@nocobase/app-template-default 1.0.0-beta.79 → 1.0.0-beta.81

package/tests/helpers/authenticated-client.tsx

@@ -0,0 +1,148 @@
+import type { ReactElement } from 'react';
+import { CookieJar } from 'jsdom';
+import { onTestFinished, vi } from 'vitest';
+import { act, waitFor } from '@testing-library/react';
+import { createTestApp, type TestApp } from '@nocobase/app-testing/server';
+import { renderWithApp } from '@nocobase/app-testing/client';
+import authorization from '@nocobase/app-plugin-authorization/client/plugin';
+import { authorizationToken } from '@nocobase/app-plugin-authorization/server';
+import type { PermissionGrant } from '@nocobase/authorization/core';
+import authentication from '@nocobase/app-plugin-authentication/client/plugin';
+import { useAuthentication } from '@nocobase/app-plugin-authentication/client';
+import {
+  signIn,
+  DEFAULT_ADMIN_CREDENTIALS,
+  type TestSession,
+  type SignInCredentials,
+} from '@nocobase/app-plugin-authentication/testing';
+import { createStandaloneServer } from '../../server/standalone.js';
+import packageMetadata from '../../package.json' with { type: 'json' };
+import enUS from '../../client/locales/en-US.js';
+import zhCN from '../../client/locales/zh-CN.js';
+
+/** Real application, authentication and cookies; only deliberate transport failures are injected by the caller. */
+export async function renderAuthenticatedClient(
+  ui: ReactElement,
+  options: {
+    member?: boolean;
+    grants?: readonly PermissionGrant[];
+    route?: string;
+    locale?: string;
+    prepare?: (server: TestApp, session: TestSession) => Promise<void>;
+    namespaces?: NonNullable<Parameters<typeof renderWithApp>[1]>['namespaces'];
+    beforeRequest?: (request: Request) => void | Promise<void>;
+    afterResponse?: (
+      request: Request,
+      response: Response,
+    ) => void | Promise<void>;
+  } = {},
+) {
+  const server = await createTestApp({
+    createServer: createStandaloneServer,
+    connections: ['main'],
+    config: {
+      logging: { enabled: false },
+      app: { publicOrigin: 'http://localhost' },
+      auth: {
+        secret: 'test-auth-secret-at-least-32-characters',
+        emailAndPassword: { disableSignUp: false },
+        advanced: { disableOriginCheck: false, disableCSRFCheck: false },
+      },
+    },
+  });
+  onTestFinished(() => server.close());
+  const member = {
+    name: 'Test member',
+    email: 'member@example.test',
+    password: 'test-member-password',
+  };
+  if (options.member) {
+    const response = await server.request('/auth/sign-up/email', {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        origin: 'http://localhost',
+      },
+      body: JSON.stringify(member),
+    });
+    if (!response.ok)
+      throw new Error(`Member registration failed: ${await response.text()}`);
+  }
+  const session = await signIn(
+    server,
+    options.member ? member : DEFAULT_ADMIN_CREDENTIALS,
+  );
+  if (options.grants) {
+    const authz = server.application.container.resolve(authorizationToken);
+    await authz.permissionSets.create({
+      key: 'test-access',
+      grants: options.grants,
+    });
+    await authz.permissionSets.assign({
+      id: 'test-assignment',
+      permissionSet: 'test-access',
+      subject: { type: 'user', id: session.user.id },
+    });
+  }
+  await options.prepare?.(server, session);
+  const jar = new CookieJar();
+  const root = `http://localhost${server.publicBasePath.replace(/\/$/u, '')}`;
+  for (const cookie of session.cookie.split('; ')) {
+    await jar.setCookie(`${cookie}; Path=/`, root);
+  }
+  const fetch: typeof globalThis.fetch = async (input, init) => {
+    const request = new Request(input, init);
+    request.headers.set('cookie', await jar.getCookieString(request.url));
+    request.headers.set('origin', 'http://localhost');
+    await options.beforeRequest?.(request);
+    const response = await server.fetch(request);
+    for (const cookie of response.headers.getSetCookie()) {
+      await jar.setCookie(cookie, request.url);
+    }
+    await options.afterResponse?.(request, response);
+    return response;
+  };
+  // Better Auth uses fetch directly; route it to the real in-process server with browser cookie handling.
+  vi.stubGlobal('fetch', fetch);
+  onTestFinished(() => {
+    vi.unstubAllGlobals();
+  });
+  let identity: ReturnType<typeof useAuthentication> | undefined;
+  function SessionObserver() {
+    identity = useAuthentication();
+    return ui;
+  }
+  const view = await renderWithApp(<SessionObserver />, {
+    plugins: [authentication(), authorization()],
+    namespace: packageMetadata.name,
+    namespaces: {
+      ...options.namespaces,
+      [packageMetadata.name]: {
+        'en-US': async () => ({ default: enUS }),
+        'zh-CN': async () => ({ default: zhCN }),
+      },
+    },
+    ...(options.route ? { route: options.route } : {}),
+    ...(options.locale ? { locale: options.locale } : {}),
+    server: { publicBasePath: server.publicBasePath, fetch },
+  });
+  await waitFor(() => {
+    if (identity?.isPending || identity?.session?.user.id !== session.user.id) {
+      throw new Error('The signed-in session has not reached the client.');
+    }
+  });
+  return {
+    ...view,
+    server,
+    session,
+    identity: () => identity!,
+    async signInAs(credentials: SignInCredentials) {
+      const next = await signIn(server, credentials);
+      await jar.removeAllCookies();
+      for (const cookie of next.cookie.split('; '))
+        await jar.setCookie(`${cookie}; Path=/`, root);
+      await act(() => identity!.refresh());
+      return next;
+    },
+  };
+}

