@nocobase/app-template-default 1.0.0-beta.79 → 1.0.0-beta.80

package/tests/helpers/authenticated-client.tsx

@@ -0,0 +1,148 @@
+import type { ReactElement } from 'react';
+import { CookieJar } from 'jsdom';
+import { onTestFinished, vi } from 'vitest';
+import { act, waitFor } from '@testing-library/react';
+import { createTestApp, type TestApp } from '@nocobase/app-testing/server';
+import { renderWithApp } from '@nocobase/app-testing/client';
+import authorization from '@nocobase/app-plugin-authorization/client/plugin';
+import { authorizationToken } from '@nocobase/app-plugin-authorization/server';
+import type { PermissionGrant } from '@nocobase/authorization/core';
+import authentication from '@nocobase/app-plugin-authentication/client/plugin';
+import { useAuthentication } from '@nocobase/app-plugin-authentication/client';
+import {
+  signIn,
+  DEFAULT_ADMIN_CREDENTIALS,
+  type TestSession,
+  type SignInCredentials,
+} from '@nocobase/app-plugin-authentication/testing';
+import { createStandaloneServer } from '../../server/standalone.js';
+import packageMetadata from '../../package.json' with { type: 'json' };
+import enUS from '../../client/locales/en-US.js';
+import zhCN from '../../client/locales/zh-CN.js';
+
+/** Real application, authentication and cookies; only deliberate transport failures are injected by the caller. */
+export async function renderAuthenticatedClient(
+  ui: ReactElement,
+  options: {
+    member?: boolean;
+    grants?: readonly PermissionGrant[];
+    route?: string;
+    locale?: string;
+    prepare?: (server: TestApp, session: TestSession) => Promise<void>;
+    namespaces?: NonNullable<Parameters<typeof renderWithApp>[1]>['namespaces'];
+    beforeRequest?: (request: Request) => void | Promise<void>;
+    afterResponse?: (
+      request: Request,
+      response: Response,
+    ) => void | Promise<void>;
+  } = {},
+) {
+  const server = await createTestApp({
+    createServer: createStandaloneServer,
+    connections: ['main'],
+    config: {
+      logging: { enabled: false },
+      app: { publicOrigin: 'http://localhost' },
+      auth: {
+        secret: 'test-auth-secret-at-least-32-characters',
+        emailAndPassword: { disableSignUp: false },
+        advanced: { disableOriginCheck: false, disableCSRFCheck: false },
+      },
+    },
+  });
+  onTestFinished(() => server.close());
+  const member = {
+    name: 'Test member',
+    email: 'member@example.test',
+    password: 'test-member-password',
+  };
+  if (options.member) {
+    const response = await server.request('/auth/sign-up/email', {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        origin: 'http://localhost',
+      },
+      body: JSON.stringify(member),
+    });
+    if (!response.ok)
+      throw new Error(`Member registration failed: ${await response.text()}`);
+  }
+  const session = await signIn(
+    server,
+    options.member ? member : DEFAULT_ADMIN_CREDENTIALS,
+  );
+  if (options.grants) {
+    const authz = server.application.container.resolve(authorizationToken);
+    await authz.permissionSets.create({
+      key: 'test-access',
+      grants: options.grants,
+    });
+    await authz.permissionSets.assign({
+      id: 'test-assignment',
+      permissionSet: 'test-access',
+      subject: { type: 'user', id: session.user.id },
+    });
+  }
+  await options.prepare?.(server, session);
+  const jar = new CookieJar();
+  const root = `http://localhost${server.publicBasePath.replace(/\/$/u, '')}`;
+  for (const cookie of session.cookie.split('; ')) {
+    await jar.setCookie(`${cookie}; Path=/`, root);
+  }
+  const fetch: typeof globalThis.fetch = async (input, init) => {
+    const request = new Request(input, init);
+    request.headers.set('cookie', await jar.getCookieString(request.url));
+    request.headers.set('origin', 'http://localhost');
+    await options.beforeRequest?.(request);
+    const response = await server.fetch(request);
+    for (const cookie of response.headers.getSetCookie()) {
+      await jar.setCookie(cookie, request.url);
+    }
+    await options.afterResponse?.(request, response);
+    return response;
+  };
+  // Better Auth uses fetch directly; route it to the real in-process server with browser cookie handling.
+  vi.stubGlobal('fetch', fetch);
+  onTestFinished(() => {
+    vi.unstubAllGlobals();
+  });
+  let identity: ReturnType<typeof useAuthentication> | undefined;
+  function SessionObserver() {
+    identity = useAuthentication();
+    return ui;
+  }
+  const view = await renderWithApp(<SessionObserver />, {
+    plugins: [authentication(), authorization()],
+    namespace: packageMetadata.name,
+    namespaces: {
+      ...options.namespaces,
+      [packageMetadata.name]: {
+        'en-US': async () => ({ default: enUS }),
+        'zh-CN': async () => ({ default: zhCN }),
+      },
+    },
+    ...(options.route ? { route: options.route } : {}),
+    ...(options.locale ? { locale: options.locale } : {}),
+    server: { publicBasePath: server.publicBasePath, fetch },
+  });
+  await waitFor(() => {
+    if (identity?.isPending || identity?.session?.user.id !== session.user.id) {
+      throw new Error('The signed-in session has not reached the client.');
+    }
+  });
+  return {
+    ...view,
+    server,
+    session,
+    identity: () => identity!,
+    async signInAs(credentials: SignInCredentials) {
+      const next = await signIn(server, credentials);
+      await jar.removeAllCookies();
+      for (const cookie of next.cookie.split('; '))
+        await jar.setCookie(`${cookie}; Path=/`, root);
+      await act(() => identity!.refresh());
+      return next;
+    },
+  };
+}

