@mzzsfy/dsh-turn-notify 0.7.2

package/test/route.test.mjs

@@ -0,0 +1,377 @@
+// host 路由测试:stub ctx 装载真实 src/index.js,验证 config 读写链路与
+// test-webhook 的真实投递结果(回归:测试按钮不再无条件谎报成功)。
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { EventEmitter } from 'node:events'
+
+import { apply } from '../src/index.js'
+
+const MIN_TURN_MS = 5 * 1000
+
+function makeRes() {
+  return {
+    status: null,
+    body: null,
+    writeHead(status) { this.status = status },
+    end(body) { this.body = JSON.parse(body) },
+  }
+}
+
+function makeReq(method, payload, headers) {
+  const req = new EventEmitter()
+  req.method = method
+  req.url = '/api/turn-notify/config'
+  req.headers = { host: '127.0.0.1:3080', ...(headers || {}) }
+  const data = payload === undefined ? null : Buffer.from(JSON.stringify(payload))
+  process.nextTick(() => {
+    if (data !== null) req.emit('data', data)
+    req.readableEnded = true
+    req.emit('end')
+  })
+  return req
+}
+
+const JSON_HEADERS = { 'content-type': 'application/json' }
+
+// settings 最小实现:get/update 挂服务级(对齐 SettingsProvider),update 按两层
+// 对象合并,覆盖 enabled 部分开关语义;近似点:get 返回原始节,真实实现返回
+// schema 解析后的冻结值,对被测读写语义无影响
+function makeSettings() {
+  const doc = new Map()
+  const merge = (under, over) => {
+    const out = { ...under }
+    for (const [key, value] of Object.entries(over)) {
+      const underValue = out[key]
+      const bothPlain = (value !== null && typeof value === 'object' && !Array.isArray(value))
+        && (underValue !== null && typeof underValue === 'object' && !Array.isArray(underValue))
+      out[key] = bothPlain ? merge(underValue, value) : value
+    }
+    return out
+  }
+  return {
+    register(ns) {
+      if (!doc.has(ns)) doc.set(ns, {})
+      return {
+        get: () => doc.get(ns),
+        watch: () => () => {},
+      }
+    },
+    get: (ns) => doc.get(ns),
+    update: async (ns, patch) => { doc.set(ns, merge(doc.get(ns) ?? {}, patch)) },
+  }
+}
+
+function makeCtx(extraServices) {
+  const routes = new Map()
+  const settingsService = makeSettings()
+  const seed = extraServices ? extraServices.settingsStore : undefined
+  if (seed !== undefined) settingsService.update('turn-notify', seed)
+  const ctx = {
+    on() {},
+    get(key) {
+      if (key === 'settings') return settingsService
+      return extraServices ? extraServices[key] : undefined
+    },
+    inject(deps, fn) { fn({ settings: settingsService }) },
+    effect(thunk) { thunk() },
+    webServer: { register(route) { routes.set(route.path, route.handler) } },
+  }
+  return { ctx, routes }
+}
+
+test('config GET 返回解析后的默认配置,webhookUrl 凭据不出主机', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const handler = routes.get('/api/turn-notify/config')
+  assert.ok(handler, 'config 路由未注册')
+  const res = makeRes()
+  await handler(makeReq('GET'), res)
+  assert.equal(res.status, 200)
+  assert.equal(res.body.webhookConfigured, false)
+  assert.equal('webhookUrl' in res.body, false)
+  assert.equal(res.body.minTurnDurationMs, MIN_TURN_MS)
+  assert.equal(res.body.rootsOnly, true)
+  assert.equal(res.body.enabled.completed, true)
+})
+
+test('config POST 非法补丁 400,合法补丁持久化且部分开关不覆盖其他分类', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const handler = routes.get('/api/turn-notify/config')
+  const bad = makeRes()
+  await handler(makeReq('POST', { webhookUrl: 'ftp://hook.example' }, JSON_HEADERS), bad)
+  assert.equal(bad.status, 400)
+  assert.match(bad.body.error, /http\(s\)/)
+  const good = makeRes()
+  await handler(makeReq('POST', { webhookUrl: 'https://hook.example', enabled: { completed: false } }, JSON_HEADERS), good)
+  assert.equal(good.status, 200)
