@nocobase/app-template-default 1.0.0-beta.68 → 1.0.0-beta.70

package/tests/logic/page-permission-titles.test.ts

@@ -0,0 +1,223 @@
+import { describe, expect, it } from 'vitest';
+import {
+  resolveAppClientContributions,
+  type AppClientRegisteredRoute,
+} from '@nocobase/app-client/plugins';
+import applicationRoutes from '../../client/routes.js';
+import enUS from '../../client/locales/en-US.js';
+import zhCN from '../../client/locales/zh-CN.js';
+import {
+  pagePermissionResources,
+  pagePermissionTitle,
+} from '../../client/pages/settings/page-permissions.js';
+import { pagePermissionTitles } from '../../client/pages/settings/page-permission-titles.js';
+
+const flatten = (
+  routes: readonly AppClientRegisteredRoute[],
+): AppClientRegisteredRoute[] =>
+  routes.flatMap((route) => [route, ...flatten(route.children ?? [])]);
+const localized = (resource: unknown, key: string): unknown =>
+  key
+    .split('.')
+    .reduce<unknown>(
+      (value, part) =>
+        value && typeof value === 'object'
+          ? Reflect.get(value, part)
+          : undefined,
+      resource,
+    );
+const application = resolveAppClientContributions([
+  {
+    packageName: 'title-check-app',
+    source: 'application',
+    routes: applicationRoutes,
+  },
+]);
+const pages = flatten(application.routes).filter(
+  (route) =>
+    route.source === 'application' &&
+    route.componentLoader &&
+    typeof route.authz === 'object' &&
+    route.authz.resource.type === 'page',
+);
+
+describe('page permission labels', () => {
+  it('names every application page permission and translates it in both languages', () => {
+    const missing = pages
+      .filter((route) => !pagePermissionTitle(route, pagePermissionTitles))
+      .map((route) => route.name);
+    expect(
+      missing,
+      'Add a navigation/breadcrumb title or a page-permission-titles entry; never rename authorization ids to fix labels.',
+    ).toEqual([]);
+    for (const route of pages) {
+      const title = pagePermissionTitle(route, pagePermissionTitles);
+      if (!title || typeof title === 'string')
+        throw new Error(`Missing permission title: ${route.name}`);
+      for (const locale of [enUS, zhCN]) {
+        const value = localized(locale, title.key);
+        expect(value, `${route.name}: ${title.key}`).toBeTypeOf('string');
+        expect(String(value).trim()).not.toBe('');
+        expect(value).not.toBe(title.key);
+        expect(value).not.toBe(route.id);
+        expect(String(value)).not.toContain('{{');
+      }
+    }
+    const names = new Set(
+      flatten(application.routes).map((route) => route.name),
+    );
+    for (const name of Object.keys(pagePermissionTitles))
+      expect(names.has(name), `Stale permission title: ${name}`).toBe(true);
+  });
+
+  it('preserves the complete application page-resource identity list', () => {
+    const expected = pages.map((route) => {
+      if (typeof route.authz !== 'object')
+        throw new Error('Expected page authorization');
+      return { type: 'page', id: route.authz.resource.id, actions: ['access'] };
+    });
+    expect(
+      pagePermissionResources(
+        application.routes,
+        pagePermissionTitles,
+        (path) => `Unnamed (${path})`,
+      ).map(({ type, id, actions }) => ({
+        type,
+        id,
+        actions: actions.map((action) => action.name),
+      })),
+    ).toEqual(expected);
+  });
+
+  const fixture = () =>
+    resolveAppClientContributions([
+      {
+        packageName: 'private-app',
+        source: 'application',
+        routes: [
+          {
+            parent: 'app',
+            routes: [
+              {
+                name: 'expenses',
+                path: '/expenses',
+                auth: 'required',
+                authz: {
+                  resource: { type: 'page', id: 'legacy-expenses' },
+                  action: 'access',
+                },
+                navigation: { title: 'expenses.title' },
+                componentLoader: async () => ({ default: () => null }),
+                children: [
+                  {
+                    name: 'expenseEdit',
+                    path: ':id/edit',
+                    authz: {
+                      resource: { type: 'page', id: 'legacy-edit' },
+                      action: 'access',
+                    },
+                    componentLoader: async () => ({ default: () => null }),
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+    ]);
+
+  it('names an overlay without adding navigation/breadcrumbs or changing resources', () => {
+    const input = fixture();
+    const route = input.routes[0]!.children![0]!;
+    const identities = flatten(input.routes).map(
+      ({ id, name, path, authz }) => ({ id, name, path, authz }),
+    );
+    const result = pagePermissionResources(
+      input.routes,
+      { expenseEdit: 'expenses.editTitle' },
+      (path) => `Unnamed (${path})`,
+    );
+    expect(result.map(({ id, actions }) => ({ id, actions }))).toEqual([
+      {
+        id: 'legacy-expenses',
+        actions: [{ name: 'access', title: { key: 'settings.access' } }],
+      },
+      {
+        id: 'legacy-edit',
+        actions: [{ name: 'access', title: { key: 'settings.access' } }],
+      },
+    ]);
+    expect(result[1]!.title).toEqual({
+      key: 'expenses.editTitle',
+      ns: 'private-app',
+    });
+    expect(route.navigation).toBeUndefined();
+    expect(route.breadcrumb).toBeUndefined();
+    expect(
+      flatten(input.routes).map(({ id, name, path, authz }) => ({
+        id,
+        name,
+        path,
+        authz,
+      })),
+    ).toEqual(identities);
+    expect(
+      pagePermissionResources(
+        input.routes,
+        { expenseEdit: 'expenses.editTitle' },
+        (path) => `Unnamed (${path})`,
+      ),
+    ).toEqual(result);
+  });
+
+  it('reports missing metadata and renders a localized fallback without dropping the permission', () => {
+    const input = fixture();
+    const overlay = input.routes[0]!.children![0]!;
+    expect(pagePermissionTitle(overlay, {})).toBeUndefined();
+    const resources = pagePermissionResources(
+      input.routes,
+      {},
+      (path) => `未命名页面（${path}）`,
+    );
+    expect(resources[1]!.id).toBe('legacy-edit');
+    expect(resources[1]!.title).toBe('未命名页面（/expenses/:id/edit）');
+    expect(resources[1]!.title).not.toContain('private-app:');
+  });
+
+  it('does not treat object prototype properties as configured labels', () => {
+    const route = fixture().routes[0]!.children![0]!;
+    expect(
+      pagePermissionTitle({ ...route, name: 'constructor' }, {}),
+    ).toBeUndefined();
+    expect(
+      pagePermissionTitle({ ...route, name: 'toString' }, {}),
+    ).toBeUndefined();
+  });
+
+  it('does not apply application-name overrides to plugin routes or expose non-page resources', () => {
+    const input = fixture();
+    const overlay = input.routes[0]!.children![0]!;
+    expect(
+      pagePermissionTitle(
+        { ...overlay, source: 'plugin', packageName: 'plugin' },
+        { expenseEdit: 'expenses.editTitle' },
+      ),
+    ).toBeUndefined();
+    expect(
+      pagePermissionResources(
+        [
+          { ...overlay, authz: 'skip' },
+          {
+            ...overlay,
+            authz: {
+              resource: { type: 'settings', id: 'members' },
+              action: 'read',
+            },
+          },
+        ],
+        {},
+        () => 'Unnamed',
+      ),
+    ).toEqual([]);
+  });
+});

