create-bubbles 0.1.25 → 0.1.27

package/template-vp-monorepo-react-nestjs/apps/web/test/organization-assignment.spec.ts

@@ -0,0 +1,137 @@
+import { describe, expect, it } from 'vite-plus/test'
+import type { OrganizationMemberCandidate, OrganizationScope } from 'shared/types'
+import {
+  canAddOrganizationAssignment,
+  canAddPositionAssignment,
+  canChangeOrganizationDuty,
+  isCandidateActiveInScope,
+} from '../src/utils/organization-assignment'
+
+const companyScope: OrganizationScope = { type: 'company', companyId: 'company-a' }
+
+/** 创建覆盖当前企业身份及可选项目身份的成员候选。 */
+function candidate({
+  accountActive = true,
+  companyMemberActive = true,
+  disabled = false,
+}: {
+  accountActive?: boolean
+  companyMemberActive?: boolean
+  disabled?: boolean
+} = {}): OrganizationMemberCandidate {
+  return {
+    userId: 'user-a',
+    account: 'alice@example.com',
+    name: 'Alice',
+    accountStatus: accountActive ? 'active' : 'disabled',
+    disabled,
+    disabledReason: disabled ? 'memberInactive' : null,
+    identities: [
+      {
+        scope: companyScope,
+        scopeName: '企业 A',
+        memberId: 'company-member',
+        memberStatus: companyMemberActive ? 'active' : 'disabled',
+        scopeStatus: 'active',
+        organizationUnits: [],
+        positions: [],
+        roles: [],
+      },
+      {
+        scope: { type: 'project', companyId: 'company-a', projectId: 'project-a' },
+        scopeName: '项目 A',
+        memberId: 'project-member',
+        memberStatus: 'active',
+        scopeStatus: 'active',
+        organizationUnits: [],
+        positions: [],
+        roles: [],
+      },
+    ],
+  }
+}
+
+describe('组织与岗位新增关系限制', () => {
+  it('按当前作用域身份判断成员有效性，不被其他项目的有效身份掩盖', () => {
+    expect(
+      isCandidateActiveInScope({
+        candidate: candidate({ companyMemberActive: false }),
+        scope: companyScope,
+      }),
+    ).toBe(false)
+    expect(
+      isCandidateActiveInScope({
+        candidate: candidate({ accountActive: false }),
+        scope: companyScope,
+      }),
+    ).toBe(false)
+  })
+
+  it('停用成员或无效组织不能新增关系，但有效关系可以新增', () => {
+    expect(
+      canAddOrganizationAssignment({
+        candidate: candidate({ companyMemberActive: false }),
+        scope: companyScope,
+        unitEffective: true,
+      }),
+    ).toBe(false)
+    expect(
+      canAddOrganizationAssignment({
+        candidate: candidate(),
+        scope: companyScope,
+        unitEffective: false,
+      }),
+    ).toBe(false)
+    expect(
+      canAddOrganizationAssignment({
+        candidate: candidate(),
+        scope: companyScope,
+        unitEffective: true,
+      }),
+    ).toBe(true)
+  })
+
+  it('失效组织关系允许原职责和降级，但禁止职责升级', () => {
+    const input = {
+      candidate: candidate(),
+      scope: companyScope,
+      unitEffective: false,
+      initialDuty: 'deputy' as const,
+    }
+    expect(canChangeOrganizationDuty({ ...input, nextDuty: 'member' })).toBe(true)
+    expect(canChangeOrganizationDuty({ ...input, nextDuty: 'deputy' })).toBe(true)
+    expect(canChangeOrganizationDuty({ ...input, nextDuty: 'leader' })).toBe(false)
+    expect(
+      canChangeOrganizationDuty({
+        candidate: candidate(),
+        scope: companyScope,
+        unitEffective: false,
+        nextDuty: 'member',
+      }),
+    ).toBe(false)
+  })
+
+  it('停用岗位或不可选成员不能新增任职', () => {
+    expect(
+      canAddPositionAssignment({
+        candidate: candidate(),
+        scope: companyScope,
+        positionActive: false,
+      }),
+    ).toBe(false)
+    expect(
+      canAddPositionAssignment({
+        candidate: candidate({ disabled: true }),
+        scope: companyScope,
+        positionActive: true,
+      }),
+    ).toBe(false)
+    expect(
+      canAddPositionAssignment({
+        candidate: candidate(),
