@nocobase/app-template-default 1.0.0-beta.83 → 1.0.0-beta.85

package/tests/fixtures/submission/page.tsx

@@ -0,0 +1,138 @@
+import { useState, type ReactElement } from 'react';
+import { useAuthentication } from '@nocobase/app-plugin-authentication/client';
+import {
+  useApiClient,
+  useSubmission,
+  PendingSubmissionError,
+} from '@nocobase/app-client';
+import { Button } from '#components/ui/button';
+import { Input } from '#components/ui/input';
+
+/** A synthetic customized business form, used against generated and upgraded applications. */
+export default function SubmissionFixture(): ReactElement {
+  const api = useApiClient();
+  const { session } = useAuthentication();
+  const submission = useSubmission({
+    scope: `${session?.user.id}:synthetic-borrowing-form`,
+  });
+  const [name, setName] = useState('Camera');
+  const [assetTag, setAssetTag] = useState('CUSTOM-001');
+  const [id, setId] = useState<string>();
+  const [message, setMessage] = useState('Ready');
+  const [mode, setMode] = useState<'create' | 'update' | 'approve'>('create');
+  const submit = async (): Promise<void> => {
+    try {
+      const result = await submission.run(
+        { name, assetTag, mode, id },
+        async (key, signal) => {
+          if (!name.trim() || !assetTag.startsWith('CUSTOM-')) {
+            setMessage('Name and CUSTOM- asset tag are required');
+            return null;
+          }
+          if (mode === 'approve')
+            return api.request({
+              path: `submissionFixture/${id}/approve`,
+              method: 'POST',
+              signal,
+              headers: { 'Idempotency-Key': key },
+              json: { note: 'Approved synthetic request' },
+            });
+          return mode === 'update'
+            ? api
+                .repository<{
+                  id: string;
+                  name: string;
+                  assetTag: string;
+                  statusChangedAt: string;
+                }>('borrowings')
+                .updateOne({
+                  idempotencyKey: key,
+                  signal,
+                  filter: { id },
+                  values: { name, assetTag },
+                })
+            : api
+                .repository<{
+                  id: string;
+                  name: string;
+                  assetTag: string;
+                  statusChangedAt: string;
+                }>('borrowings')
+                .createOne({
+                  idempotencyKey: key,
+                  signal,
+                  values: {
+                    id: key.slice(14),
+                    name,
+                    assetTag,
+                    statusChangedAt: new Date(
+                      Number(key.slice(0, 13)),
+                    ).toISOString(),
+                  },
+                });
+        },
+      );
+      if (result)
+        setMessage(mode === 'approve' ? 'Approved once' : 'Saved successfully');
+      if (result && typeof result === 'object' && 'record' in result)
+        setId((result.record as { id: string }).id);
+    } catch (error) {
+      setMessage(
+        error instanceof PendingSubmissionError
+          ? 'Retry the original operation before changing input'
+          : 'Request failed; input retained. Retry to confirm the outcome.',
+      );
+    }
+  };
+  return (
+    <main
+      className='mx-auto max-w-xl space-y-5 p-8'
+      style={{ borderTop: '6px solid #2563eb' }}
+    >
+      <h1 className='text-2xl font-semibold'>Equipment borrowing</h1>
+      <p>
+        Custom business form • Asset tag validation • Existing data retained
+      </p>
+      <form
+        id='borrowing-form'
+        onSubmit={(event) => {
+          event.preventDefault();
+          void submit();
+        }}
+        className='space-y-3'
+      >
+        <label htmlFor='name'>Equipment name</label>
+        <Input
+          id='name'
+          value={name}
+          onChange={(event) => setName(event.target.value)}
+        />
+        <label htmlFor='assetTag'>Custom asset tag</label>
+        <Input
+          id='assetTag'
+          value={assetTag}
+          onChange={(event) => setAssetTag(event.target.value)}
+        />
+        <label htmlFor='mode'>Operation</label>
+        <select
+          id='mode'
+          value={mode}
+          onChange={(event) => setMode(event.target.value as typeof mode)}
+        >
+          <option value='create'>Create</option>
+          <option value='update'>Update</option>
+          <option value='approve'>Approve</option>
+        </select>
+      </form>
+      <Button
+        type='submit'
+        form='borrowing-form'
+        disabled={submission.submitting}
+      >
+        {submission.submitting ? 'Submitting…' : 'Save'}
+      </Button>
+      <p role='status'>{submission.submitting ? 'Submitting…' : message}</p>
+      <p data-testid='record-id'>{id}</p>
+    </main>
+  );
+}

