优化

tests/session-auth.test.mjs

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict'
 
 import {
 	PDA_AUTHORITY, PDA_ROLE, applyWarehouseProfile, replaceTokens, restoreSession, session,
-	decodeAccessToken, signInWithTokens, signOut, validatePdaTokenPair
+	decodeAccessToken, signInWithTokens, signOut, validatePdaToken
 } from '../src/stores/session.js'
 import { receiving } from '../src/stores/receiving.js'
 import { fulfillment, restoreFulfillmentDraft, updateFulfillmentDraft } from '../src/stores/fulfillment.js'
@@ -24,9 +24,9 @@ function tokenPair(overrides = {}) {
 		overseas_warehouse_id: 900, exp: future()
 	}
 	const domestic = { ...base, username: 'picker-42', ...(overrides.domestic || {}) }
-	const overseas = { ...base, ...(overrides.overseas || {}) }
+
 	return {
-		accessToken: jwt(domestic), overseasAccessToken: jwt(overseas),
+		accessToken: jwt(domestic),
 		refreshToken: overrides.refreshToken ?? 'refresh-42',
 		roles: Object.hasOwn(overrides, 'roles') ? overrides.roles : [PDA_ROLE],
 		authorities: Object.hasOwn(overrides, 'authorities') ? overrides.authorities : [PDA_AUTHORITY]
@@ -46,17 +46,17 @@ function storage() {
 test('valid platform warehouse picker tokens freeze the same operator and warehouse', () => {
 	storage(); signOut()
 	const tokens = tokenPair()
-	const pair = validatePdaTokenPair(tokens.accessToken, tokens.overseasAccessToken, tokens)
+	const pair = validatePdaToken(tokens.accessToken, tokens)
 	assert.equal(pair.warehouseId, '900')
 	const user = signInWithTokens(tokens)
 	assert.deepEqual(user.roles, [PDA_ROLE])
 	assert.equal(user.warehouseId, '900')
 	assert.equal(user.warehouse, '')
 	assert.equal(session.tenantId, '0')
-	assert.equal(session.token, tokens.overseasAccessToken)
+	assert.equal(session.token, tokens.accessToken)
 	assert.deepEqual(session.authorization, { roles: [PDA_ROLE], authorities: [PDA_AUTHORITY] })
-	assert.equal(decodeAccessToken(tokens.overseasAccessToken).roles, undefined)
-	assert.equal(decodeAccessToken(tokens.overseasAccessToken).authorities, undefined)
+	assert.equal(decodeAccessToken(tokens.accessToken).roles, undefined)
+	assert.equal(decodeAccessToken(tokens.accessToken).authorities, undefined)
 })
 
 test('JWT decoding preserves unquoted snowflake subjects and warehouse IDs exactly', () => {
@@ -81,11 +81,11 @@ test('login fails closed for wrong role, authority, warehouse, application, or t
 		tokenPair({ authorities: [] }),
 		tokenPair({ roles: null }),
 		tokenPair({ authorities: null }),
-		tokenPair({ overseas: { overseas_warehouse_id: null } }),
+		tokenPair({ domestic: { overseas_warehouse_id: null } }),
 		tokenPair({ domestic: { app_code: 'MERCHANT', tenant_id: 100 } }),
-		tokenPair({ overseas: { user_id: 99 } }),
-		tokenPair({ overseas: { membership_id: 99 } }),
-		tokenPair({ overseas: { overseas_warehouse_id: 901 } })
+		tokenPair({ domestic: { user_id: null } }),
+		tokenPair({ domestic: { membership_id: null } }),
+		tokenPair({ domestic: { exp: null } })
 	]
 	for (const tokens of invalidPairs) {
 		assert.throws(() => signInWithTokens(tokens))
@@ -93,22 +93,40 @@ test('login fails closed for wrong role, authority, warehouse, application, or t
 	}
 })
 
