configured choices and rejects malformed or unconfigured selections before upstream',async()=>{
+  const sent=[];
+  const widgets=[binding,...[[],['sales'],['city','sales']].map(dimensionIds=>({...binding,dimensionIds}))];
+  const middleware=createDevMiddleware({...config,directoryEntryId:'directory',widgets},
+    {FINEBI_DEV_BASE_URL:'http://bi.example/bi',FINEBI_DEV_TOKEN:'secret'},async(_url,init)=>{sent.push(JSON.parse(init.body));return response();});
+  const http=createHttpServer((req,res)=>middleware(req,res,()=>{}));
+  await new Promise(resolve=>http.listen(0,'127.0.0.1',resolve));
+  const send=extra=>fetch(`http://127.0.0.1:${http.address().port}/bi/v5/api/dashboard/report/r/widgets/query`,{
+    method:'POST',headers:{'X-Requested-With':'XMLHttpRequest'},body:JSON.stringify({widgetIds:['w'],pageLimit:10,reportEntryId:'directory',...extra})});
+  try {
+    for(const selections of [null,[],{other:['sales']},{w:null},{w:['']},{w:['sales','sales']},{w:['unknown']},{w:['city']}]) {
+      assert.equal((await send({dimensionSelections:selections})).status,400);
+    }
+    assert.equal(sent.length,0);
+    for(const selections of [undefined,{w:[]},{w:['sales']},{w:['city','sales']}]) {
+      assert.equal((await send(selections===undefined?{}:{dimensionSelections:selections})).status,200);
+      assert.deepEqual(sent.at(-1).dimensionSelections,selections);
+      assert.equal(sent.at(-1).reportEntryId,'directory');
+    }
+  } finally {middleware.dispose?.();await new Promise(resolve=>http.close(resolve));}
+});

package/templates/web-app/tests/proxy.test.mjs

@@ -12,7 +12,7 @@ test('directory proxy pins the published entry and never forwards another source
   try {
     for(const body of [{},{reportEntryId:'other'},{directoryEntryId:'entry'}])assert.equal((await send(body)).status,400);
     assert.equal(sent.length,0);assert.equal((await send({reportEntryId:'entry'})).status,200);assert.equal(sent[0].reportEntryId,'entry');
-  }finally{await new Promise(r=>server.close(r));}
+  }finally{middleware.dispose();await new Promise(r=>server.close(r));}
 });
 