package/tests/{logic → project}/agents-md.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';

package/tests/{logic → project}/asset-url-build.test.ts

@@ -1,4 +1,3 @@
-// @vitest-environment node
 import {
   copyFile,
   mkdtemp,

package/tests/{logic → project}/config-example.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 
 import os from 'node:os';

package/tests/{logic → project}/dev-client-watch.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import {
   copyFile,
   mkdir,

package/tests/{logic → project}/plugin-commands.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 // Users develop, build and start their app through these scripts. Nothing at runtime depends on them, so dropping or
 // renaming one — a bad merge resolution did exactly that once — breaks the documented development steps silently: the app still
 // builds, starts, and passes every other test. These assertions are the alarm.

package/tests/{logic → project}/server-imports.test.ts

@@ -1,4 +1,3 @@
-// @vitest-environment node
 import { execFile } from 'node:child_process';
 import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';

package/tests/{logic → project}/tailwind-sources.test.ts

@@ -1,5 +1,4 @@
 import clientPlugins from '../../client/plugins.js';
-// @vitest-environment node
 
 import {
   existsSync,

package/tests/{logic → project}/template-package-name.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';

package/tests/{logic → server}/app-server.test.ts

@@ -1,6 +1,5 @@
 import { createApp } from '../../server/app.js';
 import authConfig from '../../server/config/auth.js';
-// @vitest-environment node
 
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import {

package/tests/{logic → server}/authorization-assignment-safety.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { expect, it } from 'vitest';
 import { createAppTest } from '@nocobase/app-testing/server';
 import { createStandaloneServer } from '../../server/standalone.js';
@@ -13,14 +11,7 @@ type Assignment = {
 function unexpectedGlobalAssignments(
   assignments: readonly Assignment[],
 ): Assignment[] {
-  return assignments.filter(
-    (assignment) =>
-      assignment.subjectId === '*' &&
-      !(
-        assignment.subjectType === 'authenticated' &&
-        assignment.permissionSetKey === 'member'
-      ),
-  );
+  return assignments.filter((assignment) => assignment.subjectId === '*');
 }
 
 const test = createAppTest({
@@ -78,5 +69,13 @@ it('detects wildcard recipients regardless of the role name, while preserving ex
       global,
       { ...global, subjectType: 'everyone' },
     ]),
-  ).toEqual([global, { ...global, subjectType: 'everyone' }]);
+  ).toEqual([
+    {
+      subjectType: 'authenticated',
+      subjectId: '*',
+      permissionSetKey: 'member',
+    },
+    global,
+    { ...global, subjectType: 'everyone' },
+  ]);
 });

package/tests/{logic → server}/config.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { fileURLToPath } from 'node:url';
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';