+  assert.equal(good.body.webhookConfigured, true)
+  assert.equal(good.body.enabled.completed, false)
+  assert.equal(good.body.enabled.error, true)
+  const readback = makeRes()
+  await handler(makeReq('GET'), readback)
+  assert.equal(readback.body.webhookConfigured, true)
+})
+
+test('config POST 负路径:跨源 403,非 JSON 400,畸形体 400,空补丁 200', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const handler = routes.get('/api/turn-notify/config')
+  const crossOrigin = makeRes()
+  await handler(makeReq('POST', {}, { ...JSON_HEADERS, origin: 'https://evil.example' }), crossOrigin)
+  assert.equal(crossOrigin.status, 403)
+  const sameOrigin = makeRes()
+  await handler(makeReq('POST', { rootsOnly: false }, { ...JSON_HEADERS, origin: 'http://127.0.0.1:3080' }), sameOrigin)
+  assert.equal(sameOrigin.status, 200)
+  const wrongType = makeRes()
+  await handler(makeReq('POST', {}, { 'content-type': 'text/plain' }), wrongType)
+  assert.equal(wrongType.status, 400)
+  const malformed = makeRes()
+  await handler(makeReq('POST', undefined, JSON_HEADERS), malformed)
+  assert.equal(malformed.status, 400)
+  const empty = makeRes()
+  await handler(makeReq('POST', {}, JSON_HEADERS), empty)
+  assert.equal(empty.status, 200)
+})
+
+test('config POST 超限体 400', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const handler = routes.get('/api/turn-notify/config')
+  const req = new EventEmitter()
+  req.method = 'POST'
+  req.url = '/api/turn-notify/config'
+  req.headers = { host: '127.0.0.1:3080', 'content-type': 'application/json' }
+  req.destroy = () => { req.destroyed = true }
+  process.nextTick(() => {
+    req.emit('data', Buffer.alloc(64 * 1024 + 1))
+    req.readableEnded = true
+    req.emit('end')
+  })
+  const res = makeRes()
+  await handler(req, res)
+  assert.equal(res.status, 400)
+})
+
+test('config 路由 405:PUT 被拒', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/config')(makeReq('PUT', {}, JSON_HEADERS), res)
+  assert.equal(res.status, 405)
+})
+
+function makeImReq(url) {
+  const req = makeReq('GET')
+  req.url = url
+  return req
+}
+
+test('config GET 返回 imAvailable 缺省 false 与 imTargets 空缺省', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/config')(makeReq('GET'), res)
+  assert.equal(res.body.imAvailable, false)
+  assert.deepEqual(res.body.imTargets, [])
+})
+
+test('config POST 持久化 imTargets 且 dshIm 在场时 imAvailable 为 true', async () => {
+  const dshIm = { send: async () => ({ sent: true }), listTargets: async () => [] }
+  const { ctx, routes } = makeCtx({ dshIm })
+  apply(ctx)
+  const handler = routes.get('/api/turn-notify/config')
+  const res = makeRes()
+  await handler(makeReq('POST', { imTargets: [{ botId: 'wx_a', targetId: 'owner' }] }, JSON_HEADERS), res)
+  assert.equal(res.status, 200)
+  assert.deepEqual(res.body.imTargets, [{ botId: 'wx_a', targetId: 'owner' }])
+  assert.equal(res.body.imAvailable, true)
+  const readback = makeRes()
+  await handler(makeReq('GET'), readback)
+  assert.deepEqual(readback.body.imTargets, [{ botId: 'wx_a', targetId: 'owner' }])
+})
+
+test('config POST 非法 imTargets 400', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/config')(makeReq('POST', { imTargets: [{ botId: 'wx_a' }] }, JSON_HEADERS), res)
+  assert.equal(res.status, 400)
+})
+
+test('config POST 仅 imTargets 的部分补丁:不触碰其他配置项,响应含完整面板状态', async () => {
+  // 勾选即存契约:面板勾选/取消注册只 POST {imTargets},不得清掉已存的 webhook 与分类开关
+  const dshIm = { send: async () => ({ sent: true }), listTargets: async () => [] }
+  const { ctx, routes } = makeCtx({ dshIm, settingsStore: { webhookUrl: 'https://hooks.example.com/x', enabled: { completed: false } } })
+  apply(ctx)
