@nocobase/app-template-default 1.0.0-beta.76 → 1.0.0-beta.78

package/tests/components/permission-filter-binding.test.tsx

@@ -18,6 +18,25 @@ const catalog = {
     {
       name: 'business',
       title: 'Business',
+      subsections: [
+        {
+          name: 'other',
+          title: 'Other',
+          resources: [
+            {
+              type: 'composite',
+              id: 'expenses.records',
+              title: 'Expenses',
+              actions: [{ name: 'other', title: 'Other' }],
+              dataScopes: {},
+            },
+          ],
+        },
+      ],
+    },
+    {
+      name: 'configuration',
+      title: 'Configuration',
       subsections: [
         {
           name: 'expenses',
@@ -108,6 +127,7 @@ it('collects native custom filter parameters before changing the draft, then sav
     );
   }
   render(<Role />);
+  await user.click(screen.getByRole('button', { name: 'Configuration' }));
   const scope = screen.getByRole('combobox', {
     name: 'How far View · Records reaches',
   });

package/tests/components/settings.test.tsx

@@ -4,6 +4,10 @@ import {
   AuthorizationClient,
   authorizationClientToken,
 } from '@nocobase/app-plugin-authorization/client';
+import {
+  defineAppRoutes,
+  defineClientPlugin,
+} from '@nocobase/app-client/plugins';
 import { act, fireEvent, screen, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { Routes, Route, useNavigate } from 'react-router';
@@ -197,8 +201,8 @@ describe('template system settings', () => {
             data: {
               sections: [
                 {
-                  name: 'settings',
-                  title: 'Settings',
+                  name: 'administration',
+                  title: 'Business operations',
                   order: 0,
                   subsections: [
                     {
@@ -207,9 +211,9 @@ describe('template system settings', () => {
                       resources: [
                         {
                           type: 'settings',
-                          id: 'files',
-                          title: 'Files',
-                          actions: [{ name: 'read', title: 'Read files' }],
+                          id: 'authorization.permission-sets',
+                          title: 'Roles',
+                          actions: [{ name: 'read', title: 'Read roles' }],
                         },
                       ],
                     },
@@ -261,14 +265,32 @@ describe('template system settings', () => {
       </Routes>,
       {
         route: '/settings/roles/sales/edit',
+        plugins: [
+          defineClientPlugin({
+            packageName: settingsNamespace,
+            routes: defineAppRoutes([
+              {
+                name: 'roles',
+                path: '/role-config',
+                componentLoader: async () => ({ default: () => null }),
+                authz: {
+                  resource: {
+                    type: 'settings',
+                    id: 'authorization.permission-sets',
+                  },
+                  action: 'read',
+                },
+              },
+            ]),
+          })(),
+        ],
         namespace: settingsNamespace,
         namespaces,
         services,
         fetch: answerApi(calls),
       },
     );
-    await user.click(await screen.findByRole('button', { name: /^Settings/ }));
-    const toggle = await screen.findByRole('checkbox', { name: 'Read files' });
+    const toggle = await screen.findByRole('checkbox', { name: 'Read roles' });
     await waitFor(() =>
       expect(toggle).not.toHaveAttribute('aria-disabled', 'true'),
     );
@@ -283,7 +305,10 @@ describe('template system settings', () => {
           expectedRevision: 'version-1',
           grants: [
             {
-              resource: { type: 'settings', id: 'files' },
+              resource: {
+                type: 'settings',
+                id: 'authorization.permission-sets',
+              },
               actions: [{ action: 'read' }],
             },
           ],

package/tests/components/user-drawer.test.tsx

@@ -254,9 +254,20 @@ it.each(['/users', '/settings/users'])(
         },
       }),
     );
-    expect(
-      await screen.findByText('Alice updated', { exact: true }),
-    ).toBeVisible();
+    // Refreshing remounts cells; permission loading can replace the name span with a link.
+    await waitFor(() => {
+      const table = screen.getByRole('table');
+      expect(table).toHaveAttribute('aria-busy', 'false');
+      const row = within(table).getByRole('row', {
+        name: /alice@example\.test/u,
+      });
+      const updated = within(row).getByRole('link', {
+        name: 'Alice updated',
+        exact: true,
+      });
+      expect(updated).toBeVisible();
+      expect(updated).toHaveAttribute('href', `${base}/alice/edit${search}`);
+    });
     expect(screen.getByTestId('location')).toHaveTextContent(
       `${base}${search}`,
     );

