@ploykit/ui 0.6.0 → 0.6.2

package/src/pages/account/__tests__/NotificationPreferencesPage.test.tsx

@@ -0,0 +1,150 @@
+import '@testing-library/jest-dom/vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NotificationPreferencesPage } from '../NotificationPreferencesPage'
+
+const mocks = vi.hoisted(() => ({
+  prefs: [] as Array<Record<string, unknown>>,
+  loading: false,
+  error: null as Error | null,
+  setPref: vi.fn(),
+}))
+vi.mock('../../../../../hooks/src/hooks/useNotificationPrefs', () => ({
+  useNotificationPrefs: () => ({ prefs: mocks.prefs, loading: mocks.loading, error: mocks.error, refetch: vi.fn() }),
+  useSetNotificationPref: () => ({ setPref: mocks.setPref, loading: false, error: null }),
+}))
+
+function pref(over: Record<string, unknown> = {}) {
+  return {
+    notification_type: 'workspace.invited', email_enabled: true, in_app_enabled: true,
+    updated_at: '2026-10-01T00:00:00Z', ...over,
+  }
+}
+
+beforeEach(() => {
+  mocks.setPref.mockReset().mockResolvedValue(pref())
+  mocks.loading = false
+  mocks.error = null
+  mocks.prefs = []
+  
+  document.title = ''
+})
+
+describe('NotificationPreferencesPage', () => {
+  it('loading 时渲染加载态', () => {
+    mocks.loading = true
+    render(<NotificationPreferencesPage />)
+    expect(screen.getByText('加载中…')).toBeInTheDocument()
+  })
+
+  it('error 时渲染错误重试', () => {
+    mocks.error = new Error('boom')
+    render(<NotificationPreferencesPage />)
+    expect(screen.getByText('boom')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: '重试' })).toBeInTheDocument()
+  })
+
+  it('无 types prop 时以 API 行生成清单（值取行内字段）', () => {
+    mocks.prefs = [pref({ notification_type: 'workspace.invited', email_enabled: false })]
+    render(<NotificationPreferencesPage />)
+    expect(screen.getByText('workspace.invited')).toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: '邮件（workspace.invited）' })).toHaveAttribute('aria-checked', 'false')
+    expect(screen.getByRole('switch', { name: '站内（workspace.invited）' })).toHaveAttribute('aria-checked', 'true')
+  })
+
+  it('types prop 清单 × 缺行 = 双渠道默认开启', () => {
+    mocks.prefs = [pref({ notification_type: 'other.type' })]
+    render(
+      <NotificationPreferencesPage
+        types={[
+          { type: 'workspace.invited', label: '工作区邀请', description: '被邀请加入工作区时' },
+        ]}
+      />,
+    )
+    expect(screen.getByText('工作区邀请')).toBeInTheDocument()
+    expect(screen.getByText('被邀请加入工作区时')).toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: '站内（工作区邀请）' })).toHaveAttribute('aria-checked', 'true')
+    expect(screen.getByRole('switch', { name: '邮件（工作区邀请）' })).toHaveAttribute('aria-checked', 'true')
+  })
+
+  it('切换站内开关 → setPref(type, {in_app_enabled:false})', async () => {
+    mocks.prefs = [pref()]
+    render(<NotificationPreferencesPage />)
+    fireEvent.click(screen.getByRole('switch', { name: '站内（workspace.invited）' }))
+    await waitFor(() =>
+      expect(mocks.setPref).toHaveBeenCalledWith('workspace.invited', { in_app_enabled: false }),
+    )
+  })
+
+  it('空清单渲染空态', () => {
+    render(<NotificationPreferencesPage types={[]} />)
+    expect(screen.getByText('暂无可配置的通知类型')).toBeInTheDocument()
+  })
+
+  
+  it('emailChannelNote 传入时渲染邮件渠道说明行', () => {
+    mocks.prefs = [pref()]
+    render(
+      <NotificationPreferencesPage emailChannelNote="当前环境未接邮件发送（偏好仍会保存）" />,
+    )
+    expect(
+      screen.getByText('邮件渠道：当前环境未接邮件发送（偏好仍会保存）'),
+    ).toBeInTheDocument()
+  })
+
+  it('emailChannelNote 缺省不渲染说明行（默认假定渠道可用）', () => {
+    mocks.prefs = [pref()]
+    render(<NotificationPreferencesPage />)
+    expect(screen.queryByText(/^邮件渠道：/)).not.toBeInTheDocument()
+  })
+
+  
+  
+  
+  
+  it('渠道文字是 label：htmlFor 落到内部 checkbox，开关名经 aria-labelledby 关联', () => {
+    mocks.prefs = [pref()]
+    render(<NotificationPreferencesPage />)
+    const inAppSwitch = screen.getByRole('switch', { name: '站内（workspace.invited）' })
+    const emailSwitch = screen.getByRole('switch', { name: '邮件（workspace.invited）' })
+    const inAppLabel = screen.getByText(/^站内/, { selector: 'label' })
+    const emailLabel = screen.getByText(/^邮件/, { selector: 'label' })
+
+    expect(inAppLabel).toHaveAttribute('for')
+    expect(emailLabel).toHaveAttribute('for')
+    
+    const inAppTarget = document.getElementById(inAppLabel.getAttribute('for')!)
