@nocobase/app-template-default 1.0.0-beta.79 → 1.0.0-beta.80

package/tests/{components → client}/home.test.tsx

@@ -1,36 +1,19 @@
-import {
-  TestI18nProvider,
-  createTestI18nRuntime,
-} from '@nocobase/i18n/testing';
-import { render, screen, waitFor, within } from '@testing-library/react';
+import { renderWithApp } from '@nocobase/app-testing/client';
+import { screen, waitFor, within } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
-import type { ReactElement, ReactNode } from 'react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
+import packageMetadata from '../../package.json' with { type: 'json' };
 import enUS from '../../client/locales/en-US.js';
 import zhCN from '../../client/locales/zh-CN.js';
 import HomePage from '../../client/pages/home/index.js';
 import { CAPABILITIES } from '../../client/pages/home/capabilities.js';
 
-const { toaster } = vi.hoisted(() => ({
-  toaster: { show: vi.fn(), close: vi.fn() },
-}));
-
-vi.mock('@nocobase/app-client', async (original) => ({
-  ...(await original<typeof import('@nocobase/app-client')>()),
-  useToaster: () => toaster,
-}));
-
-// Strict: a key the locale lacks fails the test instead of rendering as text.
-const runtime = await createTestI18nRuntime({
-  application: {
-    namespace: '@nocobase/app-template-default',
-    resources: enUS,
-  },
-});
-
-function I18n({ children }: { readonly children: ReactNode }): ReactElement {
-  return <TestI18nProvider runtime={runtime}>{children}</TestI18nProvider>;
+function renderHome() {
+  return renderWithApp(<HomePage />, {
+    namespace: packageMetadata.name,
+    namespaces: { [packageMetadata.name]: enUS },
+  });
 }
 
 const writeText = vi.fn<(text: string) => Promise<void>>();
@@ -53,12 +36,11 @@ function setup(): ReturnType<typeof userEvent.setup> {
 
 describe('home page', () => {
   beforeEach(() => {
-    toaster.show.mockReset();
     clipboard.fail = false;
   });
 
-  it('tells people to build by asking their coding agent', () => {
-    render(<HomePage />, { wrapper: I18n });
+  it('tells people to build by asking their coding agent', async () => {
+    await renderHome();
 
     expect(
       screen.getByRole('heading', { level: 1, name: enUS.home.title }),
@@ -66,8 +48,8 @@ describe('home page', () => {
     expect(screen.getByText(enUS.home.steps.describe.title)).toBeVisible();
   });
 
-  it('shows one card per built-in capability', () => {
-    render(<HomePage />, { wrapper: I18n });
+  it('shows one card per built-in capability', async () => {
+    await renderHome();
 
     for (const { id } of CAPABILITIES) {
       const title =
@@ -80,7 +62,7 @@ describe('home page', () => {
 
   it('opens a capability, switches prompts, and copies the edited text', async () => {
     const user = setup();
-    render(<HomePage />, { wrapper: I18n });
+    const view = await renderHome();
     const scheduler = enUS.home.capabilities.scheduler;
 
     await user.click(
@@ -106,10 +88,12 @@ describe('home page', () => {
     );
 
     expect(writeText).toHaveBeenCalledWith('Every Friday');
-    expect(toaster.show).toHaveBeenCalledWith({
-      type: 'success',
-      title: enUS.home.prompt.copied,
-    });
+    expect(view.toasts()).toEqual([
+      expect.objectContaining({
+        type: 'success',
+        title: enUS.home.prompt.copied,
+      }),
+    ]);
 
     await user.click(
       within(dialog).getByRole('button', { name: enUS.home.prompt.reset }),
@@ -119,7 +103,7 @@ describe('home page', () => {
 
   it('starts from the default prompt each time the dialog opens', async () => {
     const user = setup();
-    render(<HomePage />, { wrapper: I18n });
+    await renderHome();
     const theme = enUS.home.capabilities.theme;
     const card = screen.getByRole('button', { name: new RegExp(theme.title) });
 
