pda-overseas-uniapp/tests/session-auth.test.mjs

import test from 'node:test'
import assert from 'node:assert/strict'

import {
	PDA_AUTHORITY, PDA_ROLE, applyWarehouseProfile, replaceTokens, restoreSession, session,
	decodeAccessToken, signInWithTokens, signOut, validatePdaTokenPair
} from '../src/stores/session.js'
import { receiving } from '../src/stores/receiving.js'

const future = () => Math.floor(Date.now() / 1000) + 3600
const jwt = (claims) => [
	Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url'),
	Buffer.from(JSON.stringify(claims)).toString('base64url'), 'signature'
].join('.')
const rawJwt = (json) => [
	Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url'),
	Buffer.from(json).toString('base64url'), 'signature'
].join('.')

function tokenPair(overrides = {}) {
	const base = {
		user_id: 42, membership_id: 84, tenant_id: 0, app_code: 'PLATFORM',
		overseas_warehouse_id: 900, exp: future()
	}
	const domestic = { ...base, username: 'picker-42', ...(overrides.domestic || {}) }
	const overseas = {
		...base, roles: [PDA_ROLE], authorities: [PDA_AUTHORITY],
		...(overrides.overseas || {})
	}
	return {
		accessToken: jwt(domestic), overseasAccessToken: jwt(overseas),
		refreshToken: overrides.refreshToken ?? 'refresh-42'
	}
}

function storage() {
	const values = new Map()
	globalThis.uni = {
		setStorageSync: (key, value) => values.set(key, JSON.parse(JSON.stringify(value))),
		getStorageSync: (key) => values.get(key),
		removeStorageSync: (key) => values.delete(key)
	}
	return values
}

test('valid platform warehouse picker tokens freeze the same operator and warehouse', () => {
	storage(); signOut()
	const tokens = tokenPair()
	const pair = validatePdaTokenPair(tokens.accessToken, tokens.overseasAccessToken)
	assert.equal(pair.warehouseId, '900')
	const user = signInWithTokens(tokens)
	assert.deepEqual(user.roles, [PDA_ROLE])
	assert.equal(user.warehouseId, '900')
	assert.equal(user.warehouse, '')
	assert.equal(session.tenantId, '0')
	assert.equal(session.token, tokens.overseasAccessToken)
})

test('JWT decoding preserves unquoted snowflake subjects and warehouse IDs exactly', () => {
	const decoded = decodeAccessToken(rawJwt('{"user_id":2091919753535229955,"membership_id":2091919753535229956,"tenant_id":0,"overseas_warehouse_id":2091919753155878914}'))
	assert.equal(decoded.user_id, '2091919753535229955')
	assert.equal(decoded.membership_id, '2091919753535229956')
	assert.equal(decoded.overseas_warehouse_id, '2091919753155878914')
})

test('warehouse master profile replaces the technical ID only for the token-bound warehouse', () => {
	storage(); signOut(); signInWithTokens(tokenPair())
	applyWarehouseProfile({ warehouseId: '900', warehouseCode: 'US-LAX-01', warehouseName: '洛杉矶一号仓' })
	assert.equal(session.currentUser.warehouse, '洛杉矶一号仓')
	assert.equal(session.currentUser.warehouseCode, 'US-LAX-01')
	assert.throws(() => applyWarehouseProfile({ warehouseId: '901', warehouseName: '其他仓' }), /不一致/)
})

test('login fails closed for wrong role, authority, warehouse, application, or token subject', () => {
	storage(); signOut()
	const invalidPairs = [
		tokenPair({ overseas: { roles: ['PLATFORM_ADMIN'] } }),
		tokenPair({ overseas: { authorities: [] } }),
		tokenPair({ overseas: { overseas_warehouse_id: null } }),
		tokenPair({ domestic: { app_code: 'MERCHANT', tenant_id: 100 } }),
		tokenPair({ overseas: { user_id: 99 } }),
		tokenPair({ overseas: { membership_id: 99 } }),
		tokenPair({ overseas: { overseas_warehouse_id: 901 } })
	]
	for (const tokens of invalidPairs) {
		assert.throws(() => signInWithTokens(tokens))
		assert.equal(session.currentUser, null)
	}
})

test('refresh replacement validates both tokens before atomically changing session', () => {
	storage(); signOut()
	const original = tokenPair()
	signInWithTokens(original)
	const before = { domestic: session.domesticToken, overseas: session.token, refresh: session.refreshToken }
	const invalid = tokenPair({ overseas: { authorities: [] }, refreshToken: 'invalid-refresh' })
	assert.throws(() => replaceTokens(invalid), /lastleg:pda:operate/)
	assert.deepEqual({ domestic: session.domesticToken, overseas: session.token, refresh: session.refreshToken }, before)

	const replacement = tokenPair({ refreshToken: 'refresh-43' })
	replaceTokens(replacement)
	assert.equal(session.domesticToken, replacement.accessToken)
	assert.equal(session.token, replacement.overseasAccessToken)
	assert.equal(session.refreshToken, 'refresh-43')
})

test('restore rebuilds identity from claims and removes expired or tampered storage', () => {
	const values = storage(); signOut()
	signInWithTokens(tokenPair())
	const saved = structuredClone([...values.values()][0])
	signOut(); values.set('overseas-pda-auth-session', saved)
	assert.equal(restoreSession(), true)
	assert.equal(session.currentUser.warehouseId, '900')

	const tampered = { ...saved, token: tokenPair({ overseas: { overseas_warehouse_id: 901 } }).overseasAccessToken }
	signOut(); values.set('overseas-pda-auth-session', tampered)
	assert.equal(restoreSession(), false)
	assert.equal(session.currentUser, null)
	assert.equal(values.has('overseas-pda-auth-session'), false)

	const expired = tokenPair({ domestic: { exp: 1 }, overseas: { exp: 1 } })
	values.set('overseas-pda-auth-session', { ...saved, domesticToken: expired.accessToken, token: expired.overseasAccessToken })
	assert.equal(restoreSession(), false)
	assert.equal(values.has('overseas-pda-auth-session'), false)
})

test('sign out clears tokens, frozen warehouse identity, and every receiving draft', () => {
	const values = storage(); signOut()
	signInWithTokens(tokenPair())
	receiving.candidates = [{ containerNo: 'CONT-1' }]
	receiving.current = { containerNo: 'CONT-1', status: 'RECEIVING' }
	receiving.selected = receiving.current
	receiving.photoSlots = [{ fileId: '1' }, null, null]
	receiving.resolvedCarton = { cartonMark: 'BOX-1' }
	receiving.resolvedPallet = { palletCode: 'PALLET-1' }
	receiving.lastReceipt = { acceptedPackages: 1 }

	signOut()
	assert.equal(session.currentUser, null)
	assert.equal(session.token, '')
	assert.equal(session.domesticToken, '')
	assert.equal(session.refreshToken, '')
	assert.equal(values.has('overseas-pda-auth-session'), false)
	assert.deepEqual(receiving.candidates, [])
	assert.equal(receiving.current, null)
	assert.equal(receiving.selected, null)
	assert.deepEqual(receiving.photoSlots, [null, null, null])
	assert.equal(receiving.resolvedCarton, null)
	assert.equal(receiving.resolvedPallet, null)
	assert.equal(receiving.lastReceipt, null)
})