优化构架

src/core/auth/auth.test.ts

@@ -0,0 +1,154 @@
+import { createPinia, setActivePinia } from 'pinia'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  post: vi.fn(),
+  listCurrentPlatformPermissionCodes: vi.fn(),
+  refreshHandler: null as null | (() => Promise<string>),
+}))
+
+vi.mock('@/shared/api/http', () => ({
+  http: { post: mocks.post },
+  registerAuthRefreshHandler: (handler: () => Promise<string>) => { mocks.refreshHandler = handler },
+  unwrapApiResponse: <T>(response: { code: string; message: string; data: T }) => {
+    if (response.code !== '200') throw new Error(response.message)
+    return response.data
+  },
+  getApiErrorDetails: (error: { code?: string; message?: string }) => ({
+    message: error.message || '接口请求失败',
+    code: error.code,
+  }),
+}))
+
+vi.mock('./platformAuthorization', () => ({
+  listCurrentPlatformPermissionCodes: mocks.listCurrentPlatformPermissionCodes,
+}))
+
+import { useAuthStore } from './auth'
+
+function createMemoryStorage(): Storage {
+  const values = new Map<string, string>()
+  return {
+    get length() { return values.size },
+    clear: () => values.clear(),
+    getItem: (key) => values.get(key) ?? null,
+    key: (index) => [...values.keys()][index] ?? null,
+    removeItem: (key) => values.delete(key),
+    setItem: (key, value) => values.set(key, value),
+  }
+}
+
+function token(overrides: Record<string, unknown> = {}) {
+  const claims = {
+    user_id: '1000001',
+    username: 'platform_admin',
+    app_code: 'PLATFORM',
+    roles: ['PLATFORM_ADMIN'],
+    permissions: ['platform:warehouse:list', 'platform:order:list'],
+    exp: Math.floor(Date.now() / 1000) + 1800,
+    ...overrides,
+  }
+  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url')
+  return `header.${payload}.signature`
+}
+
+function loginResponse(accessToken = token(), refreshToken = 'refresh-next') {
+  return {
+    code: '200',
+    message: 'success',
+    data: {
+      tokenType: 'Bearer',
+      accessToken,
+      expiresIn: 1800,
+      refreshToken,
+      refreshExpiresIn: 604800,
+    },
+  }
+}
+
+describe('admin auth session', () => {
+  beforeEach(() => {
+    vi.stubGlobal('localStorage', createMemoryStorage())
+    setActivePinia(createPinia())
+    mocks.post.mockReset()
+    mocks.listCurrentPlatformPermissionCodes.mockReset()
+    mocks.refreshHandler = null
+  })
+
+  it('intersects JWT permissions with the current authenticated permission snapshot', async () => {
+    mocks.post.mockResolvedValue(loginResponse())
+    mocks.listCurrentPlatformPermissionCodes.mockResolvedValue(['platform:warehouse:list'])
+    const auth = useAuthStore()
+
+    await auth.login('warehouse_operator', 'password')
+
+    expect(auth.isAuthenticated).toBe(true)
+    expect([...auth.permissionCodes]).toEqual(['platform:warehouse:list'])
+    expect(auth.permissionResources).toEqual([])
+    expect(localStorage.getItem('cc-admin-permission-codes'))
+      .toBe('["platform:warehouse:list"]')
+  })
+
+  it('rejects login and clears the session when the current permission snapshot is unavailable', async () => {
+    mocks.post.mockResolvedValue(loginResponse())
+    mocks.listCurrentPlatformPermissionCodes.mockRejectedValue({ code: 'S0503', message: 'IAM 服务不可用' })
+    const auth = useAuthStore()
+
+    await expect(auth.login('platform_admin', 'password')).rejects.toMatchObject({ code: 'S0503' })
+    expect(auth.isAuthenticated).toBe(false)
+    expect(localStorage.getItem('cc-admin-token')).toBeNull()
+    expect(localStorage.getItem('cc-admin-refresh-token')).toBeNull()
+  })
+
+  it('revokes an issued token pair when the permission snapshot prevents login completion', async () => {
+    mocks.post
+      .mockResolvedValueOnce(loginResponse())
+      .mockResolvedValueOnce({ code: '200', message: 'success', data: null })
+    mocks.listCurrentPlatformPermissionCodes.mockRejectedValue({ code: 'S0503', message: 'IAM 服务不可用' })
+    const auth = useAuthStore()
+
+    await expect(auth.login('platform_admin', 'password')).rejects.toMatchObject({ code: 'S0503' })
+    await Promise.resolve()
+
+    expect(mocks.post).toHaveBeenNthCalledWith(2, '/auth/logout', { refreshToken: 'refresh-next' }, {
+      headers: { Authorization: expect.stringContaining('Bearer header.') },
+    })
+  })
+
+  it('restores an expired access session with the persisted refresh token', async () => {
+    localStorage.setItem('cc-admin-token', token({ exp: Math.floor(Date.now() / 1000) - 30 }))
+    localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
+    mocks.post.mockResolvedValue(loginResponse(token(), 'refresh-rotated'))
+    mocks.listCurrentPlatformPermissionCodes.mockResolvedValue(['platform:warehouse:list'])
+    const auth = useAuthStore()
+
+    await expect(auth.restoreSession()).resolves.toBe(true)
+
+    expect(mocks.post).toHaveBeenCalledWith('/auth/refresh', { refreshToken: 'refresh-old' })
+    expect(auth.refreshToken).toBe('refresh-rotated')
+    expect(auth.isAuthenticated).toBe(true)
+  })
+
+  it('does not let an in-flight refresh restore a session after logout', async () => {
+    localStorage.setItem('cc-admin-token', token())
+    localStorage.setItem('cc-admin-refresh-token', 'refresh-old')
+    let resolveRefresh: ((value: ReturnType<typeof loginResponse>) => void) | undefined
+    mocks.post.mockImplementation((url: string) => {
+      if (url === '/auth/refresh') {
+        return new Promise((resolve) => { resolveRefresh = resolve })
+      }
+      return Promise.resolve({ code: '200', message: 'success', data: null })
+    })
+    const auth = useAuthStore()
+
+    const refreshing = auth.refreshSession()
+    await Promise.resolve()
+    await auth.logout()
+    resolveRefresh?.(loginResponse(token(), 'refresh-rotated'))
+
+    await expect(refreshing).rejects.toThrow('登录会话已被后续操作替代')
+    expect(auth.isAuthenticated).toBe(false)
+    expect(auth.refreshToken).toBe('')
+    expect(localStorage.getItem('cc-admin-token')).toBeNull()
+  })
+})