+  const handler = routes.get('/api/turn-notify/config')
+  const res = makeRes()
+  await handler(makeReq('POST', { imTargets: [{ botId: 'wx_a', targetId: 'owner' }, { botId: 'wx_b', targetId: 'owner' }] }, JSON_HEADERS), res)
+  assert.equal(res.status, 200)
+  assert.equal(res.body.webhookConfigured, true)
+  assert.equal(res.body.enabled.completed, false)
+  assert.deepEqual(res.body.imTargets, [{ botId: 'wx_a', targetId: 'owner' }, { botId: 'wx_b', targetId: 'owner' }])
+  // 取消注册:整列表替换为空,其余配置仍原样
+  const clear = makeRes()
+  await handler(makeReq('POST', { imTargets: [] }, JSON_HEADERS), clear)
+  assert.equal(clear.status, 200)
+  assert.deepEqual(clear.body.imTargets, [])
+  assert.equal(clear.body.webhookConfigured, true)
+  assert.equal(clear.body.enabled.completed, false)
+})
+
+test('im-targets 代理成功时仅投影 targetId/name/kind,剔除 route', async () => {
+  const dshIm = {
+    send: async () => ({ sent: true }),
+    listTargets: async (botId) => {
+      assert.equal(botId, 'wx_a')
+      return [{ targetId: 'owner', name: '本人', kind: 'user', route: { toUserId: 'native-id' } }]
+    },
+  }
+  const { ctx, routes } = makeCtx({ dshIm })
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/im-targets')(makeImReq('/api/turn-notify/im-targets?botId=wx_a'), res)
+  assert.equal(res.status, 200)
+  assert.deepEqual(res.body.targets, [{ targetId: 'owner', name: '本人', kind: 'user' }])
+})
+
+test('im-targets 错误映射:botId 缺失 400,unknown-bot 404,bot-not-connected 503,其余 502,缺席 503', async () => {
+  const code = { value: 'unknown-bot' }
+  const dshIm = {
+    send: async () => ({ sent: true }),
+    listTargets: async () => { throw Object.assign(new Error('x'), { code: code.value }) },
+  }
+  const { ctx, routes } = makeCtx({ dshIm })
+  apply(ctx)
+  const handler = routes.get('/api/turn-notify/im-targets')
+  const missing = makeRes()
+  await handler(makeImReq('/api/turn-notify/im-targets'), missing)
+  assert.equal(missing.status, 400)
+  const unknown = makeRes()
+  await handler(makeImReq('/api/turn-notify/im-targets?botId=wx_nobody'), unknown)
+  assert.equal(unknown.status, 404)
+  code.value = 'bot-not-connected'
+  const offline = makeRes()
+  await handler(makeImReq('/api/turn-notify/im-targets?botId=wx_a'), offline)
+  assert.equal(offline.status, 503)
+  code.value = 'delivery-failed'
+  const other = makeRes()
+  await handler(makeImReq('/api/turn-notify/im-targets?botId=wx_a'), other)
+  assert.equal(other.status, 502)
+  const bare = makeCtx()
+  apply(bare.ctx)
+  const absent = makeRes()
+  await bare.routes.get('/api/turn-notify/im-targets')(makeImReq('/api/turn-notify/im-targets?botId=wx_a'), absent)
+  assert.equal(absent.status, 503)
+})
+
+test('test-im 缺席与未配置目标时如实返回', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/test-im')(makeReq('POST'), res)
+  assert.equal(res.status, 200)
+  assert.deepEqual(res.body, { ok: false, detail: 'dsh-im 未安装' })
+  const withIm = makeCtx({ dshIm: { send: async () => ({ sent: true }), listTargets: async () => [] } })
+  apply(withIm.ctx)
+  const empty = makeRes()
+  await withIm.routes.get('/api/turn-notify/test-im')(makeReq('POST'), empty)
+  assert.deepEqual(empty.body, { ok: false, detail: '未配置投递目标' })
+})
+
+test('test-im 跨源 403', async () => {
+  const dshIm = { send: async () => ({ sent: true }), listTargets: async () => [] }
+  const { ctx, routes } = makeCtx({ dshIm })
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/test-im')(makeReq('POST', undefined, { origin: 'https://evil.example' }), res)
+  assert.equal(res.status, 403)
+})
+
+test('test-im 逐目标返回真实结果,混合成败', async () => {
+  const sends = []
+  const dshIm = {
