@nocobase/app-template-default 1.0.0-beta.73 → 1.0.0-beta.74

package/tests/components/permission-editor.test.tsx

@@ -82,7 +82,8 @@ describe('permission workspace', () => {
     );
     expect(
       screen.getByRole('button', { name: /Business actions/ }),
-    ).toHaveTextContent('1/2');
+    ).toHaveTextContent('Business actions');
+    expect(screen.queryByText('1/2')).not.toBeInTheDocument();
     await user.clear(screen.getByRole('textbox'));
     expect(
       screen.getByRole('checkbox', { name: 'Read orders' }),
@@ -93,57 +94,6 @@ describe('permission workspace', () => {
 });
 
 describe('compact resource actions', () => {
-  it('batches only visible editable changes and shows a mixed group checkbox', async () => {
-    const user = userEvent.setup();
-    const batch = vi.fn();
-    render(
-      <PermissionEditor
-        sections={[
-          {
-            ...sections[0]!,
-            groups: [
-              {
-                id: 'orders',
-                title: 'Orders',
-                rows: [
-                  ...sections[0]!.groups[0]!.rows,
-                  {
-                    id: 'locked',
-                    label: 'Protected',
-                    enabled: false,
-                    toggleable: false,
-                  },
-                ],
-              },
-            ],
-          },
-        ]}
-        onEnabledChange={vi.fn()}
-        onEnabledBatchChange={batch}
-        onLevelChange={vi.fn()}
-      />,
-    );
-    const group = screen.getByRole('checkbox', {
-      name: 'Select visible permissions in Orders',
-    });
-    expect(group).toHaveAttribute('aria-checked', 'mixed');
-    await user.click(group);
-    expect(batch).toHaveBeenLastCalledWith([
-      { id: 'edit-orders', enabled: true },
-    ]);
-    await user.type(screen.getByRole('textbox'), 'owner');
-    await user.click(
-      screen.getByRole('checkbox', {
-        name: 'Select visible permissions in Orders',
-      }),
-    );
-    expect(batch).toHaveBeenLastCalledWith([
-      { id: 'edit-orders', enabled: true },
-    ]);
-    expect(
-      screen.queryByRole('checkbox', { name: 'Protected' }),
-    ).not.toBeInTheDocument();
-  });
   it('restores stable focus when enabled filtering removes the action or group', async () => {
     const user = userEvent.setup();
     function Draft() {
@@ -177,21 +127,13 @@ describe('compact resource actions', () => {
         />
       );
     }
-    const view = render(<Draft />);
+    render(<Draft />);
     await user.click(screen.getByRole('switch', { name: 'Enabled only' }));
     await user.click(screen.getByRole('checkbox', { name: 'Action' }));
     expect(screen.getByRole('textbox')).toHaveFocus();
     expect(screen.getByRole('status')).toHaveTextContent(
       'No matching permissions',
     );
-    view.unmount();
-    render(<Draft />);
-    await user.click(screen.getByRole('switch', { name: 'Enabled only' }));
-    screen
-      .getByRole('checkbox', { name: 'Select visible permissions in Group' })
-      .focus();
-    await user.keyboard('[Space]');
-    expect(screen.getByRole('textbox')).toHaveFocus();
   });
   it('keeps scopes attached to actions, readonly scopes disabled and control ids instance-local', async () => {
     const scoped = [
@@ -325,7 +267,7 @@ it('shows a single page access checkbox without a duplicate access action or res
   expect(onEnabledBatchChange).not.toHaveBeenCalled();
 });
 
-it('keeps multiple inline scopes independently named and editable', async () => {
+it('reveals multiple scopes without changing their independent saved selections', async () => {
   const change = vi.fn();
   render(
     <PermissionEditor
@@ -361,6 +303,9 @@ it('keeps multiple inline scopes independently named and editable', async () =>
       onLevelChange={change}
     />,
   );
+  expect(screen.getByText('Records')).not.toBeVisible();
+  await userEvent.click(screen.getByText('Data ranges (2)'));
+  expect(change).not.toHaveBeenCalled();
   expect(screen.getByText('Records')).toBeVisible();
   expect(screen.getByText('Attachments')).toBeVisible();
   await userEvent.click(
@@ -372,7 +317,7 @@ it('keeps multiple inline scopes independently named and editable', async () =>
   expect(change).toHaveBeenCalledExactlyOnceWith('attachments', 'all');
 });
 
