create-bubbles 0.1.26 → 0.1.28

package/template-vp-monorepo-react-nestjs/apps/web/src/utils/safe-next.ts

@@ -0,0 +1,36 @@
+const INTERNAL_NAVIGATION_ORIGIN = 'https://wanwu.internal'
+
+export interface AuthPathOptions {
+  next?: string | null
+  registered?: boolean
+}
+
+/**
+ * 将外部输入约束为站内绝对路径，拒绝协议地址、协议相对地址及反斜杠绕过。
+ * @param value 查询参数中待校验的跳转目标。
+ * @param fallback 输入不安全或为空时使用的站内回退路径。
+ */
+export function safeNextPath(value: string | null | undefined, fallback = '/'): string {
+  const candidate = value?.trim()
+  if (!candidate?.startsWith('/') || candidate.startsWith('//') || candidate.includes('\\')) {
+    return fallback
+  }
+
+  try {
+    const parsed = new URL(candidate, INTERNAL_NAVIGATION_ORIGIN)
+    if (parsed.origin !== INTERNAL_NAVIGATION_ORIGIN) return fallback
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`
+  } catch {
+    return fallback
+  }
+}
+
+/** 为登录或注册入口附加经过校验的站内 next，并可标记注册完成状态。 */
+export function buildAuthPath(path: '/login' | '/register', options: AuthPathOptions = {}): string {
+  const params = new URLSearchParams()
+  const next = safeNextPath(options.next)
+  if (next !== '/') params.set('next', next)
+  if (options.registered) params.set('registered', '1')
+  const query = params.toString()
+  return query ? `${path}?${query}` : path
+}

package/template-vp-monorepo-react-nestjs/apps/web/src/utils/storage/cookie.ts

@@ -9,6 +9,7 @@ export interface CookieOptions {
 }
 
 export const cookie = {
+  /** 按编码后的名称查找 Cookie 并解码值，格式损坏时保留原值。 */
   get(key: string): string | null {
     const prefix = `${encodeURIComponent(key)}=`
     const entry = document.cookie.split(';').find((item) => item.trim().startsWith(prefix))

package/template-vp-monorepo-react-nestjs/apps/web/src/utils/storage/session.ts

@@ -1,3 +1,4 @@
+/** 为本地或会话存储提供 JSON 序列化读写封装。 */
 function createStorage(type: 'localStorage' | 'sessionStorage') {
   return {
     /** 自动序列化为 JSON；同名写入即为更新。 */

package/template-vp-monorepo-react-nestjs/apps/web/test/i18n-locale.spec.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { getUiLocale } from '@/i18n/ui-locale'
+
+describe('getUiLocale', () => {
+  it('maps Simplified Chinese to all supported locale adapters', () => {
+    const locale = getUiLocale('zh_CN')
+
+    expect(locale.antd.locale).toBe('zh-cn')
+    expect(locale.pro.locale).toBe('zh_CN')
+    expect(locale.dayjs).toBe('zh-cn')
+    expect(locale.document).toBe('zh-CN')
+  })
+
+  it('maps English to all supported locale adapters', () => {
+    const locale = getUiLocale('en_US')
+
+    expect(locale.antd.locale).toBe('en')
+    expect(locale.pro.locale).toBe('en_US')
+    expect(locale.dayjs).toBe('en')
+    expect(locale.document).toBe('en')
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/icon-selector.spec.tsx

@@ -0,0 +1,23 @@
+import { describe, expect, it, vi } from 'vite-plus/test'
+import { IconSelector } from '../src/components/Icon/SvgAsset'
+import { svgAssets } from '../src/components/Icon/SvgAsset/SvgAssetRegistry'
+
+describe('菜单图标选择器', () => {
+  it('展示 SVG 目录中的全部资源并支持搜索、清空和回显', () => {
+    const onChange = vi.fn()
+    const element = IconSelector({ value: 'organization-template', onChange })
+    const props = element.props
+
+    expect(props.allowClear).toBe(true)
+    expect(props.showSearch).toBe(true)
+    expect(props.optionFilterProp).toBe('label')
+    expect(props.options.map((option: { value: string }) => option.value)).toEqual(
+      svgAssets.map((asset) => asset.key),
+    )
+    expect(
+      props.labelRender({ value: 'organization-template', label: 'organization-template' }),
+    ).toBeTruthy()
+    props.onChange?.('', { value: '' })
+    expect(onChange).toHaveBeenCalledWith('', { value: '' })
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/latest-dialog-request.spec.ts

