@nocobase/app-template-default 1.0.0-beta.82 → 1.0.0-beta.84

package/tests/fixtures/form-feedback/verify.mjs

@@ -0,0 +1,373 @@
+import process from 'node:process';
+import console from 'node:console';
+import { Buffer } from 'node:buffer';
+import { URL } from 'node:url';
+/* global document */
+// Run only against an authorized isolated application with the equipment fixture installed.
+import { chromium, expect } from '@playwright/test';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+const [base, output, name = 'application', legacy] = process.argv.slice(2);
+if (
+  !base ||
+  !output ||
+  !/^http:\/\/(127\.0\.0\.1|localhost):\d+\/main\/$/.test(base)
+)
+  throw new Error(
+    'Supply the isolated server entry URL and an evidence directory.',
+  );
+await mkdir(output, { recursive: true });
+const browser = await chromium.launch();
+const page = await browser.newPage({ viewport: { width: 1280, height: 960 } });
+const failures = [];
+page.on('pageerror', (error) => failures.push(error.message));
+await page.goto(`${base}login`, { waitUntil: 'domcontentloaded' });
+if (legacy !== '--legacy') {
+  await page.getByRole('button', { name: 'Sign in', exact: true }).click();
+  await expect(page.getByLabel('Username or email')).toBeFocused();
+  await expect(page.getByLabel('Username or email')).toHaveAttribute(
+    'aria-invalid',
+    'true',
+  );
+  await page
+    .getByLabel('Username or email')
+    .fill(process.env.TEST_ADMIN_USERNAME ?? 'nocobase');
+  await page
+    .getByLabel('Password', { exact: true })
+    .fill('incorrect-fixture-password');
+  await page.getByRole('button', { name: 'Sign in', exact: true }).click();
+  await expect(page.locator('form [role="alert"]').first()).toBeVisible();
+  await expect(page.getByLabel('Password', { exact: true })).toHaveValue(
+    'incorrect-fixture-password',
+  );
+  await page.screenshot({
+    path: join(output, `${name}-native-login.png`),
+    fullPage: true,
+    animations: 'disabled',
+  });
+}
+await page
+  .getByLabel('Username or email')
+  .fill(process.env.TEST_ADMIN_USERNAME ?? 'nocobase');
+await page
+  .getByLabel('Password', { exact: true })
+  .fill(process.env.TEST_ADMIN_PASSWORD ?? 'admin123');
+await page.getByRole('button', { name: 'Sign in', exact: true }).click();
+await expect(page.getByLabel('Username or email')).not.toBeVisible();
+
+async function open(container = 'page') {
+  await page.goto(`${base}equipment`, { waitUntil: 'domcontentloaded' });
+  await expect(page.getByTestId('retained-record')).toContainText(
+    'Legacy camera',
+  );
+  if (container !== 'page') {
+    await page.getByLabel('Container', { exact: true }).selectOption(container);
+    await expect(page).toHaveURL(
+      new RegExp(
+        container === 'detail-edit'
+          ? '/equipment/retained/edit$'
+          : `/equipment/${container}$`,
+      ),
+    );
+    await expect(
+      page.getByLabel('Equipment name', { exact: true }),
+    ).toBeVisible();
+  }
+}
+async function save() {
+  await page.getByRole('button', { name: 'Save request', exact: true }).click();
+}
+async function inline(locator) {
+  await expect(locator).toHaveAttribute('aria-invalid', 'true');
+  const ids = (await locator.getAttribute('aria-describedby')).split(/\s+/);
+  expect(
+    await page.evaluate(
+      (ids) => ids.every((id) => document.getElementById(id)),
+      ids,
+    ),
+  ).toBe(true);
+}
+async function delayedRequest(action) {
+  let release;
+  let reached;
+  let complete;
+  const completed = new Promise((resolve) => {
+    complete = resolve;
+  });
+  const reachedPromise = new Promise((resolve) => {
+    reached = resolve;
+  });
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  await page.route('**/api/equipmentFixture', async (route) => {
+    if (route.request().method() !== 'POST') return route.continue();
+    reached();
+    await gate;
+    await route.continue();
+    complete();
+  });
+  await save();
+  await reachedPromise;
+  await action();
+  release();
+  await completed;
+  await page.unroute('**/api/equipmentFixture');
+}
+
+await open();
