create-lumal-admin 0.0.5-beta → 0.0.6-beta

package/templates/base/src/{views → app/views}/auth/LoginView.vue

@@ -1,48 +1,47 @@
 <script setup lang="ts">
-import type { FormInstance } from 'element-plus'
-import { ElButton, ElForm, ElFormItem, ElInput } from 'element-plus'
-import { reactive, shallowRef, useTemplateRef } from 'vue'
-import { useRoute, useRouter } from 'vue-router'
-import { routeError } from '../../router'
-import { demoAccount } from '../../services/data-source'
-import { application, login } from '../../services/session'
+import type { FormInstance } from 'element-plus';
+import { ElButton, ElForm, ElFormItem, ElInput } from 'element-plus';
+import { reactive, shallowRef, useTemplateRef } from 'vue';
+import { useRoute, useRouter } from 'vue-router';
+import { isInternalLocation } from '../../menu-policy';
+import { routeError } from '../../router';
+import { demoAccount } from '../../services/data-source';
+import { application, login } from '../../services/session';
 
 /***********************登录状态*********************/
-const route = useRoute()
-const router = useRouter()
-const formRef = useTemplateRef<FormInstance>('formRef')
-const loading = shallowRef(false)
-const errorMessage = shallowRef('')
-const form = reactive({ username: demoAccount?.username ?? '', password: demoAccount?.password ?? '' })
+const route = useRoute();
+const router = useRouter();
+const formRef = useTemplateRef<FormInstance>('formRef');
+const loading = shallowRef(false);
+const errorMessage = shallowRef('');
+const form = reactive({ username: demoAccount?.username ?? '', password: demoAccount?.password ?? '' });
 
 /***********************登录提交*********************/
 function resolveRedirect(): string {
-  const redirect = Array.isArray(route.query.redirect) ? route.query.redirect[0] : route.query.redirect
-  return redirect && redirect.startsWith('/') && !redirect.startsWith('//') && !redirect.startsWith('/login') ? redirect : '/dashboard'
+  const redirect = Array.isArray(route.query.redirect) ? route.query.redirect[0] : route.query.redirect;
+  return redirect && isInternalLocation(redirect) && !redirect.startsWith('/login') ? redirect : '/dashboard';
 }
 
 async function handleSubmit(): Promise<void> {
   if (loading.value) {
-    return
+    return;
   }
 
-  loading.value = true
-  errorMessage.value = ''
+  loading.value = true;
+  errorMessage.value = '';
 
   try {
-    const valid = await formRef.value?.validate()
+    const valid = await formRef.value?.validate();
     if (valid === false) {
-      return
+      return;
     }
 
-    await login(form)
-    await router.replace(resolveRedirect())
-  }
-  catch (error) {
-    errorMessage.value = error instanceof Error ? error.message : '登录失败'
-  }
-  finally {
-    loading.value = false
+    await login(form);
+    await router.replace(resolveRedirect());
+  } catch (error) {
+    errorMessage.value = error instanceof Error ? error.message : '登录失败';
+  } finally {
+    loading.value = false;
   }
 }
 </script>
@@ -50,9 +49,7 @@ async function handleSubmit(): Promise<void> {
 <template>
   <main class="lumal-admin-login">
     <section class="lumal-admin-login__panel">
-      <div class="lumal-admin-login__brand" aria-hidden="true">
-        L
-      </div>
+      <div class="lumal-admin-login__brand" aria-hidden="true">L</div>
       <h1>Lumal Admin</h1>
       <p>轻量后台基座</p>
 
@@ -66,9 +63,7 @@ async function handleSubmit(): Promise<void> {
         <p v-if="errorMessage" class="lumal-admin-login__error" role="alert">
           {{ errorMessage }}
         </p>
-        <ElButton native-type="submit" type="primary" :loading="loading">
-          登录
-        </ElButton>
+        <ElButton native-type="submit" type="primary" :loading="loading"> 登录 </ElButton>
       </ElForm>
 