package/tests/logic/route-overlay.test.tsx

@@ -4,6 +4,7 @@ import {
   render,
   screen,
   waitFor,
+  within,
 } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import {
@@ -158,6 +159,47 @@ describe('route overlays', () => {
   });
 });
 
+describe('route overlay presentation', () => {
+  it('composes the dialog primitives so it follows the dialog styles', async () => {
+    setup();
+    const dialog = await screen.findByRole('dialog', { name: 'Edit' });
+    expect(dialog).toHaveAttribute('data-slot', 'route-overlay-content');
+    expect(dialog).toHaveAttribute('data-presentation', 'dialog');
+    const header = dialog.querySelector(
+      ':scope > [data-slot="route-overlay-header"] > [data-slot="dialog-header"]',
+    );
+    expect(
+      header?.querySelector('[data-slot="dialog-title"]'),
+    ).toHaveTextContent('Edit');
+    expect(
+      dialog.querySelector(':scope > [data-slot="route-overlay-body"]'),
+    ).toContainElement(screen.getByRole('textbox', { name: 'Name' }));
+    const footer = dialog.querySelector(
+      ':scope > [data-slot="route-overlay-footer"] > [data-slot="dialog-footer"]',
+    );
+    expect(footer).toContainElement(
+      screen.getByRole('button', { name: 'Cancel' }),
+    );
+    // The footer sits at the panel's edges, so the margins it uses inside `DialogContent` are reset.
+    expect(footer).toHaveClass('mx-0', 'mb-0');
+    expect(footer).not.toHaveClass('-mx-6', '-mb-6');
+    expect(
+      dialog.querySelector(':scope > [data-slot="dialog-close"]'),
+    ).toHaveAccessibleName('Close');
+  });
+
+  it('presents a drawer with the same regions', async () => {
+    setup(undefined, undefined, true);
+    const drawer = await screen.findByRole('dialog', { name: 'Details' });
+    expect(drawer).toHaveAttribute('data-presentation', 'drawer');
+    expect(
+      drawer.querySelector(
+        ':scope > [data-slot="route-overlay-footer"] > [data-slot="dialog-footer"]',
+      ),
+    ).toContainElement(within(drawer).getByRole('button', { name: 'Cancel' }));
+  });
+});
+
 describe('route overlay interactions', () => {
   it('renders an owning backdrop for the nested layer and dismisses only that layer', async () => {
     const user = userEvent.setup();