+    send: async (botId, targetId, text) => {
+      sends.push({ botId, targetId, text })
+      if (targetId === 'bad') throw Object.assign(new Error('x'), { code: 'bot-not-connected' })
+      return { sent: true }
+    },
+    listTargets: async () => [],
+  }
+  const { ctx, routes } = makeCtx({ dshIm })
+  apply(ctx)
+  await routes.get('/api/turn-notify/config')(
+    makeReq('POST', { imTargets: [{ botId: 'wx_a', targetId: 'ok1' }, { botId: 'wx_a', targetId: 'bad' }] }, JSON_HEADERS), makeRes())
+  const res = makeRes()
+  await routes.get('/api/turn-notify/test-im')(makeReq('POST'), res)
+  assert.equal(res.status, 200)
+  assert.equal(res.body.ok, false)
+  assert.equal(res.body.results.length, 2)
+  const bad = res.body.results.find((item) => item.targetId === 'bad')
+  const good = res.body.results.find((item) => item.targetId === 'ok1')
+  assert.equal(bad.ok, false)
+  assert.equal(bad.detail, 'bot-not-connected')
+  assert.equal(good.ok, true)
+  assert.equal(good.detail, 'sent')
+  assert.equal(sends.length, 2)
+  assert.ok(sends.every((call) => String(call.text).startsWith('[dsh]')), 'IM 文本应与通知单元一致')
+})
+
+test('全部写路由守卫:upload 与 sound 删除跨源 403,mapping 非 JSON 400', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const upload = makeRes()
+  await routes.get('/api/turn-notify/upload')(
+    makeReq('POST', undefined, { origin: 'https://evil.example' }), upload)
+  assert.equal(upload.status, 403)
+  const sound = makeRes()
+  await routes.get('/api/turn-notify/sound')(
+    makeReq('DELETE', undefined, { origin: 'https://evil.example' }), sound)
+  assert.equal(sound.status, 403)
+  const mapping = makeRes()
+  await routes.get('/api/turn-notify/mapping')(
+    makeReq('POST', { category: 'completed', id: '' }, { 'content-type': 'text/plain' }), mapping)
+  assert.equal(mapping.status, 400)
+  const mappingCross = makeRes()
+  await routes.get('/api/turn-notify/mapping')(
+    makeReq('POST', { category: 'completed', id: '' }, { ...JSON_HEADERS, origin: 'https://evil.example' }), mappingCross)
+  assert.equal(mappingCross.status, 403)
+})
+
+test('test-webhook 未配置时如实返回失败', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/test-webhook')(makeReq('POST'), res)
+  assert.equal(res.status, 200)
+  assert.deepEqual(res.body, { ok: false, detail: '未配置 webhook' })
+})
+
+test('test-webhook 跨源 403', async () => {
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/test-webhook')(makeReq('POST', undefined, { origin: 'https://evil.example' }), res)
+  assert.equal(res.status, 403)
+})
+
+test('test-webhook 已配置时送达并返回真实结果', async () => {
+  const calls = []
+  const original = globalThis.fetch
+  globalThis.fetch = async (url, options) => {
+    calls.push({ url, body: JSON.parse(options.body) })
+    return { ok: true, status: 200 }
+  }
+  try {
+    const { ctx, routes } = makeCtx()
+    apply(ctx)
+    await routes.get('/api/turn-notify/config')(makeReq('POST', { webhookUrl: 'https://hook.example' }, JSON_HEADERS), makeRes())
+    const res = makeRes()
+    await routes.get('/api/turn-notify/test-webhook')(makeReq('POST'), res)
+    assert.deepEqual(res.body, { ok: true, detail: 'HTTP 200' })
+    assert.equal(calls.length, 1)
+    assert.equal(calls[0].url, 'https://hook.example')
+    assert.ok(String(calls[0].body.text).startsWith('[dsh]'), 'webhook payload 缺少 text')
+  } finally { globalThis.fetch = original }
+})

package/test/sounds.route.test.mjs

@@ -0,0 +1,257 @@
+// 音效库路由集成测试:USERPROFILE 重定向到临时目录后动态装载 host 路由,
+// 隔离真实 ~/.dsh 音效库;覆盖 sounds 列表 / sound 读取与删除 / upload 写入 /
+// mapping 映射写读的完整链路(此前仅守卫路径有覆盖)。
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { EventEmitter } from 'node:events'