package/tests/components/user-permissions.test.tsx

@@ -5,6 +5,10 @@ import {
   authorizationClientToken,
   type PermissionGrant,
 } from '@nocobase/app-plugin-authorization/client';
+import {
+  defineAppRoutes,
+  defineClientPlugin,
+} from '@nocobase/app-client/plugins';
 import { screen, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { Routes, Route } from 'react-router';
@@ -35,7 +39,11 @@ describe('user permission configuration', () => {
         grants: [
           {
             resource: { type: 'user', id: '*' },
-            actions: [{ action: 'read' }, { action: 'disable' }],
+            actions: [
+              { action: 'read' },
+              { action: 'disable' },
+              { action: 'invite' },
+            ],
           },
         ] as readonly PermissionGrant[],
       };
@@ -83,6 +91,22 @@ describe('user permission configuration', () => {
             namespace,
             namespaces,
             locale,
+            plugins: [
+              defineClientPlugin({
+                packageName: namespace,
+                routes: defineAppRoutes([
+                  {
+                    name: 'users',
+                    path: '/users',
+                    authz: {
+                      resource: { type: 'user', id: '*' },
+                      action: 'read',
+                    },
+                    componentLoader: async () => ({ default: () => null }),
+                  },
+                ]),
+              })(),
+            ],
             services: (app: ClientApplication) =>
               app.container.instance(
                 authorizationClientToken,
@@ -93,17 +117,17 @@ describe('user permission configuration', () => {
         );
       const first = await mount();
       const labels = [
-        words.inviteUsers,
-        words.deleteUsers,
-        words.resetUserPassword,
+        words.createUsers,
+        words.updateUsers,
+        words.revokeSessions,
       ];
       for (const label of labels) {
-        const checkbox = await screen.findByRole('checkbox', { name: label });
+        const toggle = await screen.findByRole('checkbox', { name: label });
         await waitFor(() =>
-          expect(checkbox).not.toHaveAttribute('aria-disabled', 'true'),
+          expect(toggle).not.toHaveAttribute('aria-disabled', 'true'),
         );
-        expect(checkbox).not.toBeChecked();
-        await user.click(checkbox);
+        expect(toggle).not.toBeChecked();
+        await user.click(toggle);
       }
       expect(
         screen.getByRole('heading', { name: words.userInformation }),
@@ -114,9 +138,12 @@ describe('user permission configuration', () => {
       expect(
         screen.getByRole('heading', { name: words.roleAssignment }),
       ).toBeVisible();
-      expect(screen.getAllByRole('checkbox')).toHaveLength(10);
+      expect(screen.getAllByRole('checkbox')).toHaveLength(8);
+      expect(
+        screen.queryByRole('checkbox', { name: words.inviteUsers }),
+      ).not.toBeInTheDocument();
       const rowIds = screen.getAllByRole('checkbox').map((node) => node.id);
-      expect(new Set(rowIds).size).toBe(10);
+      expect(new Set(rowIds).size).toBe(8);
       await user.click(
         screen.getByRole('button', { name: words.save, exact: true }),
       );
@@ -128,7 +155,14 @@ describe('user permission configuration', () => {
           }),
         ),
       );
-      const all = ['read', 'disable', 'invite', 'delete', 'reset-password'];
+      const all = [
+        'read',
+        'disable',
+        'invite',
+        'create',
+        'update',
+        'revoke-sessions',
+      ];
       expect(role.grants[0]?.actions.map((action) => action.action)).toEqual(
         all,
       );
@@ -139,14 +173,14 @@ describe('user permission configuration', () => {
           await screen.findByRole('checkbox', { name: label }),
         ).toBeChecked();
       await user.click(
-        screen.getByRole('checkbox', { name: words.deleteUsers }),
+        screen.getByRole('checkbox', { name: words.updateUsers }),
       );
       await user.click(
         screen.getByRole('button', { name: words.save, exact: true }),
       );
       await waitFor(() =>
         expect(role.grants[0]?.actions.map((action) => action.action)).toEqual(
-          all.filter((action) => action !== 'delete'),
+          all.filter((action) => action !== 'update'),
         ),
       );
     },