package/tests/logic/session-preparation.test.tsx

@@ -0,0 +1,223 @@
+import {
+  ClientApplicationContext,
+  realtimeClientToken,
+  type ClientApplication,
+} from '@nocobase/app-client';
+import {
+  AuthenticationProvider,
+  authenticationClientToken,
+  useAuthentication,
+} from '@nocobase/app-plugin-authentication/client';
+import {
+  AuthorizationClient,
+  authorizationClientToken,
+} from '@nocobase/app-plugin-authorization/client';
+import { reactProviders } from '@nocobase/app-plugin-authorization/client/react-providers';
+import { ServiceContainer } from '@nocobase/service-provider';
+import {
+  TestI18nProvider,
+  createTestI18nRuntime,
+} from '@nocobase/i18n/testing';
+import { act, fireEvent, render, screen } from '@testing-library/react';
+import { useEffect } from 'react';
+import { MemoryRouter, Outlet } from 'react-router';
+import { afterEach, expect, it, vi } from 'vitest';
+import { AppRouter } from '../../client/routing/app-router.js';
+import {
+  Dialog,
+  DialogContent,
+  DialogTitle,
+  DialogDescription,
+} from '../../client/components/ui/dialog.js';
+import enUS from '../../client/locales/en-US.js';
+
+const AuthorizationProvider = reactProviders[0].component;
+vi.mock('../../client/layouts/app-layout.js', () => ({
+  AppLayout: () => <Outlet />,
+}));
+vi.mock('../../client/routing/standalone-page-layout.js', () => ({
+  StandalonePageLayout: () => <Outlet />,
+}));
+const runtime = await createTestI18nRuntime({
+  application: { namespace: 'test', resources: enUS },
+});
+afterEach(() => vi.useRealTimers());
+
+async function setup() {
+  const allowed = {
+    data: {
+      unrestricted: false,
+      permissions: [
+        { resource: { type: 'page', id: 'probe' }, actions: ['access'] },
+      ],
+    },
+  };
+  const request = vi.fn().mockResolvedValue(allowed);
+  const authz = new AuthorizationClient({ request } as never);
+  const services = new ServiceContainer();
+  const listeners = new Set<() => void>();
+  const realtime = {
+    active: true,
+    reconnect: vi.fn(),
+    onOpen: (listener: () => void) => {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+  };
+  const signOut = vi.fn().mockResolvedValue({ error: { message: 'Offline' } });
+  let session: unknown = { user: { id: 'user' }, session: { id: 'session' } };
+  const getSession = vi.fn(async () => ({ data: session }));
+  services.instance(authenticationClientToken, {
+    getSession,
+    signOut,
+  } as never);
+  services.instance(realtimeClientToken, realtime as never);
+  services.instance(authorizationClientToken, authz);
+  const mounted = vi.fn();
+  const cleaned = vi.fn();
+  const accepted = vi.fn();
+  const old = Promise.withResolvers<void>();
+  function Page() {
+    useEffect(() => {
+      let active = true;
+      mounted();
+      void old.promise.then(() => {
+        if (active) accepted();
+      });
+      return () => {
+        active = false;
+        cleaned();
+      };
+    }, []);
+    return (
+      <Dialog open>
+        <DialogContent>
+          <DialogTitle>Protected dialog</DialogTitle>
+          <DialogDescription>Protected content</DialogDescription>
+        </DialogContent>
+      </Dialog>
+    );
+  }
+  let refresh!: () => Promise<void>;
+  function Capture() {
+    refresh = useAuthentication().refresh;
+    return null;
+  }
+  const route = {
+    id: 'probe',
+    name: 'probe',
+    path: '/',
+    auth: 'required',
+    authz: { resource: { type: 'page', id: 'probe' }, action: 'access' },
+    packageName: 'test',
+    source: 'application',
+    componentLoader: async () => ({ default: Page }),
+  } as const;
+  render(
+    <TestI18nProvider runtime={runtime}>
+      <ClientApplicationContext.Provider