+    const emailTarget = document.getElementById(emailLabel.getAttribute('for')!)
+    expect(inAppTarget).toBeTruthy()
+    expect(emailTarget).toBeTruthy()
+    expect(inAppTarget).toHaveAttribute('type', 'checkbox')
+    expect(emailTarget).toHaveAttribute('type', 'checkbox')
+    
+    expect(inAppSwitch).toHaveAttribute('aria-labelledby', inAppLabel.id)
+    expect(emailSwitch).toHaveAttribute('aria-labelledby', emailLabel.id)
+  })
+
+  it('点击"邮件"文字 → 触发对应开关切换（label 关联可达）', async () => {
+    mocks.prefs = [pref()]
+    render(<NotificationPreferencesPage />)
+    fireEvent.click(screen.getByText(/^邮件/, { selector: 'label' }))
+    await waitFor(() =>
+      expect(mocks.setPref).toHaveBeenCalledWith('workspace.invited', { email_enabled: false }),
+    )
+  })
+
+  
+  it('siteName 传入时挂"通知偏好 · <产品名>"式页题', () => {
+    mocks.prefs = [pref()]
+    render(<NotificationPreferencesPage siteName="MyProduct" />)
+    expect(document.title).toBe('通知偏好 · MyProduct')
+  })
+
+  it('siteName 缺省只挂页题；自定义 title prop 同样生效', () => {
+    mocks.prefs = [pref()]
+    const { rerender } = render(<NotificationPreferencesPage />)
+    expect(document.title).toBe('通知偏好')
+    rerender(<NotificationPreferencesPage title="通知设置" siteName="MyProduct" />)
+    expect(document.title).toBe('通知设置 · MyProduct')
+  })
+})

package/src/pages/account/__tests__/ProfileSettingsPage.test.tsx

@@ -0,0 +1,173 @@
+import '@testing-library/jest-dom/vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { ApiError } from '@ploykit/client'
+import { ProfileSettingsPage } from '../ProfileSettingsPage'
+import type { PKUser } from '../../../provider/PloykitProvider'
+
+
+const mocks = vi.hoisted(() => ({
+  patch: vi.fn(),
+  post: vi.fn(),
+  del: vi.fn(),
+  refresh: vi.fn(),
+  logout: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  user: null as PKUser | null,
+  loading: false,
+}))
+vi.mock('../../../../../hooks/src/hooks/useApi', () => ({
+  useApi: () => ({ patch: mocks.patch, post: mocks.post, delete: mocks.del, get: vi.fn(), put: vi.fn() }),
+}))
+vi.mock('../../../../../hooks/src/hooks/useAuth', () => ({
+  useAuth: () => ({ user: mocks.user, loading: mocks.loading, refresh: mocks.refresh, logout: mocks.logout, workspaces: [] }),
+}))
+vi.mock('../../../components/toast', () => ({
+  toast: { success: mocks.toastSuccess, error: mocks.toastError, info: vi.fn() },
+}))
+
+function fakeUser(over: Partial<PKUser> = {}): PKUser {
+  return {
+    id: 'u1', email: 'user@example.com', display_name: '小明', avatar_url: '',
+    status: 'active', is_platform_admin: false, email_verified: false, created_at: '2026-01-01T00:00:00Z',
+    ...over,
+  }
+}
+
+beforeEach(() => {
+  mocks.patch.mockReset().mockResolvedValue(fakeUser())
+  mocks.post.mockReset().mockResolvedValue(undefined)
+  mocks.del.mockReset().mockResolvedValue(undefined)
+  mocks.refresh.mockReset().mockResolvedValue(undefined)
+  mocks.logout.mockReset().mockResolvedValue(undefined)
+  mocks.toastSuccess.mockReset()
+  mocks.toastError.mockReset()
+  mocks.loading = false
+  mocks.user = fakeUser()
+})
+
+describe('ProfileSettingsPage', () => {
+  it('loading 时渲染加载骨架', () => {
+    mocks.loading = true
+    render(<ProfileSettingsPage />)
+    expect(screen.getByText('加载账号信息…')).toBeInTheDocument()
+  })
+
+  it('渲染资料表单与邮箱行；未验证邮箱展示徽标 + 重发按钮', () => {
+    render(<ProfileSettingsPage />)
