@nocobase/app-template-default 1.0.0-beta.86 → 1.0.0-beta.88

package/tests/fixtures/theme-tokens.tsx

@@ -1,3 +1,8 @@
+import {
+  DropdownMenu,
+  DropdownMenuTrigger,
+  DropdownMenuContent,
+} from '../../client/components/ui/dropdown-menu';
 import {
   createAppSidebarPreferenceStore,
   SidebarPreferenceProvider,
@@ -35,7 +40,14 @@ export default function Fixture() {
           </AppSidebar>
           <main className='min-w-0 flex-1 space-y-6 overflow-y-auto p-6'>
             <div className='flex flex-wrap gap-2'>
-              <ThemeSettings />
+              <DropdownMenu>
+                <DropdownMenuTrigger render={<Button />}>
+                  Account
+                </DropdownMenuTrigger>
+                <DropdownMenuContent>
+                  <ThemeSettings />
+                </DropdownMenuContent>
+              </DropdownMenu>
               <AppSidebarToggle />
             </div>
             <h1 className='text-3xl'>Theme tokens · 主题样式</h1>

package/tests/server/auth-email-config.test.ts

@@ -10,6 +10,7 @@ import {
   buildVariablesManifest,
 } from '@nocobase/app-server/config';
 import auth from '../../server/config/auth.js';
+import mailers from '../../server/config/mailers.js';
 
 it('inherits private authentication sender mappings without changing other mail consumers', async () => {
   const defaults = defaultAppConfigs({ auth });
@@ -50,30 +51,63 @@ it('inherits private authentication sender mappings without changing other mail
   ).toBe(true);
 });
 
-it('ships separate, valid SMTP and Resend authentication examples', async () => {
+it('ships a valid shared mailer example with private mapped credentials', async () => {
   const example = await readFile(
     new URL('../../config.example.yml', import.meta.url),
     'utf8',
   );
-  const blocks = [...example.matchAll(/^ {2}# email:\n(?: {2}# {3}.*\n)+/gm)];
-  expect(blocks).toHaveLength(2);
-  const directory = await mkdtemp(
-    path.join(os.tmpdir(), 'auth-email-example-'),
-  );
+  const block = example.match(/^# mailers:\n(?:#.*\n)+/m)?.[0];
+  expect(block).toBeTruthy();
+  const directory = await mkdtemp(path.join(os.tmpdir(), 'mailers-example-'));
   try {
-    for (const block of blocks) {
-      const text = 'auth:\n' + block[0].replace(/^ {2}# /gm, '  ');
-      const file = path.join(directory, 'config.yml');
-      await writeFile(file, text);
-      const config = new AppConfig().loadFile(file);
-      await config.loadAll();
-      const defaults = defaultAppConfigs({ auth });
-      config.mergeDefaults(defaults({} as never));
-      config.defineSections(defaults.sections!);
-      expect(await config.validate()).toEqual([]);
-    }
+    const file = path.join(directory, 'config.yml');
+    await writeFile(file, block!.replace(/^# ?/gm, ''));
+    const config = new AppConfig().loadFile(file);
+    await config.loadAll();
+    const defaults = defaultAppConfigs({ auth, mailers });
+    config.mergeDefaults(defaults({} as never));
+    config.defineSections(defaults.sections!);
+    await config.loadSectionEnvironment({
+      MAILERS_SYSTEM_PASSWORD: 'synthetic-password',
+    });
+    expect(await config.validate()).toEqual([]);
+    expect(config.get('mailers.default')).toBe('system');
+    expect(config.get('mailers.system.auth.pass')).toBe('synthetic-password');
+    expect(JSON.stringify(config.publicValues())).not.toContain(
+      'synthetic-password',
+    );
+    expect(config.get('auth.passwordReset.enabled')).toBeUndefined();
   } finally {
     await rm(directory, { recursive: true, force: true });
   }
   expect(example).not.toContain('emailChannel:');
 });
+
+it('accepts an entirely environment-configured shared sender without enabling recovery', async () => {
+  const config = new AppConfig();
+  await config.loadAll();
+  const defaults = defaultAppConfigs({ auth, mailers });
+  config.mergeDefaults(defaults({} as never));
+  config.defineSections(defaults.sections!);
+  await config.loadSectionEnvironment({
+    MAILERS_DEFAULT: 'system',
+    MAILERS_SYSTEM_PROVIDER: 'smtp',
+    MAILERS_SYSTEM_HOST: 'localhost',
+    MAILERS_SYSTEM_PORT: '2525',
+    MAILERS_SYSTEM_SECURE: 'false',
+  });
+  expect(await config.validate()).toEqual([]);
+  expect(config.get('mailers.system')).toMatchObject({
+    provider: 'smtp',
+    port: 2525,
+    secure: false,
+  });
+  expect(config.get('auth.passwordReset.enabled')).toBeUndefined();
+  expect(config.environmentVariableMappings()).toMatchObject({
+    MAILERS_DEFAULT: { path: 'mailers.default' },
+    MAILERS_SYSTEM_PASSWORD: {
+      path: 'mailers.system.auth.pass',
+      secret: true,
+    },
+  });
+});