@@ -142,16 +126,18 @@ describe('home page', () => {
   it('reports a copy the browser refuses', async () => {
     clipboard.fail = true;
     const user = setup();
-    render(<HomePage />, { wrapper: I18n });
+    const view = await renderHome();
 
     await user.click(
       screen.getAllByRole('button', { name: enUS.home.prompt.copy })[0],
     );
 
-    expect(toaster.show).toHaveBeenCalledWith({
-      type: 'error',
-      title: enUS.home.prompt.copyFailed,
-    });
+    expect(view.toasts()).toEqual([
+      expect.objectContaining({
+        type: 'error',
+        title: enUS.home.prompt.copyFailed,
+      }),
+    ]);
   });
 });
 

package/tests/client/inbox.test.tsx

@@ -0,0 +1,94 @@
+import { realtimeClientToken } from '@nocobase/app-client';
+import {
+  AuthenticationProvider,
+  authenticationClientToken,
+} from '@nocobase/app-plugin-authentication/client';
+import {
+  answerApi,
+  renderWithApp,
+  type ApiCall,
+} from '@nocobase/app-testing/client';
+import { fireEvent, screen, waitFor } from '@testing-library/react';
+import { expect, it, vi } from 'vitest';
+
+import packageMetadata from '../../package.json' with { type: 'json' };
+import locales from '../../client/locales/index.js';
+import { TooltipProvider } from '../../client/components/ui/tooltip';
+import InboxPage from '../../client/pages/inbox.tsx';
+
+const messages = [
+  {
+    id: 'm1',
+    deliveryId: 'd1',
+    notificationId: 'n1',
+    title: 'Weekly report is ready',
+    body: 'The sales report for week 40 is ready.',
+    createdAt: '2026-10-01T08:00:00.000Z',
+  },
+  {
+    id: 'm2',
+    deliveryId: 'd2',
+    notificationId: 'n2',
+    title: 'Backup finished',
+    body: 'All databases were backed up.',
+    readAt: '2026-10-01T09:00:00.000Z',
+    createdAt: '2026-10-01T07:00:00.000Z',
+  },
+];
+
+const api = vi.fn(({ path }: ApiCall) => {
+  if (path === 'notificationInApp/unreadCount') return { data: { count: 2 } };
+  if (path === 'notificationInApp/messages')
+    return { data: messages, meta: {} };
+  if (path === 'notificationInApp/messages/m1/markRead') {
+    return { data: { ...messages[0], readAt: '2026-10-01T10:00:00.000Z' } };
+  }
+  return new Response(null, { status: 404 });
+});
+
+function renderInbox() {
+  return renderWithApp(
+    <AuthenticationProvider>
+      <TooltipProvider>
+        <InboxPage />
+      </TooltipProvider>
+    </AuthenticationProvider>,
+    {
+      route: '/inbox',
+      namespace: packageMetadata.name,
+      namespaces: { [packageMetadata.name]: locales },
+      fetch: answerApi(api),
+      services: (app) => {
+        app.container.instance(authenticationClientToken, {
+          getSession: async () => ({
+            data: { user: { id: 'user-1' }, session: { id: 'session-1' } },
+          }),
+        });
+        // Keep realtime hooks real while preventing a WebSocket connection in this page test.
+        const realtime = app.container.resolve(realtimeClientToken);
+        vi.spyOn(realtime, 'watch').mockReturnValue({ close: vi.fn() });
+        vi.spyOn(realtime, 'subscribe').mockReturnValue(vi.fn());
+        vi.spyOn(realtime, 'onOpen').mockReturnValue(vi.fn());
+      },
+    },
+  );
+}
+
+it("lists the plugin's messages as notifications and marks one read when it is opened", async () => {
+  await renderInbox();
+  expect(
+    await screen.findByRole('heading', { name: /Notifications/u }),
+  ).toBeInTheDocument();
+  expect(screen.getByText('Backup finished')).toBeInTheDocument();
+  // The first message is shown, and opening it marks it read.
+  expect(
+    screen.getByRole('heading', { name: 'Weekly report is ready', level: 2 }),
+  ).toBeInTheDocument();
+  fireEvent.click(screen.getAllByText('Weekly report is ready')[0]!);
+  await waitFor(() =>
+    expect(api).toHaveBeenCalledWith({
+      path: 'notificationInApp/messages/m1/markRead',
+      method: 'POST',
+    }),
+  );
+});