+        scope: companyScope,
+        positionActive: true,
+      }),
+    ).toBe(true)
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/password-actions.spec.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it, vi } from 'vite-plus/test'
+import type { ChangePasswordRequest, ChangePasswordResult } from 'shared/types'
+
+const session = vi.hoisted(() => ({ clear: vi.fn(), remove: vi.fn() }))
+vi.mock('../src/utils/request/workspace', () => ({ clearWorkspaceRequests: session.clear }))
+vi.mock('../src/utils/storage/cookie', () => ({ cookie: { remove: session.remove } }))
+
+import { changePasswordAndClearSession } from '../src/components/PasswordActions/change-password-session'
+
+const input: ChangePasswordRequest = {
+  oldPassword: 'old-example',
+  newPassword: 'new-example',
+  confirmPassword: 'new-example',
+}
+
+describe('本人改密后的本地会话处理', () => {
+  it('服务端确认成功后才撤销在途工作空间请求并删除本地令牌', async () => {
+    const send = vi
+      .fn<(values: ChangePasswordRequest) => Promise<ChangePasswordResult>>()
+      .mockResolvedValue({ passwordChanged: true })
+
+    await changePasswordAndClearSession(input, send)
+
+    expect(send).toHaveBeenCalledWith(input)
+    expect(session.clear).toHaveBeenCalledOnce()
+    expect(session.remove).toHaveBeenCalledWith('token')
+  })
+
+  it('改密失败时保留仍有效的本地会话和在途请求', async () => {
+    session.clear.mockClear()
+    session.remove.mockClear()
+    const error = new Error('旧密码错误')
+    const send = vi.fn().mockRejectedValue(error)
+
+    await expect(changePasswordAndClearSession(input, send)).rejects.toBe(error)
+
+    expect(session.clear).not.toHaveBeenCalled()
+    expect(session.remove).not.toHaveBeenCalled()
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/password-reset-action.spec.ts

@@ -0,0 +1,64 @@
+import type { I18nState } from '@bubblesjs/i18n-core'
+import { describe, expect, it, vi } from 'vite-plus/test'
+import type { AccountRecord } from 'shared/types'
+import { createMemberTableColumns } from '../src/pages/access/components/MemberTable'
+
+const tr = ((key: string) => key) as I18nState['tr']
+const target: AccountRecord = {
+  id: 'target',
+  account: 'target_account',
+  name: '目标用户',
+  status: 'locked',
+  createdAt: '',
+  updatedAt: '',
+  platformRoleIds: [],
+}
+
+/** 生成只开放改密操作的列，检查平台账号行的目标过滤和事件绑定。 */
+function resetAction(options: { currentUserId: string; canResetPassword: boolean }) {
+  const onResetPassword = vi.fn()
+  const columns = createMemberTableColumns({
+    platform: true,
+    currentUserId: options.currentUserId,
+    companyScope: false,
+    canReadOrganization: false,
+    canAssignOrganization: false,
+    canAssignPositions: false,
+    canManageRoles: false,
+    canManageStatus: false,
+    canResetPassword: options.canResetPassword,
+    canRemove: false,
+    candidateByUserId: new Map(),
+    tr,
+    onOpenOrganizations: vi.fn(),
+    onOpenPositions: vi.fn(),
+    onOpenRoles: vi.fn(),
+    onToggleStatus: vi.fn(),
+    onResetPassword,
+    onRemove: vi.fn(),
+  })
+  const render = columns.find((column) => column.valueType === 'option')?.render as
+    | ((_: unknown, record: AccountRecord) => { props: { children: unknown[] } })
+    | undefined
+  const actions = render?.(undefined, target).props.children ?? []
+  const button = actions.find(
+    (item): item is { props: { children: string; onClick: () => void } } =>
+      typeof item === 'object' && item !== null && 'props' in item &&
+      (item as { props: { children?: unknown } }).props.children === '重置密码',
+  )
+  return { button, onResetPassword }
+}
+
+describe('平台账号重置密码行操作', () => {
+  it('平台管理员可对其他账号操作，包括锁定账号', () => {
+    const action = resetAction({ currentUserId: 'admin', canResetPassword: true })
+    expect(action.button).toBeDefined()
+    action.button?.props.onClick()