       <p v-if="routeError || application.error.value" role="alert">

package/templates/base/src/app/views/error/ForbiddenView.vue

@@ -0,0 +1,20 @@
+<script setup lang="ts">
+import { LumalPage } from '@lumal/core/components';
+import { ElButton } from 'element-plus';
+import { useRouter } from 'vue-router';
+
+/***********************路由操作*********************/
+const router = useRouter();
+
+function handleBackDashboardClick(): void {
+  void router.push('/dashboard');
+}
+</script>
+
+<template>
+  <main class="lumal-admin-page">
+    <LumalPage title="无权限" description="当前账号没有访问该页面所需的权限。">
+      <ElButton type="primary" @click="handleBackDashboardClick"> 返回工作台 </ElButton>
+    </LumalPage>
+  </main>
+</template>

package/templates/base/src/{views → app/views}/error/NotFoundView.vue

@@ -1,18 +1,16 @@
 <script setup lang="ts">
-import { LumalPage } from '@lumal/core/components'
-import { ElButton } from 'element-plus'
-import { useRouter } from 'vue-router'
+import { LumalPage } from '@lumal/core/components';
+import { ElButton } from 'element-plus';
+import { useRouter } from 'vue-router';
 
 /***********************异常页导航*********************/
-const router = useRouter()
+const router = useRouter();
 </script>
 
 <template>
   <main class="lumal-admin-page">
     <LumalPage title="页面不存在" description="请检查地址，或返回工作台继续操作。">
-      <ElButton type="primary" @click="router.push('/dashboard')">
-        返回工作台
-      </ElButton>
+      <ElButton type="primary" @click="router.push('/dashboard')"> 返回工作台 </ElButton>
     </LumalPage>
   </main>
 </template>

package/templates/base/src/main.ts

@@ -1,16 +1,15 @@
-import type { IconDefinition } from '@lumal/icons'
-import { registerAuthorityDirectives } from '@lumal/core/directives'
-import { createLumalAdmin } from '@lumal/core/minimal'
-import App from './App.vue'
-import { router } from './router'
-import { permissionStore } from './services/access'
-import '@lumal/core/theme-chalk/index.scss'
-import '@lumal/core/style.css'
-import '@lumal/icons-vue/style.css'
-import 'element-plus/theme-chalk/el-alert.css'
-import 'element-plus/theme-chalk/el-date-picker.css'
-import 'element-plus/theme-chalk/dark/css-vars.css'
-import './styles.scss'
+import type { IconDefinition } from '@lumal/icons';
+import { registerAuthorityDirectives } from '@lumal/core/directives';
+import { createLumalAdmin } from '@lumal/core/minimal';
+import App from './App.vue';
+import { router } from './app/router';
+import { permissionStore } from './app/services/access';
+import '@lumal/core/theme-chalk/index.scss';
+import '@lumal/core/style.css';
+import '@lumal/icons-vue/style.css';
+import 'element-plus/theme-chalk/el-alert.css';
+import 'element-plus/theme-chalk/dark/css-vars.css';
+import './styles.scss';
 
 /***********************本地图标定义*********************/
 const localIcons: IconDefinition[] = [
@@ -18,9 +17,10 @@ const localIcons: IconDefinition[] = [
     key: 'app:dashboard',
     label: '控制台',
     source: 'local-svg',
-    svgText: '<svg viewBox="0 0 24 24"><path fill="currentColor" d="M3 13h8V3H3v10Zm0 8h8v-6H3v6Zm10 0h8V11h-8v10Zm0-18v6h8V3h-8Z"/></svg>',
+    svgText:
+      '<svg viewBox="0 0 24 24"><path fill="currentColor" d="M3 13h8V3H3v10Zm0 8h8v-6H3v6Zm10 0h8V11h-8v10Zm0-18v6h8V3h-8Z"/></svg>',
   },
-]
+];
 
 /***********************应用启动*********************/
 const framework = createLumalAdmin({
@@ -30,12 +30,11 @@ const framework = createLumalAdmin({
   icons: {
     localSvg: localIcons,
   },
-})
+});
 
-registerAuthorityDirectives(framework.app, permissionStore)
+registerAuthorityDirectives(framework.app, permissionStore);
 void framework.mount('#app').catch((error: unknown) => {
-  console.error('应用启动失败', error)
-  const element = document.getElementById('app')
-  if (element)
-    element.textContent = '应用启动失败，请检查配置与控制台。'
-})
+  console.error('应用启动失败', error);
+  const element = document.getElementById('app');
+  if (element) element.textContent = '应用启动失败，请检查配置与控制台。';
+});