package/tests/server/member-role.test.ts

@@ -0,0 +1,299 @@
+// @vitest-environment node
+import { expect } from 'vitest';
+import { createAppTest } from '@nocobase/app-testing/server';
+import {
+  signIn,
+  DEFAULT_ADMIN_CREDENTIALS,
+} from '@nocobase/app-plugin-authentication/testing';
+import { userManagementServiceToken } from '@nocobase/app-plugin-users/server/tokens';
+import {
+  authenticationToken,
+  userAdministrationServiceToken,
+} from '@nocobase/app-plugin-authentication';
+import { authorizationToken } from '@nocobase/app-plugin-authorization';
+import { createStandaloneServer } from '../../server/standalone.js';
+
+const test = createAppTest({
+  createServer: createStandaloneServer,
+  config: {
+    app: { publicOrigin: 'http://localhost' },
+    auth: { secret: 'test-auth-secret-at-least-32-characters' },
+  },
+});
+const json = (body: unknown, method = 'POST') => ({
+  method,
+  headers: { 'content-type': 'application/json', origin: 'http://localhost' },
+  body: JSON.stringify(body),
+});
+
+test('saved roles control direct API access while account basics remain usable', async ({
+  testApp,
+  app,
+}) => {
+  const admin = await signIn(testApp, DEFAULT_ADMIN_CREDENTIALS);
+  const sets = app.container.resolve(authorizationToken).permissionSets;
+  const grants = [
+    { resource: { type: 'user', id: '*' }, actions: [{ action: 'read' }] },
+  ];
+  await sets.update('member', { key: 'member', grants });
+  await sets.create({ key: 'reader', grants });
+  const create = async (
+    name: string,
+    roleScopes?: Record<string, string[]>,
+  ) => {
+    const response = await admin.fetch(
+      '/users',
+      json({
+        name,
+        username: name,
+        email: `${name}@example.test`,
+        password: 'Member-test-123!',
+        ...(roleScopes === undefined ? {} : { roleScopes }),
+      }),
+    );
+    expect(response.status).toBe(201);
+    return (await response.json()).data;
+  };
+  const member = await create('membercase');
+  expect(member.roleScopes.app).toEqual(['member']);
+  expect((await create('emptycase', { app: [] })).roleScopes.app).toEqual([]);
+  expect(
+    (await create('replacecase', { app: ['reader'] })).roleScopes.app,
+  ).toEqual(['reader']);
+  expect(
+    (
+      await create('appendcase', { app: ['member', 'reader'] })
+    ).roleScopes.app.sort(),
+  ).toEqual(['member', 'reader']);
+  expect((await create('omittedscope', {})).roleScopes.app).toEqual(['member']);
+  let session = await signIn(testApp, {
+    username: 'membercase',
+    password: 'Member-test-123!',
+  });
+  expect((await session.fetch('/users')).status).toBe(200);
+  expect(
+    (
+      await admin.fetch(
+        `/users/${member.id}`,
+        json({ roleScopes: { app: [] } }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(200);
+  expect((await session.fetch('/users')).status).toBe(403);
+  expect(
+    (
+      await admin.fetch(
+        `/users/${member.id}`,
+        json({ name: 'Updated member' }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(200);
+  expect(
+    (await (await admin.fetch(`/users/${member.id}`)).json()).data.roleScopes
+      .app,
+  ).toEqual([]);
+  session = await signIn(testApp, {
+    username: 'membercase',
+    password: 'Member-test-123!',
+  });
+  expect((await session.fetch('/users')).status).toBe(403);
+  expect((await session.fetch('/users/me/preferences')).status).toBe(200);
+  expect(
+    (
+      await session.fetch(
+        `/users/${member.id}`,
+        json({ roleScopes: { app: ['root'] } }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(403);
+  expect(
+    (
+      await session.fetch(
+        `/users/${admin.user.id}`,
+        json({ name: 'Forbidden' }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(403);
+  expect(
+    (
+      await session.fetch(
+        '/auth/change-password',
+        json({
+          currentPassword: 'Member-test-123!',
+          newPassword: 'Changed-test-123!',
+        }),
+      )
+    ).status,
+  ).toBe(200);
+  expect((await session.fetch('/auth/sign-out', json({}))).status).toBe(200);
+  session = await signIn(testApp, {
+    username: 'membercase',
+    password: 'Changed-test-123!',
+  });
+  expect((await session.fetch('/users')).status).toBe(403);
+  expect(
+    (
+      await admin.fetch(
+        `/users/${member.id}`,
+        json({ roleScopes: { app: ['reader'] } }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(200);
+  expect((await session.fetch('/users')).status).toBe(200);
+  const protectedRole = await admin.fetch(
+    `/users/${member.id}`,
+    json({ roleScopes: { app: ['root'] } }, 'PATCH'),
+  );
+  expect(protectedRole.status).toBe(400);
+  expect((await protectedRole.json()).error.reason).toBe(
+    'PROTECTED_ROLE_ASSIGNMENT',
+  );
