@mrrisega/dsh-remote 0.6.0 → 0.6.1

package/packages/dsh-remote-web/test/community-qr-ui.test.mjs

@@ -0,0 +1,287 @@
+// 交流群二维码（运营配置）在插件侧的两处展示回归：
+//   ① 设置面板：「💬 加入交流群」按钮 → 点击弹出二维码大图（未配置后台码 → 按钮不存在）；
+//   ② 用户反馈页：底部直接展示企微交流群二维码 + 文案。
+// 数据来源：node 半 GET /dsh-remote/community（读公开配置 community.qrcode 并拼绝对地址）。
+// 采用真实 useEffect（依赖比较 + 提交后执行），与 login-selfheal-ui.test.mjs 同一套 vm 挂载方式。
+import assert from "node:assert/strict";
+import http from "node:http";
+import { readFileSync } from "node:fs";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import vm from "node:vm";
+import { apply } from "../lib/index.js";
+
+const SOURCE = readFileSync(new URL("../lib/client.js", import.meta.url), "utf8");
+const QR_PATH = "/qr/group-qr.png";
+const API_URL = "https://relay.test/relay-api";
+const QR_ABS = API_URL + QR_PATH;
+
+function walk(node, visit) {
+  if (node == null) return;
+  if (Array.isArray(node)) { for (const item of node) walk(item, visit); return; }
+  if (typeof node !== "object") return;
+  visit(node);
+  for (const child of node.children || []) walk(child, visit);
+}
+function find(tree, predicate) {
+  let match;
+  walk(tree, (node) => { if (!match && predicate(node)) match = node; });
+  return match;
+}
+function textHas(tree, substr) {
+  return !!find(tree, (node) => (node.children || []).some((c) => typeof c === "string" && c.includes(substr)));
+}
+function nodeWithText(tree, substr) {
+  return find(tree, (node) => typeof node.props?.onClick === "function" && (node.children || []).some((c) => typeof c === "string" && c.includes(substr)));
+}
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+/**
+ * 迷你 React（真实 useEffect）+ 假定时器；fetch 覆盖 /dsh-remote/* 面板接口。
+ * @param {object} opts - community：/dsh-remote/community 的返回值（默认已配置二维码）
+ */
+function loadPlugin(opts = {}) {
+  let moduleFactory;
+  const registered = new Map();
+  const injects = new Map();
+  const requests = [];
+
+  let clock = 0;
+  let timerSeq = 1;
+  const timers = new Map();
+  const job = (fn) => { try { fn(); } catch (e) { /* 断言会暴露问题 */ } };
+  const fakeSetTimeout = (fn, ms) => { const id = timerSeq++; timers.set(id, { at: clock + (Number(ms) || 0), fn, every: 0 }); return id; };
+  const fakeSetInterval = (fn, ms) => { const id = timerSeq++; const every = Math.max(1, Number(ms) || 1); timers.set(id, { at: clock + every, fn, every }); return id; };
+  const fakeClear = (id) => { timers.delete(id); };
+
+  // ── 迷你 React：真实 useState/useEffect + 递归渲染函数组件(FeedbackCard 等嵌套组件) ──
+  // 每个组件实例按「树中位置路径」持有自己的 hook 槽位(近似 React 的位置化协调),故子组件状态
+  // 可跨渲染保持;effects 在对应子树展开后执行(cleanup 语义与 React 一致)。
+  const scopes = new Map(); // key -> { hook, effectCursor, slots, pending }
+  const scopeStack = [];
+  const currentScope = () => scopeStack[scopeStack.length - 1];
+
+  const react = {
+    createElement(type, props, ...children) { return { type, props: props || {}, children }; },
+    useState(initial) {
+      const sc = currentScope();
+      const index = sc.hook++;
+      if (!(index in sc.state)) sc.state[index] = typeof initial === "function" ? initial() : initial;
+      return [sc.state[index], (value) => { sc.state[index] = typeof value === "function" ? value(sc.state[index]) : value; }];
+    },
+    useEffect(fn, deps) {
+      const sc = currentScope();
+      const index = sc.effectCursor++;
+      const prev = sc.effects[index];
+      const changed = !prev || !deps || deps.length !== prev.deps.length || deps.some((d, i) => !Object.is(d, prev.deps[i]));
+      if (changed) sc.pending.push({ index, fn, deps: deps ? [...deps] : deps });
+    },
+    useCallback(fn) { return fn; },