+    expect(action.onResetPassword).toHaveBeenCalledWith(target)
+  })
+
+  it('不展示本人重置入口，也不展示无权限入口', () => {
+    expect(resetAction({ currentUserId: 'target', canResetPassword: true }).button).toBeUndefined()
+    expect(resetAction({ currentUserId: 'admin', canResetPassword: false }).button).toBeUndefined()
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/request.spec.ts

@@ -0,0 +1,146 @@
+import { createServer, type Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import { axiosRequestAdapter } from '@alova/adapter-axios'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vite-plus/test'
+import { createInstance } from '../src/utils/request/core'
+
+let server: Server
+let baseUrl: string
+
+beforeAll(async () => {
+  server = createServer((req, res) => {
+    res.setHeader('Content-Type', 'application/json')
+    if (req.url === '/credentials') {
+      res
+        .writeHead(422)
+        .end(JSON.stringify({ code: 'AUTH.INVALID_CREDENTIALS', message: '账号或密码错误' }))
+    } else if (req.url === '/expired') {
+      res
+        .writeHead(401)
+        .end(JSON.stringify({ code: 'AUTH.SESSION_INVALID', message: '登录已失效，请重新登录' }))
+    } else if (req.url === '/unavailable') {
+      res.writeHead(503).end(
+        JSON.stringify({
+          code: 'AUTH.SERVICE_UNAVAILABLE',
+          message: '登录服务暂时不可用，请稍后重试',
+        }),
+      )
+    } else if (req.url === '/wrapped') {
+      res.end(JSON.stringify({ code: 200, data: { id: 'test-user' } }))
+    } else if (req.url?.startsWith('/http-status/')) {
+      const status = Number(req.url.split('/').at(-1))
+      res.writeHead(status).end(status === 204 ? undefined : JSON.stringify({ status }))
+    } else if (req.url?.startsWith('/wrapped-error/')) {
+      const code = Number(req.url.split('/').at(-1))
+      res.end(JSON.stringify({ code, message: '业务处理失败' }))
+    } else {
+      res.end(JSON.stringify({ id: 'test-user', authorization: req.headers.authorization }))
+    }
+  })
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+  baseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
+})
+
+afterAll(
+  () =>
+    new Promise<void>((resolve, reject) =>
+      server.close((error) => (error ? reject(error) : resolve())),
+    ),
+)
+
+/** 创建带鉴权和错误回调监视器的请求实例，供响应处理测试复用。 */
+function setup() {
+  const unauthorized = vi.fn()
+  const errorMessage = vi.fn()
+  const request = createInstance({
+    baseUrl,
+    isWrapped: false,
+    requestAdapter: axiosRequestAdapter(),
+    commonHeaders: () => ({ Authorization: 'Bearer test-session' }),
+    unAuthorizedResponseFunc: unauthorized,
+    errorMessageFunc: errorMessage,
+  })
+  return { request, unauthorized, errorMessage }
+}
+
+describe('NestJS 响应适配', () => {
+  it('读取未包装的数据，并携带 Bearer 令牌', async () => {
+    const { request } = setup()
+    expect(await request.Get('/me')).toEqual({
+      id: 'test-user',
+      authorization: 'Bearer test-session',
+    })
+    expect(await request.Get('/wrapped', { meta: { isWrapped: true } })).toEqual({
+      id: 'test-user',
+    })
+  })
+
+  it('Axios 的 422 走统一错误解析，保留错误码和公开文案', async () => {
+    const { request, unauthorized, errorMessage } = setup()
+    await expect(request.Post('/credentials').send()).rejects.toMatchObject({
+      status: 422,
+      code: 'AUTH.INVALID_CREDENTIALS',
+      message: '账号或密码错误',
+    })
+    expect(errorMessage).toHaveBeenCalledExactlyOnceWith('账号或密码错误')
+    expect(unauthorized).not.toHaveBeenCalled()
+  })
+
+  it.each([201, 202, 204, 206])('HTTP %i 按 Axios 的 2xx 规则返回成功', async (status) => {
+    const { request, unauthorized, errorMessage } = setup()
+    await expect(request.Get(`/http-status/${status}`).send()).resolves.toEqual(
+      status === 204 ? '' : { status },
+    )
+    expect(errorMessage).not.toHaveBeenCalled()
+    expect(unauthorized).not.toHaveBeenCalled()