+    expect((screen.getByLabelText(/昵称/) as HTMLInputElement).value).toBe('小明')
+    expect(screen.getByTestId('profile-email')).toHaveTextContent('user@example.com')
+    expect(screen.getByText('未验证')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: '重新发送验证邮件' })).toBeInTheDocument()
+  })
+
+  it('已验证邮箱不渲染重发按钮', () => {
+    mocks.user = fakeUser({ email_verified: true })
+    render(<ProfileSettingsPage />)
+    expect(screen.getByText('已验证')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: '重新发送验证邮件' })).toBeNull()
+  })
+
+  it('保存资料 → PATCH /auth/me 携带 display_name/avatar_url', async () => {
+    render(<ProfileSettingsPage />)
+    fireEvent.change(screen.getByLabelText(/昵称/), { target: { value: '大明' } })
+    fireEvent.click(screen.getByRole('button', { name: '保存' }))
+
+    await waitFor(() => expect(mocks.patch).toHaveBeenCalledTimes(1))
+    expect(mocks.patch).toHaveBeenCalledWith('/auth/me', {
+      display_name: '大明', avatar_url: '',
+    })
+    await waitFor(() => expect(mocks.refresh).toHaveBeenCalledTimes(1))
+  })
+
+  it('点击重发验证邮件 → POST /auth/send-verification', async () => {
+    render(<ProfileSettingsPage />)
+    fireEvent.click(screen.getByRole('button', { name: '重新发送验证邮件' }))
+    await waitFor(() => expect(mocks.post).toHaveBeenCalledTimes(1))
+    expect(mocks.post).toHaveBeenCalledWith('/auth/send-verification')
+  })
+
+  it('删除账号：输入邮箱匹配后按钮可用，Impact 确认后 DELETE /auth/me', async () => {
+    render(<ProfileSettingsPage />)
+    const deleteBtn = screen.getByRole('button', { name: '删除账号' })
+    expect(deleteBtn).toBeDisabled()
+
+    fireEvent.change(screen.getByLabelText('输入登录邮箱以确认'), {
+      target: { value: 'USER@example.com' }, // 大小写不敏感匹配
+    })
+    expect(deleteBtn).toBeEnabled()
+    fireEvent.click(deleteBtn)
+
+    
+    const confirm = await screen.findByRole('button', { name: '永久删除' })
+    expect(confirm).toBeDisabled()
+    fireEvent.click(screen.getByLabelText('我理解并接受以上影响'))
+    fireEvent.click(confirm)
+
+    await waitFor(() => expect(mocks.del).toHaveBeenCalledWith('/auth/me'))
+  })
+
+  
+  it('B5：昵称为必填字段（aria-required + 视觉星号）', () => {
+    render(<ProfileSettingsPage />)
+    const input = screen.getByLabelText(/昵称/)
+    expect(input).toHaveAttribute('aria-required', 'true')
+    expect(screen.getByText('*')).toHaveAttribute('aria-hidden', 'true')
+    
+    expect(screen.getByLabelText(/头像链接/)).not.toHaveAttribute('aria-required')
+  })
+
+  
+  it('G7.3：昵称校验失败 → aria-invalid=true 且 aria-describedby 指向错误节点', async () => {
+    render(<ProfileSettingsPage />)
+    const input = screen.getByLabelText(/昵称/)
+    fireEvent.change(input, { target: { value: '' } })
+    fireEvent.click(screen.getByRole('button', { name: '保存' }))
+
+    expect(await screen.findByText('请输入昵称')).toBeInTheDocument()
+    expect(input).toHaveAttribute('aria-invalid', 'true')
+    expect(input.getAttribute('aria-describedby')).toContain('profile-name-error')
+    expect(document.getElementById('profile-name-error')).toHaveAttribute('role', 'alert')
+  })
+
+  
+  it('B2：头像链接 javascript: 与超长均被前端校验拦截（不发请求）', async () => {
+    render(<ProfileSettingsPage />)
+    const avatar = screen.getByLabelText(/头像链接/)
+    fireEvent.change(avatar, { target: { value: 'javascript:alert(1)' } })
+    fireEvent.click(screen.getByRole('button', { name: '保存' }))