+    useSyncExternalStore(_subscribe, getSnapshot) { return getSnapshot(); },
+  };
+
+  /** 渲染一棵树:函数组件递归展开(含 effects),普通节点保留并递归子节点。 */
+  function renderNode(node, path) {
+    if (node == null) return node;
+    if (Array.isArray(node)) return node.map((n, i) => renderNode(n, path + "/" + i));
+    if (typeof node !== "object") return node;
+    if (typeof node.type === "function") {
+      const name = node.type.name || "anon";
+      const key = path + ":" + name;
+      const sc = scopes.get(key) || { hook: 0, effectCursor: 0, state: [], effects: [], pending: [] };
+      sc.hook = 0; sc.effectCursor = 0; sc.pending = [];
+      scopes.set(key, sc);
+      scopeStack.push(sc);
+      let out;
+      try {
+        out = node.type(node.props || {});
+      } finally {
+        scopeStack.pop();
+      }
+      const expanded = renderNode(out, key);
+      const todos = sc.pending;
+      sc.pending = [];
+      for (const t of todos) {
+        const prev = sc.effects[t.index];
+        if (prev && typeof prev.cleanup === "function") job(prev.cleanup);
+        const cleanup = t.fn();
+        sc.effects[t.index] = { deps: t.deps, cleanup: typeof cleanup === "function" ? cleanup : null };
+      }
+      return expanded;
+    }
+    return { ...node, children: (node.children || []).map((c, i) => renderNode(c, path + "/" + i)) };
+  }
+
+  const community = opts.community !== undefined ? opts.community : { ok: true, qrcode: QR_ABS, wechat: "dsh-remote-support" };
+  const status = opts.status || {
+    ok: true,
+    config: { phone: "138****0000", hasPhone: true, mode: "saas", deviceId: "dev-x" },
+    service: { running: true },
+    remoteUrl: "https://relay.test/app/",
+  };
+  const response = (s, body) => Promise.resolve({ ok: s >= 200 && s < 300, status: s, text: async () => JSON.stringify(body) });
+
+  const makeEl = () => ({
+    tag: "div", children: [], style: {}, className: "", attributes: {}, textContent: "",
+    setAttribute(k, v) { this.attributes[k] = v; },
+    getAttribute(k) { return this.attributes[k] ?? null; },
+    appendChild(c) { this.children.push(c); },
+    addEventListener() {}, removeEventListener() {},
+  });
+  const doc = {
+    hidden: false,
+    createElement: makeEl,
+    head: makeEl(),
+    body: makeEl(),
+    querySelector() { return null; },
+    querySelectorAll() { return []; },
+    getElementById() { return null; },
+    addEventListener() {}, removeEventListener() {},
+  };
+  class MutationObserverMock { constructor() {} observe() {} disconnect() {} }
+  const localStorage = {
+    _s: new Map(),
+    getItem(k) { return this._s.has(k) ? this._s.get(k) : null; },
+    setItem(k, v) { this._s.set(k, String(v)); },
+    removeItem(k) { this._s.delete(k); },
+  };
+
+  const sandbox = {
+    window: { __ModuleLoader__: { load(spec) { moduleFactory = spec.factory; } }, open() { return null; } },
+    document: doc,
+    localStorage,
+    MutationObserver: MutationObserverMock,
+    navigator: { clipboard: { writeText: async () => {} } },
+    setTimeout: fakeSetTimeout,
+    clearTimeout: fakeClear,
+    setInterval: fakeSetInterval,
+    clearInterval: fakeClear,
+    fetch(path, options = {}) {
+      requests.push({ path, method: options.method || "GET" });
+      if (path === "/dsh-remote/status") return response(200, status);
+      if (path === "/dsh-remote/community") return response(200, community);
+      return response(200, { ok: true });
+    },
+    Set, Symbol, Date, JSON, Math, Number, String, Object, Array, console,
+  };
+
+  vm.runInNewContext(SOURCE, sandbox);
+  const plugin = moduleFactory((name) => {
+    assert.equal(name, "react");
+    return react;