package/tests/{components → client}/permission-management-tabs.test.tsx

@@ -1,34 +1,24 @@
-import { renderWithApp } from '@nocobase/app-testing/client';
+import { renderAuthenticatedClient } from '../helpers/authenticated-client.js';
 import { screen, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { Route, Routes, useLocation } from 'react-router';
-import { beforeEach, expect, it, vi } from 'vitest';
+import { expect, it } from 'vitest';
 import { PermissionManagementPage } from '../../client/pages/settings/permission-management-page.js';
-import enUS from '../../client/locales/en-US.js';
-import zhCN from '../../client/locales/zh-CN.js';
-const access = vi.hoisted(() => ({ roles: true, defaults: true }));
-vi.mock('@nocobase/app-plugin-authorization/client', async (original) => ({
-  ...(await original<
-    typeof import('@nocobase/app-plugin-authorization/client')
-  >()),
-  useCan: ({ resource }: { resource: { id: string } }) => ({
-    can:
-      resource.id === 'authorization.permission-sets'
-        ? access.roles
-        : access.defaults,
-  }),
-}));
-const namespace = '@nocobase/permission-tabs-test';
-const namespaces = {
-  [namespace]: {
-    'en-US': async () => ({ default: enUS }),
-    'zh-CN': async () => ({ default: zhCN }),
-  },
-};
-beforeEach(() => {
-  access.roles = true;
-  access.defaults = true;
-});
+
+function mount(prefix: string, tab = 'roles', roles = true, locale = 'en-US') {
+  return renderAuthenticatedClient(tree(prefix), {
+    route: `${prefix}/${tab}`,
+    locale,
+    member: true,
+    grants: [
+      'authorization.default-access',
+      ...(roles ? ['authorization.permission-sets'] : []),
+    ].map((id) => ({
+      resource: { type: 'settings', id },
+      actions: [{ action: 'read' }],
+    })),
+  });
+}
 function Content({ tab }: { tab: 'roles' | 'default-access' }) {
   const location = useLocation();
   return (
@@ -55,11 +45,8 @@ it.each(['', '/settings'])(
   'uses two URL-backed tabs under one heading, preserves the existing %s route prefix and keyboard focus',
   async (prefix) => {
     const user = userEvent.setup();
-    await renderWithApp(tree(prefix), {
-      route: `${prefix}/roles`,
-      namespace,
-      namespaces,
-    });
+    await mount(prefix);
+    await screen.findByRole('tab', { name: 'Roles and permissions' });
     expect(
       screen.getByRole('heading', { name: 'Permission management' }),
     ).toBeVisible();
@@ -99,12 +86,8 @@ it.each(['', '/settings'])(
   },
 );
 it('hides an unreadable tab while keeping direct navigation on the readable default scope page', async () => {
-  access.roles = false;
-  await renderWithApp(tree(''), {
-    route: '/default-access',
-    namespace,
-    namespaces,
-  });
+  await mount('', 'default-access', false);
+  await screen.findByRole('tab', { name: 'Default data scopes' });
   expect(
     screen.queryByRole('tab', { name: 'Roles and permissions' }),
   ).not.toBeInTheDocument();
@@ -116,12 +99,8 @@ it('hides an unreadable tab while keeping direct navigation on the readable defa
   );
 });
 it('uses the agreed Chinese menu and tab names', async () => {
-  await renderWithApp(tree(''), {
-    route: '/roles',
-    namespace,
-    namespaces,
-    locale: 'zh-CN',
-  });
+  await mount('', 'roles', true, 'zh-CN');
+  await screen.findByRole('tab', { name: '角色与权限' });
   expect(screen.getByRole('heading', { name: '权限管理' })).toBeVisible();
   expect(screen.getByRole('tab', { name: '角色与权限' })).toBeVisible();
   expect(screen.getByRole('tab', { name: '默认数据范围' })).toBeVisible();