package/tests/fixtures/submission/playwright.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from '@playwright/test';
+export default defineConfig({
+  testDir: '.',
+  testMatch: 'browser.test.ts',
+  timeout: 120_000,
+  workers: 1,
+  retries: 0,
+  outputDir: process.env.SUBMISSION_EVIDENCE_DIR ?? './evidence',
+  reporter: 'list',
+  use: { viewport: { width: 1280, height: 900 }, trace: 'off' },
+});

package/tests/fixtures/submission/routes.ts

@@ -0,0 +1,208 @@
+import {
+  authorizationToken,
+  grantBacked,
+  type AuthorizationEnv,
+} from '@nocobase/app-plugin-authorization';
+import type { Application } from '@nocobase/app-server/application';
+import {
+  authenticationToken,
+  type AuthEnv,
+} from '@nocobase/app-plugin-authentication';
+import {
+  ApiError,
+  defineApiRoutes,
+  defineRepositoryApiRoutes,
+  executeIdempotentMutation,
+  describeRoute,
+  apiValidator,
+  dataResponse,
+  apiErrorResponses,
+} from '@nocobase/app-server/router';
+import { databaseManagerToken } from '@nocobase/db';
+import {
+  createRepositoryLifecycleStore,
+  defineLifecycle,
+  LifecycleRuntime,
+  type LifecycleRecord,
+} from '@nocobase/lifecycle';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { randomUUID } from 'node:crypto';
+
+interface Borrowing extends LifecycleRecord {
+  status: 'draft' | 'approved';
+  name: string;
+  assetTag: string;
+}
+type BorrowingTypes = {
+  record: Borrowing;
+  state: Borrowing['status'];
+  parameters: Record<string, never>;
+  services: Record<string, never>;
+};
+/** Isolated synthetic business fixture. Authentication uses this application's native session. */
+export default defineApiRoutes(async (app: Application) => {
+  const database = app.container.resolve(databaseManagerToken);
+  const connection = database.connection();
+  const auth = app.container.resolve(authenticationToken);
+  const authorization = app.container.resolve(authorizationToken);
+  authorization.resourceTypes.add({
+    type: 'submissionBorrowing',
+    actions: ['read', 'create', 'update', 'delete', 'approve'],
+    authorize: grantBacked(),
+  });
+  const runtime = new LifecycleRuntime({
+    store: createRepositoryLifecycleStore(database),
+  });
+  runtime.register(
+    defineLifecycle<BorrowingTypes>({
+      name: 'borrowings',
+      initial: 'draft',
+      states: ['draft', { name: 'approved', final: true }],
+      transitions: {
+        approve: {
+          from: 'draft',
+          to: 'approved',
+          onTransition: async ({ record, transactionHandle }) => {
+            const tx = transactionHandle as typeof connection;
+            await tx.repository('inventoryEntries').createOne({
+              values: { id: randomUUID(), borrowingId: record.id },
+            });
+          },
+        },
+      },
+    }),
+  );
+  const router = new Hono<AuthEnv & AuthorizationEnv>();
+  router.use('*', auth.required(), authorization.middleware());
+  router.use('*', async (c, next) => {
+    const path = c.req.path;
+    const action = path.endsWith('/createOne')
+      ? 'create'
+      : path.endsWith('/updateOne')
+        ? 'update'
+        : path.endsWith('/deleteOne')
+          ? 'delete'
+          : path.endsWith('/approve')
+            ? 'approve'
+            : 'read';
+    await c.get('authz').require(
+      path.endsWith('/fixtureAccess')
+        ? {
+            resource: {
+              type: 'settings',
+              id: 'authorization.permission-sets',
+            },
+            action: 'update',
+          }
+        : { resource: { type: 'submissionBorrowing', id: '*' }, action },
+    );
+    await next();
+  });
+  let revoked = false;