+  await expect(
+    sets.assign({
+      subject: { type: 'authenticated', id: '*' },
+      permissionSet: 'member',
+    }),
+  ).rejects.toThrow();
+});
+
+test('registration and trusted external identity creation receive defaults atomically', async ({
+  testApp,
+  app,
+  connection,
+}) => {
+  const response = await testApp.request(
+    '/auth/sign-up/email',
+    json({
+      name: 'Signup',
+      email: 'signup@example.test',
+      password: 'Signup-test-123!',
+      roleScopes: { app: ['root'] },
+    }),
+  );
+  expect(response.status).toBe(200);
+  const registered = (await response.json()).user;
+  const roles = async (id: string) =>
+    (
+      await connection.query
+        .selectFrom('authorizationPermissionSetAssignments')
+        .select('permissionSetKey')
+        .where('subjectType', '=', 'user')
+        .where('subjectId', '=', id)
+        .execute()
+    ).map((r) => r.permissionSetKey);
+  expect(await roles(registered.id)).toEqual(['member']);
+  const auth = app.container.resolve(authenticationToken);
+  const context = await auth.administrationContext();
+  const external = await context.internalAdapter.createUser({
+    name: 'External',
+    email: 'external@example.test',
+    emailVerified: true,
+  });
+  expect(await roles(external.id)).toEqual(['member']);
+  const service = await app.container
+    .resolve(userAdministrationServiceToken)
+    .createServiceAccount({ name: 'Service verification' });
+  expect(await roles(service.id)).toEqual([]);
+  const remove = auth.addUserInitializer(async () => {
+    throw new Error('Synthetic initialization failure');
+  });
+  try {
+    await expect(
+      context.internalAdapter.createUser({
+        name: 'Failed',
+        email: 'failed@example.test',
+        emailVerified: true,
+      }),
+    ).rejects.toThrow('Synthetic initialization failure');
+    expect(
+      await connection.query
+        .selectFrom('user')
+        .select('id')
+        .where('email', '=', 'failed@example.test')
+        .execute(),
+    ).toEqual([]);
+  } finally {
+    remove();
+  }
+});
+
+test('invitations preserve explicit empty roles and existing account decisions', async ({
+  testApp,
+  app,
+}) => {
+  const admin = await signIn(testApp, DEFAULT_ADMIN_CREDENTIALS);
+  const users = app.container.resolve(userManagementServiceToken);
+  await app.container.resolve(authorizationToken).permissionSets.create({
+    key: 'invitation-reader',
+    grants: [],
+  });
+  for (const [name, scopes, expected] of [
+    ['invite-default', undefined, ['member']],
+    ['invite-empty', { app: [] }, []],
+    ['invite-replace', { app: ['invitation-reader'] }, ['invitation-reader']],
+  ] as const) {
+    const [invitation] = await users.invite({
+      emails: [`${name}@example.test`],
+      invitedBy: admin.user.id,
+      origin: 'http://localhost',
+      sendEmail: false,
+      ...(scopes ? { roleScopes: scopes } : {}),
+    });
+    const token = invitation.inviteUrl!.split('/').at(-1)!;
+    const accepted = await users.acceptInvitation({
+      token,
+      name,
+      password: 'Invite-test-123!',
+    });
+    expect((await users.get(accepted.userId)).roleScopes.app).toEqual(expected);
+    await expect(
+      users.acceptInvitation({ token, name, password: 'Invite-test-123!' }),
+    ).rejects.toThrow();
+    await users.update(accepted.userId, { roleScopes: { app: [] } });
+    const [again] = await users.invite({
+      emails: [`${name}@example.test`],
+      invitedBy: admin.user.id,
+      origin: 'http://localhost',
+      sendEmail: false,
+    });
+    expect(again.outcome).toBe('existingUser');
+    expect((await users.get(accepted.userId)).roleScopes.app).toEqual([]);
+  }
+  const [pending] = await users.invite({
+    emails: ['preaccepted@example.test'],
+    invitedBy: admin.user.id,
+    origin: 'http://localhost',
+    sendEmail: false,
+  });
+  const existing = await users.create({
+    name: 'Existing',
+    email: 'preaccepted@example.test',
+    password: 'Existing-test-123!',
+    roleScopes: { app: [] },
+  });
+  await users.acceptInvitation(
+    {
+      token: pending.inviteUrl!.split('/').at(-1)!,
+      name: 'Existing',
+      password: 'Existing-test-123!',
+    },
+    existing.id,
+  );
+  expect((await users.get(existing.id)).roleScopes.app).toEqual([]);
+  const created = await Promise.all(
+    Array.from({ length: 4 }, (_, index) =>
+      users.create({
+        name: `Concurrent ${index}`,
+        email: `concurrent-${index}@example.test`,
+        password: 'Concurrent-test-123!',
+        ...(index % 2 ? { roleScopes: { app: [] } } : {}),
+      }),
+    ),
+  );
+  expect(created.map((user) => user.roleScopes.app)).toEqual([
+    ['member'],
+    [],
+    ['member'],
+    [],
+  ]);
+});

