create-react-admin-template 0.0.0-stage → 0.1.0

package/template/tests/unit/authentication/authentication.test.ts

@@ -0,0 +1,376 @@
+import {
+  AuthenticationError,
+  fnCreateAuthenticationController,
+  fnResolveAuthenticationRedirect,
+  type IAuthenticationAdapter,
+  type TAuthenticationAdapterResult,
+  type TAuthenticationCompletion,
+} from '@/authentication'
+import { describe, expect, it, vi } from 'vitest'
+
+const objRedirectPolicy = {
+  arrAllowedOrigins: ['https://identity.example.com'],
+  strApplicationOrigin: 'https://admin.example.com',
+}
+
+function fnCreateSignInCompletion(): TAuthenticationAdapterResult {
+  return {
+    objCompletion: {
+      objTokenResult: {
+        objUser: {
+          strId: 'user-1',
+          strRole: 'admin',
+        },
+        strAccessToken: 'access-token',
+        strRefreshToken: 'refresh-token',
+      },
+      strPurpose: 'signIn',
+      strReturnPath: '/dashboard',
+    },
+    strResult: 'complete',
+  }
+}
+
+function fnCreateAdapter(
+  objOverrides: Partial<IAuthenticationAdapter> = {}
+): IAuthenticationAdapter {
+  return {
+    fnCompleteRedirect: async () => fnCreateSignInCompletion(),
+    fnStart: async () => fnCreateSignInCompletion(),
+    fnVerifyChallenge: async () => fnCreateSignInCompletion(),
+    ...objOverrides,
+  }
+}
+
+describe('authentication redirect policy', () => {
+  it('allows same-origin paths and explicitly allowlisted HTTPS providers', () => {
+    expect(
+      fnResolveAuthenticationRedirect('/auth/continue', objRedirectPolicy)
+    ).toBe('https://admin.example.com/auth/continue')
+    expect(
+      fnResolveAuthenticationRedirect(
+        'https://identity.example.com/authorize?client_id=public-client',
+        objRedirectPolicy
+      )
+    ).toBe('https://identity.example.com/authorize?client_id=public-client')
+  })
+
+  it('rejects unknown origins, credentials, fragments and external HTTP', () => {
+    const arrUnsafeUrls = [
+      'https://evil.example.com/authorize',
+      'https://user:password@identity.example.com/authorize',
+      'https://identity.example.com/authorize#access_token=secret',
+      'http://identity.example.com/authorize',
+      'javascript:alert(1)',
+    ]
+
+    arrUnsafeUrls.forEach((strUrl) => {
+      expect(() =>
+        fnResolveAuthenticationRedirect(strUrl, objRedirectPolicy)
+      ).toThrowError(AuthenticationError)
+    })
+  })
+})
+
+describe('authentication controller', () => {
+  it('moves from challenge to completion without retaining tokens in snapshot', async () => {
+    const fnOnComplete = vi.fn(
+      async (
+        _objCompletion: TAuthenticationCompletion,
+        _objContext: { readonly objSignal: AbortSignal }
+      ) => undefined
+    )
+    const objAdapter = fnCreateAdapter({
+      fnStart: async () => ({
+        objChallenge: {
+          nAttemptsRemaining: 3,
+          nExpiresAt: Date.now() + 60_000,
+          strChallengeId: 'challenge-1',
+          strMaskedDestination: '138****0000',
+          strMethod: 'smsOtp',
+        },
+        strPurpose: 'signIn',
+        strResult: 'challenge',
+        strTransactionId: 'transaction-1',
+      }),
+      fnVerifyChallenge: async () => fnCreateSignInCompletion(),
+    })
+    const objController = fnCreateAuthenticationController({
+      fnNavigateRedirect: vi.fn(),
+      fnOnComplete,
+      objAdapter,
+      objRedirectPolicy,
+    })
+
+    const objChallengeSnapshot = await objController.fnStart({
+      strProviderKey: 'password',
+      strPurpose: 'signIn',
+      strReturnPath: '/dashboard',
+    })
+    expect(objChallengeSnapshot).toMatchObject({
+      objChallenge: { strChallengeId: 'challenge-1' },
+      strStatus: 'awaitingChallenge',
+      strTransactionId: 'transaction-1',
+    })
+
+    const objCompletedSnapshot = await objController.fnVerifyChallenge({
+      objResponse: { code: '123456' },
+      strChallengeId: 'challenge-1',