@@ -0,0 +1,89 @@
+import { describe, expect, it, vi } from 'vite-plus/test'
+import { createLatestDialogRequestController } from '../src/hooks/useLatestDialogRequest'
+
+interface Deferred<T> {
+  promise: Promise<T>
+  resolve: (value: T) => void
+}
+
+/** 创建可由测试控制完成时机的 Promise。 */
+function deferred<T>(): Deferred<T> {
+  let resolve: (value: T) => void = () => undefined
+  const promise = new Promise<T>((complete) => {
+    resolve = complete
+  })
+  return { promise, resolve }
+}
+
+/** 创建记录成功与失败回调的弹窗请求参数。 */
+function requestOptions(
+  targetId: string,
+  request: Deferred<string>,
+  opened: string[],
+  onError = vi.fn(),
+) {
+  return {
+    targetId,
+    load: () => request.promise,
+    onSuccess: (result: string) => opened.push(result),
+    onError,
+  }
+}
+
+describe('最新弹窗请求协调器', () => {
+  it('A 慢 B 快时只允许 B 打开弹窗', async () => {
+    const loading: Array<string | undefined> = []
+    const opened: string[] = []
+    const first = deferred<string>()
+    const second = deferred<string>()
+    const controller = createLatestDialogRequestController((targetId) => loading.push(targetId))
+
+    const firstRun = controller.run(requestOptions('A', first, opened))
+    const secondRun = controller.run(requestOptions('B', second, opened))
+    second.resolve('B')
+    await secondRun
+    first.resolve('A')
+    await firstRun
+
+    expect(opened).toEqual(['B'])
+    expect(loading).toEqual(['A', 'B', undefined])
+  })
+
+  it('A 的旧 finally 不会清除仍在加载的 B', async () => {
+    const loading: Array<string | undefined> = []
+    const opened: string[] = []
+    const first = deferred<string>()
+    const second = deferred<string>()
+    const controller = createLatestDialogRequestController((targetId) => loading.push(targetId))
+
+    const firstRun = controller.run(requestOptions('A', first, opened))
+    const secondRun = controller.run(requestOptions('B', second, opened))
+    first.resolve('A')
+    await firstRun
+
+    expect(opened).toEqual([])
+    expect(loading).toEqual(['A', 'B'])
+
+    second.resolve('B')
+    await secondRun
+    expect(opened).toEqual(['B'])
+    expect(loading).toEqual(['A', 'B', undefined])
+  })
+
+  it('失效后的请求不再执行成功或失败回调', async () => {
+    const loading: Array<string | undefined> = []
+    const opened: string[] = []
+    const pending = deferred<string>()
+    const onError = vi.fn()
+    const controller = createLatestDialogRequestController((targetId) => loading.push(targetId))
+
+    const run = controller.run(requestOptions('A', pending, opened, onError))
+    controller.invalidate()
+    pending.resolve('A')
+    await run
+
+    expect(opened).toEqual([])
+    expect(onError).not.toHaveBeenCalled()
+    expect(loading).toEqual(['A'])
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/member-invitation-navigation.spec.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vite-plus/test'
+import { buildCompanyMemberInvitationLink } from '../src/pages/access/components/MemberOnboarding/CompanyMemberInvitation/invitation-link'
+import { buildAuthPath, safeNextPath } from '../src/utils/safe-next'
+
+describe('企业成员邀请导航', () => {
+  it('仅保留站内绝对路径作为登录后跳转目标', () => {
+    const invitationPath = '/member-invitations/accept?token=abc_123-xyz'
+    expect(safeNextPath(invitationPath)).toBe(invitationPath)
+    expect(safeNextPath('https://example.com/steal')).toBe('/')
+    expect(safeNextPath('//example.com/steal')).toBe('/')
+    expect(safeNextPath('/\\example.com/steal')).toBe('/')
+    expect(safeNextPath(undefined, '/workspaces')).toBe('/workspaces')
+  })
+
+  it('在登录与注册之间完整传递邀请返回路径', () => {
+    const next = '/member-invitations/accept?token=abc_123-xyz'
+    const loginPath = buildAuthPath('/login', { next, registered: true })
+    const params = new URL(loginPath, 'https://wanwu.test').searchParams
+
+    expect(loginPath.startsWith('/login?')).toBe(true)
+    expect(params.get('next')).toBe(next)
+    expect(params.get('registered')).toBe('1')
+    expect(buildAuthPath('/register', { next: 'https://example.com' })).toBe('/register')
+  })
+
+  it('用 URLSearchParams 安全组装一次性邀请链接', () => {
+    const link = buildCompanyMemberInvitationLink('abc_123-xyz', 'https://wanwu.test')
+    const url = new URL(link)
+
+    expect(url.origin).toBe('https://wanwu.test')
+    expect(url.pathname).toBe('/member-invitations/accept')
+    expect(url.searchParams.get('token')).toBe('abc_123-xyz')
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/organization-assignment.spec.ts