+  });
+  plugin.apply({
+    slots: {
+      inject(name, cb) { injects.set(name, cb); cb(); },
+      register(meta, component) { registered.set(meta.id, component); return () => {}; },
+    },
+  });
+
+  return {
+    requests,
+    /** 渲染 → 让在途请求落地 → 再渲染（返回最新树）。 */
+    async settle(times = 2) {
+      let tree = null;
+      for (let i = 0; i < times; i++) { tree = this.render(); await flush(); await flush(); }
+      return this.render();
+    },
+    render() {
+      const root = { type: registered.get("dsh-remote"), props: { close() {} }, children: [] };
+      return renderNode(root, "root");
+    },
+  };
+}
+
+test("node 半 /dsh-remote/community：读公开配置 community.qrcode 并拼成企业端绝对地址", async () => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-community-"));
+  const relay = http.createServer((req, res) => {
+    const send = (code, obj) => { res.writeHead(code, { "content-type": "application/json" }); res.end(JSON.stringify(obj)); };
+    if (req.url.startsWith("/api/public-config")) {
+      return send(200, {
+        service: "dsh-remote",
+        app_url: "https://relay.test/app/",
+        api_url: API_URL,
+        community: { qrcode: QR_PATH, wechat: "dsh-remote-support" },
+      });
+    }
+    send(404, { error: { code: "not_found" } });
+  });
+  await new Promise((r) => relay.listen(0, "127.0.0.1", r));
+  const port = relay.address().port;
+  await writeFile(path.join(tempDir, ".dsh-config.json"), JSON.stringify({
+    phone: "13800000000", password: "pw", api_url: `http://127.0.0.1:${port}`, bridge_secret: "s",
+  }));
+  const routes = new Map();
+  apply({ webServer: { register(rt) { routes.set(rt.path, rt.handler); return () => {}; } }, effect(reg) { return reg(); }, logger: { info() {}, warn() {} } }, { relayDir: tempDir });
+  const host = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    const h = routes.get(url.pathname);
+    (h || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((r) => host.listen(0, "127.0.0.1", r));
+  try {
+    const base = `http://127.0.0.1:${host.address().port}`;
+    const r = await (await fetch(`${base}/dsh-remote/community`)).json();
+    assert.equal(r.ok, true);
+    // 相对路径按「api_url + 路径」拼绝对地址(与手机端 PWA 的 API_BASE + qr 同一约定)
+    assert.equal(r.qrcode, `http://127.0.0.1:${port}${QR_PATH}`);
+    assert.equal(r.wechat, "dsh-remote-support");
+  } finally {
+    host.close();
+    relay.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("设置面板:后台已配置 → 「加入交流群」按钮出现;点击弹出二维码大图;关闭后收起", async () => {
+  const plugin = loadPlugin();
+  let tree = await plugin.settle();
+  assert.ok(plugin.requests.some((r) => r.path === "/dsh-remote/community"), "面板应拉取交流群配置");
+
+  const btn = nodeWithText(tree, "加入交流群");
+  assert.ok(btn, "应出现「💬 加入交流群」按钮");
+  assert.ok(!find(tree, (n) => n.props?.className === "dru-community-qr"), "未点击时不应有弹窗");
+
+  btn.props.onClick();
+  tree = plugin.render();
+  assert.ok(find(tree, (n) => n.props?.className === "dru-community-qr"), "点击后应弹出二维码");
+  const img = find(tree, (n) => n.props?.className === "dru-community-qr");
+  assert.equal(img.props.src, QR_ABS, "二维码用 node 半下发的绝对地址");
+  assert.equal(img.props.alt, "企微交流群二维码");
+  assert.ok(textHas(tree, "加入企微交流群"), "弹窗应有标题");
+  assert.ok(textHas(tree, "扫码入群"), "弹窗应有入群说明");
+
+  // 关闭:点「关闭」→ 弹窗消失
+  const closeBtn = nodeWithText(tree, "关闭");
+  assert.ok(closeBtn, "弹窗应有「关闭」按钮");
+  closeBtn.props.onClick();
+  tree = plugin.render();
+  assert.ok(!find(tree, (n) => n.props?.className === "dru-community-qr"), "关闭后弹窗应消失");
+});
+
+test("设置面板:后台未配置二维码 → 不展示任何入口（不留空壳按钮）", async () => {
+  const plugin = loadPlugin({ community: { ok: true, qrcode: "", wechat: "" } });