 test('development identity stays on server and cross-site or out-of-scope requests are rejected', async () => {
@@ -20,7 +20,7 @@ test('development identity stays on server and cross-site or out-of-scope reques
   const middleware = createDevMiddleware({basePath:'/webroot/decision',dashboardId:'r',widgets:[{entryId:'w'}],maxRows:1000}, {FINEBI_DEV_BASE_URL:'http://bi.example/webroot/decision',FINEBI_DEV_USERNAME:'tester',FINEBI_DEV_PASSWORD:'dev-secret'}, async (url,init) => {
     upstream.push({url,init});
     return new Response(JSON.stringify(url.endsWith('/login') ? {data:{accessToken:'session-secret'}} : {success:true,data:{w:{previewResult:{resultType:'DETAIL'}}}}));
-  });
+  }, {save:async()=>{},notify:()=>{}});
   const server=createServer((req,res)=>middleware(req,res,()=>{res.writeHead(404);res.end();}));
   await new Promise(r=>server.listen(0,'127.0.0.1',r));
   const base=`http://127.0.0.1:${server.address().port}`;
@@ -44,16 +44,31 @@ test('development identity stays on server and cross-site or out-of-scope reques
     assert.equal(upstream.length,3,'reuse only the in-memory development session');
   } finally {await new Promise(r=>server.close(r));}
 });
-test('HTML login response clears expired development session and explicit retry logs in again', async()=>{
+test('HTML login response renews the session and retries native query once', async()=>{
   let logins=0, queries=0;
   const middleware=createDevMiddleware({basePath:'/webroot/decision',dashboardId:'r',widgets:[{entryId:'w'}],filters:[],maxRows:1000},{FINEBI_DEV_BASE_URL:'http://bi.example/webroot/decision',FINEBI_DEV_USERNAME:'tester',FINEBI_DEV_PASSWORD:'secret'},async url=>{
     if(url.endsWith('/login')){logins++;return new Response(JSON.stringify({data:{accessToken:'token-'+logins}}));}
     if(++queries===1)return new Response('<html>登录</html>',{headers:{'content-type':'text/html'}});
     return new Response(JSON.stringify({success:true,data:{w:{previewResult:{resultType:'DETAIL'}}}}));
-  });
+  }, {save:async()=>{},notify:()=>{}});
   const server=createServer((req,res)=>middleware(req,res,()=>{}));await new Promise(r=>server.listen(0,'127.0.0.1',r));
   const send=()=>fetch(`http://127.0.0.1:${server.address().port}/webroot/decision/v5/api/dashboard/report/r/widgets/query`,{method:'POST',headers:{'X-Requested-With':'XMLHttpRequest'},body:JSON.stringify({widgetIds:['w'],pageLimit:10})});
-  try{const expired=await send();assert.equal(expired.status,401);assert.equal((await expired.json()).errorCode,'AUTH_REQUIRED');assert.equal((await send()).status,200);assert.equal(logins,2);}finally{await new Promise(r=>server.close(r));}
+  try{assert.equal((await send()).status,200);assert.equal(logins,2);assert.equal(queries,2);}finally{await new Promise(r=>server.close(r));}
+});
+
+test('permission errors never renew and repeated expiry stops after one retry',async()=>{
+  for(const status of [403,401]) {
+    let queries=0,logins=0;
+    const middleware=createDevMiddleware({basePath:'/bi',dashboardId:'r',widgets:[{entryId:'w'}],maxRows:1000},
+      {FINEBI_DEV_BASE_URL:'http://localhost/bi',FINEBI_DEV_TOKEN:'cached',FINEBI_DEV_USERNAME:'alice',FINEBI_DEV_PASSWORD:'secret'},
+      async url=>{if(url.endsWith('/login')){logins++;return new Response(JSON.stringify({data:{accessToken:'new'}}));}
+        queries++;return new Response('{}',{status});},{save:async()=>{},notify:()=>{}});
+    const server=createServer((req,res)=>middleware(req,res,()=>{}));await new Promise(r=>server.listen(0,'127.0.0.1',r));
+    try {
+      const response=await fetch(`http://127.0.0.1:${server.address().port}/bi/v5/api/dashboard/report/r/widgets/query`,{method:'POST',headers:{'X-Requested-With':'XMLHttpRequest'},body:JSON.stringify({widgetIds:['w'],pageLimit:10})});
+      assert.equal(response.status,status);assert.equal(queries,status===403?1:2);assert.equal(logins,status===403?0:1);
+    } finally {middleware.dispose?.();await new Promise(r=>server.close(r));}
+  }
 });
 test('missing credentials gives an explicit auth error without upstream access',async()=>{
   const middleware=createDevMiddleware({basePath:'/webroot/decision',dashboardId:'r',widgets:[{entryId:'w'}],maxRows:1000},{},()=>{throw Error('must not fetch');});

