test: harden business boundary conditions

apps/server/src/auth/auth.service.spec.ts

@@ -1,7 +1,7 @@
 import * as bcrypt from 'bcryptjs';
 import { AuthService } from './auth.service';
 
-describe('AuthService — super admin identity', () => {
+describe('AuthService — authentication boundaries', () => {
   it('marks the preset 超管 role as super admin in the JWT payload', async () => {
     const userRepo = {
       findOne: jest.fn().mockResolvedValue({
@@ -22,8 +22,29 @@ describe('AuthService — super admin identity', () => {
 
     await service.login({ username: 'admin', password: 'secret' }, '127.0.0.1');
 
-    expect(jwtService.sign).toHaveBeenCalledWith(
-      expect.objectContaining({ isSuperAdmin: true }),
+    expect(jwtService.sign).toHaveBeenCalledWith(expect.objectContaining({ isSuperAdmin: true }));
+  });
+  it('rejects an archived user even when the password is valid', async () => {
+    const userRepo = {
+      findOne: jest.fn().mockResolvedValue({
+        id: 2,
+        username: 'archived',
+        passwordHash: await bcrypt.hash('secret', 4),
+        isActive: true,
+        isArchived: true,
+        roles: [],
+      }),
+      save: jest.fn(),
+    };
+    const service = new AuthService(
+      userRepo as never,
+      { sign: jest.fn() } as never,
+      { getUserPermissions: jest.fn() } as never,
     );
+
+    await expect(
+      service.login({ username: 'archived', password: 'secret' }, '192.0.2.10'),
+    ).rejects.toThrow('账号已失效');
+    expect(userRepo.save).not.toHaveBeenCalled();
   });
 });