test(fba): preserve verified fleet and fulfillment acceptance workflows

2026-10-03 06:26:33 +08:00
parent c55bd7f4b6
commit d858357c5d
52 changed files with 4217 additions and 103 deletions
@@ -1,9 +1,32 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
+import { verifyRevokedSessions } from './system.mjs'
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'

+test('撤销检查逐会话核对Access和Refresh且403不能冒充会话失效', async () => {
+  const records = [], calls = []
+  const context = {
+    assert: (_module, name, _response, passed, evidence) => records.push({ name, passed, evidence }),
+    request: async (method, path, body, token) => {
+      calls.push({ method, path, body, token })
+      return { http: path.endsWith('/refresh') ? 200 : 401, body: { code: 'A0401' } }
+    },
+  }
+  await verifyRevokedSessions(context, '密码重置', [{ accessToken: 'a-1', refreshToken: 'r-1' },
+    { accessToken: 'a-2', refreshToken: 'r-2' }])
+  assert.equal(calls.length, 4)
+  assert.ok(records.every(row => row.passed))
+  assert.ok(records.every(row => !/a-1|r-1|a-2|r-2/.test(row.evidence)))
+  assert.equal(calls[1].token, '')
+  context.request = async () => ({ http: 403, body: { code: 'A0403' } })
+  await verifyRevokedSessions(context, '停用', [{ accessToken: 'a', refreshToken: 'r' }])
+  assert.equal(records.at(-2).passed, false)
+  assert.equal(records.at(-1).passed, false)
+  await assert.rejects(verifyRevokedSessions(context, '缺失', [{}]), /完整 Access\/Refresh/)
+})
+
 const here = path.dirname(fileURLToPath(import.meta.url))
 const acceptance = fs.readFileSync(path.join(here, '..', 'admin-test-env-acceptance.mjs'), 'utf8')
 const system = fs.readFileSync(path.join(here, 'system.mjs'), 'utf8')