package/templates/web-app/tests/retail.test.mjs

@@ -1,31 +1,31 @@
-import assert from 'node:assert/strict';
-import {after,test} from 'node:test';
-import {createServer} from 'vite';
-const server=await createServer({configFile:false,cacheDir:'temp/vite-retail-tests',server:{middlewareMode:true,hmr:false}});
-after(()=>server.close());
-const {formatMetric,formatCategory}=await server.ssrLoadModule('/src/services/presentation.ts');
-const {configErrors}=await import('../src/finebi/config.js');
-const cell=(value,state='AVAILABLE')=>({value,display:null,state,reason:null});
-test('KPI display preserves decimal precision and formats ratios only by explicit configuration',()=>{
-  assert.equal(formatMetric(cell('9007199254740993.01'),'number'),'9,007,199,254,740,993.01');
-  assert.equal(formatMetric(cell('1.2345678e7'),'number'),'12,345,678');
-  assert.equal(formatMetric(cell('0.123456789'),'percent'),'12.35%');
-  assert.equal(formatMetric(cell('-0.00005'),'percent'),'-0.01%');
-  assert.equal(formatMetric(cell('42.0'),'number'),'42');
-  assert.equal(formatMetric(cell('100','RESTRICTED'),'number'),'受限');
-  assert.equal(formatMetric(cell(null,'NULL'),'percent'),'—');
-  assert.equal(formatMetric(cell('0.5')),'0.5');
-});
-test('month formatting is explicit, timezone-aware and preserves invalid or restricted values',()=>{
-  const binding={categoryFormat:'epoch-month',categoryTimeZone:'Asia/Shanghai'};
-  const timestamp=String(Date.UTC(2024,1,29,16));
-  assert.equal(formatCategory(cell(timestamp),binding),'2024-03');
-  assert.equal(formatCategory(cell(timestamp),{}),timestamp);
-  assert.equal(formatCategory(cell('not-a-date'),binding),'not-a-date');
-  assert.equal(formatCategory(cell(timestamp,'RESTRICTED'),binding),'受限');
-});
-test('display configuration rejects implicit date timezone and invalid formats',()=>{
-  const config={schemaVersion:'1',title:'Test',basePath:'/bi',layout:'retail',dashboardId:'r',maxRows:1000,pageSize:8,filters:[],widgets:[{entryId:'w',name:'Trend',type:'line',categoryFieldId:'x',valueFieldId:'y',categoryFormat:'epoch-month',categoryTimeZone:'Asia/Shanghai'}]};
-  assert.deepEqual(configErrors(config),[]);
-  for(const patch of [{categoryTimeZone:undefined},{categoryTimeZone:'Bad/Timezone'},{categoryFormat:'guess'},{valueFormat:'guess'}])assert.ok(configErrors({...config,widgets:[{...config.widgets[0],...patch}]}).length);
-});
+import assert from 'node:assert/strict';
+import {after,test} from 'node:test';
+import {createServer} from 'vite';
+const server=await createServer({configFile:false,cacheDir:'temp/vite-retail-tests',server:{middlewareMode:true,hmr:false}});
+after(()=>server.close());
+const {formatMetric,formatCategory}=await server.ssrLoadModule('/src/services/presentation.ts');
+const {configErrors}=await import('../src/finebi/config.js');
+const cell=(value,state='AVAILABLE')=>({value,display:null,state,reason:null});
+test('KPI display preserves decimal precision and formats ratios only by explicit configuration',()=>{
+  assert.equal(formatMetric(cell('9007199254740993.01'),'number'),'9,007,199,254,740,993.01');
+  assert.equal(formatMetric(cell('1.2345678e7'),'number'),'12,345,678');
+  assert.equal(formatMetric(cell('0.123456789'),'percent'),'12.35%');
+  assert.equal(formatMetric(cell('-0.00005'),'percent'),'-0.01%');
+  assert.equal(formatMetric(cell('42.0'),'number'),'42');
+  assert.equal(formatMetric(cell('100','RESTRICTED'),'number'),'受限');
+  assert.equal(formatMetric(cell(null,'NULL'),'percent'),'—');
+  assert.equal(formatMetric(cell('0.5')),'0.5');
+});
+test('month formatting is explicit, timezone-aware and preserves invalid or restricted values',()=>{
+  const binding={categoryFormat:'epoch-month',categoryTimeZone:'Asia/Shanghai'};
+  const timestamp=String(Date.UTC(2024,1,29,16));
+  assert.equal(formatCategory(cell(timestamp),binding),'2024-03');
+  assert.equal(formatCategory(cell(timestamp),{}),timestamp);
+  assert.equal(formatCategory(cell('not-a-date'),binding),'not-a-date');
+  assert.equal(formatCategory(cell(timestamp,'RESTRICTED'),binding),'受限');
+});
+test('display configuration rejects implicit date timezone and invalid formats',()=>{
+  const config={schemaVersion:'1',title:'Test',basePath:'/bi',layout:'retail',dashboardId:'r',maxRows:1000,pageSize:8,filters:[],widgets:[{entryId:'w',name:'Trend',type:'line',categoryFieldId:'x',valueFieldId:'y',categoryFormat:'epoch-month',categoryTimeZone:'Asia/Shanghai'}]};
+  assert.deepEqual(configErrors(config),[]);
+  for(const patch of [{categoryTimeZone:undefined},{categoryTimeZone:'Bad/Timezone'},{categoryFormat:'guess'},{valueFormat:'guess'}])assert.ok(configErrors({...config,widgets:[{...config.widgets[0],...patch}]}).length);
+});