+    expect(await screen.findByText('头像链接需以 http(s):// 开头')).toBeInTheDocument()
+    expect(mocks.patch).not.toHaveBeenCalled()
+
+    fireEvent.change(avatar, { target: { value: 'https://' + 'a'.repeat(2049) } })
+    fireEvent.click(screen.getByRole('button', { name: '保存' }))
+    expect(await screen.findByText('头像链接最多 2048 字符')).toBeInTheDocument()
+    expect(mocks.patch).not.toHaveBeenCalled()
+  })
+
+  
+  it('B2：头像字段呈现"外部图片可能被拦截"的如实说明', () => {
+    render(<ProfileSettingsPage />)
+    expect(screen.getByText(/外部图片可能被内容安全策略拦截/)).toBeInTheDocument()
+  })
+
+  
+  it('B3：邮箱行说明"暂不支持自助修改"，页头不含登录邮箱承诺', () => {
+    render(<ProfileSettingsPage />)
+    expect(screen.getByText(/暂不支持自助修改/)).toBeInTheDocument()
+    expect(screen.getByText('个人资料').textContent).toBe('个人资料')
+  })
+
+  
+  it('B8：保存失败（E_VALIDATION 英文 message）→ toast 中文文案', async () => {
+    mocks.patch.mockRejectedValueOnce(
+      new ApiError(400, 'E_VALIDATION', 'display_name must be 1-100 characters after trim'),
+    )
+    render(<ProfileSettingsPage />)
+    fireEvent.click(screen.getByRole('button', { name: '保存' }))
+
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledTimes(1))
+    expect(mocks.toastError).toHaveBeenCalledWith('请求参数有误，请检查填写内容后重试')
+  })
+})

package/src/pages/account/__tests__/SecuritySettingsPage.test.tsx

@@ -0,0 +1,212 @@
+import '@testing-library/jest-dom/vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { ApiError } from '@ploykit/client'
+import { SecuritySettingsPage } from '../SecuritySettingsPage'
+
+const mocks = vi.hoisted(() => ({
+  post: vi.fn(),
+  refresh: vi.fn(),
+  logout: vi.fn(),
+  confirm: vi.fn(),
+  toastError: vi.fn(),
+  toastSuccess: vi.fn(),
+  sessions: [] as Array<Record<string, unknown>>,
+  loading: false,
+  revoke: vi.fn(),
+  revokeAll: vi.fn(),
+}))
+vi.mock('../../../../../hooks/src/hooks/useApi', () => ({
+  useApi: () => ({ post: mocks.post, get: vi.fn(), put: vi.fn(), patch: vi.fn(), delete: vi.fn() }),
+}))
+vi.mock('../../../../../hooks/src/hooks/useAuth', () => ({
+  useAuth: () => ({ user: null, loading: false, refresh: mocks.refresh, logout: mocks.logout, workspaces: [] }),
+}))
+vi.mock('../../../components/toast', () => ({
+  toast: { success: mocks.toastSuccess, error: mocks.toastError, info: vi.fn() },
+}))
+vi.mock('../../../components/ConfirmDialog', () => ({
+  useConfirm: () => mocks.confirm,
+}))
+vi.mock('../../../../../hooks/src/hooks/useSessions', () => ({
+  useSessions: () => ({ sessions: mocks.sessions, loading: mocks.loading, error: null, refetch: vi.fn() }),
+  useRevokeSession: () => ({ revoke: mocks.revoke, loading: false, error: null }),
+  useRevokeAllSessions: () => ({ revokeAll: mocks.revokeAll, loading: false, error: null }),
+}))
+
+const NOW = '2026-10-05T10:00:00Z'
+function session(over: Record<string, unknown> = {}) {
+  return {
+    id: 's-1', ip_hash: 'a1b2c3d4e5f6', user_agent: 'Mozilla/5.0 Chrome/130',
+    last_seen_at: NOW, expires_at: '2026-11-05T10:00:00Z', created_at: NOW,
+    ...over,
+  }
+}
+
+beforeEach(() => {
+  mocks.post.mockReset().mockResolvedValue({ expires_at: NOW })
+  mocks.refresh.mockReset().mockResolvedValue(undefined)
+  mocks.logout.mockReset().mockResolvedValue(undefined)
+  mocks.confirm.mockReset().mockResolvedValue(true)
+  mocks.revoke.mockReset().mockResolvedValue(undefined)
+  mocks.revokeAll.mockReset().mockResolvedValue(undefined)