@@ -0,0 +1,137 @@
+import { describe, expect, it } from 'vite-plus/test'
+import type { OrganizationMemberCandidate, OrganizationScope } from 'shared/types'
+import {
+  canAddOrganizationAssignment,
+  canAddPositionAssignment,
+  canChangeOrganizationDuty,
+  isCandidateActiveInScope,
+} from '../src/utils/organization-assignment'
+
+const companyScope: OrganizationScope = { type: 'company', companyId: 'company-a' }
+
+/** 创建覆盖当前企业身份及可选项目身份的成员候选。 */
+function candidate({
+  accountActive = true,
+  companyMemberActive = true,
+  disabled = false,
+}: {
+  accountActive?: boolean
+  companyMemberActive?: boolean
+  disabled?: boolean
+} = {}): OrganizationMemberCandidate {
+  return {
+    userId: 'user-a',
+    account: 'alice@example.com',
+    name: 'Alice',
+    accountStatus: accountActive ? 'active' : 'disabled',
+    disabled,
+    disabledReason: disabled ? 'memberInactive' : null,
+    identities: [
+      {
+        scope: companyScope,
+        scopeName: '企业 A',
+        memberId: 'company-member',
+        memberStatus: companyMemberActive ? 'active' : 'disabled',
+        scopeStatus: 'active',
+        organizationUnits: [],
+        positions: [],
+        roles: [],
+      },
+      {
+        scope: { type: 'project', companyId: 'company-a', projectId: 'project-a' },
+        scopeName: '项目 A',
+        memberId: 'project-member',
+        memberStatus: 'active',
+        scopeStatus: 'active',
+        organizationUnits: [],
+        positions: [],
+        roles: [],
+      },
+    ],
+  }
+}
+
+describe('组织与岗位新增关系限制', () => {
+  it('按当前作用域身份判断成员有效性，不被其他项目的有效身份掩盖', () => {
+    expect(
+      isCandidateActiveInScope({
+        candidate: candidate({ companyMemberActive: false }),
+        scope: companyScope,
+      }),
+    ).toBe(false)
+    expect(
+      isCandidateActiveInScope({
+        candidate: candidate({ accountActive: false }),
+        scope: companyScope,
+      }),
+    ).toBe(false)
+  })
+
+  it('停用成员或无效组织不能新增关系，但有效关系可以新增', () => {
+    expect(
+      canAddOrganizationAssignment({
+        candidate: candidate({ companyMemberActive: false }),
+        scope: companyScope,
+        unitEffective: true,
+      }),
+    ).toBe(false)
+    expect(
+      canAddOrganizationAssignment({
+        candidate: candidate(),
+        scope: companyScope,
+        unitEffective: false,
+      }),
+    ).toBe(false)
+    expect(
+      canAddOrganizationAssignment({
+        candidate: candidate(),
+        scope: companyScope,
+        unitEffective: true,
+      }),
+    ).toBe(true)
+  })
+
+  it('失效组织关系允许原职责和降级，但禁止职责升级', () => {
+    const input = {
+      candidate: candidate(),
+      scope: companyScope,
+      unitEffective: false,
+      initialDuty: 'deputy' as const,
+    }
+    expect(canChangeOrganizationDuty({ ...input, nextDuty: 'member' })).toBe(true)
+    expect(canChangeOrganizationDuty({ ...input, nextDuty: 'deputy' })).toBe(true)
+    expect(canChangeOrganizationDuty({ ...input, nextDuty: 'leader' })).toBe(false)
+    expect(
+      canChangeOrganizationDuty({
+        candidate: candidate(),
+        scope: companyScope,
+        unitEffective: false,
+        nextDuty: 'member',
+      }),
+    ).toBe(false)
+  })
+
+  it('停用岗位或不可选成员不能新增任职', () => {
+    expect(
+      canAddPositionAssignment({
+        candidate: candidate(),
+        scope: companyScope,
+        positionActive: false,
+      }),
+    ).toBe(false)
+    expect(
+      canAddPositionAssignment({
+        candidate: candidate({ disabled: true }),
+        scope: companyScope,
+        positionActive: true,
+      }),
+    ).toBe(false)
+    expect(
+      canAddPositionAssignment({
+        candidate: candidate(),
+        scope: companyScope,
+        positionActive: true,
+      }),
+    ).toBe(true)
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/password/password-actions.spec.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it, vi } from 'vite-plus/test'
+import type { ChangePasswordRequest, ChangePasswordResult } from 'shared/types'
+
+const session = vi.hoisted(() => ({ clear: vi.fn(), remove: vi.fn() }))
+vi.mock('../../src/utils/request/workspace', () => ({ clearWorkspaceRequests: session.clear }))
+vi.mock('../../src/utils/storage/cookie', () => ({ cookie: { remove: session.remove } }))
+
+import { changePasswordAndClearSession } from '../../src/components/PasswordActions/change-password-session'
+
+const input: ChangePasswordRequest = {
+  oldPassword: 'old-example',
+  newPassword: 'new-example',
+  confirmPassword: 'new-example',
+}
+
+describe('本人改密后的本地会话处理', () => {
+  it('服务端确认成功后才撤销在途工作空间请求并删除本地令牌', async () => {
+    const send = vi
+      .fn<(values: ChangePasswordRequest) => Promise<ChangePasswordResult>>()
+      .mockResolvedValue({ passwordChanged: true })
+
+    await changePasswordAndClearSession(input, send)
+
+    expect(send).toHaveBeenCalledWith(input)
+    expect(session.clear).toHaveBeenCalledOnce()
+    expect(session.remove).toHaveBeenCalledWith('token')
+  })
+
+  it('改密失败时保留仍有效的本地会话和在途请求', async () => {
+    session.clear.mockClear()
+    session.remove.mockClear()
+    const error = new Error('旧密码错误')
+    const send = vi.fn().mockRejectedValue(error)
+
+    await expect(changePasswordAndClearSession(input, send)).rejects.toBe(error)
+
+    expect(session.clear).not.toHaveBeenCalled()
+    expect(session.remove).not.toHaveBeenCalled()
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/password/password-reset-action.spec.ts