package/tests/{logic → project}/agents-md.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';

package/tests/{logic → project}/asset-url-build.test.ts

@@ -1,4 +1,3 @@
-// @vitest-environment node
 import {
   copyFile,
   mkdtemp,

package/tests/{logic → project}/config-example.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 
 import os from 'node:os';

package/tests/{logic → project}/dev-client-watch.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import {
   copyFile,
   mkdir,

package/tests/{logic → project}/plugin-commands.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 // Users develop, build and start their app through these scripts. Nothing at runtime depends on them, so dropping or
 // renaming one — a bad merge resolution did exactly that once — breaks the documented development steps silently: the app still
 // builds, starts, and passes every other test. These assertions are the alarm.

package/tests/{logic → project}/server-imports.test.ts

@@ -1,4 +1,3 @@
-// @vitest-environment node
 import { execFile } from 'node:child_process';
 import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';

package/tests/{logic → project}/tailwind-sources.test.ts

@@ -1,5 +1,4 @@
 import clientPlugins from '../../client/plugins.js';
-// @vitest-environment node
 
 import {
   existsSync,

package/tests/{logic → project}/template-package-name.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';

package/tests/{logic → server}/app-server.test.ts

@@ -1,6 +1,5 @@
 import { createApp } from '../../server/app.js';
 import authConfig from '../../server/config/auth.js';
-// @vitest-environment node
 
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import {

package/tests/{logic → server}/authorization-assignment-safety.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { expect, it } from 'vitest';
 import { createAppTest } from '@nocobase/app-testing/server';
 import { createStandaloneServer } from '../../server/standalone.js';

package/tests/{logic → server}/config.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { fileURLToPath } from 'node:url';
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';

package/tests/{logic → server}/session-isolation.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';

package/tests/setup/application-environment.ts

@@ -0,0 +1,8 @@
+import { builtinEnvironments, type Environment } from 'vitest/runtime';
+
+// Render in jsdom while loading the in-process application's Node workers as server modules.
+export default {
+  ...builtinEnvironments.jsdom,
+  name: 'application',
+  viteEnvironment: 'ssr',
+} satisfies Environment;

package/tests/setup/client-config.ts

@@ -8,8 +8,6 @@ const RUNTIME_CONFIG_ELEMENT_ID = 'nocobase-runtime-config';
  * at `/main`. A test that needs other values removes it and renders its own.
  */
 function renderClientConfig(): void {
-  // Server-side tests run under `@vitest-environment node`, where there is no page to render into.
-  if (typeof document === 'undefined') return;
   if (document.getElementById(RUNTIME_CONFIG_ELEMENT_ID)) return;
   const element = document.createElement('script');
   element.id = RUNTIME_CONFIG_ELEMENT_ID;

package/vitest.config.ts

@@ -1,34 +1,49 @@
 import { fileURLToPath } from 'node:url';
 