-it('keeps the category heading consistent for a single resource and labels bulk selection explicitly', async () => {
+it('uses the category navigation without a duplicate heading and identifies filtered results', async () => {
   const batch = vi.fn();
   render(
     <PermissionEditor
@@ -407,19 +352,24 @@ it('keeps the category heading consistent for a single resource and labels bulk
       onLevelChange={vi.fn()}
     />,
   );
+  expect(
+    screen.queryByRole('heading', { level: 2, name: 'Users' }),
+  ).not.toBeInTheDocument();
+  expect(screen.getByRole('region', { name: 'Users' })).toBeInTheDocument();
+  await userEvent.type(screen.getByRole('textbox'), 'users');
   expect(
     screen.getByRole('heading', { level: 2, name: 'Users' }),
-  ).toBeInTheDocument();
-  expect(screen.getAllByText('1/2')).toHaveLength(1);
+  ).toBeVisible();
+  expect(batch).not.toHaveBeenCalled();
+  expect(screen.queryByText('1/2')).not.toBeInTheDocument();
   expect(
-    screen.getByRole('checkbox', {
-      name: 'Select visible permissions in Users',
-    }),
-  ).toHaveAttribute('aria-checked', 'mixed');
-  await userEvent.click(screen.getByText('All', { selector: 'span' }));
-  expect(batch).toHaveBeenCalledExactlyOnceWith([
-    { id: 'edit', enabled: true },
-  ]);
+    screen.queryByRole('checkbox', { name: /Select visible/ }),
+  ).not.toBeInTheDocument();
+  expect(
+    screen.queryByText('All', { selector: 'span' }),
+  ).not.toBeInTheDocument();
+  await userEvent.click(screen.getByRole('checkbox', { name: 'Edit users' }));
+  expect(batch).not.toHaveBeenCalled();
 });
 