@@ -0,0 +1,66 @@
+import type { I18nState } from '@bubblesjs/i18n-core'
+import { describe, expect, it, vi } from 'vite-plus/test'
+import type { AccountRecord } from 'shared/types'
+import { createMemberTableColumns } from '../../src/pages/access/components/MemberTable'
+
+const tr = ((key: string) => key) as I18nState['tr']
+const target: AccountRecord = {
+  id: 'target',
+  account: 'target_account',
+  name: '目标用户',
+  status: 'locked',
+  createdAt: '',
+  updatedAt: '',
+  platformRoleIds: [],
+}
+
+/** 生成只开放改密操作的列，检查平台账号行的目标过滤和事件绑定。 */
+function resetAction(options: { currentUserId: string; canResetPassword: boolean }) {
+  const onResetPassword = vi.fn()
+  const columns = createMemberTableColumns({
+    platform: true,
+    currentUserId: options.currentUserId,
+    companyScope: false,
+    canReadOrganization: false,
+    canAssignOrganization: false,
+    canAssignPositions: false,
+    canManageRoles: false,
+    canManageStatus: false,
+    canResetPassword: options.canResetPassword,
+    canRemove: false,
+    candidateByUserId: new Map(),
+    tr,
+    onOpenOrganizations: vi.fn(),
+    onOpenPositions: vi.fn(),
+    onOpenRoles: vi.fn(),
+    onToggleStatus: vi.fn(),
+    onResetPassword,
+    onRemove: vi.fn(),
+  })
+  const render = columns.find((column) => column.valueType === 'option')?.render as
+    | ((_: unknown, record: AccountRecord) => { props: { children: unknown[] } })
+    | undefined
+  const actions = render?.(undefined, target).props.children ?? []
+  const button = actions.find(
+    (item): item is { props: { children: string; onClick: () => void } } =>
+      typeof item === 'object' &&
+      item !== null &&
+      'props' in item &&
+      (item as { props: { children?: unknown } }).props.children === '重置密码',
+  )
+  return { button, onResetPassword }
+}
+
+describe('平台账号重置密码行操作', () => {
+  it('平台管理员可对其他账号操作，包括锁定账号', () => {
+    const action = resetAction({ currentUserId: 'admin', canResetPassword: true })
+    expect(action.button).toBeDefined()
+    action.button?.props.onClick()
+    expect(action.onResetPassword).toHaveBeenCalledWith(target)
+  })
+
+  it('不展示本人重置入口，也不展示无权限入口', () => {
+    expect(resetAction({ currentUserId: 'target', canResetPassword: true }).button).toBeUndefined()
+    expect(resetAction({ currentUserId: 'admin', canResetPassword: false }).button).toBeUndefined()
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/password/workspaces-password-entry.spec.tsx