package/templates/base/src/modules/business/README.md

@@ -0,0 +1,33 @@
+# 业务模块
+
+在此目录新增 `orders/module.ts`，导出 `menus`、`views` 和可选 `permissions`。
+应用仅自动加载模块元数据，页面使用 `() => import('./OrderView.vue')`。
+业务类型与 API 放在同一模块内，不要向系统管理或 Core 添加业务依赖。
+
+```ts
+import type { AppModule } from '../../../app/module';
+
+export const menus: AppModule['menus'] = [
+  {
+    path: '/orders',
+    name: 'Orders',
+    component: 'business/orders',
+    meta: { title: '订单', authority: ['orders:list'] },
+  },
+];
+export const views: AppModule['views'] = {
+  'business/orders': () => import('./OrderView.vue'),
+};
+export const permissions: AppModule['permissions'] = [
+  { id: 'orders:list', label: '订单列表', permission: 'orders:list' },
+];
+```
+
+后端 `/menus` 必须返回此组件白名单键；HTTP 不会把本地路由悄悄融合到远端菜单中。
+本地开发的权限来自显式注册表，生产权限始终由后端检查。
+
+业务 API、输入/响应类型与页面放在 `orders/` 内，通过 `BusinessTransport` 发送请求。
+Local 模式可在同目录提供 `local.ts`，导出满足 `LocalModule` 的 `createLocalHandler`：
+`handles(path)` 仅匹配本模块端点，`request(method, path, input)` 实现开发行为。
+处理器通过上下文的 `db/user/assertPermission` 读写演示数据、确认身份和检查权限。
+路由元数据和 Local 处理器均自动发现，无需改写中心注册文件；HTTP 仍需真实后端实现同一端点。

package/templates/base/src/{views → modules}/dashboard/DashboardView.vue

@@ -1,9 +1,9 @@
 <script setup lang="ts">
-import { ElDescriptions, ElDescriptionsItem } from 'element-plus'
-import { currentUser, permissionStore } from '../../services/session'
+import { ElDescriptions, ElDescriptionsItem } from 'element-plus';
+import { currentUser, permissionStore } from '../../app/services/session';
 
 /***********************会话摘要*********************/
-const startedAt = new Date().toLocaleDateString()
+const startedAt = new Date().toLocaleDateString();
 </script>
 
 <template>

package/templates/base/src/modules/dashboard/module.ts

@@ -0,0 +1,14 @@
+import type { AppModule } from '../../app/module';
+
+export const menus: AppModule['menus'] = [
+  {
+    path: '/dashboard',
+    name: 'Dashboard',
+    component: 'dashboard/index',
+    meta: { title: '工作台', icon: 'app:dashboard', affixTab: true, keepAlive: true, order: 0 },
+  },
+];
+export const views: AppModule['views'] = {
+  'dashboard/index': () => import('./DashboardView.vue'),
+  'app/iframe': () => import('../../app/views/SafeIframeView.vue'),
+};

package/templates/base/src/shared/api.ts

@@ -0,0 +1,53 @@
+import type { SchemaFormModel } from '@lumal/core/components';
+import { object, stringArray } from '../app/menu-policy';
+
+export type Status = 'enabled' | 'disabled';
+export interface Option {
+  label: string;
+  value: string;
+  disabled?: boolean;
+  children?: Option[];
+}
+export interface Query {
+  keyword?: string;
+  status?: Status | '';
+}
+export interface PageInput<Q = Query> {
+  page: number;
+  pageSize: number;
+  query: Q;
+}
+export { object, stringArray };
+
+export function text(value: unknown, label: string, required = false): string {
+  if (value == null && !required) return '';
+  if (typeof value !== 'string' || (required && !value.trim()))
+    throw new Error(`${label}必须是${required ? '非空' : ''}字符串`);
+  return value.trim();
+}
+export function status(value: unknown): Status {
+  if (value !== 'enabled' && value !== 'disabled') throw new Error('状态仅支持 enabled / disabled');
+  return value;
+}
+export function integer(value: unknown): number {
+  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) throw new Error('排序必须是非负整数');
+  return value;
+}
+export function rows<T>(value: unknown, parse: (item: unknown) => T): T[] {
+  if (!Array.isArray(value)) throw new Error('列表响应必须是数组');
+  return value.map(parse);
+}
+export function options(value: unknown): Option[] {
+  return rows(value, (item) => {
+    const raw = object(item);
+    return {
+      label: text(raw.label, '选项名称', true),
+      value: text(raw.value, '选项值', true),
+      disabled: raw.disabled === true,
+      children: raw.children === undefined ? undefined : options(raw.children),
+    };
+  });
+}
+export function formStatus(model: SchemaFormModel): Status {
+  return status(model.status ?? 'enabled');
+}

