forked from wangziqi/gongxue-base
112 lines
3.0 KiB
JavaScript
112 lines
3.0 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { pathToFileURL } from 'node:url';
|
|
|
|
const repoRoot = process.cwd();
|
|
process.env.TARO_ENV = 'h5';
|
|
process.env.TARO_APP_SUPABASE_URL = 'https://auth.example.test';
|
|
process.env.TARO_APP_SUPABASE_PUBLISHABLE_KEY = 'sb_publishable_test';
|
|
const authModule = await import(pathToFileURL(`${repoRoot}/apps/taro/src/services/api-auth.ts`).href);
|
|
|
|
authModule.setSupabaseAccessTokenProviderForTest(async () => 'supabase_access_token');
|
|
|
|
assert.equal(
|
|
await authModule.resolveApiAuthorization({
|
|
hasTokenOverride: false,
|
|
legacyToken: 'tk_legacy_token',
|
|
}),
|
|
'supabase_access_token',
|
|
);
|
|
|
|
assert.equal(
|
|
await authModule.resolveApiAuthorization({
|
|
hasTokenOverride: false,
|
|
legacyToken: 'tk_legacy_token',
|
|
legacySource: 'app_session',
|
|
}),
|
|
'tk_legacy_token',
|
|
'An explicitly active app session must remain usable for H5 SMS login',
|
|
);
|
|
|
|
assert.equal(
|
|
await authModule.resolveApiAuthorization({
|
|
authMode: 'none',
|
|
hasTokenOverride: false,
|
|
legacyToken: 'tk_legacy_token',
|
|
}),
|
|
null,
|
|
);
|
|
|
|
assert.equal(
|
|
await authModule.resolveApiAuthorization({
|
|
authMode: 'legacy',
|
|
hasTokenOverride: false,
|
|
legacyToken: 'tk_legacy_token',
|
|
}),
|
|
'tk_legacy_token',
|
|
);
|
|
|
|
assert.equal(
|
|
await authModule.resolveApiAuthorization({
|
|
hasTokenOverride: true,
|
|
explicitToken: null,
|
|
legacyToken: 'tk_legacy_token',
|
|
}),
|
|
null,
|
|
);
|
|
|
|
authModule.setSupabaseAccessTokenProviderForTest(async () => null);
|
|
|
|
assert.equal(
|
|
await authModule.resolveApiAuthorization({
|
|
hasTokenOverride: false,
|
|
legacyToken: 'tk_legacy_token',
|
|
legacySource: 'app_session',
|
|
}),
|
|
'tk_legacy_token',
|
|
);
|
|
|
|
assert.equal(
|
|
await authModule.resolveApiAuthorization({
|
|
hasTokenOverride: false,
|
|
legacyToken: 'tk_stale_token',
|
|
legacySource: 'supabase_jwt',
|
|
}),
|
|
null,
|
|
'H5 with Supabase configured must not silently fall back to a stale non-active legacy session',
|
|
);
|
|
|
|
assert.equal(
|
|
await authModule.resolveApiAuthorization({
|
|
authMode: 'supabase',
|
|
hasTokenOverride: false,
|
|
legacyToken: 'tk_legacy_token',
|
|
}),
|
|
null,
|
|
);
|
|
|
|
const authenticatedHeaders = authModule.buildApiHeaders({
|
|
tenantId: 'tenant-1',
|
|
token: 'supabase_access_token',
|
|
extraHeaders: { 'x-client-version': 'test' },
|
|
});
|
|
assert.equal(authenticatedHeaders.authorization, 'Bearer supabase_access_token');
|
|
assert.equal(authenticatedHeaders['x-tenant-id'], 'tenant-1');
|
|
assert.equal(authenticatedHeaders['x-client-version'], 'test');
|
|
|
|
const publicHeaders = authModule.buildApiHeaders({ tenantId: null, token: null });
|
|
assert.equal(publicHeaders.authorization, undefined);
|
|
assert.equal(publicHeaders['x-tenant-id'], undefined);
|
|
|
|
assert.throws(
|
|
() => authModule.buildApiHeaders({ extraHeaders: { Authorization: 'Bearer unsafe' } }),
|
|
/Reserved API header cannot be overridden/,
|
|
);
|
|
assert.throws(
|
|
() => authModule.buildApiHeaders({ tenantId: 'tenant-1', extraHeaders: { 'X-Tenant-Id': 'tenant-2' } }),
|
|
/Reserved API header cannot be overridden/,
|
|
);
|
|
|
|
authModule.setSupabaseAccessTokenProviderForTest(null);
|
|
|
|
console.log('[PASS] Taro API auth mode guardrails');
|