package/tests/{logic → server}/session-isolation.test.ts

@@ -1,5 +1,3 @@
-// @vitest-environment node
-
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';

package/tests/setup/application-environment.ts

@@ -0,0 +1,8 @@
+import { builtinEnvironments, type Environment } from 'vitest/runtime';
+
+// Render in jsdom while loading the in-process application's Node workers as server modules.
+export default {
+  ...builtinEnvironments.jsdom,
+  name: 'application',
+  viteEnvironment: 'ssr',
+} satisfies Environment;

package/tests/setup/client-config.ts

@@ -8,8 +8,6 @@ const RUNTIME_CONFIG_ELEMENT_ID = 'nocobase-runtime-config';
  * at `/main`. A test that needs other values removes it and renders its own.
  */
 function renderClientConfig(): void {
-  // Server-side tests run under `@vitest-environment node`, where there is no page to render into.
-  if (typeof document === 'undefined') return;
   if (document.getElementById(RUNTIME_CONFIG_ELEMENT_ID)) return;
   const element = document.createElement('script');
   element.id = RUNTIME_CONFIG_ELEMENT_ID;

package/vitest.config.ts

@@ -1,34 +1,49 @@
 import { fileURLToPath } from 'node:url';
 
+import { createNodeVitestConfig } from '@nocobase/dev-config/vitest/node';
 import { createReactVitestConfig } from '@nocobase/dev-config/vitest/react';
+import { defineConfig } from 'vitest/config';
 
 const root = fileURLToPath(new URL('.', import.meta.url));
 
-export default createReactVitestConfig({
+export default defineConfig({
   test: {
     root,
-    server: {
-      deps: {
-        // Transform the public Client surfaces so vi.mock applies, without duplicating the Server packages' identity tokens.
-        inline: [
-          // The published fixture mounts MemoryRouter; transform it with the page to share the router context.
-          /@nocobase\/app-testing\/(?:dist\/)?src\/client\//u,
-          // AppClientProviders includes the navigation guard and must use that same router context.
-          /@nocobase\/app-client\//u,
-          // Client plugins in every scope, including @acme/app-plugin-*, must share the transformed runtime.
-          // Keep server/shared modules external so their service identities remain unchanged.
-          /@[^/]+\/app-plugin-[^/]+\/(?:dist\/)?client\//u,
-        ],
-      },
-    },
-    // A glob rather than a list of filenames. The list had to be edited by hand for every test added or removed and
-    // silently drifted: it named a file that no longer existed while several real test files were absent from it, so
-    // those tests were never run at all.
-    include: ['tests/**/*.test.{ts,tsx}'],
-    // Playwright runs tests/playwright/ against a built application; its files are named *.test.ts too.
-    exclude: ['tests/playwright/**'],
-    setupFiles: ['./tests/setup/client-config.ts'],
-    // Keep the command usable if an application intentionally removes all scaffold tests before adding its own.
+    projects: [
+      createNodeVitestConfig({
+        test: {
+          root,
+          name: 'node',
+          include: ['tests/{server,database,cli,project}/**/*.test.{ts,tsx}'],
+          // Database fixtures and command output capture run one file at a time.
+          fileParallelism: false,
+        },
+      }),
+      createReactVitestConfig({
+        test: {
+          root,
+          name: 'client',
+          environment: './tests/setup/application-environment.ts',
+          // Client integration tests also start isolated application databases.
+          fileParallelism: false,
+          include: ['tests/client/**/*.test.{ts,tsx}'],
+          setupFiles: ['./tests/setup/client-config.ts'],
+          server: {
+            deps: {
+              // Keep the fixture, application and plugin clients in the same React/router context.
+              // Server and shared modules stay external to preserve their service identities.
+              inline: [
+                /@nocobase\/app-testing\/(?:dist\/)?src\/client\//u,
+                /@nocobase\/app-client\//u,
+                /@[^/]+\/app-plugin-[^/]+\/(?:dist\/)?client\//u,
+              ],
+            },
+          },
+        },
+      }),
+    ],
+    // Only the directories above contain Vitest suites. Playwright has its own runner.
+    // Keep the command usable if an application intentionally removes all scaffold tests.
     passWithNoTests: true,
     coverage: {
       provider: 'v8',