package/templates/base/src/shared/components/BaseEntityDialog.vue

@@ -0,0 +1,39 @@
+<script setup lang="ts">
+import type { SchemaFormItem, SchemaFormModel } from '@lumal/core/components';
+import { LumalSchemaForm } from '@lumal/core/components';
+import { ElAlert, ElDialog } from 'element-plus';
+
+/***********************编辑弹窗契约*********************/
+defineProps<{ title: string; schemas: SchemaFormItem[]; editing?: boolean; saving?: boolean; error?: string }>();
+defineEmits<{ submit: [model: SchemaFormModel] }>();
+const visible = defineModel<boolean>('visible', { required: true });
+const model = defineModel<SchemaFormModel>('model', { required: true });
+</script>
+
+<template>
+  <ElDialog
+    v-model="visible"
+    :title="title"
+    width="min(760px, 94vw)"
+    append-to-body
+    destroy-on-close
+    :close-on-click-modal="!saving"
+    :close-on-press-escape="!saving"
+  >
+    <ElAlert v-if="error" :title="error" type="error" :closable="false" role="alert" />
+    <LumalSchemaForm
+      v-model="model"
+      :mode="editing ? 'edit' : 'create'"
+      :schemas="schemas"
+      :columns="2"
+      :submit-loading="saving"
+      show-actions
+      submit-text="保存"
+      @submit="$emit('submit', $event)"
+    >
+      <template v-for="(_, name) in $slots" #[name]="scope">
+        <slot :name="name" v-bind="scope || {}" />
+      </template>
+    </LumalSchemaForm>
+  </ElDialog>
+</template>

package/templates/base/src/shared/composables/use-async-data.ts

@@ -0,0 +1,35 @@
+import { onActivated, onDeactivated, onMounted, onScopeDispose, shallowRef } from 'vue';
+
+export function useAsyncData<T>(fetcher: () => Promise<T>, initial: T) {
+  const data = shallowRef(initial);
+  const loading = shallowRef(false);
+  const error = shallowRef('');
+  let generation = 0;
+  let reactivating = false;
+  async function load(): Promise<void> {
+    const version = ++generation;
+    loading.value = true;
+    error.value = '';
+    try {
+      const next = await fetcher();
+      if (version === generation) data.value = next;
+    } catch (reason) {
+      if (version === generation) error.value = reason instanceof Error ? reason.message : '加载失败';
+      throw reason;
+    } finally {
+      if (version === generation) loading.value = false;
+    }
+  }
+  const reload = () => load().catch(() => {}); // 错误已保留供页面显示和重试。
+  onMounted(reload);
+  onDeactivated(() => {
+    reactivating = true;
+  });
+  onActivated(() => {
+    if (reactivating) void reload();
+  });
+  onScopeDispose(() => {
+    generation += 1;
+  });
+  return { data, loading, error, load, reload };
+}