package/tests/client/sidebar-permissions.test.tsx

@@ -0,0 +1,157 @@
+import {
+  createAppSidebarPreferenceStore,
+  SidebarPreferenceProvider,
+} from '../../client/layouts/use-sidebar-preference.js';
+import type { AppClientRegisteredRoute } from '@nocobase/app-client/plugins';
+import { act, screen, waitFor } from '@testing-library/react';
+import { apiClientToken } from '@nocobase/app-client';
+import {
+  AuthorizationClient,
+  authorizationClientToken,
+  type AuthorizationSnapshot,
+} from '@nocobase/app-plugin-authorization/client';
+import { answerApi, renderWithApp } from '@nocobase/app-testing/client';
+import packageMetadata from '../../package.json' with { type: 'json' };
+import enUS from '../../client/locales/en-US.js';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  useRouteNavigation,
+  routeKey,
+} from '../../client/routing/route-navigation';
+import { NavigationMenu } from '../../client/layouts/components/navigation-menu';
+import { AppSidebarProvider } from '../../client/layouts/components/app-sidebar';
+
+const sidebarPreference = createAppSidebarPreferenceStore('/main');
+
+beforeEach(() => {
+  localStorage.clear();
+  vi.stubGlobal('matchMedia', () => ({
+    matches: false,
+    addEventListener: vi.fn(),
+    removeEventListener: vi.fn(),
+  }));
+});
+afterEach(() => vi.unstubAllGlobals());
+function page(name: string): AppClientRegisteredRoute {
+  return {
+    id: name,
+    name,
+    path: `/${name}`,
+    packageName: 'test',
+    source: 'application',
+    auth: 'required',
+    authz: { resource: { type: 'page', id: name }, action: 'access' },
+    navigation: { title: name },
+    componentLoader: async () => ({ default: () => null }),
+  };
+}
+const visible = page('Allowed');
+const hidden = page('Denied');
+const routes: AppClientRegisteredRoute[] = [
+  { ...page('Group'), componentLoader: undefined, children: [visible, hidden] },
+  { ...page('Empty'), componentLoader: undefined, children: [hidden] },
+];
+function Menu() {
+  const { items, loading } = useRouteNavigation(routes);
+  return (
+    <section aria-label='Permission status' aria-busy={loading}>
+      <NavigationMenu
+        items={items}
+        label='Navigation'
+        selectedKey={routeKey(visible)}
+      />
+    </section>
+  );
+}
+describe.each(['expanded', 'collapsed', 'mobile'])(
+  'permissions in %s navigation',
+  (mode) => {
+    it('hides pending and denied entries, removes empty groups, and refreshes open menus', async () => {
+      if (mode === 'mobile') vi.stubGlobal('innerWidth', 390);
+      if (mode === 'collapsed')
+        localStorage.setItem('nocobase:sidebar:collapsed:app:/main', 'true');
+      const response = Promise.withResolvers<{ data: AuthorizationSnapshot }>();
+      let permissions: AuthorizationSnapshot = {
+        unrestricted: false,
+        permissions: [],
+      };
+      let pending = true;
+      const { app } = await renderWithApp(
+        <SidebarPreferenceProvider value={sidebarPreference}>
+          <AppSidebarProvider>
+            <Menu />
+          </AppSidebarProvider>
+        </SidebarPreferenceProvider>,
+        {
+          namespace: packageMetadata.name,
+          namespaces: {
+            [packageMetadata.name]: enUS,
+            test: {
+              Allowed: 'Allowed',
+              Denied: 'Denied',
+              Group: 'Group',
+              Empty: 'Empty',
+            },
+          },
+          fetch: answerApi(({ path }) =>
+            path === 'authorization/permissions'
+              ? pending
+                ? response.promise
+                : { data: permissions }
+              : new Response(null, { status: 404 }),
+          ),
+          services: (app) => {
+            app.container.singleton(
+              authorizationClientToken,
+              (resolver) =>
+                new AuthorizationClient(resolver.resolve(apiClientToken)),
+            );
+          },
+        },
+      );
+      expect(screen.queryByText('Group')).not.toBeInTheDocument();
+      await act(async () => {
+        permissions = {
+          unrestricted: false,
+          permissions: [
+            { resource: { type: 'page', id: 'Allowed' }, actions: ['access'] },
+          ],
+        };
+        pending = false;
+        response.resolve({ data: permissions });
+      });
+      // Group is a section: its entries show in every mode, as icons in the collapsed sidebar.
+      expect(
+        await screen.findByRole('link', { name: 'Allowed' }),
+      ).toHaveAttribute('href', '/Allowed');
+      expect(screen.queryByText('Denied')).not.toBeInTheDocument();
+      expect(screen.queryByText('Empty')).not.toBeInTheDocument();
+      const allowedPermissions = permissions;
+      await act(async () => {
+        permissions = { unrestricted: false, permissions: [] };
+        const authorization = app.container.resolve(authorizationClientToken);
+        authorization.invalidate();
+        await authorization.snapshot();
+      });
+      await waitFor(() =>
+        expect(
+          screen.getByRole('region', { name: 'Permission status' }),
+        ).toHaveAttribute('aria-busy', 'false'),
+      );
+      expect(screen.queryByText('Group')).not.toBeInTheDocument();
+      expect(
+        screen.queryByRole('link', { name: 'Allowed' }),
+      ).not.toBeInTheDocument();
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+      await act(async () => {
+        permissions = allowedPermissions;
+        const authorization = app.container.resolve(authorizationClientToken);
+        authorization.invalidate();
+        await authorization.snapshot();
+      });
+      expect(
+        await screen.findByRole('link', { name: 'Allowed' }),
+      ).toBeVisible();
+    });
+  },
+);