+      strMethod: 'smsOtp',
+    })
+
+    expect(fnOnComplete).toHaveBeenCalledOnce()
+    const [objCompletion, objCompletionContext] = fnOnComplete.mock.calls[0]
+    expect(objCompletion).toMatchObject({ strPurpose: 'signIn' })
+    expect(objCompletionContext.objSignal).toBeInstanceOf(AbortSignal)
+    expect(objCompletedSnapshot).toMatchObject({
+      strPurpose: 'signIn',
+      strStatus: 'completed',
+    })
+    expect('objCompletion' in objCompletedSnapshot).toBe(false)
+    expect('strAccessToken' in objCompletedSnapshot).toBe(false)
+  })
+
+  it('validates redirect URLs before invoking browser navigation', async () => {
+    const fnNavigateRedirect = vi.fn(async () => undefined)
+    const objController = fnCreateAuthenticationController({
+      fnNavigateRedirect,
+      fnOnComplete: vi.fn(),
+      objAdapter: fnCreateAdapter({
+        fnStart: async () => ({
+          strPurpose: 'signIn',
+          strRedirectUrl: 'https://identity.example.com/authorize',
+          strResult: 'redirect',
+          strTransactionId: 'transaction-redirect',
+        }),
+      }),
+      objRedirectPolicy,
+    })
+
+    const objSnapshot = await objController.fnStart({
+      strProviderKey: 'corporate-sso',
+      strPurpose: 'signIn',
+    })
+
+    expect(fnNavigateRedirect).toHaveBeenCalledWith(
+      'https://identity.example.com/authorize'
+    )
+    expect(objSnapshot.strStatus).toBe('redirecting')
+  })
+
+  it('rejects unsafe post-sign-in redirects before calling the Adapter', async () => {
+    const fnStart = vi.fn(async () => fnCreateSignInCompletion())
+    const objAdapter = fnCreateAdapter({ fnStart })
+    const objController = fnCreateAuthenticationController({
+      fnNavigateRedirect: vi.fn(),
+      fnOnComplete: vi.fn(),
+      objAdapter,
+      objRedirectPolicy,
+    })
+
+    const objSnapshot = await objController.fnStart({
+      strProviderKey: 'corporate-sso',
+      strPurpose: 'signIn',
+      strReturnPath: 'https://evil.example.com/capture',
+    })
+
+    expect(fnStart).not.toHaveBeenCalled()
+    expect(objSnapshot).toMatchObject({
+      objError: { strCode: 'invalid_input' },
+      strStatus: 'error',
+    })
+  })
+
+  it('completes Step-up callbacks without creating a second login result', async () => {
+    const fnOnComplete = vi.fn(
+      async (
+        _objCompletion: TAuthenticationCompletion,
+        _objContext: { readonly objSignal: AbortSignal }
+      ) => undefined
+    )
+    const objController = fnCreateAuthenticationController({
+      fnNavigateRedirect: vi.fn(),
+      fnOnComplete,
+      objAdapter: fnCreateAdapter({
+        fnCompleteRedirect: async () => ({
+          objCompletion: {
+            objGrant: {
+              nExpiresAt: 2_000_000_000_000,
+              strGrantId: 'step-up-grant-1',
+              strMode: 'serverSession',
+            },
+            strPurpose: 'stepUp',
+          },
+          strResult: 'complete',
+        }),
+      }),
+      objRedirectPolicy,
+    })
+
+    const objSnapshot = await objController.fnCompleteRedirect({
+      objParameters: { code: 'callback-code', state: 'opaque-state' },
+      strPurpose: 'stepUp',
+    })
+
+    expect(fnOnComplete).toHaveBeenCalledOnce()
+    const [objCompletion, objCompletionContext] = fnOnComplete.mock.calls[0]
+    expect(objCompletion).toEqual({
+      objGrant: {
+        nExpiresAt: 2_000_000_000_000,
+        strGrantId: 'step-up-grant-1',
+        strMode: 'serverSession',
+      },
+      strPurpose: 'stepUp',
+    })
+    expect(objCompletionContext.objSignal).toBeInstanceOf(AbortSignal)
+    expect(objSnapshot.strStatus).toBe('completed')
+  })
+
+  it('aborts stale work and ignores its late result', async () => {
+    let fnResolveSlowRequest: (
+      objResult: TAuthenticationAdapterResult
+    ) => void = () => undefined
+    let objSlowSignal: AbortSignal | undefined