+import { mkdtemp, mkdir, writeFile, readFile, readdir, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createHash } from 'node:crypto'
+
+const homeRoot = await mkdtemp(join(tmpdir(), 'tn-sounds-'))
+process.env.USERPROFILE = homeRoot
+process.env.HOME = homeRoot
+const { apply } = await import('../src/index.js')
+
+test.after(async () => { await rm(homeRoot, { recursive: true, force: true }) })
+
+const soundsDir = join(homeRoot, '.dsh', 'dsh-turn-notify', 'sounds')
+const JSON_HEADERS = { 'content-type': 'application/json' }
+const WAV_BYTES = Buffer.from([1, 2, 3, 4])
+
+function makeRes() {
+  return {
+    status: null,
+    body: null,
+    raw: null,
+    headers: null,
+    writeHead(status, headers) { this.status = status; this.headers = headers },
+    end(body) {
+      if (Buffer.isBuffer(body)) this.raw = body
+      else if (typeof body === 'string' && (this.headers ? String(this.headers['content-type']) : '').includes('json')) this.body = JSON.parse(body)
+      else this.raw = body
+    },
+  }
+}
+
+function makeReq(method, payload, headers, url) {
+  const req = new EventEmitter()
+  req.method = method
+  req.url = url || '/api/turn-notify/sounds'
+  req.headers = { host: '127.0.0.1:3080', ...(headers || {}) }
+  req.destroy = () => {}
+  const data = payload === undefined ? null : Buffer.from(JSON.stringify(payload))
+  process.nextTick(() => {
+    if (data !== null) req.emit('data', data)
+    req.readableEnded = true
+    req.emit('end')
+  })
+  return req
+}
+
+function makeSettings() {
+  const doc = new Map()
+  const merge = (under, over) => {
+    const out = { ...under }
+    for (const [key, value] of Object.entries(over)) {
+      const underValue = out[key]
+      const bothPlain = (value !== null && typeof value === 'object' && !Array.isArray(value))
+        && (underValue !== null && typeof underValue === 'object' && !Array.isArray(underValue))
+      out[key] = bothPlain ? merge(underValue, value) : value
+    }
+    return out
+  }
+  return {
+    register(ns) {
+      if (!doc.has(ns)) doc.set(ns, {})
+      return {
+        get: () => doc.get(ns),
+        watch: () => () => {},
+      }
+    },
+    get: (ns) => doc.get(ns),
+    update: async (ns, patch) => { doc.set(ns, merge(doc.get(ns) ?? {}, patch)) },
+  }
+}
+
+function makeCtx() {
+  const routes = new Map()
+  const settingsService = makeSettings()
+  const ctx = {
+    on() {},
+    get(key) { return key === 'settings' ? settingsService : undefined },
+    inject(deps, fn) { fn({ settings: settingsService }) },
+    effect(thunk) { thunk() },
+    webServer: { register(route) { routes.set(route.path, route.handler) } },
+  }
+  return { ctx, routes, settingsService }
+}
+
+async function resetSounds() {
+  await rm(soundsDir, { recursive: true, force: true })
+  await mkdir(soundsDir, { recursive: true })
+}
+
+async function seedSound(name, bytes) {
+  await writeFile(join(soundsDir, name), bytes || WAV_BYTES)
+}
+
+async function listNames() {
+  return readdir(soundsDir)
+}
+
+test('sounds 列表:id/ext 按首点切分,非音效文件过滤,无索引记录展示名为空', async () => {
+  await resetSounds()
+  await seedSound('a.wav')
+  await seedSound('c.ogg')
+  await seedSound('notasound')
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/sounds')(makeReq('GET'), res)
+  assert.equal(res.status, 200)
+  assert.deepEqual(
+    res.body.sounds.sort((x, y) => x.id.localeCompare(y.id)),
+    [{ id: 'a', ext: 'wav', name: null }, { id: 'c', ext: 'ogg', name: null }],
+  )
+  assert.equal(res.body.builtin, true)
+})
+
+test('sounds 列表:展示名随索引附加,索引文件不入列,索引损坏降级为无名', async () => {
+  await resetSounds()
+  await seedSound('a.wav')