+const before = await page.getByTestId('retained-record').innerText();
+await writeFile(join(output, `${name}-record.json`), before);
+if (legacy === '--legacy') {
+  await save();
+  await expect(page.getByRole('alert')).toHaveText('Unable to save equipment.');
+  await expect(page.locator('#row-camera')).toHaveCount(0);
+  await page.screenshot({
+    path: join(output, `${name}-before.png`),
+    fullPage: true,
+    animations: 'disabled',
+  });
+  await browser.close();
+  console.log(`${name}: legacy failure reproduced; record captured`);
+  process.exit(0);
+}
+
+const checked = [
+  'native template sign-in validation and request failure preserve input',
+];
+for (const container of ['page', 'dialog', 'drawer', 'detail-edit']) {
+  await open(container);
+  const routeBeforeFailure = page.url();
+  const title = page.getByLabel('Equipment name', { exact: true });
+  await title.fill('');
+  await save();
+  await expect(title).toBeFocused();
+  await inline(title);
+  expect(await title.getAttribute('aria-describedby')).toContain('name-help');
+  await title.fill('Retained equipment draft');
+  await page.getByLabel('Attachment', { exact: true }).setInputFiles({
+    name: 'equipment.txt',
+    mimeType: 'text/plain',
+    buffer: Buffer.from('attachment fixture'),
+  });
+  await save();
+  await expect(page.locator('#row-camera')).toBeFocused();
+  await inline(page.locator('#row-camera'));
+  await expect(
+    page.getByRole('tab', { name: 'Items', exact: true }),
+  ).toHaveAttribute('aria-selected', 'true');
+  await expect(
+    page.getByRole('button', { name: 'Borrowed items', exact: true }),
+  ).toHaveAttribute('aria-expanded', 'true');
+  await expect(title).toHaveValue('Retained equipment draft');
+  expect(
+    await page
+      .getByLabel('Attachment', { exact: true })
+      .evaluate((input) => input.files[0]?.name),
+  ).toBe('equipment.txt');
+  await page.locator('#row-camera').fill('Corrected camera');
+  await expect(page.locator('#row-camera')).toBeFocused();
+  await expect(page.locator('#row-camera')).not.toHaveAttribute('aria-invalid');
+  await page.screenshot({
+    path: join(output, `${name}-${container}.png`),
+    fullPage: true,
+    animations: 'disabled',
+  });
+  expect(page.url()).toBe(routeBeforeFailure);
+  checked.push(
+    `${container}: native errors, region reveal, inline association, scroll/focus, input and file retention`,
+  );
+}
+
+await open();
+await delayedRequest(() =>
+  page.getByRole('button', { name: 'Reorder rows', exact: true }).click(),
+);
+await expect(page.locator('#row-tripod')).toBeFocused();
+await inline(page.locator('#row-camera'));
+checked.push('request snapshot follows stable rows after reordering');
+await open();
+await delayedRequest(() =>
+  page.getByRole('button', { name: 'Delete camera row', exact: true }).click(),
+);
+await expect(page.locator('#row-tripod')).toBeFocused();
+await expect(page.locator('#row-camera')).toHaveCount(0);
+checked.push('deleted rows do not receive response errors');
+await open();
+await page.getByRole('tab', { name: 'Items', exact: true }).click();
+await page.getByRole('button', { name: 'Borrowed items', exact: true }).click();
+await delayedRequest(() =>
+  page.locator('#row-camera').fill('Edited while request was pending'),
+);
+await expect(page.locator('#row-tripod')).toBeFocused();
+await expect(page.locator('#row-camera')).not.toHaveAttribute('aria-invalid');
+checked.push('edits during a request discard stale field errors');
+
+await open();
+await page.route('**/api/equipmentFixture', (route) =>
+  route.request().method() === 'POST'
+    ? route.abort('failed')
+    : route.continue(),
+);
+await page.getByLabel('Response', { exact: true }).selectOption('success');
+await save();
+await expect(page.getByRole('alert')).toBeFocused();
+await expect(page.getByRole('alert')).toContainText('Unable to connect');
+await page.unroute('**/api/equipmentFixture');
+checked.push(
+  'aborted HTTP transport preserves input and reports a connection failure',
+);
+for (const mode of ['unknown', 'denied', 'network']) {