 it('aligns semantic actions across resources without dropping special or filtered actions', async () => {
@@ -531,9 +481,219 @@ it('keeps scope captions consistent in a category with multiple data ranges, inc
     />,
   );
   expect(screen.getByText('Visible quotes')).toBeVisible();
+  expect(
+    screen.getByText(
+      'Linked projects: All records; Allowed quotes: All records',
+    ),
+  ).toBeVisible();
+  await userEvent.click(screen.getByText('Data ranges (2)'));
   expect(screen.getByText('Linked projects')).toBeVisible();
   expect(screen.getByText('Allowed quotes')).toBeVisible();
   await userEvent.type(screen.getByRole('textbox'), 'View quotes');
   expect(screen.queryByText('Linked projects')).not.toBeInTheDocument();
   expect(screen.getByText('Visible quotes')).toBeVisible();
 });
+
+it('keeps administration actions ordered and independently editable with unrelated special actions', async () => {
+  const enabled = vi.fn();
+  render(
+    <PermissionEditor
+      sections={[
+        {
+          id: 'admin',
+          title: 'Administration',
+          groups: [
+            {
+              id: 'roles',
+              title: 'Roles',
+              rows: [
+                {
+                  id: 'grants',
+                  actionKey: 'grants',
+                  label: 'Manage grants',
+                  enabled: false,
+                },
+                {
+                  id: 'delete',
+                  actionKey: 'delete',
+                  label: 'Delete',
+                  enabled: false,
+                },
+                { id: 'read', actionKey: 'read', label: 'View', enabled: true },
+                {
+                  id: 'update',
+                  actionKey: 'update',
+                  label: 'Edit',
+                  enabled: false,
+                },
+                {
+                  id: 'create',
+                  actionKey: 'create',
+                  label: 'Create',
+                  enabled: false,
+                },
+              ],
+            },
+            {
+              id: 'checker',
+              title: 'Checker',
+              rows: [
+                {
+                  id: 'check',
+                  actionKey: 'check',
+                  label: 'Check permissions',
+                  enabled: false,
+                },
+              ],
+            },
+            {
+              id: 'scheduler',
+              title: 'Scheduler',
+              rows: [
+                {
+                  id: 'run',
+                  actionKey: 'run',
+                  label: 'Start and stop rules',
+                  enabled: false,
+                },
+              ],
+            },
+          ],
+        },
+      ]}
+      onEnabledChange={enabled}
+      onLevelChange={vi.fn()}
+    />,
+  );
+  const controls = screen.getAllByRole('checkbox');
+  for (const [index, name] of [
+    'View',
+    'Create',
+    'Edit',
+    'Delete',
+    'Manage grants',
+    'Check permissions',
+    'Start and stop rules',
+  ].entries()) {
+    expect(controls[index]).toHaveAccessibleName(name);
+  }
+  expect(
+    screen.getByRole('checkbox', { name: 'View', exact: true }),
+  ).toBeChecked();
+  expect(enabled).not.toHaveBeenCalled();
+  await userEvent.type(screen.getByRole('textbox'), 'Manage grants');
+  expect(screen.getAllByRole('checkbox')).toHaveLength(1);
+  await userEvent.click(
+    screen.getByRole('checkbox', { name: 'Manage grants' }),
+  );
+  expect(enabled).toHaveBeenCalledExactlyOnceWith('grants', true);
+});
+
+it('explains categories and allows individual review without bulk selection', async () => {
+  const change = vi.fn();
+  const batch = vi.fn();
+  render(
+    <PermissionEditor
+      sections={[
+        {
+          id: 'accounts',
+          title: 'Users and accounts',
+          description: 'Review account permissions individually.',
+          groups: [
+            {
+              id: 'security',
+              title: 'Account security',
+              rows: [
+                {
+                  id: 'disable',
+                  label: 'Disable account',
+                  enabled: false,
+                  hint: 'Prevent further sign-in.',
+                },
+                { id: 'reset', label: 'Reset password', enabled: false },
+              ],
+            },
+          ],
+        },
+      ]}
+      onEnabledChange={change}
+      onEnabledBatchChange={batch}
+      onLevelChange={vi.fn()}
+    />,
+  );
+  expect(
+    screen.getByText('Review account permissions individually.'),
+  ).toBeVisible();
+  expect(screen.getAllByRole('checkbox')).toHaveLength(2);
+  expect(
+    screen.queryByText('All', { selector: 'span' }),
+  ).not.toBeInTheDocument();
+  expect(screen.getByText('Prevent further sign-in.')).toBeVisible();
+  expect(change).not.toHaveBeenCalled();
+  expect(batch).not.toHaveBeenCalled();
+  await userEvent.click(
+    screen.getByRole('checkbox', { name: 'Disable account' }),
+  );
+  expect(change).toHaveBeenCalledExactlyOnceWith('disable', true);
+});
+
+it('shows scope explanations on focus or tap without changing the permission draft', async () => {
+  const user = userEvent.setup();
+  const enabled = vi.fn();
+  const changed = vi.fn();
+  render(
+    <PermissionEditor
+      sections={[
+        {
+          id: 'orders',
+          title: 'Orders',
+          groups: [
+            {
+              id: 'orders',
+              title: 'Orders',
+              rows: [
+                {
+                  id: 'view',
+                  label: 'View orders',
+                  enabled: true,
+                  scopes: [
+                    {
+                      id: 'scope',
+                      label: 'Orders',
+                      level: '',
+                      hint: 'Default access and sharing still apply.',
+                      levels: [
+                        { value: '', label: 'No additional record access' },
+                        { value: 'all', label: 'All records' },
+                      ],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        },
+      ]}
+      onEnabledChange={enabled}
+      onLevelChange={changed}
+    />,
+  );
+  const help = screen.getByRole('button', {
+    name: 'About the data range for View orders · Orders',
+  });
+  expect(screen.queryByRole('tooltip')).not.toBeInTheDocument();
+  await user.click(help);
+  expect(await screen.findByRole('tooltip')).toHaveTextContent(
+    'Default access and sharing still apply.',
+  );
+  await user.keyboard('{Escape}');
+  expect(screen.queryByRole('tooltip')).not.toBeInTheDocument();
+  await user.tab({ shift: true });
+  await user.tab();
+  expect(help).toHaveFocus();
+  expect(await screen.findByRole('tooltip')).toHaveTextContent(
+    'Default access and sharing still apply.',
+  );
+  expect(enabled).not.toHaveBeenCalled();
+  expect(changed).not.toHaveBeenCalled();
+});