+  await writeFile(join(soundsDir, 'index.json'), JSON.stringify({ a: '别名甲', ghost: '孤儿名' }))
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/sounds')(makeReq('GET'), res)
+  assert.equal(res.status, 200)
+  assert.deepEqual(res.body.sounds, [{ id: 'a', ext: 'wav', name: '别名甲' }])
+  await writeFile(join(soundsDir, 'index.json'), '{broken')
+  const degraded = makeRes()
+  await routes.get('/api/turn-notify/sounds')(makeReq('GET'), degraded)
+  assert.equal(degraded.status, 200)
+  assert.deepEqual(degraded.body.sounds, [{ id: 'a', ext: 'wav', name: null }])
+})
+
+test('sounds 列表 405 与错误兜底', async () => {
+  await resetSounds()
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const res = makeRes()
+  await routes.get('/api/turn-notify/sounds')(makeReq('POST'), res)
+  assert.equal(res.status, 405)
+})
+
+test('sound 读取:命中返回音频与 MIME,未命中 404,fs 故障 500', async () => {
+  await resetSounds()
+  await seedSound('x.wav')
+  // 同名目录:列表命中但读取报 EISDIR,锚定错误归一的 fs 类 500 分支
+  await mkdir(join(soundsDir, 'd.wav'))
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const hit = makeRes()
+  await routes.get('/api/turn-notify/sound')(makeReq('GET', undefined, undefined, '/api/turn-notify/sound?id=x'), hit)
+  assert.equal(hit.status, 200)
+  assert.equal(hit.headers['content-type'], 'audio/wav')
+  assert.deepEqual(hit.raw, WAV_BYTES)
+  const miss = makeRes()
+  await routes.get('/api/turn-notify/sound')(makeReq('GET', undefined, undefined, '/api/turn-notify/sound?id=missing'), miss)
+  assert.equal(miss.status, 404)
+  const fsFailure = makeRes()
+  await routes.get('/api/turn-notify/sound')(makeReq('GET', undefined, undefined, '/api/turn-notify/sound?id=d'), fsFailure)
+  assert.equal(fsFailure.status, 500)
+})
+
+test('sound 删除:文件移除,映射引用同步清理,再次删除 404', async () => {
+  await resetSounds()
+  await seedSound('gone.wav')
+  const { ctx, routes, settingsService } = makeCtx()
+  apply(ctx)
+  await settingsService.update('turn-notify', { soundMapping: { completed: 'gone', error: 'other' } })
+  const res = makeRes()
+  await routes.get('/api/turn-notify/sound')(makeReq('DELETE', undefined, undefined, '/api/turn-notify/sound?id=gone'), res)
+  assert.equal(res.status, 200)
+  assert.deepEqual(await listNames(), [])
+  const stored = settingsService.get('turn-notify')
+  // 深合并存储语义:清除为置 null,读侧 resolvedConfig 过滤
+  assert.equal(stored.soundMapping.completed, null)
+  assert.equal(stored.soundMapping.error, 'other')
+  const again = makeRes()
+  await routes.get('/api/turn-notify/sound')(makeReq('DELETE', undefined, undefined, '/api/turn-notify/sound?id=gone'), again)
+  assert.equal(again.status, 404)
+})
+
+test('upload 主路径:内容寻址落盘,非法扩展与超限体拒绝,同内容幂等', async () => {
+  await resetSounds()
+  const { ctx, routes } = makeCtx()
+  apply(ctx)
+  const wav = Buffer.alloc(64, 7)
+  const upload = routes.get('/api/turn-notify/upload')
+  const bodyReq = (name, bytes) => {
+    const req = new EventEmitter()
+    req.method = 'POST'
+    req.url = '/api/turn-notify/upload?name=' + encodeURIComponent(name)
+    req.headers = { host: '127.0.0.1:3080' }
+    req.destroy = () => {}
+    process.nextTick(() => {
+      req.emit('data', bytes)
+      req.readableEnded = true
+      req.emit('end')
+    })
+    return req
+  }
+  const ok = makeRes()
+  await upload(bodyReq('clip.wav', wav), ok)
+  assert.equal(ok.status, 200)
+  const expectedId = 'snd-' + createHash('sha256').update(wav).digest('hex').slice(0, 16)
+  assert.equal(ok.body.id, expectedId)
+  const names = await listNames()
+  assert.deepEqual(names, [expectedId + '.wav'])
+  assert.deepEqual(await readFile(join(soundsDir, expectedId + '.wav')), wav)