+    const objSlowRequest = new Promise<TAuthenticationAdapterResult>(
+      (fnResolve) => {
+        fnResolveSlowRequest = fnResolve
+      }
+    )
+    const objAdapter = fnCreateAdapter({
+      fnStart: async (objInput, { objSignal }) => {
+        if (objInput.strProviderKey === 'slow-provider') {
+          objSlowSignal = objSignal
+          return objSlowRequest
+        }
+        return {
+          objChallenge: {
+            nExpiresAt: Date.now() + 60_000,
+            strChallengeId: 'current-challenge',
+            strMethod: 'totp',
+          },
+          strPurpose: 'signIn',
+          strResult: 'challenge',
+          strTransactionId: 'current-transaction',
+        }
+      },
+    })
+    const objController = fnCreateAuthenticationController({
+      fnNavigateRedirect: vi.fn(),
+      fnOnComplete: vi.fn(),
+      objAdapter,
+      objRedirectPolicy,
+    })
+
+    const objSlowOperation = objController.fnStart({
+      strProviderKey: 'slow-provider',
+      strPurpose: 'signIn',
+    })
+    const objCurrentSnapshot = await objController.fnStart({
+      strProviderKey: 'current-provider',
+      strPurpose: 'signIn',
+    })
+    fnResolveSlowRequest(fnCreateSignInCompletion())
+    await objSlowOperation
+
+    expect(objSlowSignal?.aborted).toBe(true)
+    expect(objCurrentSnapshot.strStatus).toBe('awaitingChallenge')
+    expect(objController.fnGetSnapshot()).toMatchObject({
+      objChallenge: { strChallengeId: 'current-challenge' },
+      strStatus: 'awaitingChallenge',
+    })
+  })
+
+  it('does not publish stale completion after a newer flow starts', async () => {
+    let fnResolveCompletion: () => void = () => undefined
+    let objCompletionSignal: AbortSignal | undefined
+    const objCompletionGate = new Promise<void>((fnResolve) => {
+      fnResolveCompletion = fnResolve
+    })
+    const objController = fnCreateAuthenticationController({
+      fnNavigateRedirect: vi.fn(),
+      fnOnComplete: async (_objCompletion, { objSignal }) => {
+        objCompletionSignal = objSignal
+        await objCompletionGate
+      },
+      objAdapter: fnCreateAdapter({
+        fnStart: async (objInput) =>
+          objInput.strProviderKey === 'completing-provider'
+            ? fnCreateSignInCompletion()
+            : {
+                objChallenge: {
+                  nExpiresAt: Date.now() + 60_000,
+                  strChallengeId: 'newer-challenge',
+                  strMethod: 'totp',
+                },
+                strPurpose: 'signIn',
+                strResult: 'challenge',
+                strTransactionId: 'newer-transaction',
+              },
+      }),
+      objRedirectPolicy,
+    })
+
+    const objCompletingOperation = objController.fnStart({
+      strProviderKey: 'completing-provider',
+      strPurpose: 'signIn',
+    })
+    await vi.waitFor(() => expect(objCompletionSignal).toBeDefined())
+    await objController.fnStart({
+      strProviderKey: 'newer-provider',
+      strPurpose: 'signIn',
+    })
+    fnResolveCompletion()
+    await objCompletingOperation
+
+    expect(objCompletionSignal?.aborted).toBe(true)
+    expect(objController.fnGetSnapshot()).toMatchObject({
+      objChallenge: { strChallengeId: 'newer-challenge' },
+      strStatus: 'awaitingChallenge',
+    })
+  })
+
+  it('cancels the current remote transaction without restoring failed state', async () => {
+    const fnCancel = vi.fn<NonNullable<IAuthenticationAdapter['fnCancel']>>(
+      async () => {
+        throw new Error('remote cancellation failed')
+      }
+    )
+    const objController = fnCreateAuthenticationController({
+      fnNavigateRedirect: vi.fn(),
+      fnOnComplete: vi.fn(),
+      objAdapter: fnCreateAdapter({
+        fnCancel,
+        fnStart: async () => ({
+          objChallenge: {
+            nExpiresAt: Date.now() + 60_000,
+            strChallengeId: 'cancel-challenge',
+            strMethod: 'totp',
+          },