package/tests/logic/config.test.ts

@@ -167,7 +167,9 @@ describe('application config', () => {
       env: { APP_BASE_PATH: '/crm/' },
     });
     expect(mounted.config.get('session.cookie.path')).toBe('/crm');
-    expect(mounted.config.get('session.cookie.name')).toBe('nocobase_session');
+    expect(mounted.config.get('session.cookie.name')).toBe(
+      'nocobase_session_%2Fcrm',
+    );
   });
 
   it('loads only explicit env overrides and restores defaults on reload', async () => {

package/tests/logic/page-permission-navigation.test.ts

@@ -0,0 +1,394 @@
+import { describe, expect, it } from 'vitest';
+import {
+  defineAppRoutes,
+  resolveAppClientContributions,
+} from '@nocobase/app-client/plugins';
+import type { LocalizedText } from '@nocobase/app-plugin-authorization/client';
+import type {
+  PermissionEditorNavigationNode,
+  PermissionEditorSection,
+} from '../../client/components/permission-editor.js';
+import {
+  pagePermissionNavigation,
+  pagePermissionResources,
+  permissionNavigationSections,
+} from '../../client/pages/settings/page-permissions.js';
+import enUS from '../../client/locales/en-US.js';
+import zhCN from '../../client/locales/zh-CN.js';
+
+const componentLoader = async () => ({ default: () => null });
+const text = (value: LocalizedText): string =>
+  typeof value === 'string' ? value : value.key;
+const resource = (id: string) => ({
+  resource: { type: 'page' as const, id },
+  action: 'access',
+});
+const flatten = (
+  nodes: readonly PermissionEditorNavigationNode[],
+): PermissionEditorNavigationNode[] =>
+  nodes.flatMap((node) => [node, ...flatten(node.children ?? [])]);
+const fixture = () =>
+  resolveAppClientContributions([
+    {
+      packageName: 'private-app',
+      source: 'application',
+      routes: defineAppRoutes([
+        {
+          name: 'basic',
+          navigation: { title: 'Basic data' },
+          children: [
+            {
+              name: 'materials',
+              path: '/materials',
+              navigation: { title: 'Materials' },
+              authz: resource('legacy-materials'),
+              componentLoader,
+            },
+            {
+              name: 'locations',
+              navigation: { title: 'Locations' },
+              children: [
+                {
+                  name: 'warehouses',
+                  path: '/warehouses',
+                  navigation: { title: 'Warehouses' },
+                  authz: resource('legacy-warehouses'),
+                  componentLoader,
+                },
+              ],
+            },
+          ],
+        },
+        {
+          name: 'loans',
+          path: '/loans',
+          navigation: { title: 'Loans' },
+          authz: resource('legacy-loans'),
+          componentLoader,
+          children: [
+            { name: 'loanDetail', path: ':id', componentLoader },
+            {
+              name: 'reviews',
+              path: 'reviews',
+              navigation: { title: 'Reviews' },
+              authz: resource('legacy-reviews'),
+              componentLoader,
+            },
+            {
+              name: 'audit',
+              path: 'audit',
+              authz: resource('legacy-audit'),
+              componentLoader,
+            },
+          ],
+        },
+        {
+          name: 'alias',
+          path: '/loan-alias',
+          navigation: { title: 'Loan alias' },
+          authz: resource('legacy-loans'),
+          componentLoader,
+        },
+        {
+          name: 'settings',
+          path: '/settings',
+          navigation: { title: 'Settings' },
+          authz: {
+            resource: { type: 'settings', id: 'rules' },
+            action: 'read',
+          },
+          componentLoader,
+        },
+        {
+          name: 'landing',
+          path: '/',
+          navigation: { title: 'Landing' },
+          authz: 'skip',
+          componentLoader,
+        },
+      ]),
+    },
+  ]);
+
+describe('page permission navigation projection', () => {
+  it('supplies named disclosure and non-menu labels in both supported languages', () => {
+    for (const locale of [enUS, zhCN]) {
+      const settings = Reflect.get(locale, 'settings') as Record<
+        string,
+        unknown
+      >;