+  // 同内容重传:幂等返回既有 id,不产生第二份文件
+  const again = makeRes()
+  await upload(bodyReq('clip.wav', wav), again)
+  assert.equal(again.status, 200)
+  assert.equal(again.body.id, expectedId)
+  assert.deepEqual(await listNames(), [expectedId + '.wav'])
+  // 非法扩展名 400
+  const badExt = makeRes()
+  await upload(bodyReq('a.txt', Buffer.from('x')), badExt)
+  assert.equal(badExt.status, 400)
+  // 超限体 400
+  const tooBig = makeRes()
+  await upload(bodyReq('big.wav', Buffer.alloc(2 * 1024 * 1024 + 1)), tooBig)
+  assert.equal(tooBig.status, 400)
+})
+
+test('mapping 写读链路:写映射生效,未知分类与未知音效 400,空 id 清除', async () => {
+  await resetSounds()
+  await seedSound('snd-1.wav')
+  const { ctx, routes, settingsService } = makeCtx()
+  apply(ctx)
+  const handler = routes.get('/api/turn-notify/mapping')
+  const write = makeRes()
+  await handler(makeReq('POST', { category: 'completed', id: 'snd-1' }, JSON_HEADERS, '/api/turn-notify/mapping'), write)
+  assert.equal(write.status, 200)
+  assert.deepEqual(write.body.soundMapping, { completed: 'snd-1' })
+  assert.equal(settingsService.get('turn-notify').soundMapping.completed, 'snd-1')
+  // 投影路由带回 mapping
+  const projection = makeRes()
+  await routes.get('/api/turn-notify/projection')(makeReq('GET', undefined, undefined, '/api/turn-notify/projection'), projection)
+  assert.deepEqual(projection.body.soundMapping, { completed: 'snd-1' })
+  const unknownCategory = makeRes()
+  await handler(makeReq('POST', { category: 'nope', id: 'snd-1' }, JSON_HEADERS, '/api/turn-notify/mapping'), unknownCategory)
+  assert.equal(unknownCategory.status, 400)
+  const unknownSound = makeRes()
+  await handler(makeReq('POST', { category: 'completed', id: 'snd-404' }, JSON_HEADERS, '/api/turn-notify/mapping'), unknownSound)
+  assert.equal(unknownSound.status, 400)
+  const clear = makeRes()
+  await handler(makeReq('POST', { category: 'completed', id: '' }, JSON_HEADERS, '/api/turn-notify/mapping'), clear)
+  assert.equal(clear.status, 200)
+  assert.deepEqual(clear.body.soundMapping, {})
+  // 深合并存储语义:清除为置 null;真实宿主 settings 经 schema 归一落为空串,
+  // 两者均被读侧 resolvedConfig 的非空字符串过滤挡下,mock 原样存 null
+  assert.equal(settingsService.get('turn-notify').soundMapping.completed, null)
+})

package/test/switch-guard.test.mjs

@@ -0,0 +1,32 @@
+// 开关样式守卫 BDD:状态选择器回退为裸 input 会静默隐藏 label 内其他 input,
+// 属无报错的 UI 损坏,故对源文本做静态断言锁死结构
+import { readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+const PKG_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+const source = readFileSync(join(PKG_ROOT, 'src', 'client.js'), 'utf8')
+
+test('switch 隐藏规则以 input[type="checkbox"] 精确匹配', () => {
+  assert.match(source, /\.tn-switch input\[type="checkbox"\] \{ position:absolute/)
+})
+
+test('switch 状态选择器禁止裸 input 锚定(防误伤 label 内其他 input)', () => {
+  const bare = source.match(/\.tn-switch input:(?!\[type)[a-z-]+/g)
+  assert.equal(bare, null, `裸 input 状态选择器: ${bare}`)
+})
+
+test('checkbox 仅允许出现在 switchToggle 工厂内,禁止裸 checkbox 直出', () => {
+  const occurrences = [...source.matchAll(/type: 'checkbox'/g)].map((match) => match.index)
+  assert.equal(occurrences.length, 1, `checkbox 字面量出现 ${occurrences.length} 次`)
+  const factoryStart = source.indexOf('function switchToggle')
+  const factoryEnd = source.indexOf('}', source.indexOf('__thumb', factoryStart))
+  assert.ok(occurrences[0] > factoryStart && occurrences[0] < factoryEnd, 'checkbox 字面量不在 switchToggle 工厂内')
+})
+
+test('switchToggle 产出顺序为 input 在前 track 在后', () => {
+  const factory = source.slice(source.indexOf('function switchToggle'))
+  assert.ok(factory.indexOf("h('input'") < factory.indexOf('tn-switch__track'), '工厂内 input 必须先于 track')
+})