+import { createNodeVitestConfig } from '@nocobase/dev-config/vitest/node';
 import { createReactVitestConfig } from '@nocobase/dev-config/vitest/react';
+import { defineConfig } from 'vitest/config';
 
 const root = fileURLToPath(new URL('.', import.meta.url));
 
-export default createReactVitestConfig({
+export default defineConfig({
   test: {
     root,
-    server: {
-      deps: {
-        // Transform the public Client surfaces so vi.mock applies, without duplicating the Server packages' identity tokens.
-        inline: [
-          // The published fixture mounts MemoryRouter; transform it with the page to share the router context.
-          /@nocobase\/app-testing\/(?:dist\/)?src\/client\//u,
-          // AppClientProviders includes the navigation guard and must use that same router context.
-          /@nocobase\/app-client\//u,
-          // Client plugins in every scope, including @acme/app-plugin-*, must share the transformed runtime.
-          // Keep server/shared modules external so their service identities remain unchanged.
-          /@[^/]+\/app-plugin-[^/]+\/(?:dist\/)?client\//u,
-        ],
-      },
-    },
-    // A glob rather than a list of filenames. The list had to be edited by hand for every test added or removed and
-    // silently drifted: it named a file that no longer existed while several real test files were absent from it, so
-    // those tests were never run at all.
-    include: ['tests/**/*.test.{ts,tsx}'],
-    // Playwright runs tests/playwright/ against a built application; its files are named *.test.ts too.
-    exclude: ['tests/playwright/**'],
-    setupFiles: ['./tests/setup/client-config.ts'],
-    // Keep the command usable if an application intentionally removes all scaffold tests before adding its own.
+    projects: [
+      createNodeVitestConfig({
+        test: {
+          root,
+          name: 'node',
+          include: ['tests/{server,database,cli,project}/**/*.test.{ts,tsx}'],
+          // Database fixtures and command output capture run one file at a time.
+          fileParallelism: false,
+        },
+      }),
+      createReactVitestConfig({
+        test: {
+          root,
+          name: 'client',
+          environment: './tests/setup/application-environment.ts',
+          // Client integration tests also start isolated application databases.
+          fileParallelism: false,
+          include: ['tests/client/**/*.test.{ts,tsx}'],
+          setupFiles: ['./tests/setup/client-config.ts'],
+          server: {
+            deps: {
+              // Keep the fixture, application and plugin clients in the same React/router context.
+              // Server and shared modules stay external to preserve their service identities.
+              inline: [
+                /@nocobase\/app-testing\/(?:dist\/)?src\/client\//u,
+                /@nocobase\/app-client\//u,
+                /@[^/]+\/app-plugin-[^/]+\/(?:dist\/)?client\//u,
+              ],
+            },
+          },
+        },
+      }),
+    ],
+    // Only the directories above contain Vitest suites. Playwright has its own runner.
+    // Keep the command usable if an application intentionally removes all scaffold tests.
     passWithNoTests: true,
     coverage: {
       provider: 'v8',