package/tests/server/notification-templates.test.ts

@@ -0,0 +1,144 @@
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import {
+  signIn,
+  DEFAULT_ADMIN_CREDENTIALS,
+} from '@nocobase/app-plugin-authentication/testing';
+import { createAppTest } from '@nocobase/app-testing/server';
+import { describe, expect } from 'vitest';
+import { createStandaloneServer } from '../../server/standalone.js';
+
+const common = {
+  createServer: createStandaloneServer,
+  scope: 'test' as const,
+  config: {
+    app: { publicOrigin: 'http://localhost' },
+    spa: {
+      indexPath: fileURLToPath(new URL('../../index.html', import.meta.url)),
+    },
+    auth: {
+      secret: 'notification-template-test-secret-at-least-32-characters',
+    },
+  },
+};
+describe('bare Default', () => {
+  const test = createAppTest(common);
+  test('keeps the bare Default navigation disabled without an invitation transport', async ({
+    app,
+  }) => {
+    expect(
+      app.config.get('client.notificationTemplates.invitationConfigured'),
+    ).toBe(false);
+  });
+});
+describe('configured Default', () => {
+  const test = createAppTest({
+    ...common,
+    config: {
+      ...common.config,
+      mailers: {
+        default: 'system',
+        system: {
+          provider: 'smtp',
+          host: '127.0.0.1',
+          port: 9,
+          auth: { user: 'synthetic', pass: 'synthetic-private-password' },
+        },
+      },
+    },
+  });
+
+  test('boots the real Default invitation directory and protects all three endpoints', async ({
+    testApp,
+    app,
+    request,
+  }) => {
+    expect(
+      app.config.get('client.notificationTemplates.invitationConfigured'),
+    ).toBe(true);
+    const page = await testApp.fetch(
+      new Request(`http://localhost${testApp.publicBasePath}/`),
+    );
+    expect(page.status).toBe(200);
+    const html = await page.text();
+    expect(html).toContain('"invitationConfigured":true');
+    expect(html).not.toContain('synthetic-private-password');
+    const admin = await signIn(testApp, DEFAULT_ADMIN_CREDENTIALS);
+    expect((await request('/notifications/templates')).status).toBe(401);
+    const list = await admin.fetch('/notifications/templates');
+    expect(list.status).toBe(200);
+    const body = await list.json();
+    expect(JSON.stringify(body)).not.toContain('synthetic-private-password');
+    expect(body.data).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          id: 'users.invitation',
+          channels: [
+            { name: 'system', type: 'email', configured: true, enabled: true },
+          ],
+        }),
+      ]),
+    );
+    const detail = await admin.fetch(
+      '/notifications/templates/users.invitation',
+    );
+    expect(detail.status).toBe(200);
+    const logsBefore = await (await admin.fetch('/notifications/logs')).json();
+    const preview = await admin.fetch(
+      '/notifications/templates/users.invitation/preview',
+      {
+        method: 'POST',
+        headers: {
+          origin: 'http://localhost',
+          'content-type': 'application/json',
+        },
+        body: JSON.stringify({ locale: 'en-US' }),
+      },
+    );
+    expect(preview.status).toBe(200);
+    expect(JSON.stringify(await preview.json())).toContain('example.invalid');
+    expect(await (await admin.fetch('/notifications/logs')).json()).toEqual(
+      logsBefore,
+    );
+    const member = {
+      username: 'templateviewer',
+      email: 'templateviewer@example.invalid',
+      password: 'Synthetic-template-viewer-943!',
+    };
+    const created = await admin.fetch('/users', {
+      method: 'POST',
+      headers: {
+        origin: 'http://localhost',
+        'content-type': 'application/json',
+        'Idempotency-Key': `${Date.now()}.${randomUUID()}`,
+      },
+      body: JSON.stringify({
+        ...member,
+        name: 'Synthetic restricted viewer',
+        roleScopes: {},
+      }),
+    });
+    expect(created.status).toBe(201);
+    const restricted = await signIn(testApp, member);
+    for (const endpoint of [
+      '',
+      '/users.invitation',
+      '/users.invitation/preview',
+    ]) {
+      const response = await restricted.fetch(
+        `/notifications/templates${endpoint}`,
+        endpoint.endsWith('/preview')
+          ? {
+              method: 'POST',
+              headers: {
+                origin: 'http://localhost',
+                'content-type': 'application/json',
+              },
+              body: JSON.stringify({ locale: 'en-US' }),
+            }
+          : undefined,
+      );
+      expect(response.status).toBe(403);
+    }
+  });
+});