+        value={{ services } as unknown as ClientApplication}
+      >
+        <AuthenticationProvider>
+          <Capture />
+          <AuthorizationProvider>
+            <MemoryRouter>
+              <AppRouter
+                clientRoutes={[
+                  route,
+                  {
+                    id: 'login',
+                    name: 'login',
+                    path: '/login',
+                    auth: 'guest',
+                    authz: 'skip',
+                    source: 'application',
+                    packageName: 'test',
+                    componentLoader: async () => ({
+                      default: () => <p>Login route</p>,
+                    }),
+                  },
+                ]}
+              />
+            </MemoryRouter>
+          </AuthorizationProvider>
+        </AuthenticationProvider>
+      </ClientApplicationContext.Provider>
+    </TestI18nProvider>,
+  );
+  await act(async () => {});
+  // Register after preparation to prove ordering does not depend on effects.
+  listeners.add(() => authz.invalidate());
+  return {
+    allowed,
+    request,
+    authz,
+    realtime,
+    signOut,
+    getSession,
+    mounted,
+    cleaned,
+    accepted,
+    old,
+    open: async () => {
+      await act(async () => {
+        for (const listener of listeners) listener();
+      });
+    },
+    logout: async () => {
+      session = null;
+      await act(async () => refresh());
+    },
+  };
+}
+
+it('mounts only after the initial handshake and preserves runtime fail-closed portal cleanup', async () => {
+  const probe = await setup();
+  expect(probe.mounted).not.toHaveBeenCalled();
+  expect(probe.request).not.toHaveBeenCalled();
+  await probe.open();
+  await screen.findByText('Protected dialog');
+  expect(probe.mounted).toHaveBeenCalledOnce();
+  expect(probe.request).toHaveBeenCalledOnce();
+  const next = Promise.withResolvers<typeof probe.allowed>();
+  probe.request.mockReturnValueOnce(next.promise);
+  await probe.open();
+  expect(screen.queryByRole('dialog')).toBeNull();
+  expect(probe.cleaned).toHaveBeenCalledOnce();
+  await act(async () => probe.old.resolve());
+  expect(probe.accepted).not.toHaveBeenCalled();
+  await act(async () =>
+    next.resolve({ data: { unrestricted: false, permissions: [] } }),
+  );
+  expect(screen.queryByRole('dialog')).toBeNull();
+  expect(await screen.findByText('Access denied')).toBeVisible();
+});
+
+it('keeps a timed-out session closed, supports retry, and reports sign-out failure', async () => {
+  vi.useFakeTimers();
+  const probe = await setup();
+  await act(async () => vi.advanceTimersByTime(10_000));
+  expect(screen.getByText('Unable to connect')).toBeVisible();
+  fireEvent.click(screen.getByRole('button', { name: 'Sign out' }));
+  await act(async () => {});
+  expect(screen.getByRole('alert')).toHaveTextContent('Unable to sign out');
+  fireEvent.click(screen.getByRole('button', { name: 'Retry' }));
+  expect(probe.realtime.reconnect).toHaveBeenCalledTimes(2);
+  expect(screen.queryByText('Unable to connect')).toBeNull();
+  await probe.open();
+  expect(probe.mounted).toHaveBeenCalledOnce();
+});
+
+it('can sign out of a failed initialization without a working realtime connection', async () => {
+  vi.useFakeTimers();
+  const probe = await setup();
+  await act(async () => vi.advanceTimersByTime(10_000));
+  probe.signOut.mockResolvedValueOnce({});
+  probe.getSession.mockResolvedValueOnce({ data: null });
+  fireEvent.click(screen.getByRole('button', { name: 'Sign out' }));
+  await act(async () => {});
+  expect(screen.getByText('Login route')).toBeVisible();
+  expect(probe.mounted).not.toHaveBeenCalled();
+});