+  })
+
+  it('默认适配器的 HTTP 401 也走统一错误处理', async () => {
+    const unauthorized = vi.fn()
+    const errorMessage = vi.fn()
+    const request = createInstance({
+      baseUrl,
+      isWrapped: false,
+      unAuthorizedResponseFunc: unauthorized,
+      errorMessageFunc: errorMessage,
+    })
+
+    await expect(request.Get('/expired').send()).rejects.toMatchObject({
+      status: 401,
+      code: 'AUTH.SESSION_INVALID',
+      message: '登录已失效，请重新登录',
+    })
+    expect(unauthorized).toHaveBeenCalledOnce()
+    expect(errorMessage).toHaveBeenCalledExactlyOnceWith('登录已失效，请重新登录')
+  })
+
+  it.each([401, 422])('HTTP 200 下的业务错误 %i 仍会拒绝且只提示一次', async (code) => {
+    const { request, unauthorized, errorMessage } = setup()
+    await expect(
+      request.Get(`/wrapped-error/${code}`, { meta: { isWrapped: true } }).send(),
+    ).rejects.toMatchObject({ status: 200, code, message: '业务处理失败' })
+    expect(errorMessage).toHaveBeenCalledExactlyOnceWith('业务处理失败')
+    expect(unauthorized).toHaveBeenCalledTimes(code === 401 ? 1 : 0)
+  })
+
+  it('页面关闭全局提示后，401 仍触发会话失效回调', async () => {
+    const { request, unauthorized, errorMessage } = setup()
+    await expect(
+      request.Get('/expired', { meta: { isShowErrorMessage: false } }).send(),
+    ).rejects.toMatchObject({ status: 401 })
+    expect(unauthorized).toHaveBeenCalledOnce()
+    expect(unauthorized.mock.calls[0]?.[0].config.headers.get('Authorization')).toBe(
+      'Bearer test-session',
+    )
+    expect(errorMessage).not.toHaveBeenCalled()
+  })
+
+  it('服务暂不可用时保留会话，不当成 401 注销用户', async () => {
+    const { request, unauthorized } = setup()
+    await expect(request.Get('/unavailable').send()).rejects.toMatchObject({
+      status: 503,
+      message: '登录服务暂时不可用，请稍后重试',
+    })
+    expect(unauthorized).not.toHaveBeenCalled()
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/router/access.spec.ts

@@ -0,0 +1,136 @@
+import { beforeEach, describe, expect, it } from 'vite-plus/test'
+import {
+  access,
+  api,
+  makeRouter,
+  resetPolicyData,
+  setAccess,
+  setWorkspaces,
+  workspace,
+} from './config'
+
+beforeEach(() => {
+  resetPolicyData()
+  setWorkspaces([workspace({ type: 'platform' }, 'platform')])
+  setAccess([
+    access(
+      { type: 'platform' },
+      { administrator: 'platform', permissionKeys: ['platform.menus.read'] },
+    ),
+  ])
+})
+
+describe('工作空间与页面权限 middleware', () => {
+  it('叶子页面 403 保留已验证的父级空间，并允许继续进入有权页面', async () => {
+    const fixture = await makeRouter()
+    try {
+      await fixture.router.navigate('/platform/accounts')
+      expect(fixture.router.state.errors?.['platform.accounts']).toMatchObject({ status: 403 })
+      expect(fixture.access({ type: 'platform' })).toMatchObject({
+        permissionKeys: ['platform.menus.read'],
+        workspace: { scope: { type: 'platform' } },
+      })
+      await fixture.router.navigate('/platform/menus')
+      expect(fixture.router.state.errors).toBeNull()
+      expect(fixture.access({ type: 'platform' })?.permissionKeys).toEqual(['platform.menus.read'])
+    } finally {
+      fixture.dispose()
+    }
+  })
+
+  it('首页撤权时跳到其他已授权静态页面', async () => {
+    const fixture = await makeRouter()
+    try {
+      await fixture.router.navigate('/platform')
+      expect(fixture.router.state.location.pathname).toBe('/platform/menus')
+      expect(fixture.router.state.errors).toBeNull()
+      expect(fixture.access({ type: 'platform' })?.scope).toEqual({ type: 'platform' })
+    } finally {
+      fixture.dispose()
+    }
+  })
+
+  it('没有已授权页面时显示 403 且不会循环跳转', async () => {
+    setAccess([access({ type: 'platform' }, { permissionKeys: [] })])
+    const fixture = await makeRouter()
+    try {
+      await fixture.router.navigate('/platform')
+      expect(fixture.router.state.location.pathname).toBe('/platform')