package/tests/{logic → client}/theme-tokens.test.ts

@@ -1,14 +1,12 @@
-// @vitest-environment node
-
+import path from 'node:path';
 import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
 import tailwind from '@tailwindcss/postcss';
 import postcss, { type Root } from 'postcss';
 import { beforeAll, describe, expect, it } from 'vitest';
 
 import { themePresets } from '../../client/theme/theme-presets';
 
-const appRoot = fileURLToPath(new URL('../..', import.meta.url));
+const appRoot = path.resolve(import.meta.dirname, '../..');
 const sizes = [
   'xs',
   'sm',
@@ -92,7 +90,7 @@ describe('theme token contract', () => {
     const readPreset = (id: string) =>
       postcss.parse(
         readFileSync(
-          new URL(`../../client/theme/themes/${id}.css`, import.meta.url),
+          path.join(appRoot, `client/theme/themes/${id}.css`),
           'utf8',
         ),
       );
@@ -129,7 +127,7 @@ describe('theme token contract', () => {
     it(`${id} defines complete tokens for the page and isolated previews`, () => {
       const root = postcss.parse(
         readFileSync(
-          new URL(`../../client/theme/themes/${id}.css`, import.meta.url),
+          path.join(appRoot, `client/theme/themes/${id}.css`),
           'utf8',
         ),
       );
@@ -170,13 +168,13 @@ describe('compiled theme utilities', () => {
       'stroke-chart-5',
     ];
     const source = readFileSync(
-      new URL('../../client/styles.css', import.meta.url),
+      path.join(appRoot, 'client/styles.css'),
       'utf8',
     );
     const result = await postcss([
       tailwind({ base: appRoot, optimize: false }),
     ]).process(source + `\n@source inline("${candidates.join(' ')}");`, {
-      from: fileURLToPath(new URL('../../client/styles.css', import.meta.url)),
+      from: path.join(appRoot, 'client/styles.css'),
     });
     compiled = result.root;
   }, 30_000);