package/tests/logic/settings-permissions.test.ts

@@ -0,0 +1,168 @@
+import { describe, expect, it } from 'vitest';
+import {
+  setPermission,
+  setPermissions,
+  permissionSections,
+  setScope,
+  type CatalogResource,
+} from '../../client/pages/settings/permissions-model.js';
+const resource: CatalogResource = {
+  type: 'composite',
+  id: 'orders',
+  title: 'Orders',
+  actions: [{ name: 'edit', title: 'Edit' }],
+  dataScopes: {
+    edit: [
+      {
+        key: 'records',
+        title: 'Records',
+        collection: 'orders',
+        fields: [],
+        recordAccess: ['mine', 'all'],
+        defaultValue: 'mine',
+      },
+    ],
+  },
+};
+describe('settings permission drafts', () => {
+  it('adds only the explicit action at its registered default and keeps unrelated policies intact', () => {
+    const untouched = {
+      resource: { type: 'settings', id: 'notification' },
+      actions: [{ action: 'read', policy: { type: 'custom', region: 'east' } }],
+    };
+    const original = [untouched];
+    const next = setPermission(original, resource, 'edit', true);
+    expect(next).toContainEqual(untouched);
+    expect(next[1]?.actions).toEqual([
+      {
+        action: 'edit',
+        policy: { type: 'composite', scopes: { records: 'mine' } },
+      },
+    ]);
+    expect(original).toEqual([untouched]);
+    expect(setPermission(next, resource, 'edit', false)).toEqual([untouched]);
+  });
+  it('changes one scope without losing a different scope or custom grant', () => {
+    const original = [
+      {
+        resource: { type: 'composite', id: 'orders' },
+        actions: [
+          {
+            action: 'edit',
+            policy: {
+              type: 'composite',
+              scopes: {
+                records: 'mine',
+                attachments: { selected: ['file-1'] },
+              },
+            },
+          },
+          { action: 'approve' },
+        ],
+      },
+    ];
+    const next = setScope(
+      original,
+      JSON.stringify(['composite', 'orders', 'edit', 'records']),
+      'all',
+    );
+    expect(next[0]?.actions[0]?.policy).toMatchObject({
+      scopes: { records: 'all', attachments: { selected: ['file-1'] } },
+    });
+    expect(next[0]?.actions[1]).toEqual({ action: 'approve' });
+    expect(original[0]?.actions[0]?.policy.scopes.records).toBe('mine');
+  });
+});
+
+it('keeps action scopes inline and folds a visible batch without resetting existing policies', () => {
+  const catalog = {
+    sections: [
+      {
+        name: 'business',
+        title: 'Business',
+        subsections: [
+          {
+            name: 'orders',
+            title: 'Orders',
+            resources: [
+              {
+                ...resource,
+                actions: [
+                  ...resource.actions,
+                  { name: 'export', title: 'Export' },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+    recordAccess: [
+      { key: 'mine', title: 'Mine' },
+      { key: 'all', title: 'All' },
+    ],
+  } as unknown as Parameters<typeof permissionSections>[0];
+  const unrelated = {
+    resource: { type: 'unknown', id: 'legacy' },
+    actions: [{ action: 'custom', policy: { type: 'custom', keep: true } }],
+  };
+  const original = [...setPermission([], resource, 'edit', true), unrelated];
+  const before = JSON.stringify(original);
+  const changed = setPermissions(original, catalog, [
+    { id: JSON.stringify(['composite', 'orders', 'export']), enabled: true },
+    { id: JSON.stringify(['composite', 'orders', 'edit']), enabled: true },
+    {
+      id: JSON.stringify(['composite', 'orders', 'notRegistered']),
+      enabled: true,
+    },
+  ]);
+  expect(changed).toContainEqual(unrelated);
+  expect(changed[0]?.actions).toEqual([
+    ...original[0]!.actions,
+    { action: 'export' },
+  ]);
+  expect(JSON.stringify(original)).toBe(before);
+  const result = permissionSections(catalog, changed, (value) =>
+    typeof value === 'string' ? value : value.key,
+  );
+  expect(result[0]?.groups[0]?.rows).toHaveLength(2);
+  expect(result[0]?.groups[0]?.rows[0]?.scopes?.[0]).toMatchObject({
+    label: 'Records',
+    level: 'mine',
+    id: JSON.stringify(['composite', 'orders', 'edit', 'records']),
+  });
+});
+
+it('replaces a raw collection scope caption with localized data-range text', () => {
+  const scopedResource = {
+    ...resource,
+    dataScopes: {
+      edit: [{ ...resource.dataScopes!.edit![0]!, title: 'orders' }],
+    },
+  };
+  const catalog = {
+    sections: [
+      {
+        name: 's',
+        title: 'Business',
+        subsections: [
+          { name: 'orders', title: 'Orders', resources: [scopedResource] },
+        ],
+      },
+    ],
+    recordAccess: [{ key: 'mine', title: 'Mine' }],
+  } as unknown as Parameters<typeof permissionSections>[0];
+  const result = permissionSections(
+    catalog,
+    setPermission([], scopedResource, 'edit', true),
+    (value) =>
+      typeof value === 'string'
+        ? value
+        : value.key === 'settings.recordScope'
+          ? 'Record scope'
+          : value.key,
+  );
+  expect(result[0]?.groups[0]?.rows[0]?.scopes?.[0]?.label).toBe(
+    'Record scope',
+  );
+});