package/tests/components/permission-management-tabs.test.tsx

@@ -0,0 +1,128 @@
+import { renderWithApp } from '@nocobase/app-testing/client';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Route, Routes, useLocation } from 'react-router';
+import { beforeEach, expect, it, vi } from 'vitest';
+import { PermissionManagementPage } from '../../client/pages/settings/permission-management-page.js';
+import enUS from '../../client/locales/en-US.js';
+import zhCN from '../../client/locales/zh-CN.js';
+const access = vi.hoisted(() => ({ roles: true, defaults: true }));
+vi.mock('@nocobase/app-plugin-authorization/client', async (original) => ({
+  ...(await original<
+    typeof import('@nocobase/app-plugin-authorization/client')
+  >()),
+  useCan: ({ resource }: { resource: { id: string } }) => ({
+    can:
+      resource.id === 'authorization.permission-sets'
+        ? access.roles
+        : access.defaults,
+  }),
+}));
+const namespace = '@nocobase/permission-tabs-test';
+const namespaces = {
+  [namespace]: {
+    'en-US': async () => ({ default: enUS }),
+    'zh-CN': async () => ({ default: zhCN }),
+  },
+};
+beforeEach(() => {
+  access.roles = true;
+  access.defaults = true;
+});
+function Content({ tab }: { tab: 'roles' | 'default-access' }) {
+  const location = useLocation();
+  return (
+    <PermissionManagementPage tab={tab}>
+      <output aria-label='Route'>{location.pathname}</output>
+    </PermissionManagementPage>
+  );
+}
+function tree(prefix: string) {
+  return (
+    <Routes>
+      <Route
+        path={`${prefix}/roles`}
+        element={<Content key='roles' tab='roles' />}
+      />
+      <Route
+        path={`${prefix}/default-access`}
+        element={<Content key='default-access' tab='default-access' />}
+      />
+    </Routes>
+  );
+}
+it.each(['', '/settings'])(
+  'uses two URL-backed tabs under one heading, preserves the existing %s route prefix and keyboard focus',
+  async (prefix) => {
+    const user = userEvent.setup();
+    await renderWithApp(tree(prefix), {
+      route: `${prefix}/roles`,
+      namespace,
+      namespaces,
+    });
+    expect(
+      screen.getByRole('heading', { name: 'Permission management' }),
+    ).toBeVisible();
+    expect(screen.getAllByRole('tab')).toHaveLength(2);
+    await user.click(screen.getByRole('tab', { name: 'Default data scopes' }));
+    await waitFor(() =>
+      expect(screen.getByRole('status', { name: 'Route' })).toHaveTextContent(
+        `${prefix}/default-access`,
+      ),
+    );
+    expect(
+      screen.getByRole('tab', { name: 'Default data scopes' }),
+    ).toHaveAttribute('aria-selected', 'true');
+    expect(
+      screen.getByRole('tabpanel', { name: 'Default data scopes' }),
+    ).toBeVisible();
+    await waitFor(() =>
+      expect(
+        screen.getByRole('tab', { name: 'Default data scopes' }),
+      ).toHaveFocus(),
+    );
+    await user.keyboard('{ArrowLeft}');
+    expect(
+      screen.getByRole('tab', { name: 'Roles and permissions' }),
+    ).toHaveFocus();
+    await user.keyboard('{Enter}');
+    await waitFor(() =>
+      expect(
+        screen.getByRole('tab', { name: 'Roles and permissions' }),
+      ).toHaveAttribute('aria-selected', 'true'),
+    );
+    await waitFor(() =>
+      expect(
+        screen.getByRole('tab', { name: 'Roles and permissions' }),
+      ).toHaveFocus(),
+    );
+  },
+);
+it('hides an unreadable tab while keeping direct navigation on the readable default scope page', async () => {
+  access.roles = false;
+  await renderWithApp(tree(''), {
+    route: '/default-access',
+    namespace,
+    namespaces,
+  });
+  expect(
+    screen.queryByRole('tab', { name: 'Roles and permissions' }),
+  ).not.toBeInTheDocument();
+  expect(
+    screen.getByRole('tab', { name: 'Default data scopes' }),
+  ).toHaveAttribute('aria-selected', 'true');
+  expect(screen.getByRole('status', { name: 'Route' })).toHaveTextContent(
+    '/default-access',
+  );
+});
+it('uses the agreed Chinese menu and tab names', async () => {
+  await renderWithApp(tree(''), {
+    route: '/roles',
+    namespace,
+    namespaces,
+    locale: 'zh-CN',
+  });
+  expect(screen.getByRole('heading', { name: '权限管理' })).toBeVisible();
+  expect(screen.getByRole('tab', { name: '角色与权限' })).toBeVisible();
+  expect(screen.getByRole('tab', { name: '默认数据范围' })).toBeVisible();
+});