package/tests/client/user-menu-sign-out.test.tsx

@@ -0,0 +1,78 @@
+import { act, fireEvent, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it } from 'vitest';
+import { UserMenu } from '../../client/layouts/components/user-menu.tsx';
+import { renderAuthenticatedClient } from '../helpers/authenticated-client.js';
+
+async function openAccountMenu(): Promise<void> {
+  act(() => screen.getByRole('button', { name: 'Open account menu' }).focus());
+  await userEvent.keyboard('{Enter}');
+}
+async function signOutFromMenu() {
+  await openAccountMenu();
+  fireEvent.click(await screen.findByRole('menuitem', { name: 'Sign out' }));
+}
+
+describe('account menu sign out', () => {
+  it('ends the server session and refreshes the displayed identity', async () => {
+    const view = await renderAuthenticatedClient(<UserMenu />);
+    await signOutFromMenu();
+    await waitFor(() => expect(view.identity().session).toBeNull());
+    expect(
+      await (await view.session.fetch('/auth/get-session')).json(),
+    ).toBeNull();
+    expect(view.toasts()).toHaveLength(0);
+    await openAccountMenu();
+    expect(screen.queryByText(view.session.user.email)).not.toBeInTheDocument();
+  });
+  it('reports a rejected origin without pretending the session ended', async () => {
+    const view = await renderAuthenticatedClient(<UserMenu />, {
+      beforeRequest(request) {
+        // Exercise the real origin guard and error resolver, not a fabricated authentication result.
+        if (request.url.endsWith('/sign-out'))
+          request.headers.set('origin', 'https://untrusted.example');
+      },
+    });
+    await signOutFromMenu();
+    await waitFor(() => expect(view.toasts()).toHaveLength(1));
+    expect(view.toasts()[0]).toMatchObject({
+      type: 'error',
+      title: expect.stringContaining('This origin is not trusted.'),
+    });
+    expect(view.identity().session?.user.id).toBe(view.session.user.id);
+    expect(
+      await (await view.session.fetch('/auth/get-session')).json(),
+    ).toMatchObject({ user: { id: view.session.user.id } });
+    await openAccountMenu();
+    expect(
+      await screen.findByRole('menuitem', { name: 'Sign out' }),
+    ).not.toHaveAttribute('aria-disabled', 'true');
+  });
+  it('reports a network failure and successfully retries sign-out', async () => {
+    let offline = true;
+    const view = await renderAuthenticatedClient(<UserMenu />, {
+      beforeRequest(request) {
+        // Network loss cannot be produced by the in-process server.
+        if (offline && request.url.endsWith('/sign-out'))
+          throw new TypeError('Failed to fetch');
+      },
+    });
+    await signOutFromMenu();
+    await waitFor(() => expect(view.toasts()).toHaveLength(1));
+    expect(view.toasts()[0]).toMatchObject({
+      type: 'error',
+      title: 'Could not reach the server. Check your connection and try again.',
+    });
+    expect(view.identity().session?.user.id).toBe(view.session.user.id);
+    expect(
+      await (await view.session.fetch('/auth/get-session')).json(),
+    ).toMatchObject({ user: { id: view.session.user.id } });
+    offline = false;
+    await signOutFromMenu();
+    await waitFor(() => expect(view.identity().session).toBeNull());
+    expect(
+      await (await view.session.fetch('/auth/get-session')).json(),
+    ).toBeNull();
+    expect(view.toasts()).toHaveLength(1);
+  });
+});

package/tests/{logic → database}/device-code-migration.test.ts

@@ -1,4 +1,3 @@
-// @vitest-environment node
 import path from 'node:path';
 import type { MigrationSource } from '@nocobase/db';
 import { describeMigration } from '@nocobase/app-testing/server';