package/templates/base/src/shared/composables/use-entity-editor.ts

@@ -0,0 +1,77 @@
+import type { SchemaFormModel } from '@lumal/core/components';
+import { ElMessage, ElMessageBox } from 'element-plus';
+import { shallowRef } from 'vue';
+
+interface EditorOptions<T extends { id: string }, Input> {
+  create: (input: Input) => Promise<unknown>;
+  update: (id: string, input: Input) => Promise<unknown>;
+  remove: (id: string) => Promise<unknown>;
+  toInput: (model: SchemaFormModel) => Input;
+  reload: () => Promise<void>;
+  removeMessage?: (record: T) => string;
+}
+export function useEntityEditor<T extends { id: string }, Input>(options: EditorOptions<T, Input>) {
+  const visible = shallowRef(false);
+  const model = shallowRef<SchemaFormModel>({});
+  const editing = shallowRef<T>();
+  const saving = shallowRef(false);
+  const error = shallowRef('');
+  function openCreate(initial: SchemaFormModel = {}): void {
+    editing.value = undefined;
+    model.value = structuredClone(initial);
+    error.value = '';
+    visible.value = true;
+  }
+  function openEdit(record: T): void {
+    editing.value = record;
+    model.value = structuredClone(record) as SchemaFormModel;
+    error.value = '';
+    visible.value = true;
+  }
+  async function submit(values: SchemaFormModel): Promise<void> {
+    if (saving.value) return;
+    saving.value = true;
+    error.value = '';
+    let persisted = false;
+    try {
+      const input = options.toInput(values);
+      if (editing.value) await options.update(editing.value.id, input);
+      else await options.create(input);
+      persisted = true;
+      visible.value = false;
+      await options.reload();
+      ElMessage.success('保存成功');
+    } catch (reason) {
+      const message = reason instanceof Error ? reason.message : '操作失败';
+      error.value = persisted ? `保存已完成，但刷新失败：${message}。请重新加载，不要重复提交。` : message;
+    } finally {
+      saving.value = false;
+    }
+  }
+  async function remove(record: T): Promise<void> {
+    if (saving.value) return;
+    try {
+      await ElMessageBox.confirm(options.removeMessage?.(record) ?? '确定删除该记录？', '删除确认', {
+        confirmButtonText: '删除',
+        cancelButtonText: '取消',
+        type: 'warning',
+      });
+    } catch {
+      return;
+    }
+    saving.value = true;
+    error.value = '';
+    let persisted = false;
+    try {
+      await options.remove(record.id);
+      persisted = true;
+      await options.reload();
+      ElMessage.success('删除成功');
+    } catch (reason) {
+      error.value = `${persisted ? '删除已完成，但刷新失败：' : ''}${reason instanceof Error ? reason.message : '删除失败'}`;
+    } finally {
+      saving.value = false;
+    }
+  }
+  return { visible, model, editing, saving, error, openCreate, openEdit, submit, remove };
+}

package/templates/base/src/shared/status.ts

@@ -0,0 +1,4 @@
+export const statusOptions = [
+  { label: '启用', value: 'enabled' },
+  { label: '停用', value: 'disabled' },
+];

package/templates/base/src/shared/tree.ts

@@ -0,0 +1,41 @@
+export interface TreeItem {
+  id: string;
+  parentId: string;
+}
+
+export function assertHierarchy<T extends TreeItem>(items: T[]): void {
+  const byId = new Map(items.map((item) => [item.id, item]));
+  if (byId.size !== items.length) throw new Error('树节点 ID 重复');
+  for (const item of items) {
+    const visited = new Set([item.id]);
+    let parent = item.parentId;
+    while (parent) {
+      if (visited.has(parent)) throw new Error('父子关系形成循环');
+      const found = byId.get(parent);
+      if (!found) throw new Error('父节点不存在');
+      visited.add(parent);
+      parent = found.parentId;
+    }
+  }
+}
+export function buildTree<T extends TreeItem>(
+  items: T[],
+  parentId = '',
+): (T & { children: (T & { children?: T[] })[] })[] {
+  return items
+    .filter((item) => item.parentId === parentId)
+    .map((item) => ({ ...item, children: buildTree(items, item.id) }));
+}
+export function flattenTree<T extends { children?: T[] }>(items: T[]): T[] {
+  return items.flatMap((item) => [item, ...flattenTree(item.children ?? [])]);
+}
+export function excludedDescendants<T extends TreeItem>(items: T[], id?: string): Set<string> {
+  const excluded = new Set<string>();
+  function visit(current?: string): void {
+    if (!current || excluded.has(current)) return;
+    excluded.add(current);
+    items.filter((item) => item.parentId === current).forEach((item) => visit(item.id));
+  }
+  visit(id);
+  return excluded;
+}

package/templates/base/src/styles.scss

@@ -1,12 +1,7 @@
 :root {
   color: var(--el-text-color-primary);
   background: var(--el-bg-color-page);
-  font-family:
-    Inter,
-    "Segoe UI",
-    "Microsoft YaHei",
-    Arial,
-    sans-serif;
+  font-family: Inter, 'Segoe UI', 'Microsoft YaHei', Arial, sans-serif;
 }
 
