fix(auth): restore cross-tab permissions and bind retries to session identity

2026-10-02 23:29:20 +08:00
parent e564353a80
commit 5f963f326e
7 changed files with 386 additions and 109 deletions
@@ -0,0 +1,138 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { readFileSync } from 'node:fs'
+import ts from 'typescript'
+import * as vue from 'vue'
+import * as pinia from 'pinia'
+
+function compile(path, dependencies = {}) {
+  const code = ts.transpileModule(readFileSync(new URL(path, import.meta.url), 'utf8'), {
+    compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
+  }).outputText
+  const exports = {}
+  new Function('require', 'exports', code)(id => { assert.ok(id in dependencies, id); return dependencies[id] }, exports)
+  return exports
+}
+function storage() {
+  const values = new Map()
+  return { getItem: key => values.get(key) ?? null, setItem: (key, value) => values.set(key, value), removeItem: key => values.delete(key) }
+}
+function token(user = 1, tenant = 1, membership = 1, nonce = 'a') {
+  return `test.${Buffer.from(JSON.stringify({ user_id: user, tenant_id: tenant, membership_id: membership, username: `user-${user}`, app_code: 'MERCHANT', exp: 4102444800, nonce })).toString('base64url')}.test`
+}
+const flush = () => new Promise(resolve => setTimeout(resolve, 10))
+function deferred() { let resolve, reject; const promise = new Promise((yes, no) => { resolve = yes; reject = no }); return { promise, resolve, reject } }
+
+function harness(t, expired = false) {
+  globalThis.localStorage = storage(); globalThis.sessionStorage = storage()
+  const listeners = new Map()
+  globalThis.window = { addEventListener: (name, fn) => listeners.set(name, fn) }
+  const session = compile('../../../api/session.ts')
+  const initial = expired ? `test.${Buffer.from(JSON.stringify({ user_id: 1, tenant_id: 1, membership_id: 1, username: 'user-1', app_code: 'MERCHANT', exp: 1 })).toString('base64url')}.test` : token()
+  session.persistTokenPair({ accessToken: initial, refreshToken: 'refresh-a' })
+  let reads = 0
+  const behavior = { permissions: async () => ['edit'], tenant: async () => ({ tenantName: 'company' }) }
+  class ApiError extends Error { constructor(status) { super('failed'); this.status = status } }
+  const module = compile('./auth.ts', {
+    vue, pinia, '@/api/session': session,
+    '@/modules/auth/api/auth': { logoutMerchant: async () => {} },
+    '@/modules/auth/utils/jwt': compile('../utils/jwt.ts'),
+    '@/api/http': { ApiError, refreshAuthenticatedSession: async () => {
+      session.persistTokenPair({ accessToken: token(1, 1, 1, 'refreshed'), refreshToken: 'refresh-new' })
+      listeners.get('cc-client-session-updated')()
+      return session.getAccessToken()
+    } },
+    '@/modules/tenant-management/public': {
+      FRONTEND_TO_MERCHANT_PERMISSION_CODES: { 'order:first-leg:edit': 'edit' },
+      hasMappedMerchantPermission: (_, codes) => codes.has('edit'),
+      getCurrentMerchantPermissionCodes: () => { reads++; return behavior.permissions() },
+      getTenantProfile: () => behavior.tenant(), getMerchantPersonalProfile: async () => ({}),
+    },
+  })
+  const context = pinia.createPinia(); pinia.setActivePinia(context)
+  t.after(async () => { await flush(); pinia.disposePinia(context) })
+  const auth = module.useAuthStore()
+  const event = key => listeners.get('storage')({ key, storageArea: localStorage })
+  function rotate(nextToken = token(1, 1, 1, 'b')) {
+    session.persistTokenPair({ accessToken: nextToken, refreshToken: 'refresh-b' })
+    event(session.ACCESS_TOKEN_KEY); event(session.REFRESH_TOKEN_KEY)
+  }
+  return { auth, session, event, rotate, behavior, listeners, ApiError, reads: () => reads }
+}
+
+test('pair storage rotation retains same-identity rights and automatically reloads once without navigation', async t => {
+  const h = harness(t); await h.auth.restoreSession()
+  h.behavior.permissions = async () => []
+  h.rotate()
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), true)
+  assert.equal(h.auth.sessionRestored, false)
+  await flush()
+  assert.equal(h.auth.sessionRestored, true)
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), false, 'new server rights replace the retained snapshot')
+  assert.equal(h.reads(), 2)
+  h.listeners.get('cc-client-session-updated')()
+  await flush()
+  assert.equal(h.reads(), 2, 'already applied token does not reload twice')
+})
+
+test('startup expired-token refresh waits for restored rights even when local rotation emits an event', async t => {
+  const h = harness(t, true)
+  await h.auth.restoreSession()
+  assert.equal(h.auth.isAuthenticated, true)
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), true)
+  assert.equal(h.auth.sessionRestored, true)
+  assert.equal(h.reads(), 1)
+})
+
+test('logout storage event immediately clears rights and late context cannot restore them', async t => {
+  const h = harness(t); const old = deferred(); h.behavior.permissions = () => old.promise
+  const pending = h.auth.restoreSession()
+  h.session.clearSessionTokens(); h.event(h.session.ACCESS_TOKEN_KEY)
+  assert.equal(h.auth.isAuthenticated, false)
+  assert.deepEqual(h.auth.permissionCodes, [])
+  old.resolve(['edit']); await pending; await flush()
+  assert.equal(h.auth.user, null)
+  assert.deepEqual(h.auth.permissionCodes, [])
+})
+
+test('account, customer and membership switches revoke rights immediately and reject stale request results', async t => {
+  const h = harness(t); await h.auth.restoreSession()
+  const old = deferred(); h.behavior.permissions = () => old.promise
+  h.rotate(); await flush()
+  h.behavior.permissions = async () => []
+  h.rotate(token(2, 2, 2, 'new'))
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), false)
+  assert.equal(h.auth.user.id, '2')
+  await flush(); old.resolve(['edit']); await flush()
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), false)
+  assert.equal(h.auth.user.id, '2')
+  h.behavior.permissions = async () => ['edit']; h.rotate(token(2, 3, 3, 'next')); await flush()
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), true)
+  h.rotate(token(2, 3, 4, 'membership'))
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), false)
+})
+
+test('context failure is not marked restored and explicit retry coalesces concurrent callers', async t => {
+  const h = harness(t)
+  h.behavior.permissions = async () => { throw new Error('offline') }
+  await h.auth.restoreSession()
+  assert.equal(h.auth.sessionRestored, false)
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), false)
+  const pending = deferred(); h.behavior.permissions = () => pending.promise
+  const first = h.auth.restoreSession(), second = h.auth.restoreSession()
+  assert.equal(h.reads(), 2)
+  pending.resolve(['edit']); await Promise.all([first, second])
+  assert.equal(h.auth.sessionRestored, true)
+  assert.equal(h.auth.hasPermission('order:first-leg:edit'), true)
+})
+
+test('stale unauthorized context response cannot clear a newer account', async t => {
+  const h = harness(t); const old = deferred(); h.behavior.permissions = () => old.promise
+  const pending = h.auth.restoreSession()
+  h.behavior.permissions = async () => []
+  h.rotate(token(2, 2, 2)); await flush()
+  old.reject(new h.ApiError(401)); await pending
+  assert.equal(h.auth.user.id, '2')
+  assert.equal(h.auth.isAuthenticated, true)
+  assert.equal(h.auth.sessionRestored, true)
+})