+      for (const key of [
+        'expandPermissionGroup',
+        'collapsePermissionGroup',
+        'pagesOutsideNavigation',
+      ]) {
+        const value = settings[key];
+        expect(typeof value).toBe('string');
+        expect(String(value).trim()).not.toBe('');
+        expect(value).not.toBe(key);
+        if (key !== 'pagesOutsideNavigation')
+          expect(value).toContain('{{name}}');
+      }
+    }
+  });
+  it('preserves real groups, deeper menus and independent parent/child identities', () => {
+    const { routes } = fixture();
+    const result = pagePermissionNavigation(
+      routes,
+      { audit: 'Audit details' },
+      (path) => `Unnamed (${path})`,
+      text,
+    );
+    expect(result.map((node) => node.label)).toEqual([
+      'Basic data',
+      'Loans',
+      'settings.pagesOutsideNavigation',
+    ]);
+    expect(result[0]?.rowId).toBeUndefined();
+    expect(result[0]?.children?.map((node) => node.label)).toEqual([
+      'Materials',
+      'Locations',
+    ]);
+    expect(result[0]?.children?.[1]?.children?.[0]?.label).toBe('Warehouses');
+    expect(result[1]?.rowId).toBe('["page","legacy-loans","access"]');
+    expect(result[1]?.children?.[0]?.rowId).toBe(
+      '["page","legacy-reviews","access"]',
+    );
+    expect(
+      flatten(result)
+        .filter((node) => node.rowId)
+        .map((node) => node.rowId),
+    ).toEqual([
+      '["page","legacy-materials","access"]',
+      '["page","legacy-warehouses","access"]',
+      '["page","legacy-loans","access"]',
+      '["page","legacy-reviews","access"]',
+      '["page","legacy-audit","access"]',
+    ]);
+  });
+
+  it('keeps actual non-menu independent pages and deduplicates inherited and aliased grants', () => {
+    const { routes } = fixture();
+    const before = JSON.stringify(routes);
+    const pages = pagePermissionResources(
+      routes,
+      { audit: 'Audit details' },
+      (path) => `Unnamed (${path})`,
+    );
+    const result = pagePermissionNavigation(
+      routes,
+      { audit: 'Audit details' },
+      (path) => `Unnamed (${path})`,
+      text,
+    );
+    expect(result.at(-1)?.children).toEqual([
+      {
+        id: 'page:legacy-audit',
+        label: 'Audit details',
+        rowId: '["page","legacy-audit","access"]',
+      },
+    ]);
+    expect(flatten(result).filter((node) => node.rowId)).toHaveLength(
+      pages.length,
+    );
+    expect(flatten(result).map((node) => node.label)).not.toContain(
+      'Loan alias',
+    );
+    expect(flatten(result).map((node) => node.label)).not.toContain('Landing');
+    expect(flatten(result).map((node) => node.label)).not.toContain('Settings');
+    expect(JSON.stringify(routes)).toBe(before);
+    expect(
+      pagePermissionNavigation(
+        routes,
+        { audit: 'Audit details' },
+        (path) => `Unnamed (${path})`,
+        text,
+      ),
+    ).toEqual(result);
+  });
+
+  it('renders single-level menus at a single level without inventing groups', () => {
+    const { routes } = resolveAppClientContributions([
+      {
+        packageName: 'flat-app',
+        source: 'application',
+        routes: defineAppRoutes([
+          {
+            name: 'one',
+            path: '/one',
+            navigation: { title: 'One' },
+            authz: resource('one'),
+            componentLoader,
+          },
+          {
+            name: 'two',
+            path: '/two',
+            navigation: { title: 'Two' },
+            authz: resource('two'),
+            componentLoader,
+          },
+        ]),
+      },
+    ]);
+    const result = pagePermissionNavigation(routes, {}, () => 'Unnamed', text);
+    expect(result.map((node) => node.label)).toEqual(['One', 'Two']);
+    expect(result.every((node) => !node.children?.length)).toBe(true);
+    expect(result.every((node) => node.rowId)).toBe(true);
+  });
+});
+
+it('omits menus governed by settings or account permissions instead of mirroring them as page controls or links', () => {
+  const { routes } = resolveAppClientContributions([
+    {
+      packageName: 'app',
+      source: 'application',
+      routes: defineAppRoutes([
+        {
+          name: 'settings',
+          path: '/settings',
+          navigation: { title: 'System settings' },