 body {

package/templates/base/tests/menu-policy.test.ts.template

@@ -0,0 +1,89 @@
+import { describe, expect, it } from 'vitest';
+import {
+  isInternalLocation,
+  resolveView,
+  safeExternalUrl,
+  validateMenus,
+  withAccessibleRedirects,
+} from '../src/app/menu-policy';
+import { assembleModules, collectPermissions } from '../src/app/module';
+
+const views = { page: async () => ({}), 'app/iframe': async () => ({}) };
+const page = (path = '/page') => ({ path, name: path, component: 'page', meta: {} });
+describe('远程菜单信任边界', () => {
+  it.each(['constructor', '__proto__', 'prototype', 'missing', 'https://evil.invalid/a.js'])(
+    '拒绝非白名单组件 %s',
+    (component) => {
+      expect(() => validateMenus([{ ...page(), component }], views)).toThrow('白名单');
+      expect(() =>
+        validateMenus([{ path: '/group', name: 'group', children: [{ ...page('/group/page'), component }] }], views),
+      ).toThrow('白名单');
+    },
+  );
+  it('仅接受自有函数加载器', () => {
+    const inherited = Object.create({ page: async () => ({}) });
+    expect(resolveView(inherited, 'page')).toBeUndefined();
+    expect(resolveView({ page: false } as unknown as typeof views, 'page')).toBeUndefined();
+    expect(resolveView(views, 'page')).toBe(views.page);
+  });
+  it.each([
+    'javascript:alert(1)',
+    'data:text/html,bad',
+    'vbscript:x',
+    '//evil.invalid',
+    'ftp://evil.invalid',
+    'https://user:pass@evil.invalid',
+    'https://evil.invalid\\test',
+    ' https://evil.invalid',
+    'https://evil.invalid/\nfoo',
+  ])('拒绝危险外链 %s', (url) => {
+    expect(() => safeExternalUrl(url)).toThrow();
+    expect(() => validateMenus([{ ...page(), meta: { externalLink: url } }], views)).toThrow();
+  });
+  it('站内地址、iframe 来源和重定向有独立约束', () => {
+    expect(safeExternalUrl('https://example.com/path')).toBe('https://example.com/path');
+    expect(isInternalLocation('/page?q=1')).toBe(true);
+    for (const path of ['//host', '/a/../b', '/%2fhost', '/a\\b', 'https://example.com'])
+      expect(isInternalLocation(path)).toBe(false);
+    expect(() => validateMenus([{ ...page(), redirect: '//evil.invalid' }], views)).toThrow();
+    expect(() => validateMenus([{ ...page(), meta: { iframeSrc: 'https://evil.invalid' } }], views)).toThrow('iframe');
+  });
+  it('拒绝异常权限、重复路由和循环结构，远程 ignoreAccess 不能取消权限', () => {
+    expect(() => validateMenus([{ ...page(), meta: { authority: [7] } }], views)).toThrow();
+    expect(() => validateMenus([page(), page()], views)).toThrow('重复');
+    const node = { path: '/loop', name: 'Loop', children: [] as unknown[] };
+    node.children.push(node);
+    expect(() => validateMenus([node], views)).toThrow('循环');
+    const result = validateMenus(
+      [{ ...page(), meta: { authority: ['read'], ignoreAccess: true, requireLogin: false } }],
+      views,
+    );
+    expect(result[0]?.meta?.authority).toEqual(['read']);
+    expect(result[0]?.meta).not.toHaveProperty('requireLogin');
+  });
+});
+describe('模块权限与目录重定向', () => {
+  it('递归提取真实操作，不机械生成权限', () => {
+    const permissions = [{ id: 'group', label: '分组', children: [{ id: 'read', label: '读取', permission: 'read' }] }];
+    expect(collectPermissions(permissions)).toEqual(['read']);
+    expect(assembleModules([{ menus: [], views, permissions }]).permissionCodes).toEqual(['read']);
+  });
+  it('父目录跳到首个有权限的子页，无可访问子页时隐藏', () => {
+    const menus = [
+      {
+        path: '/group',
+        name: 'Group',
+        children: [
+          { ...page('/group/a'), meta: { authority: ['a'] } },
+          { ...page('/group/b'), meta: { authority: ['b'] } },
+        ],
+      },
+    ];
+    expect(withAccessibleRedirects(menus, { roles: [], permissions: ['b'] })[0]?.redirect).toBe('/group/b');
+    expect(withAccessibleRedirects(menus, { roles: [], permissions: [] })[0]?.meta?.hideInMenu).toBe(true);
+    expect(
+      withAccessibleRedirects([{ ...menus[0]!, meta: { authority: ['parent'] } }], { roles: [], permissions: ['b'] })[0]
+        ?.redirect,
+    ).toBe('/403');
+  });
+});