+  const tree = await plugin.settle();
+  assert.ok(plugin.requests.some((r) => r.path === "/dsh-remote/community"), "仍应尝试拉取");
+  assert.ok(!nodeWithText(tree, "加入交流群"), "未配置时不展示按钮");
+  assert.ok(!find(tree, (n) => n.props?.className === "dru-community-qr"), "未配置时不展示二维码");
+});
+
+test("用户反馈页:底部展示企微交流群二维码（含客服微信兜底文案）", async () => {
+  const plugin = loadPlugin();
+  await plugin.settle();
+  // 进入「用户反馈」视图
+  let tree = plugin.render();
+  const entry = nodeWithText(tree, "用户反馈");
+  assert.ok(entry, "应有「用户反馈」入口");
+  entry.props.onClick();
+  tree = await plugin.settle();
+
+  assert.ok(textHas(tree, "加入企微交流群"), "反馈页应展示交流群标题");
+  const img = find(tree, (n) => n.props?.className === "dru-community-qr");
+  assert.ok(img, "反馈页应展示二维码图片");
+  assert.equal(img.props.src, QR_ABS);
+  assert.ok(textHas(tree, "dsh-remote-support"), "应展示客服微信兜底文案");
+});

package/packages/dsh-remote-web/test/first-login-selfheal.test.mjs

@@ -0,0 +1,247 @@
+// 首次安装后「立即登录」二维码/设备列表报红字 的回归（node 半）。
+//
+// 现场：全新安装只装插件（dsh plugin add / 插件市场）时，.dsh-config.json 里没有 bridge_secret
+// （该字段原本只有一键安装器 dsh-setup.mjs 会写）。而企业端 POST /api/device-login 强制校验
+// x-dsh-bridge-secret → 面板请求 /dsh-remote/access-key & /dsh-remote/mobile-sessions 时拿不到 token，
+// 旧版一律回 401「尚未登录：请先在「账号」卡片登录手机号账号」——用户明明刚登录成功（误导性红字），
+// 只能等后台自愈装完运行环境写回密钥、或手动刷新页面才恢复。
+//
+// 本用例锁死四点：
+//   1. 缺 bridge_secret → 插件向 /api/public-config 自愈取一次并落盘，请求一次即成功（无需刷新）；
+//   2. 带了密钥仍失败（网络/5xx）→ 服务端退避重试一次；
+//   3. 服务端轮换密钥 → 强制重取新密钥再试；
+//   4. 凭证齐全却拿不到 token → 503 + retryable（绝不再谎报“尚未登录”）；密码失效 → 401 relogin_required。
+import assert from "node:assert/strict";
+import http from "node:http";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { apply } from "../lib/index.js";
+
+const SECRET = "secret-aaa-111";
+const NEW_SECRET = "secret-bbb-222";
+const EXPIRES = 1893456000000;
+
+/**
+ * 假企业端（复刻生产行为）：
+ *  - GET /api/public-config：下发 bridge_secret（可关闭/可轮换）
+ *  - POST /api/device-login：**强制**校验 x-dsh-bridge-secret，缺失/不符 → 401 需要有效设备密钥
+ *  - POST /api/auth-key：需 Bearer → 返回一次性访问地址与二维码
+ */
+function startFakeRelay(opts = {}) {
+  const seen = [];
+  let secret = opts.secret === undefined ? SECRET : opts.secret;
+  let deviceLoginCalls = 0;
+  const srv = http.createServer(async (req, res) => {
+    const url = new URL(req.url, "http://x");
+    const send = (code, obj) => {
+      res.writeHead(code, { "content-type": "application/json" });
+      res.end(JSON.stringify(obj));
+    };
+    seen.push({
+      method: req.method,
+      path: url.pathname,
+      authorization: req.headers.authorization || "",
+      secret: req.headers["x-dsh-bridge-secret"] || "",
+    });
+    if (req.method === "GET" && url.pathname === "/api/public-config") {
+      if (opts.noPublicConfig) return send(503, { error: { message: "public-config down" } });
+      return send(200, { service: "dsh-remote", app_url: "https://app.test/", api_url: `http://127.0.0.1:${srv.address().port}`, bridge_secret: secret });
+    }
+    if (req.method === "POST" && url.pathname === "/api/device-login") {
+      deviceLoginCalls += 1;
+      // 前 N 次网络/5xx 类失败（模拟中继刚重启）
+      if (opts.deviceLoginFailTimes && deviceLoginCalls <= opts.deviceLoginFailTimes) {
+        if (opts.deviceLoginFailMode === "throw") { req.socket.destroy(); return; }
+        return send(503, { error: { code: "unavailable", message: "中继重启中" } });
+      }
+      if (opts.badCredentials) return send(401, { error: { code: "bad_credentials", message: "手机号或密码错误" } });
+      const got = req.headers["x-dsh-bridge-secret"] || "";
+      if (!secret || got !== secret) return send(401, { error: { code: "unauthorized", message: "device-login 需要有效设备密钥" } });