package/templates/web-app/tests/runtime.test.mjs

@@ -73,6 +73,13 @@ test('auth expiry, permission denial, login HTML and missing widget stay distinc
     await assert.rejects(queryWidgets(config,{},undefined,async()=>response), e=>e instanceof FineBIError && e.code===code);
   }
 });
+
+test('development authorization failures explain the next action without revealing credentials',async()=>{
+  for(const code of ['AUTH_PLUGIN_REQUIRED','AUTH_HTTPS_REQUIRED','AUTH_PROTOCOL_ERROR','AUTH_UNAVAILABLE','AUTH_STORAGE_FAILED']) {
+    await assert.rejects(queryWidgets(config,{},undefined,async()=>new Response(JSON.stringify({success:false,errorCode:code}),{status:502})),
+      error=>error.code===code && /开发终端/.test(error.message));
+  }
+});
 test('view binding requires exact fields and an explicit model for multi-model results', () => {
   const source = {previewResult:{resultType:'CHART',geoms:[{dataModel:{fields:[{id:'x',name:'地区',fieldType:'DIMENSION'},{id:'y',name:'金额',fieldType:'MEASURE'}],colData:[['East','West'],[12,5]],rowCount:2}}]}};
   const r=normalize(source);

package/templates/web-app/tests/session.test.mjs

@@ -0,0 +1,91 @@
+import assert from 'node:assert/strict';
+import {test} from 'node:test';
+import {mkdtemp, mkdir, readFile, writeFile, stat, symlink} from 'node:fs/promises';
+import {resolve} from 'node:path';
+import {createDevSession} from '../scripts/dev-session.mjs';
+import {saveSession} from '../scripts/session-file.mjs';
+import {browserSession} from '../scripts/browser-session.mjs';
+
+const baseUrl='https://bi.example/decision';
+const env={FINEBI_DEV_BASE_URL:baseUrl,FINEBI_DEV_USERNAME:'alice',FINEBI_DEV_PASSWORD:'password'};
+const json=(body,status=200)=>new Response(JSON.stringify(body),{status,headers:{'content-type':'application/json'}});
+const no=()=>{throw Error('unexpected call');};
+
+test('query arriving during invalidation waits for file clearing then acquires a session',async()=>{
+  let release;
+  const blocked=new Promise(r=>{release=r;});
+  const session=createDevSession({...env,FINEBI_DEV_TOKEN:'old'}, {fetchImpl:async()=>json({data:{accessToken:'new'}}),
+    browser:no,save:async(_url,token)=>{if(!token)await blocked;}});
+  const clearing=session.invalidate('old');const next=session.get();release();await clearing;
+  assert.equal(await next,'new');
+});
+
+test('valid cached session wins; concurrent acquisition prefers password and persists once',async()=>{
+  const cached=createDevSession({...env,FINEBI_DEV_TOKEN:'cached'},{fetchImpl:no,browser:no,save:no});
+  assert.equal(await cached.get(),'cached');
+  const saves=[];
+  const session=createDevSession(env,{fetchImpl:async(url,init)=>{
+    assert.equal(url,baseUrl+'/login');assert.equal(JSON.parse(init.body).username,'alice');
+    return json({data:{accessToken:'password-session'}});
+  },browser:no,save:async(...args)=>saves.push(args)});
+  assert.deepEqual(await Promise.all([session.get(),session.get()]),['password-session','password-session']);
+  assert.equal(saves.length,1);assert.equal(saves[0][1],'password-session');
+});
+
+test('password rejection uses browser once, persists identity and does not retry rejected password',async()=>{
+  let passwords=0,browsers=0;
+  const saves=[];
+  const session=createDevSession(env,{fetchImpl:async()=>{passwords++;return json({errorCode:'PASSWORD_ERROR'},401);},
+    browser:async()=>({token:'sso-'+(++browsers),username:'Bob'}),save:async(...args)=>saves.push(args)});
+  assert.equal(await session.get(),'sso-1');await session.invalidate('sso-1');
+  assert.equal(await session.get(),'sso-2');assert.equal(passwords,1);assert.equal(browsers,2);