+          strPurpose: 'stepUp',
+          strResult: 'challenge',
+          strTransactionId: 'cancel-transaction',
+        }),
+      }),
+      objRedirectPolicy,
+    })
+    await objController.fnStart({
+      strActionKey: 'customer:phone:reveal',
+      strProviderKey: 'corporate-mfa',
+      strPurpose: 'stepUp',
+    })
+
+    const objSnapshot = await objController.fnCancel()
+
+    expect(fnCancel).toHaveBeenCalledOnce()
+    const [objCancelInput, objCancelContext] = fnCancel.mock.calls[0]
+    expect(objCancelInput).toEqual({
+      strPurpose: 'stepUp',
+      strTransactionId: 'cancel-transaction',
+    })
+    expect(objCancelContext.objSignal).toBeInstanceOf(AbortSignal)
+    expect(objSnapshot).toMatchObject({
+      strPurpose: 'stepUp',
+      strStatus: 'cancelled',
+    })
+  })
+})

package/template/tests/unit/components/AppDialog.test.tsx

@@ -0,0 +1,225 @@
+import { LocaleProvider } from '@/locale'
+import '@/styles/index.css'
+import { describe, expect, it, vi } from 'vitest'
+import { render } from 'vitest-browser-react'
+import { AppConfirmDialog, AppDialog } from '@/components/AppDialog'
+import { RouteDialog, useRouteDialogNavigation } from '@/components/RouteDialog'
+
+function RouteDialogNavigationHarness({
+  fnPrepareAndNavigate,
+}: {
+  fnPrepareAndNavigate: () => Promise<void>
+}) {
+  const { strPendingRouteDialogKey, fnOpenRouteDialog } =
+    useRouteDialogNavigation()
+
+  return (
+    <button
+      type='button'
+      disabled={Boolean(strPendingRouteDialogKey)}
+      onClick={() => void fnOpenRouteDialog('detail:1', fnPrepareAndNavigate)}
+    >
+      {strPendingRouteDialogKey ? '正在打开' : '打开详情'}
+    </button>
+  )
+}
+
+describe('AppDialog', () => {
+  it('composes the shared header, scrollable body and footer', async () => {
+    const fnOnOpenChange = vi.fn()
+
+    await render(
+      <AppDialog
+        bOpen
+        fnOnOpenChange={fnOnOpenChange}
+        strTitle='公共弹窗'
+        strDescription='统一弹窗结构'
+        strSize='lg'
+        objFooter={<button type='button'>保存</button>}
+      >
+        <div style={{ height: '180vh' }}>可滚动内容</div>
+      </AppDialog>
+    )
+
+    const objContent = document.querySelector<HTMLElement>(
+      '[data-slot="dialog-content"]'
+    )!
+    const objBody = document.querySelector<HTMLElement>(
+      '[data-slot="dialog-body"]'
+    )!
+
+    expect(objContent).toHaveClass('sm:max-w-2xl')
+    expect(objBody).toHaveClass('min-h-0', 'flex-1', 'overflow-y-auto')
+    expect(document.body.textContent).toContain('公共弹窗')
+    expect(document.body.textContent).toContain('统一弹窗结构')
+    expect(document.body.textContent).toContain('保存')
+    expect(document.body.textContent).not.toContain('取消')
+  })
+
+  it('provides standard cancel and confirm actions', async () => {
+    const fnOnOpenChange = vi.fn()
+    const fnOnConfirm = vi.fn()
+
+    await render(
+      <AppDialog
+        bOpen
+        fnOnOpenChange={fnOnOpenChange}
+        fnOnConfirm={fnOnConfirm}
+        strTitle='标准操作弹窗'
+        strConfirmText='保存'
+        bConfirmPending
+      >
+        弹窗内容
+      </AppDialog>
+    )
+
+    const arrButtons = Array.from(document.querySelectorAll('button'))
+    const objCancelButton = arrButtons.find(
+      (objButton) => objButton.textContent === '取消'
+    )!
+    const objConfirmButton = arrButtons.find(
+      (objButton) => objButton.textContent === '保存'
+    )!
+
+    expect(objConfirmButton).toBeDisabled()
+    objCancelButton.click()
+    expect(fnOnOpenChange).toHaveBeenCalledWith(false)
+
+    await render(
+      <AppDialog
+        bOpen
+        fnOnOpenChange={fnOnOpenChange}
+        fnOnConfirm={fnOnConfirm}
+        strTitle='可提交弹窗'
+        strConfirmText='确定'
+      >
+        弹窗内容
+      </AppDialog>
+    )
+
+    const objEnabledConfirmButton = Array.from(
+      document.querySelectorAll('button')
+    ).find((objButton) => objButton.textContent === '确定')!
