等待后端更新接口

tests/security-upload-scope.test.js

@@ -190,3 +190,30 @@ test('security page field names match phone-change and account-deactivation DTOs
   assert.match(source, /id="deactivateSmsCode"\s+name="smsCode"/);
   assert.match(source, /data-security-send-deactivate-code/);
 });
+
+test('上传状态复用统一组件并区分无权限', () => {
+  const source = fs.readFileSync(path.join(__dirname, '..', 'public', 'js', 'upload-pages.js'), 'utf8');
+
+  assert.match(source, /root\.ProfileUI && root\.ProfileUI\.setApiState/);
+  assert.match(source, /setUploadStatus\(status, 'loading', files\[index\]\.name \+ ' 正在上传…'\)/);
+  assert.match(source, /当前账号无权上传文件。/);
+  assert.match(source, /status\.setAttribute\('role', 'status'\)/);
+  assert.equal(UploadPages.isForbidden({ status: 403 }), true);
+  assert.equal(UploadPages.isForbidden({ status: 401 }), false);
+});
+
+test('security forms provide visible required labels and unified validation, loading and failure feedback', () => {
+  const page = fs.readFileSync(path.join(__dirname, '..', 'profile-security.html'), 'utf8');
+  const script = fs.readFileSync(path.join(__dirname, '..', 'public', 'js', 'security-pages.js'), 'utf8');
+
+  assert.match(page, /data-security-form="password" novalidate/);
+  assert.match(page, /data-security-form="phone" novalidate/);
+  assert.match(page, /data-security-form="deactivate" novalidate/);
+  assert.match(page, /field-required/);
+  assert.match(page, /data-security-status[^>]*role="status"/);
+  assert.match(page, /data-security-bound-phone[^>]*role="status"/);
+  assert.doesNotMatch(page, /微信快捷登录|账号安全提醒/);
+  assert.match(script, /root\.ProfileUI && root\.ProfileUI\.setApiState/);
+  assert.match(script, /function setBoundPhoneStatus\(type, message\)/);
+  assert.match(script, /setStatus\(form, 'error', '验证码发送失败，请稍后重试。'\)/);
+});