32 lines
965 B
JavaScript
32 lines
965 B
JavaScript
import assert from 'node:assert/strict'
|
|
import test from 'node:test'
|
|
import { decodeMerchantToken } from './jwt.ts'
|
|
|
|
function tokenFor(payload) {
|
|
const encoded = Buffer.from(JSON.stringify(payload)).toString('base64url')
|
|
return `header.${encoded}.signature`
|
|
}
|
|
|
|
const payload = {
|
|
user_id: 1001,
|
|
username: 'merchant_admin',
|
|
tenant_id: 2001,
|
|
membership_id: 3001,
|
|
app_code: 'MERCHANT',
|
|
roles: ['MERCHANT_OWNER'],
|
|
permissions: ['merchant:profile:view'],
|
|
exp: 1900000000,
|
|
}
|
|
|
|
test('decodes a merchant JWT payload for UI identity and permissions', () => {
|
|
assert.deepEqual(decodeMerchantToken(tokenFor(payload)), payload)
|
|
})
|
|
|
|
test('rejects tokens from the platform application domain', () => {
|
|
assert.throws(() => decodeMerchantToken(tokenFor({ ...payload, app_code: 'PLATFORM' })), /账号不属于当前应用端/)
|
|
})
|
|
|
|
test('rejects malformed tokens', () => {
|
|
assert.throws(() => decodeMerchantToken('not-a-jwt'), /登录凭证格式无效/)
|
|
})
|