+    objEnabledConfirmButton.click()
+    expect(fnOnConfirm).toHaveBeenCalledOnce()
+  })
+
+  it('renders confirmation content as one concise prompt', async () => {
+    const fnOnRequestChange = vi.fn()
+    const fnOnConfirm = vi.fn()
+    const objScreen = await render(
+      <AppConfirmDialog
+        fnOnRequestChange={fnOnRequestChange}
+        objRequest={{
+          strTitle: '删除记录？',
+          strDescription: '删除后将无法恢复。',
+          objContent: '示例记录',
+          strConfirmText: '删除',
+          strConfirmVariant: 'destructive',
+          fnOnConfirm,
+        }}
+      />
+    )
+
+    const objDialog = objScreen.getByRole('dialog')
+    await expect
+      .element(objDialog.getByRole('heading', { name: '提示' }))
+      .toBeVisible()
+    await expect
+      .element(
+        objDialog.getByText('确定删除记录“示例记录”吗？删除后将无法恢复。')
+      )
+      .toBeVisible()
+    expect(
+      document.querySelector('[data-slot="dialog-description"]')
+    ).toBeNull()
+    expect(document.querySelector('[data-slot="dialog-header"]')).toHaveClass(
+      'border-b-0'
+    )
+    expect(document.querySelector('[data-slot="dialog-body"]')).toHaveClass(
+      'py-3'
+    )
+    expect(document.querySelector('[data-slot="dialog-footer"]')).toHaveClass(
+      'border-t-0'
+    )
+
+    await objDialog.getByRole('button', { name: '删除', exact: true }).click()
+    expect(fnOnRequestChange).toHaveBeenCalledWith(undefined)
+    expect(fnOnConfirm).toHaveBeenCalledOnce()
+  })
+
+  it('localizes defaults while preserving explicit action text', async () => {
+    const objScreen = await render(
+      <LocaleProvider strLocale='en-US' strTimeZone='UTC'>
+        <AppConfirmDialog
+          fnOnRequestChange={() => undefined}
+          objRequest={{
+            strTitle: 'Delete record?',
+            strDescription: 'This cannot be undone.',
+            objContent: 'Example record',
+            strConfirmText: 'Delete permanently',
+            fnOnConfirm: () => undefined,
+          }}
+        />
+      </LocaleProvider>
+    )
+
+    const objDialog = objScreen.getByRole('dialog')
+    await expect
+      .element(objDialog.getByRole('heading', { name: 'Confirmation' }))
+      .toBeVisible()
+    await expect
+      .element(
+        objDialog.getByText(
+          'Are you sure you want to Delete record “Example record”?This cannot be undone.'
+        )
+      )
+      .toBeVisible()
+    await expect
+      .element(objDialog.getByRole('button', { name: 'Cancel' }))
+      .toBeVisible()
+    await expect
+      .element(objDialog.getByRole('button', { name: 'Delete permanently' }))
+      .toBeVisible()
+  })
+
+  it('delegates route dialog closing without a second open state', async () => {
+    const fnOnClose = vi.fn()
+    const objScreen = await render(
+      <RouteDialog fnOnClose={fnOnClose} strTitle='路由弹窗'>
+        已加载内容
+      </RouteDialog>
+    )
+
+    await expect.element(objScreen.getByRole('dialog')).toBeVisible()
+    await objScreen.getByRole('button', { name: '关闭' }).click()
+
+    expect(fnOnClose).toHaveBeenCalledOnce()
+  })
+
+  it('keeps loading on the opener until preparation and navigation finish', async () => {
+    let fnResolvePreparation: () => void = () => undefined
+    const objPreparation = new Promise<void>((fnResolve) => {
+      fnResolvePreparation = fnResolve
+    })
+    const fnPrepareAndNavigate = vi.fn(() => objPreparation)
+    const objScreen = await render(
+      <RouteDialogNavigationHarness
+        fnPrepareAndNavigate={fnPrepareAndNavigate}
+      />
+    )
+
+    await objScreen.getByRole('button', { name: '打开详情' }).click()
+    const objPendingButton = objScreen.getByRole('button', {
+      name: '正在打开',
+    })
+    await expect.element(objPendingButton).toBeDisabled()
+
+    fnResolvePreparation()
+
+    await expect
+      .element(objScreen.getByRole('button', { name: '打开详情' }))
+      .toBeEnabled()
+    expect(fnPrepareAndNavigate).toHaveBeenCalledOnce()
+  })
+})