+  router.use('*', async (c, next) => {
+    if (revoked && !c.req.path.endsWith('/fixtureAccess'))
+      throw new ApiError({
+        status: 'PERMISSION_DENIED',
+        reason: 'FIXTURE_REVOKED',
+        domain: 'submissionFixture',
+        message: 'The business permission was revoked.',
+      });
+    await next();
+  });
+  const routes = defineRepositoryApiRoutes({
+    repositories: [
+      {
+        name: 'borrowings',
+        policy: {
+          read: true,
+          create: {
+            scope: true,
+            fields: ['id', 'name', 'assetTag', 'statusChangedAt'],
+          },
+          update: { scope: true, fields: ['name', 'assetTag'] },
+          delete: true,
+        },
+        actions: { findMany: {}, createOne: {}, updateOne: {}, deleteOne: {} },
+      },
+    ],
+  });
+  router.route('/', await routes.createRouter(app));
+  const info = (operationId: string, summary: string) =>
+    describeRoute({
+      tags: ['SubmissionFixture'],
+      summary,
+      operationId,
+      responses: { 200: dataResponse(z.unknown()), ...apiErrorResponses },
+    });
+  router.get(
+    '/submissionFixture/evidence',
+    info('submissionFixtureEvidence', 'Inspect synthetic business data'),
+    async (c) =>
+      c.json({
+        data: {
+          rows: await connection.repository('borrowings').findMany(),
+          entries: await connection.repository('inventoryEntries').findMany(),
+          history: await connection
+            .repository('lifecycleTransitions')
+            .findMany(),
+        },
+      }),
+  );
+  router.post(
+    '/submissionFixture/fixtureAccess',
+    info('submissionFixtureAccess', 'Change the synthetic business permission'),
+    apiValidator('json', z.strictObject({ revoked: z.boolean() })),
+    (c) => {
+      revoked = c.req.valid('json').revoked;
+      return c.json({ data: { revoked } });
+    },
+  );
+  router.post(
+    '/submissionFixture/:id/approve',
+    info('submissionFixtureApprove', 'Approve a synthetic borrowing'),
+    apiValidator('param', z.object({ id: z.string() })),
+    apiValidator('header', z.object({ 'idempotency-key': z.string() })),
+    apiValidator('json', z.strictObject({ note: z.string() })),
+    async (c) => {
+      const user = c.get('auth') as { user: { id: string } };
+      const id = c.req.valid('param').id;
+      const result = await executeIdempotentMutation({
+        connection,
+        key: c.req.valid('header')['idempotency-key'],
+        principal: user.user.id,
+        operation: `borrowings/${id}/approve`,
+        input: c.req.valid('json'),
+        authorize: async () => {
+          if (revoked)
+            throw new ApiError({
+              status: 'PERMISSION_DENIED',
+              reason: 'FIXTURE_REVOKED',
+              domain: 'submissionFixture',
+              message: 'Permission revoked.',
+            });
+        },
+        authorizeReplay: async () => {
+          if (
+            !(await connection
+              .repository('borrowings')
+              .findOne({ filter: { id } }))
+          )
+            throw new Error('Borrowing unavailable.');
+        },
+        execute: async (transaction) => {
+          await runtime.fire('borrowings', id, 'approve', {
+            actor: { id: user.user.id },
+            requestId: c.req.valid('header')['idempotency-key'],
+            input: c.req.valid('json'),
+            transaction,
+          });
+          return { approved: true, id };
+        },
+      });
+      c.header('Idempotency-Replayed', String(result.replayed));
+      return c.json({ data: result.data });
+    },
+  );
+  return new Hono().route('/', router);
+});