package/tests/components/role-list.test.tsx

@@ -0,0 +1,71 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter, Route, Routes } from 'react-router';
+import { describe, expect, it } from 'vitest';
+import { RoleList } from '../../client/components/role-list.js';
+
+const roles = [
+  {
+    key: 'member',
+    title: 'Member',
+    to: { pathname: '/roles/member/edit', search: '?q=team' },
+    protected: true,
+  },
+  {
+    key: 'team',
+    title: 'A very long role name that remains available in full',
+    to: '/roles/team/edit',
+    protected: false,
+  },
+];
+describe('compact role list', () => {
+  it('renders ordinary list content with full names, identifiers and translated state labels', () => {
+    render(
+      <MemoryRouter>
+        <RoleList
+          roles={roles}
+          ariaLabel='角色与权限'
+          labels={{ protected: '受保护', custom: '自定义' }}
+        />
+      </MemoryRouter>,
+    );
+    expect(screen.getByRole('list', { name: '角色与权限' })).toBeVisible();
+    expect(screen.getAllByRole('listitem')).toHaveLength(2);
+    expect(
+      screen.queryByRole('heading', { name: 'Member' }),
+    ).not.toBeInTheDocument();
+    expect(screen.getByTitle(roles[1]!.title)).toHaveTextContent(
+      roles[1]!.title,
+    );
+    expect(screen.getByTitle('team')).toHaveTextContent('team');
+    expect(screen.getByText('受保护')).toBeVisible();
+    expect(screen.getByText('自定义')).toBeVisible();
+  });
+  it('keeps keyboard navigation and the supplied edit path and query', async () => {
+    const user = userEvent.setup();
+    render(
+      <MemoryRouter>
+        <Routes>
+          <Route
+            path='/'
+            element={
+              <RoleList
+                roles={roles}
+                labels={{ protected: 'Protected', custom: 'Custom' }}
+              />
+            }
+          />
+          <Route path='/roles/member/edit' element={<p>Edit member</p>} />
+        </Routes>
+      </MemoryRouter>,
+    );
+    const link = screen.getByRole('link', {
+      name: 'Member',
+    });
+    expect(link).toHaveAttribute('href', '/roles/member/edit?q=team');
+    await user.tab();
+    expect(link).toHaveFocus();
+    await user.keyboard('{Enter}');
+    expect(screen.getByText('Edit member')).toBeVisible();
+  });
+});