+  mocks.toastError.mockReset()
+  mocks.toastSuccess.mockReset()
+  mocks.loading = false
+  mocks.sessions = []
+})
+
+describe('SecuritySettingsPage', () => {
+  it('会话加载中渲染 Skeleton 行', () => {
+    mocks.loading = true
+    render(<SecuritySettingsPage />)
+    expect(document.querySelectorAll('[data-slot="skeleton"]').length).toBeGreaterThan(0)
+  })
+
+  it('渲染会话行：current=true 显示当前设备徽标，current 缺失显示 —', () => {
+    mocks.sessions = [
+      session({ id: 's-cur', user_agent: 'MacBook Chrome/130', current: true }),
+      session({ id: 's-old', user_agent: 'iPhone Safari' }), // 后端 current 并行落地前的形态
+    ]
+    render(<SecuritySettingsPage />)
+    expect(screen.getByText('当前设备')).toBeInTheDocument()
+    expect(screen.getByText('MacBook Chrome/130')).toBeInTheDocument()
+    expect(screen.getByText('iPhone Safari')).toBeInTheDocument()
+  })
+
+  it('修改密码 → POST /auth/change-password 携带 old/new', async () => {
+    render(<SecuritySettingsPage />)
+    fireEvent.change(screen.getByLabelText('当前密码'), { target: { value: 'old-password' } })
+    fireEvent.change(screen.getByLabelText('新密码'), { target: { value: 'Abcdef1234!' } })
+    fireEvent.click(screen.getByRole('button', { name: '修改密码' }))
+
+    await waitFor(() => expect(mocks.post).toHaveBeenCalledTimes(1))
+    expect(mocks.post).toHaveBeenCalledWith('/auth/change-password', {
+      old_password: 'old-password', new_password: 'Abcdef1234!',
+    })
+  })
+
+  it('弱新密码被 zod 拦截，不发请求', async () => {
+    render(<SecuritySettingsPage />)
+    fireEvent.change(screen.getByLabelText('当前密码'), { target: { value: 'old-password' } })
+    fireEvent.change(screen.getByLabelText('新密码'), { target: { value: 'abcdefgh' } }) 
+    fireEvent.click(screen.getByRole('button', { name: '修改密码' }))
+
+    expect(await screen.findByText('密码至少 10 位')).toBeInTheDocument()
+    expect(mocks.post).not.toHaveBeenCalled()
+  })
+
+  
+  
+  it('B4：新密码与当前密码相同 → 内联报错且不发请求', async () => {
+    render(<SecuritySettingsPage />)
+    fireEvent.change(screen.getByLabelText('当前密码'), { target: { value: 'Abcdef1234!' } })
+    fireEvent.change(screen.getByLabelText('新密码'), { target: { value: 'Abcdef1234!' } })
+    fireEvent.click(screen.getByRole('button', { name: '修改密码' }))
+
+    expect(await screen.findByText('新密码不能与当前密码相同')).toBeInTheDocument()
+    expect(mocks.post).not.toHaveBeenCalled()
+  })
+
+  it('B4 边界：当前密码为空时不触发 new==old 跨字段报错（仍报必填）', async () => {
+    render(<SecuritySettingsPage />)
+    fireEvent.change(screen.getByLabelText('新密码'), { target: { value: 'Abcdef1234!' } })
+    fireEvent.click(screen.getByRole('button', { name: '修改密码' }))
+
+    expect(await screen.findByText('请输入当前密码')).toBeInTheDocument()
+    expect(screen.queryByText('新密码不能与当前密码相同')).not.toBeInTheDocument()
+    expect(mocks.post).not.toHaveBeenCalled()
+  })
+
+  it('单行吊销：确认后调用 revoke(sessionId)', async () => {
+    mocks.confirm.mockResolvedValueOnce(true)
+    mocks.sessions = [session({ id: 's-9', user_agent: 'iPad Safari', current: false })]
+    render(<SecuritySettingsPage />)
+
+    fireEvent.click(screen.getByRole('button', { name: '吊销' }))
+    await waitFor(() => expect(mocks.revoke).toHaveBeenCalledWith('s-9'))
+    expect(mocks.confirm).toHaveBeenCalledWith(
+      expect.objectContaining({ title: '吊销此会话？', danger: true }),
+    )
+  })
+
+  it('单行吊销：取消确认则不调用 revoke', async () => {
