60%

tests/auth-api-runtime-smoke.js

@@ -11,6 +11,8 @@ const run = async () => {
   const rawSource = fs.readFileSync(path.join(__dirname, "../utils/api.js"), "utf8");
   const moduleBody = rawSource.slice(rawSource.indexOf("const successCodes"));
   const savedTokens = [];
+  const clearedSessions = [];
+  const relaunchedRoutes = [];
   const prelude = `
     const currentUser = {};
     const genealogies = [];
@@ -45,14 +47,21 @@ const run = async () => {
     const session = {
       getToken: () => "",
       saveToken: (token) => globalThis.__savedTokens.push(token),
+      clear: () => globalThis.__clearedSessions.push("cleared"),
     };
   `;
 
   globalThis.__savedTokens = savedTokens;
+  globalThis.__clearedSessions = clearedSessions;
+  globalThis.__relaunchedRoutes = relaunchedRoutes;
   const requests = [];
   let nextResponse = null;
   let holdResponse = false;
   globalThis.uni = {
+    reLaunch(options) {
+      globalThis.__relaunchedRoutes.push(options.url);
+      options.complete?.();
+    },
     request(options) {
       requests.push(options);
       const task = {
@@ -104,6 +113,16 @@ const run = async () => {
   respond({ statusCode: 200, data: { code: 200 } });
   assert.strictEqual(await sendSms(), null, "RVoid 未声明 data 必填，省略 data 仍必须解析为 null");
   assert.strictEqual(requests.at(-1).header.clientid, "client-1");
+  assert.strictEqual(requests.at(-1).header.tenantId, "000000");
+
+  // 已鉴权读取收到业务 401 时，只清理失效的本地会话；请求仍向调用方失败返回。
+  respond({ statusCode: 200, data: { code: 401, msg: "认证失败", data: null } });
+  await assert.rejects(
+    appApi.getProfile(),
+    (error) => error.code === "BUSINESS_ERROR" && error.businessCode === 401,
+  );
+  assert.deepStrictEqual(clearedSessions, ["cleared"]);
+  assert.deepStrictEqual(relaunchedRoutes, ["/pages/auth/a01-entry"]);
 
   respond({ statusCode: 200, data: null });
   await assert.rejects(
@@ -156,6 +175,51 @@ const run = async () => {
   });
   assert.deepStrictEqual(savedTokens, ["token-1", "token-password"]);
 
+  // 登录接口不携带既有会话，错误凭据不能借由 401 清理其他页面的本地会话。
+  respond({ statusCode: 200, data: { code: 401, msg: "密码错误", data: null } });
+  await assert.rejects(
+    appApi.loginWithPassword({
+      phone: "13800138000",
+      passwordHash: "a".repeat(32),
+    }),
+    (error) => error.code === "BUSINESS_ERROR" && error.businessCode === 401,
+  );
+  assert.deepStrictEqual(clearedSessions, ["cleared"]);
+  assert.deepStrictEqual(relaunchedRoutes, ["/pages/auth/a01-entry"]);
+
+  respond({
+    statusCode: 200,
+    data: { code: 200, msg: "操作成功", data: { access_token: "token-register" } },
+  });
+  const registration = await appApi.registerWithPassword({
+    phone: "13800138000",
+    nickName: "  联调昵称  ",
+    passwordHash: "a".repeat(32),
+    smsCode: "1234",
+  });
+  assert.strictEqual(registration.access_token, "token-register");
+  assert.deepStrictEqual(requests.at(-1).data, {
+    clientId: "client-1",
+    tenantId: "000000",
+    grantType: "password",
+    phone: "13800138000",
+    password: "a".repeat(32),
+    smsCode: "1234",
+    nickName: "联调昵称",
+  });
+
+  respond({
+    statusCode: 200,
+    data: { code: 200, msg: "操作成功", data: { access_token: "token-register-empty" } },
+  });
+  await appApi.registerWithPassword({
+    phone: "13800138000",
+    nickName: "   ",
+    passwordHash: "a".repeat(32),
+    smsCode: "1234",
+  });
+  assert.strictEqual(Object.hasOwn(requests.at(-1).data, "nickName"), false);
+
   holdResponse = true;
   const requestController = createRequestController();
   const cancelled = appApi.sendSmsCode(
@@ -175,6 +239,8 @@ const run = async () => {
 
   delete globalThis.uni;
   delete globalThis.__savedTokens;
+  delete globalThis.__clearedSessions;
+  delete globalThis.__relaunchedRoutes;
   process.stdout.write("AUTH-API-RUNTIME-SMOKE PASS\n");
 };