package/tests/helpers/settings-client.tsx

@@ -0,0 +1,31 @@
+import type { ReactElement } from 'react';
+import { beforeEach } from 'vitest';
+import { renderWithApp } from '@nocobase/app-testing/client';
+import {
+  AuthenticationProvider,
+  authenticationClientToken,
+  type AuthClient,
+} from '@nocobase/app-plugin-authentication/client';
+
+// Presentation tests keep their existing API doubles; native authentication is exercised separately against the server.
+beforeEach(() => window.sessionStorage.clear());
+export function renderSettingsClient(
+  ui: ReactElement,
+  options: Parameters<typeof renderWithApp>[1] = {},
+): ReturnType<typeof renderWithApp> {
+  return renderWithApp(<AuthenticationProvider>{ui}</AuthenticationProvider>, {
+    ...options,
+    services: (app) => {
+      options.services?.(app);
+      app.container.instance(authenticationClientToken, {
+        getSession: async () => ({
+          data: {
+            user: { id: 'settings-test-user' },
+            session: { id: 'settings-test-session' },
+          },
+          error: null,
+        }),
+      } as unknown as AuthClient);
+    },
+  });
+}

package/tests/playwright/permission-alignment.test.ts

@@ -0,0 +1,109 @@
+import { expect, test } from '@playwright/test';
+
+const applicationUrl = process.env.APP_URL;
+test.skip(!applicationUrl, 'Set APP_URL to the running application entry.');
+const fixture = `${applicationUrl?.replace(/\/$/, '')}/tests/fixtures/permission-alignment.html`;
+
+for (const width of [1440, 1024, 768, 390, 375, 360]) {
+  test(`aligns scopes across groups and actions at ${width}px`, async ({
+    page,
+  }) => {
+    await page.setViewportSize({ width, height: 1100 });
+    await page.goto(fixture);
+    await expect(page.getByRole('combobox')).toHaveCount(18);
+    const geometry = await Promise.all(
+      (await page.getByRole('combobox').all()).map(async (node) => {
+        const rect = (await node.boundingBox())!;
+        return { x: Math.round(rect.x), width: Math.round(rect.width) };
+      }),
+    );
+    expect(new Set(geometry.map((item) => item.x)).size).toBe(
+      width >= 1024 ? 2 : 1,
+    );
+    expect(new Set(geometry.map((item) => item.width)).size).toBe(1);
+    expect(
+      await page.locator('html').evaluate((element) => {
+        const root = element as unknown as {
+          scrollWidth: number;
+          clientWidth: number;
+        };
+        return root.scrollWidth <= root.clientWidth;
+      }),
+    ).toBe(true);
+    for (const row of await page.locator('[data-slot=permission-row]').all()) {
+      const checkbox = await row.getByRole('checkbox').boundingBox();
+      const controls = row.getByRole('combobox');
+      if (await controls.count()) {
+        const first = await controls.first().boundingBox();