+  await open();
+  await page.getByLabel('Response', { exact: true }).selectOption(mode);
+  await save();
+  await expect(page.getByRole('alert')).toBeFocused();
+  await expect(page.getByLabel('Equipment name', { exact: true })).toHaveValue(
+    'Equipment draft',
+  );
+  await expect(page.locator('body')).not.toContainText('Private developer');
+  await expect(page.locator('body')).not.toContainText('Secret salary');
+  checked.push(`${mode}: safe form error and retained input`);
+}
+await open();
+await page
+  .getByRole('button', { name: 'Toggle field access', exact: true })
+  .click();
+await save();
+await expect(page.getByRole('alert')).toBeFocused();
+await expect(page.locator('#row-camera')).toHaveCount(0);
+await expect(page.getByRole('alert')).not.toContainText('Camera item');
+await expect(
+  page.getByRole('tab', { name: 'Details', exact: true }),
+).toHaveAttribute('aria-selected', 'true');
+checked.push('inaccessible fields do not appear or open their region');
+await open();
+await page
+  .getByRole('button', { name: 'Toggle disabled', exact: true })
+  .click();
+await save();
+await expect(page.getByRole('alert')).toBeFocused();
+await page.keyboard.press('Tab');
+await expect(page.getByLabel('Equipment name', { exact: true })).toBeFocused();
+checked.push('disabled fields fall back to a keyboard-accessible safe message');
+await open();
+await page.getByLabel('Response', { exact: true }).selectOption('business');
+await save();
+await expect(page.getByLabel('Department', { exact: true })).toBeFocused();
+await inline(page.getByLabel('Department', { exact: true }));
+await page.getByLabel('Department', { exact: true }).fill('Operations');
+await page.getByLabel('Response', { exact: true }).selectOption('success');
+await save();
+await expect(page.getByRole('status')).toHaveText('Saved; workflow submitted.');
+await expect(page.getByRole('alert')).toHaveCount(0);
+await expect(page.getByTestId('workflow-status')).toContainText('submitted');
+const submittedId = (
+  await page.getByTestId('workflow-status').innerText()
+).split(':')[0];
+await page
+  .getByRole('button', { name: 'Approve request', exact: true })
+  .click();
+await expect(page.getByTestId('workflow-status')).toContainText('approved');
+const persisted = await (
+  await page.request.get(`${base}api/equipmentFixture`)
+).json();
+expect(persisted.requests.find((row) => row.id === submittedId)?.workflow).toBe(
+  'approved',
+);
+expect(
+  persisted.history
+    .filter((row) => row.recordId === submittedId)
+    .map((row) => row.event)
+    .sort(),
+).toEqual(['approved', 'submitted']);
+await page.screenshot({
+  path: join(output, `${name}-approved-workflow.png`),
+  fullPage: true,
+  animations: 'disabled',
+});
+checked.push(
+  'real equipment submission and approval persist with both history events',
+);
+checked.push(
+  'trusted business copy and successful retry clear obsolete errors',
+);
+await open();
+expect(await page.getByTestId('retained-record').innerText()).toBe(before);
+await expect(page.getByTestId('custom-style')).toHaveCSS(
+  'font-family',
+  /serif/,
+);
+const restricted = await browser.newContext();
+const member = {
+  email: 'restricted@example.test',
+  password: 'fixture-member-password',
+};
+const nativeHeaders = { origin: new URL(base).origin };
+let signedIn = await restricted.request.post(`${base}api/auth/sign-in/email`, {
+  headers: nativeHeaders,
+  data: member,
+});
+if (!signedIn.ok()) {
+  const registered = await restricted.request.post(
+    `${base}api/auth/sign-up/email`,
+    {
+      headers: nativeHeaders,
+      data: {
+        ...member,
+        username: 'restricted_fixture',
+        name: 'Restricted fixture member',
+      },
+    },
+  );
+  expect(registered.ok()).toBe(true);
+  signedIn = await restricted.request.post(`${base}api/auth/sign-in/email`, {
+    headers: nativeHeaders,
+    data: member,
+  });
+}
+expect(signedIn.ok()).toBe(true);
+const deniedRead = await restricted.request.get(`${base}api/equipmentFixture`);
+expect(deniedRead.status()).toBe(403);