-test('refresh replacement validates both tokens before atomically changing session', () => {
+test('refresh replacement validates the unified token before atomically changing session', () => {
 	storage(); signOut()
 	const original = tokenPair()
 	signInWithTokens(original)
-	const before = { domestic: session.domesticToken, overseas: session.token, refresh: session.refreshToken }
+	const before = { access: session.token, refresh: session.refreshToken }
 	const invalid = tokenPair({ authorities: [], refreshToken: 'invalid-refresh' })
 	assert.throws(() => replaceTokens(invalid), /lastleg:pda:operate/)
-	assert.deepEqual({ domestic: session.domesticToken, overseas: session.token, refresh: session.refreshToken }, before)
+	assert.deepEqual({ access: session.token, refresh: session.refreshToken }, before)
 
 	const replacement = tokenPair({ refreshToken: 'refresh-43' })
 	replaceTokens(replacement)
-	assert.equal(session.domesticToken, replacement.accessToken)
-	assert.equal(session.token, replacement.overseasAccessToken)
+	assert.equal(session.token, replacement.accessToken)
 	assert.equal(session.refreshToken, 'refresh-43')
 })
 
+test('refresh cannot carry an old operation into another user or warehouse', () => {
+	storage(); signOut(); signInWithTokens(tokenPair())
+	const original = session.token
+	for (const domestic of [{ user_id: 99 }, { overseas_warehouse_id: 901 }]) {
+		assert.throws(() => replaceTokens(tokenPair({ domestic })), /主体或绑定仓库已变更/)
+		assert.equal(session.token, original)
+		assert.equal(session.currentUser.warehouseId, '900')
+	}
+})
+
+test('legacy dual-token storage requires a fresh login', () => {
+	const values = storage(); signOut(); signInWithTokens(tokenPair())
+	const saved = structuredClone([...values.values()][0])
+	delete saved.version
+	signOut(); values.set('overseas-pda-auth-session', saved)
+	assert.equal(restoreSession(), false)
+	assert.equal(session.currentUser, null)
+})
+
 test('restore rebuilds identity from claims and removes expired or tampered storage', () => {
 	const values = storage(); signOut()
 	signInWithTokens(tokenPair())
@@ -123,14 +141,14 @@ test('restore rebuilds identity from claims and removes expired or tampered stor
 	assert.equal(restoreSession(), false)
 	assert.equal(values.has('overseas-pda-auth-session'), false)
 
-	const tampered = { ...saved, token: tokenPair({ overseas: { overseas_warehouse_id: 901 } }).overseasAccessToken }
+	const tampered = { ...saved, token: tokenPair({ domestic: { overseas_warehouse_id: 901 } }).accessToken }
 	signOut(); values.set('overseas-pda-auth-session', tampered)
 	assert.equal(restoreSession(), false)
 	assert.equal(session.currentUser, null)
 	assert.equal(values.has('overseas-pda-auth-session'), false)
 
-	const expired = tokenPair({ domestic: { exp: 1 }, overseas: { exp: 1 } })
-	values.set('overseas-pda-auth-session', { ...saved, domesticToken: expired.accessToken, token: expired.overseasAccessToken })
+	const expired = tokenPair({ domestic: { exp: 1 } })
+	values.set('overseas-pda-auth-session', { ...saved, token: expired.accessToken })
 	assert.equal(restoreSession(), false)
 	assert.equal(values.has('overseas-pda-auth-session'), false)
 })
@@ -152,7 +170,6 @@ test('sign out clears tokens, frozen warehouse identity, and every receiving or
 	signOut()
 	assert.equal(session.currentUser, null)
 	assert.equal(session.token, '')
-	assert.equal(session.domesticToken, '')
 	assert.equal(session.refreshToken, '')
 	assert.deepEqual(session.authorization, { roles: [], authorities: [] })
 	assert.equal(values.has('overseas-pda-auth-session'), false)