+        expect(first!.y).toBeGreaterThan(checkbox!.y + checkbox!.height);
+        expect(Math.round(first!.x)).toBe(
+          Math.min(...geometry.map((item) => item.x)),
+        );
+        if ((await controls.count()) % 2 === 1) {
+          const last = await controls.last().boundingBox();
+          expect(Math.round(last!.x)).toBe(Math.round(first!.x));
+        }
+      }
+    }
+    for (const scope of await page
+      .locator('[data-slot=permission-scope]')
+      .all()) {
+      const trigger = await scope.getByRole('combobox').boundingBox();
+      if (width < 416) {
+        const label = await scope.locator('span[title]').boundingBox();
+        expect(label!.y + label!.height).toBeLessThanOrEqual(trigger!.y);
+        expect(Math.round(label!.x)).toBe(Math.round(trigger!.x));
+      }
+      const conditions = scope.getByRole('button', {
+        name: 'Conditions',
+        exact: true,
+      });
+      if (await conditions.count()) {
+        const button = await conditions.boundingBox();
+        expect(button!.y).toBeGreaterThanOrEqual(trigger!.y + trigger!.height);
+        expect(Math.round(button!.x)).toBe(Math.round(trigger!.x));
+      }
+    }
+  });
+}
+
+test('preserves long labels, independent scope changes and ungranted visibility', async ({
+  page,
+}) => {
+  await page.goto(`${fixture}?chinese`);
+  const label = '需要完整显示名称的跨部门监控规则计算数据范围长标签';
+  await expect(page.getByTitle(label)).toHaveCount(3);
+  const control = page.getByRole('combobox', {
+    name: `How far View monitoring rules · ${label} reaches`,
+  });
+  await control.click();
+  await page.getByRole('option', { name: 'All records', exact: true }).click();
+  await expect(control.locator('[data-slot=select-value]')).toHaveText(
+    'All records',
+  );
+  await expect(
+    page.getByRole('checkbox', { name: 'View monitoring rules', exact: true }),
+  ).toBeChecked();
+  await page
+    .getByRole('checkbox', { name: 'Manage responsible units', exact: true })
+    .click();
+  await expect(page.getByRole('combobox')).toHaveCount(17);
+  await page.getByRole('tab', { name: 'Ungranted', exact: true }).click();
+  await expect(page.getByRole('combobox')).toHaveCount(0);
+});
+
+test('keeps readonly scopes visible and disables editing', async ({ page }) => {
+  await page.goto(`${fixture}?readonly`);
+  await expect(page.getByRole('combobox')).toHaveCount(18);
+  for (const control of await page.getByRole('combobox').all()) {
+    await expect(control).toBeDisabled();
+  }
+  for (const button of await page
+    .getByRole('button', { name: 'Conditions', exact: true })
+    .all()) {
+    await expect(button).toBeDisabled();
+  }
+  await expect(
+    page.getByRole('checkbox', { name: 'Manage alerts', exact: true }),
+  ).toHaveAttribute('aria-disabled', 'true');
+});