package/tests/components/roles.test.tsx

@@ -0,0 +1,78 @@
+import { answerApi, renderWithApp } from '@nocobase/app-testing/client';
+import { apiClientToken, type ClientApplication } from '@nocobase/app-client';
+import {
+  AuthorizationClient,
+  authorizationClientToken,
+} from '@nocobase/app-plugin-authorization/client';
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Routes, Route } from 'react-router';
+import { expect, it } from 'vitest';
+import RolesPage from '../../client/pages/settings/roles.js';
+import enUS from '../../client/locales/en-US.js';
+import zhCN from '../../client/locales/zh-CN.js';
+const settingsNamespace = '@nocobase/compact-role-test';
+const services = (app: ClientApplication) =>
+  app.container.instance(
+    authorizationClientToken,
+    new AuthorizationClient(app.container.resolve(apiClientToken)),
+  );
+const namespaces = {
+  [settingsNamespace]: {
+    'en-US': async () => ({ default: enUS }),
+    'zh-CN': async () => ({ default: zhCN }),
+  },
+};
+
+it('keeps the compact role list sorted, searchable and linked to the current query', async () => {
+  const user = userEvent.setup();
+  await renderWithApp(
+    <Routes>
+      <Route path='/settings/roles' element={<RolesPage />} />
+    </Routes>,
+    {
+      route: '/settings/roles',
+      namespace: settingsNamespace,
+      namespaces,
+      services,
+      fetch: answerApi(({ path }) =>
+        path === 'authorization/permissions'
+          ? { data: { unrestricted: false, permissions: [] } }
+          : {
+              data: [
+                { key: 'team', title: 'NocoBase team', grants: [] },
+                { key: 'cp-customer', title: 'Customer', grants: [] },
+                {
+                  key: 'member',
+                  title: 'Member',
+                  grants: [],
+                  protection: { allow: ['update'] },
+                },
+              ],
+            },
+      ),
+    },
+  );
+  await screen.findByTitle('Customer');
+  const list = screen.getByRole('list', { name: 'Roles and permissions' });
+  expect(
+    Array.from(list.querySelectorAll('li')).map((item) =>
+      item.querySelector('[title]')?.getAttribute('title'),
+    ),
+  ).toEqual(['Customer', 'Member', 'NocoBase team']);
+  expect(
+    screen.queryByRole('heading', { name: 'Customer' }),
+  ).not.toBeInTheDocument();
+  expect(
+    screen.queryByRole('button', { name: 'New role' }),
+  ).not.toBeInTheDocument();
+  await user.type(
+    screen.getByRole('textbox', { name: 'Search role names' }),
+    'Customer',
+  );
+  await waitFor(() => expect(list.querySelectorAll('li')).toHaveLength(1));
+  expect(screen.getByTitle('Customer').closest('a')).toHaveAttribute(
+    'href',
+    '/settings/roles/cp-customer/edit?q=Customer',
+  );
+});

package/tests/components/user-permissions.test.tsx

@@ -105,6 +105,18 @@ describe('user permission configuration', () => {
         expect(checkbox).not.toBeChecked();
         await user.click(checkbox);
       }
+      expect(
+        screen.getByRole('heading', { name: words.userInformation }),
+      ).toBeVisible();
+      expect(
+        screen.getByRole('heading', { name: words.accountSecurity }),
+      ).toBeVisible();
+      expect(
+        screen.getByRole('heading', { name: words.roleAssignment }),
+      ).toBeVisible();
+      expect(screen.getAllByRole('checkbox')).toHaveLength(10);
+      const rowIds = screen.getAllByRole('checkbox').map((node) => node.id);
+      expect(new Set(rowIds).size).toBe(10);
       await user.click(
         screen.getByRole('button', { name: words.save, exact: true }),
       );

package/tests/logic/client-routes.test.ts

@@ -90,6 +90,14 @@ describe('app client routes', () => {
         name: 'settingsRoleEdit',
         authorizedAs: 'settings:authorization.permission-sets',
       },
+      ...[
+        'settingsDefaultAccess',
+        'settingsDefaultAccessCreate',
+        'settingsDefaultAccessEdit',
+      ].map((name) => ({
+        name,
+        authorizedAs: 'settings:authorization.default-access',
+      })),
     ]);
     for (const loader of componentLoadersIn(built.routes))
       await expect(loader()).resolves.toMatchObject({