+expect(await deniedRead.text()).not.toContain('Legacy camera');
+const deniedWrite = await restricted.request.post(
+  `${base}api/equipmentFixture`,
+  {
+    headers: nativeHeaders,
+    data: {
+      mode: 'success',
+      name: 'Denied request',
+      department: 'Operations',
+      items: [],
+      attachment: '',
+    },
+  },
+);
+expect(deniedWrite.status()).toBe(403);
+const restrictedPage = await restricted.newPage();
+await restrictedPage.goto(`${base}equipment`, {
+  waitUntil: 'domcontentloaded',
+});
+await expect(
+  restrictedPage.getByRole('heading', { name: 'Access denied', exact: true }),
+).toBeVisible();
+await expect(
+  restrictedPage.getByLabel('Equipment name', { exact: true }),
+).toHaveCount(0);
+await restricted.close();
+checked.push(
+  'native ordinary identity is denied both business reads and writes without record disclosure',
+);
+expect(failures).toEqual([]);
+await writeFile(
+  join(output, `${name}-checks.json`),
+  JSON.stringify(
+    { base, checked, recordPreserved: true, pageErrors: failures },
+    null,
+    2,
+  ),
+);
+await browser.close();
+console.log(
+  `${name}: ${checked.length} scenario groups passed; business record and custom style preserved`,
+);

package/tests/fixtures/submission/README.md

@@ -0,0 +1,35 @@
+# Submission acceptance fixture
+
+This is a synthetic equipment-borrowing module for disposable applications, using native application authentication. It adds an asset tag, `CUSTOM-` validation, a business permission gate, custom blue border, and a lifecycle approval transition whose transaction inserts an inventory entry. Never install these test-only routes into an application with real data; the permission switch exists only to exercise revocation. The real equipment-borrowing application is not required or accessed.
+
+## Fresh application
+
+Create the application with `pnpm create @nocobase/app submission-new --template=<target-template-directory-or-package> --no-install --json`, from a scratch working directory. Verify its `nocobase.templatePackage`, read its `AGENTS.md` and synchronized application Skills, and install the target's coordinated dependencies. For an unreleased source-workspace verification, link the generated application's `node_modules` to the target template's installed workspace modules; this exercises the pending source and is not a published-version certification. Do not run package-manager mutations through that shared link.
+
+Copy `migration.ts` to `database/main/migrations/202610260099_submission_fixture.ts`, `routes.ts` to `server/routes/submission-fixture.ts`, and `page.tsx` to `client/pages/submission-fixture.tsx`. Register the server contribution in `server/routes/index.ts`, preserving the template's submission provider. Add an authenticated application route at `/submission-check`, with `authz: 'skip'` and a component loader for the fixture page. The fixture's business endpoints own their authentication and synthetic permission gate independently of that page setting.
+
+Run `pnpm nocobase config init --dialect sqlite --json`, then start with `APP_PUBLIC_ORIGIN=http://127.0.0.1:<chosen-port> APP_SERVER_PORT=<chosen-port> I18N_DEFAULT_LOCALE=en-US pnpm dev`. Use the actual printed application entry URL, including its base path. Configuration initialization generates local secrets; do not publish its file or native session cookies.
+
+## Version upgrade acceptance
+
+For release acceptance, run this fixture through the shared [versioned template-upgrade procedure](../../../../../app/app-skills/skills/nocobase-app-upgrade/references/versioned-upgrade-verification.md). Start Default and Examples separately from published BASE tarballs and their original application Skills. Resolve an explicitly newer TARGET from the isolated candidate registry or the official registry, discover its instructions through the normal template diff, and coordinate dependencies and copied source within that same upgrade. Do not install target Skills or patch individual pages before starting the upgrade. Generate a fresh comparison application from each identical TARGET package.