package/tests/server/auth-email-config.test.ts

@@ -0,0 +1,79 @@
+// @vitest-environment node
+
+import { readFile, mkdtemp, writeFile, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { expect, it } from 'vitest';
+import {
+  AppConfig,
+  defaultAppConfigs,
+  buildVariablesManifest,
+} from '@nocobase/app-server/config';
+import auth from '../../server/config/auth.js';
+
+it('inherits private authentication sender mappings without changing other mail consumers', async () => {
+  const defaults = defaultAppConfigs({ auth });
+  const config = new AppConfig();
+  await config.loadAll();
+  config.mergeDefaults(defaults({} as never));
+  config.defineSections(defaults.sections!);
+  await config.loadSectionEnvironment({
+    AUTH_EMAIL_PROVIDER: 'smtp',
+    AUTH_EMAIL_HOST: 'smtp.example.test',
+    AUTH_EMAIL_PORT: '587',
+    AUTH_EMAIL_SECURE: 'false',
+    AUTH_EMAIL_FROM: 'sender@example.test',
+    AUTH_EMAIL_PASSWORD: 'synthetic-password',
+    AUTH_EMAIL_USER: 'synthetic',
+    MAIL_HOST: 'unrelated.example.test',
+  });
+  expect(await config.validate()).toEqual([]);
+  expect(config.get('auth.email.host')).toBe('smtp.example.test');
+  expect(config.get('auth.email.port')).toBe(587);
+  expect(config.get('auth.email.secure')).toBe(false);
+  expect(JSON.stringify(config.publicValues())).not.toContain(
+    'synthetic-password',
+  );
+  expect(config.get('auth.passwordReset.enabled')).toBeUndefined();
+  const variables = buildVariablesManifest({
+    app: { name: 'synthetic' },
+    variables: config.environmentVariableMappings(),
+    defaults: config.layers().defaults,
+  }).variables;
+  expect(
+    variables.filter((variable) => variable.name.startsWith('AUTH_EMAIL_')),
+  ).toHaveLength(9);
+  expect(
+    variables
+      .filter((variable) => variable.name.startsWith('AUTH_EMAIL_'))
+      .every((variable) => variable.required === false),
+  ).toBe(true);
+});
+
+it('ships separate, valid SMTP and Resend authentication examples', async () => {
+  const example = await readFile(
+    new URL('../../config.example.yml', import.meta.url),
+    'utf8',
+  );
+  const blocks = [...example.matchAll(/^ {2}# email:\n(?: {2}# {3}.*\n)+/gm)];
+  expect(blocks).toHaveLength(2);
+  const directory = await mkdtemp(
+    path.join(os.tmpdir(), 'auth-email-example-'),
+  );
+  try {
+    for (const block of blocks) {
+      const text = 'auth:\n' + block[0].replace(/^ {2}# /gm, '  ');
+      const file = path.join(directory, 'config.yml');
+      await writeFile(file, text);
+      const config = new AppConfig().loadFile(file);
+      await config.loadAll();
+      const defaults = defaultAppConfigs({ auth });
+      config.mergeDefaults(defaults({} as never));
+      config.defineSections(defaults.sections!);
+      expect(await config.validate()).toEqual([]);
+    }
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+  expect(example).not.toContain('emailChannel:');
+});

package/tests/server/concurrency.test.ts

@@ -0,0 +1,61 @@
+import { expect, it } from 'vitest';
+import { createAppTest } from '@nocobase/app-testing/server';
+import {
+  concurrencyServiceToken,
+  type ConcurrencyService,
+} from '@nocobase/app-plugin-concurrency/server';
+import { createStandaloneServer } from '../../server/standalone.js';
+import concurrency from '../../server/config/concurrency.js';
+
+class BusinessConsumer {
+  public constructor(private readonly service: ConcurrencyService) {}
+  public manager() {
+    return this.service.getManager('memory');
+  }
+}
+
+const test = createAppTest({
+  createServer: createStandaloneServer,
+  connections: ['main'],
+  config: {
+    app: { publicOrigin: 'http://localhost' },
+    auth: { secret: 'test-auth-secret-at-least-32-characters' },
+  },
+});
+
+test('the real default composition supplies one memory lock domain to two business consumers', async ({
+  app,
+}) => {
+  const service = app.container.resolve(concurrencyServiceToken);
+  const first = new BusinessConsumer(service);
+  const second = new BusinessConsumer(service);
+  expect(app.config.get('concurrency')).toEqual({
+    default: 'memory',
+    memory: { adapter: 'mutex' },
+  });
+  const [left, right] = await Promise.all([first.manager(), second.manager()]);
+  expect(left).toBe(right);
+  expect(left).toBe(await service.getManager());
+  const lock = await left.createLock('concurrency-test:business');
+  const executor = await right.createSynchronous('concurrency-test:business');
+  const lease = await lock.lock();
+  try {
+    expect(await executor.tryRun(() => 'should-not-run')).toEqual({
+      acquired: false,
+    });
+  } finally {
+    await lease.release();
+  }
+  expect(await executor.tryRun(() => 'done')).toEqual({
+    acquired: true,
+    value: 'done',
+  });
+});
+
+it('declares only the default selector environment variable and no public configuration', () => {
+  expect(concurrency.rules?.public).toEqual([]);
+  expect(Object.keys(concurrency.rules?.env ?? {})).toEqual([
+    'CONCURRENCY_DEFAULT',
+  ]);
+  expect(concurrency.rules?.validators).toHaveLength(1);
+});