+      return send(200, { token: "jwt-abc" });
+    }
+    if (req.method === "POST" && url.pathname === "/api/auth-key") {
+      if (!(req.headers.authorization || "").startsWith("Bearer ")) return send(401, { error: { code: "invalid_token", message: "无效或过期的 token" } });
+      return send(200, { ok: true, key: "K1", url: "https://app.test/a/K1", expires_at: EXPIRES, ttl_ms: 1800000, qr_data_url: "data:image/png;base64,AAAA" });
+    }
+    if (req.method === "GET" && url.pathname === "/api/mobile-sessions") {
+      if (!(req.headers.authorization || "").startsWith("Bearer ")) return send(401, { error: { code: "invalid_token", message: "无效或过期的 token" } });
+      return send(200, { ok: true, sessions: [{ id: "ms_1", label: "iPhone 15", created_at: 1700000000000, revoked_at: null }] });
+    }
+    send(404, { error: { code: "not_found" } });
+  });
+  return new Promise((resolve) => srv.listen(0, "127.0.0.1", () => resolve({
+    srv, seen, port: srv.address().port,
+    rotateSecret(next) { secret = next === undefined ? NEW_SECRET : next; },
+    getSecret() { return secret; },
+  })));
+}
+
+/** 装载插件路由（boot），cfgExtra 覆盖默认配置。 */
+async function bootRelay(relayPort, cfgExtra = {}, relayDirOverride) {
+  const tempDir = relayDirOverride || (await mkdtemp(path.join(os.tmpdir(), "dsh-first-login-")));
+  await writeFile(path.join(tempDir, ".dsh-config.json"), JSON.stringify({
+    phone: "13800000000",
+    password: "pw",
+    device_id: "dev-first-login",
+    api_url: `http://127.0.0.1:${relayPort}`,
+    ...cfgExtra,
+  }));
+  const routes = new Map();
+  apply({
+    webServer: { register(route) { routes.set(route.path, route.handler); return () => {}; } },
+    effect(register) { return register(); },
+    logger: { info() {}, warn() {} },
+  }, { relayDir: tempDir });
+  const host = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    const handler = routes.get(url.pathname);
+    (handler || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((resolve) => host.listen(0, "127.0.0.1", resolve));
+  return { host, base: `http://127.0.0.1:${host.address().port}`, tempDir };
+}
+
+async function readCfg(dir) {
+  return JSON.parse(await readFile(path.join(dir, ".dsh-config.json"), "utf8"));
+}
+
+test("首次安装（配置缺 bridge_secret）→ 自愈取密钥并落盘：二维码一次就拿到，不再需要刷新页面", async () => {
+  const relay = await startFakeRelay();
+  const { host, base, tempDir } = await bootRelay(relay.port); // 无 bridge_secret：模拟只装插件的全新安装
+  try {
+    const res = await fetch(`${base}/dsh-remote/access-key`);
+    assert.equal(res.status, 200, "首次登录后应立即拿到一次性访问地址（旧版这里 401「尚未登录」）");
+    const r = await res.json();
+    assert.equal(r.ok, true);
+    assert.equal(r.url, "https://app.test/a/K1");
+    assert.equal(r.qr_data_url, "data:image/png;base64,AAAA", "二维码应随首次请求一起返回");
+
+    const dl = relay.seen.filter((s) => s.path === "/api/device-login");
+    assert.equal(dl.length, 1, "device-login 只应调用一次（自愈取到密钥后再发请求）");
+    assert.equal(dl[0].secret, SECRET, "device-login 必须带上自愈得到的共享密钥");
+    assert.equal((await readCfg(tempDir)).bridge_secret, SECRET, "密钥应落盘，供 bridge 与后续重启复用");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("设备列表同样自愈：缺 bridge_secret 时 mobile-sessions 一次成功", async () => {
+  const relay = await startFakeRelay();
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const res = await fetch(`${base}/dsh-remote/mobile-sessions`);
+    assert.equal(res.status, 200);
+    const r = await res.json();
+    assert.equal(r.ok, true);
+    assert.equal(r.sessions.length, 1);
+    assert.equal(r.sessions[0].label, "iPhone 15");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("有密钥但中继 5xx（刚重启）→ 服务端退避重试一次即成功", async () => {