+
+Record exact BASE/TARGET versions, registry and tarball provenance, integrity, lockfile hashes, BASE-to-TARGET and BASE-to-PROJECT differences, resolved custom conflicts and the validated final baseline. Missing targets and unresolved conflicts must leave the baseline unchanged. Preserve the original business fields, validation, native roles and user assignments, lifecycle history, styling and rows. Candidate-package results and official-package results are separate acceptance records; repeat the matrix from real target packages after publication. Source-workspace checks below are useful specialist checks, but do not satisfy version upgrade acceptance.
+
+The shared upgrade Skill, template entry documentation and versioned packaging procedure supply the common entry. This fixture supplies only the submission-specific business module, browser matrix and before/after evidence inputs. Integrate those inputs with the shared fixture rather than creating another packaging or upgrade mechanism.
+
+## Customized source verification
+
+Prepare a separate application from the BASE template, before this feature. Add the same custom business schema, validation, permission gate, style and lifecycle hook. For the pre-upgrade page, replace only the shared controller with a direct submit function and omit operation headers on Repository mutations. For its custom action call `runtime.fire` without the new outer receipt adapter. Start it on its own database, sign in through its own native login and reproduce two records from a double click while holding the first response. Preserve these synthetic record ids and complete JSON rows as the data baseline.
+
+Stop the old application and commit its source baseline on a local branch. Back up its closed database and migration history. Reconcile BASE → TARGET and BASE → PROJECT through the [submission source-upgrade checklist](../../../../../app/app-skills/skills/nocobase-app-upgrade/references/submission-upgrade.md). Merge the provider/registration, receipt migration, three settings forms and client peer dependencies. For the customized page change only the controller and key forwarding; preserve the fields, validation and styling. For its custom server action add the receipt adapter around the existing lifecycle transition and join its transaction, preserving the permission check and inventory hook. Keep all business tables and records. Inspect `db apply --dry-run` and `db repair --dry-run`; this additive feature should add only the receipt migration with no old checksum changes. Apply it, restart the same application and retain its original database.
+
+For an unreleased source target, report its commit and keep the existing release marker instead of inventing a published target version. For a published target, advance `defaultTemplateVersion` only after source reconciliation and validation. Restore the paired old source and database backup for recovery.
+
+## Run the browser matrix
+
+Set `SUBMISSION_APPLICATIONS` to a JSON array of `{ "name": "new-template", "url": "http://127.0.0.1:<port>/main" }` and `{ "name": "upgraded-customized", "url": "http://127.0.0.1:<other-port>/main", "beforeData": "<path-to-pre-upgrade-evidence-JSON>", "beforePermissions": "<path-to-pre-upgrade-native-permissions-JSON>" }`. `beforeData` contains the fixture's `{ rows, entries, history }`, captured from its authenticated evidence endpoint before upgrading. `beforePermissions` contains the persisted `borrowing-clerk` permission set, explicit user assignment and native role scopes captured before the upgrade; the second browser case compares these and signs in as that ordinary user to exercise allowed reads/updates and forbidden deletion/approval. Fresh applications create equivalent synthetic native permissions in that case. Write the environment setup to a local file when it spans multiple lines. Use the synthetic initial administrator from the disposable template; never reuse a management-instance identity or credential.
+
+Run the application's local `pnpm exec playwright test -c tests/fixtures/submission/playwright.config.ts`. `PLAYWRIGHT_BROWSERS_PATH` must name an allowed scratch directory when installing a browser; use that same directory to run it. `SUBMISSION_EVIDENCE_DIR` selects a scratch output directory. The dedicated configuration keeps this opt-in fixture out of ordinary template browser tests. The test neither sleeps nor automatically retries failures.
+
+Each application checks validation and custom styling, double click, Enter plus programmatic submit while a committed response is held, normal identical new records, update, a definite server rejection with retained input, response loss after a server-confirmed commit, unchanged keys and bodies on retry, refusal of changed input during an uncertain operation, permission revocation, and lifecycle approval with exactly one history entry and inventory effect. Every original row must remain identical. English submitting/error/success screenshots and JSON invariant summaries are attached to the Playwright result. The service-level suites separately cover parallel HTTP attempts, rollback, changed-content conflicts, expiration after cleanup, strict/compatibility modes and query costs on SQLite, PostgreSQL and MySQL.