package/tests/components/inbox.test.tsx

@@ -1,124 +0,0 @@
-import { fireEvent, render, screen, waitFor } from '@testing-library/react';
-import { I18nRuntime } from '@nocobase/i18n';
-import { I18nProvider } from '@nocobase/i18n/client';
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import type { ReactElement } from 'react';
-import { MemoryRouter } from 'react-router';
-import { beforeEach, expect, it, vi } from 'vitest';
-
-import locales from '../../client/locales/index.js';
-import { TooltipProvider } from '../../client/components/ui/tooltip';
-
-const mocks = vi.hoisted(() => ({
-  session: { user: { id: 'user-1' } } as { user: { id: string } } | null,
-  unread: 2,
-  request: vi.fn(),
-}));
-vi.mock('@nocobase/app-plugin-authentication/client', () => ({
-  useAuthentication: () => ({ session: mocks.session, isPending: false }),
-}));
-vi.mock('@nocobase/app-client', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@nocobase/app-client')>();
-  const client = { request: mocks.request };
-  const realtime = {
-    watch: () => ({ close: vi.fn() }),
-    subscribe: () => vi.fn(),
-    onOpen: () => vi.fn(),
-  };
-  return {
-    ...actual,
-    useApiClient: () => client,
-    useService: (token: unknown) =>
-      token === actual.realtimeClientToken ? realtime : client,
-  };
-});
-
-import InboxPage from '../../client/pages/inbox.tsx';
-
-const messages = [
-  {
-    id: 'm1',
-    deliveryId: 'd1',
-    notificationId: 'n1',
-    title: 'Weekly report is ready',
-    body: 'The sales report for week 40 is ready.',
-    createdAt: '2026-10-01T08:00:00.000Z',
-  },
-  {
-    id: 'm2',
-    deliveryId: 'd2',
-    notificationId: 'n2',
-    title: 'Backup finished',
-    body: 'All databases were backed up.',
-    readAt: '2026-10-01T09:00:00.000Z',
-    createdAt: '2026-10-01T07:00:00.000Z',
-  },
-];
-
-let runtime: I18nRuntime;
-beforeEach(async () => {
-  mocks.session = { user: { id: 'user-1' } };
-  mocks.unread = 2;
-  mocks.request.mockReset();
-  mocks.request.mockImplementation(
-    async ({ path }: { readonly path: string }) => {
-      if (path.endsWith('/unreadCount'))
-        return { data: { count: mocks.unread } };
-      if (path.startsWith('notificationInApp/messages?'))
-        return { data: messages, meta: {} };
-      return { data: { ...messages[0], readAt: '2026-10-01T10:00:00.000Z' } };
-    },
-  );
-  runtime = new I18nRuntime({
-    defaultLocale: 'en-US',
-    locales: ['en-US', 'zh-CN'],
-    applicationNamespace: 'test-app',
-  });
-  runtime.registerApplicationNamespace('test-app', locales);
-  await runtime.init('en-US');
-});
-
-function Frame({
-  children,
-  path,
-}: {
-  readonly children: ReactElement;
-  readonly path: string;
-}): ReactElement {
-  return (
-    <QueryClientProvider
-      client={
-        new QueryClient({ defaultOptions: { queries: { retry: false } } })
-      }
-    >
-      <MemoryRouter initialEntries={[path]}>
-        <I18nProvider runtime={runtime}>
-          <TooltipProvider>{children}</TooltipProvider>
-        </I18nProvider>
-      </MemoryRouter>
-    </QueryClientProvider>
-  );
-}
-
-it("lists the plugin's messages as notifications and marks one read when it is opened", async () => {
-  render(
-    <Frame path='/inbox'>
-      <InboxPage />
-    </Frame>,
-  );
-  expect(
-    await screen.findByRole('heading', { name: /Notifications/u }),
-  ).toBeInTheDocument();
-  expect(screen.getByText('Backup finished')).toBeInTheDocument();
-  // The first message is shown, and opening it marks it read.
-  expect(
-    screen.getByRole('heading', { name: 'Weekly report is ready', level: 2 }),
-  ).toBeInTheDocument();
-  fireEvent.click(screen.getAllByText('Weekly report is ready')[0]!);
-  await waitFor(() =>
-    expect(mocks.request).toHaveBeenCalledWith({
-      path: 'notificationInApp/messages/m1/markRead',
-      method: 'POST',
-    }),
-  );
-});