+  assert.equal(saves.at(-1)[2],'Bob');
+});
+
+test('network and upstream server errors never trigger browser authorization',async()=>{
+  for(const fetchImpl of [async()=>{throw Error('socket');},async()=>json({},503)]) {
+    const s=createDevSession(env,{fetchImpl,browser:no,save:no});
+    await assert.rejects(s.get(),/UPSTREAM_UNAVAILABLE/);
+  }
+});
+
+test('stale failures do not clear fresh token; persisted token is bound to server',async()=>{
+  const saves=[];
+  const s=createDevSession({...env,FINEBI_DEV_TOKEN:'old'},{fetchImpl:async()=>json({data:{accessToken:'new'}}),browser:no,save:async(...v)=>saves.push(v)});
+  await s.invalidate('old');assert.equal(await s.get(),'new');await s.invalidate('old');assert.equal(await s.get(),'new');
+  const changed=createDevSession({...env,FINEBI_DEV_TOKEN:'wrong-server',FINEBI_DEV_TOKEN_BASE_URL:'https://other.example/decision'},
+    {fetchImpl:async()=>json({data:{accessToken:'right-server'}}),browser:no,save:async()=>{}});
+  assert.equal(await changed.get(),'right-server');
+});
+
+test('session file preserves other configuration, replaces duplicate tokens and restricts access',async()=>{
+  const root=resolve('temp');await mkdir(root,{recursive:true});const dir=await mkdtemp(resolve(root,'auth-file-'));
+  const path=resolve(dir,'.env.local');
+  await writeFile(path,'# own config\nCUSTOM="keep"\nFINEBI_DEV_PASSWORD="keep-password"\nFINEBI_DEV_TOKEN=old\nexport FINEBI_DEV_TOKEN=duplicate\n');
+  await saveSession(path,baseUrl,'new-session','Alice');
+  const content=await readFile(path,'utf8');
+  assert.match(content,/CUSTOM="keep"/);assert.match(content,/PASSWORD="keep-password"/);
+  assert.equal((content.match(/^FINEBI_DEV_TOKEN=/gm)||[]).length,1);assert.doesNotMatch(content,/duplicate|=old/);
+  assert.match(content,/FINEBI_DEV_TOKEN_BASE_URL="https:\/\/bi.example\/decision"/);
+  if(process.platform!=='win32')assert.equal((await stat(path)).mode & 0o777,0o600);
+  await saveSession(path,baseUrl,'','');assert.match(await readFile(path,'utf8'),/FINEBI_DEV_TOKEN=""/);
+});
+
+test('session persistence refuses symlinks', {skip:process.platform==='win32'}, async()=>{
+  await mkdir('temp',{recursive:true});const dir=await mkdtemp(resolve('temp','auth-link-'));
+  const target=resolve(dir,'other');await writeFile(target,'unchanged');await symlink(target,resolve(dir,'.env.local'));
+  await assert.rejects(saveSession(resolve(dir,'.env.local'),baseUrl,'secret','Alice'));
+  assert.equal(await readFile(target,'utf8'),'unchanged');
+});
+
+test('browser handoff pins verification URL and keeps retrieval secret out of notices',async()=>{
+  const notices=[],opened=[],calls=[];
+  const result=await browserSession(baseUrl,{notify:text=>notices.push(text),openBrowser:url=>opened.push(url),sleep:async()=>{},
+    fetchImpl:async(url,init)=>{calls.push({url,init});return url.endsWith('/start')
+      ?json({data:{deviceCode:'d'.repeat(43),userCode:'ABCD-EFGH',verificationPath:'/api/bi-cli/dev-session-auth/authorize?code=ABCD-EFGH',expiresIn:600,interval:5}})
+      :json({data:{status:'approved',token:'session-secret',username:'Alice'}});}});
+  assert.equal(result.token,'session-secret');assert.equal(opened[0],baseUrl+'/api/bi-cli/dev-session-auth/authorize?code=ABCD-EFGH');
+  assert.doesNotMatch(notices.join(' '),/session-secret|dddddddd/);
+  assert.equal(JSON.parse(calls[1].init.body).deviceCode,'d'.repeat(43));
+  await assert.rejects(browserSession(baseUrl,{notify:no,openBrowser:no,fetchImpl:async()=>json({data:{deviceCode:'d'.repeat(43),userCode:'ABCD-EFGH',verificationPath:'https://evil.example/',expiresIn:600,interval:5}})}),/AUTH_PROTOCOL_ERROR/);
+});