+          children: [
+            {
+              name: 'users',
+              path: 'users',
+              navigation: { title: 'User management' },
+              authz: { resource: { type: 'user', id: '*' }, action: 'read' },
+              componentLoader,
+            },
+            {
+              name: 'roles',
+              path: 'roles',
+              navigation: { title: 'Permission management' },
+              authz: {
+                resource: {
+                  type: 'settings',
+                  id: 'authorization.permission-sets',
+                },
+                action: 'read',
+              },
+              componentLoader,
+            },
+            {
+              name: 'logs',
+              path: 'logs',
+              navigation: { title: 'Notification logs' },
+              authz: resource('logs'),
+              componentLoader,
+            },
+          ],
+        },
+      ]),
+    },
+  ]);
+  const result = pagePermissionNavigation(routes, {}, (path) => path, text);
+  expect(result).toEqual([]);
+  const withoutPage = routes.map((route) => ({
+    ...route,
+    children: route.children?.filter(({ name }) => name !== 'logs'),
+  }));
+  expect(
+    pagePermissionNavigation(withoutPage, {}, (path) => path, text),
+  ).toEqual([]);
+});
+
+it.each(['settings', 'systemManagement'])(
+  'moves all %s controls into configuration without changing or duplicating grants',
+  (rootName) => {
+    const { routes } = resolveAppClientContributions([
+      {
+        packageName: 'app',
+        source: 'application',
+        routes: defineAppRoutes([
+          {
+            name: 'orders',
+            path: '/orders',
+            navigation: { title: 'Orders' },
+            authz: resource('orders'),
+            componentLoader,
+          },
+          {
+            name: rootName,
+            path: '/settings',
+            navigation: { title: 'Settings' },
+            children: [
+              {
+                name: 'users',
+                path: 'users',
+                navigation: { title: 'Users' },
+                authz: { resource: { type: 'user', id: '*' }, action: 'read' },
+                componentLoader,
+              },
+              {
+                name: 'logs',
+                path: 'logs',
+                navigation: { title: 'Logs' },
+                authz: resource('logs'),
+                componentLoader,
+              },
+            ],
+          },
+        ]),
+      },
+    ]);
+    const user = {
+      id: '["user","*","read"]',
+      label: 'View users',
+      enabled: true,
+    };
+    const accountAction = {
+      id: '["user","*","disable"]',
+      label: 'Disable account',
+      enabled: false,
+    };
+    const order = {
+      id: '["page","orders","access"]',
+      label: 'Orders',
+      enabled: true,
+    };
+    const logs = {
+      id: '["page","logs","access"]',
+      label: 'Logs',
+      enabled: false,
+    };
+    const sections: PermissionEditorSection[] = [
+      {
+        id: 'users',
+        title: 'Users and accounts',
+        groups: [{ id: 'users', rows: [user, accountAction] }],
+      },
+      {
+        id: 'pages',
+        title: 'Page access',
+        groups: [
+          { id: 'orders', accessOnly: true, rows: [order] },
+          { id: 'logs', accessOnly: true, rows: [logs] },
+        ],
+      },
+    ];
+    const before = JSON.stringify(sections);
+    const result = permissionNavigationSections(
+      sections,
+      routes,
+      {},
+      (path) => path,
+      text,
+    );
+    expect(result.map(({ id }) => id)).toEqual(['pages', 'configuration']);
+    expect(result[0]?.groups.flatMap(({ rows }) => rows)).toEqual([order]);
+    expect(
+      flatten(result[0]?.navigation ?? []).flatMap(({ rowId }) =>
+        rowId ? [rowId] : [],
+      ),
+    ).toEqual([order.id]);
+    expect(result[1]?.groups.flatMap(({ rows }) => rows)).toEqual([
+      user,
+      accountAction,
+      logs,
+    ]);
+    expect(result[1]?.groups[0]?.rows[0]).toBe(user);
+    expect(JSON.stringify(sections)).toBe(before);
+    expect(
+      permissionNavigationSections(result, routes, {}, (path) => path, text),
+    ).toEqual(result);
+  },
+);