+      expect(fixture.router.state.errors?.['platform.home']).toMatchObject({ status: 403 })
+      expect(api.getAccessContext).toHaveBeenCalledTimes(1)
+    } finally {
+      fixture.dispose()
+    }
+  })
+
+  it('整个作用域失效时清除当前权限上下文', async () => {
+    const fixture = await makeRouter()
+    try {
+      await fixture.router.navigate('/platform/menus')
+      api.getAccessContext.mockRejectedValue(
+        Object.assign(new Error('身份已撤销'), { status: 403 }),
+      )
+      await fixture.router.navigate('/platform/accounts')
+      expect(Object.values(fixture.router.state.errors ?? {})).toEqual([
+        expect.objectContaining({ status: 403 }),
+      ])
+      expect(fixture.access({ type: 'platform' })).toBeUndefined()
+    } finally {
+      fixture.dispose()
+    }
+  })
+
+  it('父级与叶子共享一次权限请求，每次导航重新校验', async () => {
+    const fixture = await makeRouter()
+    try {
+      await fixture.router.navigate('/platform/menus')
+      expect(api.getAccessContext).toHaveBeenCalledTimes(1)
+      expect(api.getWorkspaces).toHaveBeenCalledTimes(1)
+      await fixture.router.navigate('/platform/accounts')
+      expect(api.getAccessContext).toHaveBeenCalledTimes(2)
+      expect(api.getWorkspaces).toHaveBeenCalledTimes(2)
+    } finally {
+      fixture.dispose()
+    }
+  })
+
+  it('重新校验读取最新权限，叶子被撤权后仍保留有效父级空间', async () => {
+    const fixture = await makeRouter()
+    try {
+      await fixture.router.navigate('/platform/menus')
+      setAccess([
+        access(
+          { type: 'platform' },
+          { permissionKeys: ['platform.accounts.read'], menuVersion: 2 },
+        ),
+      ])
+      await fixture.router.revalidate()
+      expect(api.getAccessContext).toHaveBeenCalledTimes(2)
+      expect(api.getWorkspaces).toHaveBeenCalledTimes(2)
+      expect(fixture.router.state.errors?.['platform.menus']).toMatchObject({ status: 403 })
+      expect(fixture.access({ type: 'platform' })).toMatchObject({
+        permissionKeys: ['platform.accounts.read'],
+        menuVersion: 2,
+      })
+    } finally {
+      fixture.dispose()
+    }
+  })
+
+  it('重新校验发现身份撤销时丢弃旧权限', async () => {
+    const fixture = await makeRouter()
+    try {
+      await fixture.router.navigate('/platform/menus')
+      api.getAccessContext.mockRejectedValue(
+        Object.assign(new Error('身份已撤销'), { status: 403 }),
+      )
+      await fixture.router.revalidate()
+      expect(Object.values(fixture.router.state.errors ?? {})).toEqual([
+        expect.objectContaining({ status: 403 }),
+      ])
+      expect(fixture.access({ type: 'platform' })).toBeUndefined()
+    } finally {
+      fixture.dispose()
+    }
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/router/config.ts

@@ -0,0 +1,140 @@
+import { vi } from 'vite-plus/test'
+import type { AccessContext, AccessScope, WorkspaceEntry, WorkspacesResult } from 'shared/types'
+import { accessScopeKey } from 'shared/utils'
+
+const api = vi.hoisted(() => ({
+  getAccessContext:
+    vi.fn<
+      (
+        scope: AccessScope,
+        options: { workspaceKey: string; signal?: AbortSignal },
+      ) => Promise<AccessContext>
+    >(),
+  getWorkspaces:
+    vi.fn<(options: { workspaceKey: string; signal?: AbortSignal }) => Promise<WorkspacesResult>>(),
+}))
+const session = vi.hoisted(() => ({ token: 'session' as string | null }))
+export { api, session }
+vi.mock('@/pages/workspaces/api', () => api)
+vi.mock('@/utils/request/workspace', () => ({ enterWorkspace: vi.fn() }))
+vi.mock('@/utils/storage/cookie', () => ({ cookie: { get: () => session.token } }))
+
+import { authMiddleware } from '../../src/router/middleware/auth'
+import { accessMiddleware } from '../../src/router/middleware/workspace/access'
+import { scopeMiddleware, workspacesMiddleware } from '../../src/router/middleware/workspace/data'