package/tests/client/permission-management-routes.test.ts

@@ -1,64 +0,0 @@
-import { resolveAppClientContributions } from '@nocobase/app-client/plugins';
-import { expect, it } from 'vitest';
-import settings from '../../client/pages/settings/routes.js';
-import {
-  buildRouteNavigation,
-  selectedNavigationId,
-  routeKey,
-} from '../../client/routing/route-navigation.js';
-it('groups existing permission pages without changing their URLs or authorization and hides inaccessible children', () => {
-  const { routes } = resolveAppClientContributions([
-    { packageName: 'test', source: 'application', routes: [settings] },
-  ]);
-  const group = routes[0].children!.find(
-    (route) => route.name === 'permissionManagement',
-  )!;
-  expect(group.componentLoader).toBeUndefined();
-  expect(
-    group.children!.map((route) => [route.name, route.path, route.authz]),
-  ).toEqual([
-    [
-      'settingsRoles',
-      '/settings/roles',
-      {
-        resource: { type: 'settings', id: 'authorization.permission-sets' },
-        action: 'read',
-      },
-    ],
-    [
-      'settingsDefaultAccess',
-      '/settings/default-access',
-      {
-        resource: { type: 'settings', id: 'authorization.default-access' },
-        action: 'read',
-      },
-    ],
-  ]);
-  const visible = buildRouteNavigation(routes, new Set())[0].children.find(
-    ({ route }) => route.name === 'permissionManagement',
-  )!;
-  expect(visible.children).toEqual([]);
-  expect(visible.route.path).toBe('/settings/roles');
-  expect(visible.route.navigation?.title).toBe('settings.permissionManagement');
-  expect(selectedNavigationId(routes, '/settings/roles/member/edit')).toBe(
-    routeKey(visible.route),
-  );
-  expect(selectedNavigationId(routes, '/settings/default-access')).toBe(
-    routeKey(visible.route),
-  );
-  const denied = new Set([routeKey(group.children![0])]);
-  const onlyDefault = buildRouteNavigation(routes, denied)[0].children.find(
-    ({ route }) => route.name === 'permissionManagement',
-  )!;
-  expect(onlyDefault.children).toEqual([]);
-  expect(onlyDefault.route.path).toBe('/settings/default-access');
-  expect(selectedNavigationId(routes, '/settings/default-access', denied)).toBe(
-    routeKey(onlyDefault.route),
-  );
-  denied.add(routeKey(group.children![1]));
-  expect(
-    buildRouteNavigation(routes, denied)[0].children.map(
-      ({ route }) => route.name,
-    ),
-  ).toEqual(['settingsUsers']);
-});