@@ -0,0 +1,71 @@
+// @vitest-environment happy-dom
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test'
+
+vi.mock('../../src/pages/workspaces/state', () => ({
+  getWorkspaceState: () => ({
+    workspaces: {
+      user: { id: 'user-without-workspace', name: '无空间用户' },
+      workspaces: [],
+    },
+  }),
+}))
+vi.mock('../../src/api/auth', () => ({ logout: vi.fn() }))
+vi.mock('../../src/utils/request/workspace', () => ({ clearWorkspaceRequests: vi.fn() }))
+vi.mock('../../src/components/Brand/Brand', () => ({ default: () => <span>万物</span> }))
+vi.mock('../../src/components/LocaleSwitch/LocaleSwitch', () => ({ default: () => null }))
+vi.mock('@bubblesjs/i18n-react', () => ({
+  useI18n: () => ({ tr: (key: string) => key }),
+}))
+vi.mock('../../src/components/PasswordActions/ChangePasswordDialog', () => ({
+  /** 模拟改密弹窗的引用接口，以验证页面入口能实际打开它。 */
+  default: function PasswordDialog({ ref }: { ref: Ref<{ show: () => void; hide: () => void }> }) {
+    const [open, setOpen] = useState(false)
+    useImperativeHandle(ref, () => ({ show: () => setOpen(true), hide: () => setOpen(false) }))
+    return open ? <div role="dialog">修改密码表单</div> : null
+  },
+}))
+
+import { App } from 'antd'
+import WorkspacesPage from '../../src/pages/workspaces'
+
+let host: HTMLDivElement
+let root: ReturnType<typeof createRoot>
+
+beforeEach(() => {
+  document.body.replaceChildren()
+  host = document.createElement('div')
+  document.body.append(host)
+  root = createRoot(host)
+})
+
+afterEach(() => {
+  flushSync(() => root.unmount())
+  document.body.replaceChildren()
+})
+
+describe('无工作空间账号的本人改密入口', () => {
+  it('显示空工作空间提示时仍可打开改密表单', async () => {
+    const router = createMemoryRouter([{ path: '/workspaces', element: <WorkspacesPage /> }], {
+      initialEntries: ['/workspaces'],
+    })
+    flushSync(() =>
+      root.render(
+        <App>
+          <RouterProvider router={router} />
+        </App>,
+      ),
+    )
+
+    await vi.waitFor(() => {
+      expect(host.textContent).toContain('暂未加入企业')
+    })
+    const button = [...host.querySelectorAll('button')].find((element) =>
+      element.textContent?.includes('修改密码'),
+    )
+    expect(button).toBeDefined()
+
+    flushSync(() => button?.click())
+    expect(host.querySelector('[role="dialog"]')?.textContent).toBe('修改密码表单')
+  })
+})

package/template-vp-monorepo-react-nestjs/apps/web/test/request.spec.ts

@@ -48,6 +48,7 @@ afterAll(
     ),
 )
 
+/** 创建带鉴权和错误回调监视器的请求实例，供响应处理测试复用。 */
 function setup() {
   const unauthorized = vi.fn()
   const errorMessage = vi.fn()