+    mocks.confirm.mockResolvedValueOnce(false)
+    mocks.sessions = [session({ id: 's-9' })]
+    render(<SecuritySettingsPage />)
+
+    fireEvent.click(screen.getByRole('button', { name: '吊销' }))
+    await waitFor(() => expect(mocks.confirm).toHaveBeenCalled())
+    expect(mocks.revoke).not.toHaveBeenCalled()
+  })
+
+  it('P1-3：吊销当前会话（current=true）→ 调 logout() 并跳 /login，不困在失效会话页', async () => {
+    mocks.sessions = [session({ id: 's-cur', current: true })]
+    render(<SecuritySettingsPage />)
+
+    fireEvent.click(screen.getByRole('button', { name: '吊销' }))
+    await waitFor(() => expect(mocks.revoke).toHaveBeenCalledWith('s-cur'))
+    await waitFor(() => expect(mocks.logout).toHaveBeenCalledTimes(1))
+  })
+
+  it('P1-3：吊销非当前会话 → 不调 logout，留在本页', async () => {
+    mocks.sessions = [session({ id: 's-other', current: false })]
+    render(<SecuritySettingsPage />)
+
+    fireEvent.click(screen.getByRole('button', { name: '吊销' }))
+    await waitFor(() => expect(mocks.revoke).toHaveBeenCalledWith('s-other'))
+    expect(mocks.logout).not.toHaveBeenCalled()
+  })
+
+  it('P2-24（最危险操作）：全部吊销 → ImpactConfirmation 勾选后 revokeAll', async () => {
+    mocks.sessions = [session({ id: 's-1' }), session({ id: 's-2', current: true })]
+    render(<SecuritySettingsPage />)
+
+    fireEvent.click(screen.getByRole('button', { name: '全部吊销' }))
+    
+    expect(await screen.findByText('吊销全部会话？')).toBeInTheDocument()
+    expect(screen.getByText(/个人访问令牌（PAT）不受影响/)).toBeInTheDocument()
+
+    fireEvent.click(screen.getByLabelText(/我理解并接受以上影响/))
+    fireEvent.click(screen.getByRole('button', { name: '全部吊销', hidden: false }))
+    await waitFor(() => expect(mocks.revokeAll).toHaveBeenCalledTimes(1))
+  })
+
+  it('P2-24：全部吊销失败 → 错误 toast（服务端语义透出）', async () => {
+    mocks.revokeAll.mockRejectedValueOnce(new Error('网络连接失败'))
+    render(<SecuritySettingsPage />)
+
+    fireEvent.click(screen.getByRole('button', { name: '全部吊销' }))
+    fireEvent.click(await screen.findByLabelText(/我理解并接受以上影响/))
+    fireEvent.click(screen.getByRole('button', { name: '全部吊销', hidden: false }))
+
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith('网络连接失败'))
+  })
+
+  it('P2-24：修改密码失败 → 错误 toast（服务端语义透出）', async () => {
+    mocks.post.mockRejectedValueOnce(new Error('当前密码不正确'))
+    render(<SecuritySettingsPage />)
+    fireEvent.change(screen.getByLabelText('当前密码'), { target: { value: 'wrong-old' } })
+    fireEvent.change(screen.getByLabelText('新密码'), { target: { value: 'Abcdef1234!' } })
+    fireEvent.click(screen.getByRole('button', { name: '修改密码' }))
+
+    await waitFor(() => expect(mocks.post).toHaveBeenCalledTimes(1))
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith('当前密码不正确'))
+  })
+
+  
+  
+  
+  it('B3：旧密码错 401 信封（英文 message）→ toast 中文域文案，不直出英文行话', async () => {
+    mocks.post.mockRejectedValueOnce(
+      new ApiError(401, 'E_UNAUTHENTICATED', 'current password incorrect'),
+    )
+    render(<SecuritySettingsPage />)
+    fireEvent.change(screen.getByLabelText('当前密码'), { target: { value: 'wrong-old' } })
+    fireEvent.change(screen.getByLabelText('新密码'), { target: { value: 'Abcdef1234!' } })
+    fireEvent.click(screen.getByRole('button', { name: '修改密码' }))
+
+    await waitFor(() => expect(mocks.post).toHaveBeenCalledTimes(1))
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith('当前密码不正确，请确认后重新输入'))
+  })
+})