+import { entryMiddleware } from '../../src/router/middleware/workspace/entry'
+import { getWorkspaceState } from '../../src/pages/workspaces/state'
+import type { RegisteredPage } from '../../src/router/page-registry'
+
+export const companyScope = { type: 'company', companyId: 'company-a' } as const
+export const projectScope = {
+  type: 'project',
+  companyId: 'company-a',
+  projectId: 'project-a',
+} as const
+export const projectPath = '/companies/company-a/projects/project-a'
+const user = { id: 'user', name: '测试成员', account: 'member' }
+
+/** 构造完整权限响应，允许各策略用例只覆盖相关业务字段。 */
+export function access(scope: AccessScope, overrides: Partial<AccessContext> = {}): AccessContext {
+  return {
+    user,
+    scope,
+    administrator: null,
+    permissionKeys: [`${scope.type}.home.read`],
+    menus: [],
+    menuVersion: 1,
+    catalogVersion: 'v1',
+    ...overrides,
+  }
+}
+
+/** 构造列表入口，管理员字段与权限响应可分别模拟。 */
+export function workspace(
+  scope: AccessScope,
+  administrator: WorkspaceEntry['administrator'] = null,
+): WorkspaceEntry {
+  return { scope, name: `${scope.type} 工作空间`, administrator }
+}
+
+/** 重置会话及接口，默认允许所有测试作用域的首页。 */
+export function resetPolicyData() {
+  vi.clearAllMocks()
+  session.token = 'session'
+  const state = getWorkspaceState()
+  state.workspaces = undefined
+  state.accessByScope.clear()
+  api.getAccessContext.mockReset().mockImplementation(async (scope) => access(scope))
+  setWorkspaces([])
+}
+
+/** 为后续列表请求提供可明确控制的空间集合。 */
+export function setWorkspaces(workspaces: WorkspaceEntry[]) {
+  api.getWorkspaces.mockReset().mockResolvedValue({ user, workspaces })
+}
+
+/** 按作用域返回指定权限，未指定的作用域仍有默认首页权限。 */
+export function setAccess(contexts: AccessContext[]) {
+  const byScope = new Map(contexts.map((context) => [accessScopeKey(context.scope), context]))
+  api.getAccessContext.mockImplementation(
+    async (scope) => byScope.get(accessScopeKey(scope)) ?? access(scope),
+  )
+}
+
+/** 用真实 middleware 构建最小页面树，保留生产路由的父子错误边界。 */
+function scopeRoute(type: AccessScope['type'], path: string): RouteObject {
+  const pages = type === 'platform' ? ['home', 'accounts', 'menus'] : ['home', 'members', 'roles']
+  return {
+    id: type,
+    path,
+    middleware: [authMiddleware, scopeMiddleware(type)],
+    errorElement: '作用域不可用',
+    children: pages.map((name): RouteObject => ({
+      id: `${type}.${name}`,
+      ...(name === 'home' ? { index: true as const } : { path: name }),
+      middleware: [accessMiddleware(`${type}.${name}` as RegisteredPage)],
+      element: null,
+      errorElement: '页面不可用',
+    })),
+  }
+}
+
+/** 建立内存路由并提供业务数据读取入口，测试结束必须调用 dispose。 */
+export async function makeRouter() {
+  const router = createMemoryRouter(
+    [
+      {
+        id: 'root',
+        errorElement: '路由不可用',
+        children: [
+          { path: '/placeholder', element: null },
+          { path: '/login', element: null },
+          ...['/', '/home'].map((path) => ({
+            path,
+            middleware: [authMiddleware, workspacesMiddleware, entryMiddleware],
+          })),
+          {
+            path: '/workspaces',
+            middleware: [authMiddleware, workspacesMiddleware],
+            element: null,
+          },
+          scopeRoute('platform', '/platform'),
+          scopeRoute('company', '/companies/:companyId'),
+          scopeRoute('project', '/companies/:companyId/projects/:projectId'),
+        ],
+      },
+    ],
+    { initialEntries: ['/placeholder'] },
+  )
+  await vi.waitFor(() => {
+    if (!router.state.initialized) throw new Error('等待初始导航完成')
+  })
+  return {
+    router,
+    access: (scope: AccessScope) => getWorkspaceState().accessByScope.get(accessScopeKey(scope)),
+    workspaces: () => getWorkspaceState().workspaces,
+    dispose() {
+      router.dispose()
+    },
+  }
+}