+  const relay = await startFakeRelay({ deviceLoginFailTimes: 1 });
+  const { host, base, tempDir } = await bootRelay(relay.port, { bridge_secret: SECRET });
+  try {
+    const res = await fetch(`${base}/dsh-remote/access-key`);
+    assert.equal(res.status, 200, "中继抖动一次应被服务端重试吸收");
+    assert.equal(relay.seen.filter((s) => s.path === "/api/device-login").length, 2, "应重试一次");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("网络层失败（连接被断开）→ 服务端重试一次", async () => {
+  const relay = await startFakeRelay({ deviceLoginFailTimes: 1, deviceLoginFailMode: "throw" });
+  const { host, base, tempDir } = await bootRelay(relay.port, { bridge_secret: SECRET });
+  try {
+    const res = await fetch(`${base}/dsh-remote/mobile-sessions`);
+    assert.equal(res.status, 200, "连接抖动（fetch 抛错）也应重试后成功");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("服务端轮换 shared secret → 强制重取新密钥再试，且写回配置", async () => {
+  const relay = await startFakeRelay({ secret: SECRET });
+  const { host, base, tempDir } = await bootRelay(relay.port, { bridge_secret: "secret-stale-999" });
+  try {
+    relay.rotateSecret(NEW_SECRET); // 企业端换了密钥，本机还存着旧的
+    const res = await fetch(`${base}/dsh-remote/access-key`);
+    assert.equal(res.status, 200, "旧密钥被拒后应自动取新密钥重试");
+    assert.equal((await readCfg(tempDir)).bridge_secret, NEW_SECRET, "新密钥应覆盖写回配置");
+    const secrets = relay.seen.filter((s) => s.path === "/api/device-login").map((s) => s.secret);
+    assert.deepEqual(secrets, ["secret-stale-999", NEW_SECRET], "先旧后新：第二次必须用轮换后的密钥");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("凭证齐全但中继未就绪（重试后仍失败）→ 503 + retryable，绝不谎报「尚未登录」", async () => {
+  const relay = await startFakeRelay({ noPublicConfig: true }); // 取不到密钥 → device-login 401 需要设备密钥
+  const { host, base, tempDir } = await bootRelay(relay.port);
+  try {
+    const res = await fetch(`${base}/dsh-remote/access-key`);
+    assert.equal(res.status, 503, "应回可重试状态码，而不是 401");
+    const r = await res.json();
+    assert.equal(r.ok, false);
+    assert.equal(r.retryable, true, "必须标记 retryable，浏览器半据此自动重试");
+    assert.equal(r.hint, "relay_not_ready");
+    assert.ok(!/尚未登录/.test(String(r.error)), "账号已登录，文案不得再引导用户去登录");
+    assert.match(String(r.error), /尚未就绪|稍后重试/);
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("密码被企业端拒绝 → 401 relogin_required（不可重试，提示重新登录）", async () => {
+  const relay = await startFakeRelay({ badCredentials: true });
+  const { host, base, tempDir } = await bootRelay(relay.port, { bridge_secret: SECRET });
+  try {
+    const res = await fetch(`${base}/dsh-remote/mobile-sessions`);
+    assert.equal(res.status, 401);
+    const r = await res.json();
+    assert.equal(r.hint, "relogin_required");
+    assert.equal(r.retryable, false, "密码失效重试无意义");
+    assert.match(String(r.error), /重新登录/);
+    assert.ok(!/尚未登录/.test(String(r.error)), "与「未登录」分开，文案要能指导下一步");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("自建模式不取设备密钥（走 /_login，不经 public-config）", async () => {
+  const relay = await startFakeRelay();
+  // 自建：local_key 优先于账号（假企业端未实现 /_login → 降级失败，但绝不能去 device-login/public-config）
+  const { host, base, tempDir } = await bootRelay(relay.port, {
+    local_key: "lk-1",
+    tunnel_url: `ws://127.0.0.1:${relay.port}`,
+  });
+  try {
+    const res = await fetch(`${base}/dsh-remote/access-key`);
+    assert.equal(res.status, 503, "自建且上游未实现 /_login → 可重试降级");
+    assert.ok(!relay.seen.some((s) => s.path === "/api/device-login" || s.path === "/api/public-config"),
+      "自建模式不得请求 device-login / public-config");
+  } finally {
+    host.close();
+    relay.srv.close();
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});