package/tests/components/sidebar-permissions.test.tsx

@@ -1,108 +0,0 @@
-import {
-  createAppSidebarPreferenceStore,
-  SidebarPreferenceProvider,
-} from '../../client/layouts/use-sidebar-preference.js';
-import type { AppClientRegisteredRoute } from '@nocobase/app-client/plugins';
-import { act, render, screen, waitFor } from '@testing-library/react';
-import { MemoryRouter } from 'react-router';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import {
-  useRouteNavigation,
-  routeKey,
-} from '../../client/routing/route-navigation';
-import { NavigationMenu } from '../../client/layouts/components/navigation-menu';
-import { AppSidebarProvider } from '../../client/layouts/components/app-sidebar';
-
-const sidebarPreference = createAppSidebarPreferenceStore('/main');
-
-const auth = vi.hoisted(() => ({ revision: 0, client: { can: vi.fn() } }));
-vi.mock('@nocobase/app-plugin-authorization/client', () => ({
-  useAuthorizationClient: () => auth.client,
-  useAuthorizationRevision: () => auth.revision,
-}));
-vi.mock('@nocobase/i18n/client', () => ({
-  useTranslation: () => ({ t: (key: string) => key }),
-}));
-beforeEach(() => {
-  auth.revision = 0;
-  localStorage.clear();
-  vi.stubGlobal('matchMedia', () => ({
-    matches: false,
-    addEventListener: vi.fn(),
-    removeEventListener: vi.fn(),
-  }));
-});
-afterEach(() => vi.unstubAllGlobals());
-function page(name: string): AppClientRegisteredRoute {
-  return {
-    id: name,
-    name,
-    path: `/${name}`,
-    packageName: 'test',
-    source: 'application',
-    auth: 'required',
-    authz: { resource: { type: 'page', id: name }, action: 'access' },
-    navigation: { title: name },
-    componentLoader: async () => ({ default: () => null }),
-  };
-}
-const visible = page('Allowed');
-const hidden = page('Denied');
-const routes: AppClientRegisteredRoute[] = [
-  { ...page('Group'), componentLoader: undefined, children: [visible, hidden] },
-  { ...page('Empty'), componentLoader: undefined, children: [hidden] },
-];
-function Menu() {
-  const { items } = useRouteNavigation(routes);
-  return (
-    <NavigationMenu
-      items={items}
-      label='Navigation'
-      selectedKey={routeKey(visible)}
-    />
-  );
-}
-describe.each(['expanded', 'collapsed', 'mobile'])(
-  'permissions in %s navigation',
-  (mode) => {
-    it('hides pending and denied entries, removes empty groups, and refreshes open menus', async () => {
-      if (mode === 'mobile') vi.stubGlobal('innerWidth', 390);
-      if (mode === 'collapsed')
-        localStorage.setItem('nocobase:sidebar:collapsed:app:/main', 'true');
-      const resolve: ((allowed: boolean) => void)[] = [];
-      auth.client.can.mockImplementation(
-        () => new Promise<boolean>((done) => resolve.push(done)),
-      );
-      const tree = () => (
-        <MemoryRouter>
-          <SidebarPreferenceProvider value={sidebarPreference}>
-            <AppSidebarProvider>
-              <Menu />
-            </AppSidebarProvider>
-          </SidebarPreferenceProvider>
-        </MemoryRouter>
-      );
-      const { rerender } = render(tree());
-      expect(screen.queryByText('Group')).not.toBeInTheDocument();
-      await act(async () => {
-        resolve.forEach((done, i) => done(i === 0));
-      });
-      // Group is a section: its entries show in every mode, as icons in the collapsed sidebar.
-      expect(
-        await screen.findByRole('link', { name: 'Allowed' }),
-      ).toHaveAttribute('href', '/Allowed');
-      expect(screen.queryByText('Denied')).not.toBeInTheDocument();
-      expect(screen.queryByText('Empty')).not.toBeInTheDocument();
-      auth.client.can.mockResolvedValue(false);
-      auth.revision++;
-      rerender(tree());
-      await waitFor(() =>
-        expect(screen.queryByText('Group')).not.toBeInTheDocument(),
-      );
-      expect(
-        screen.queryByRole('link', { name: 'Allowed' }),
-      ).not.toBeInTheDocument();
-      expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
-    });
-  },
-);