fba6c5ac22
- 登录页删除体验账号卡片、切换按钮与全部 demo 登录/失败回退逻辑，微信授权失败只提示重试 - completeLogin 只接受服务端签发的 token，禁止无 token 的假登录 - 删除 /api/auth/demo-accounts、/api/auth/demo-login、loadDemoAccounts 与客户端 API - 停止种子 demo_accounts 配置并清理历史配置行；117 套件/763 用例全绿；线上接口已 404
58 行
2.7 KiB
TypeScript
58 行
2.7 KiB
TypeScript
// 已读取AGENTS.md
|
||
import * as fs from 'fs';
|
||
import * as path from 'path';
|
||
|
||
/**
|
||
* 第九十批：登录态一致性（userId 与 userToken 不得错配）。
|
||
* 背景：体验账号回退登录只写 userId=1001 却保留旧 token（属主 2010），
|
||
* 服务端按 token 身份校验 → 判定"以他人身份操作" → 收藏/通知/优惠券/举报全部 403。
|
||
*/
|
||
describe('第九十批登录态一致性闸门', () => {
|
||
const root = path.resolve(__dirname, '../../');
|
||
const api = fs.readFileSync(path.join(root, 'pwuniapp/common/api.js'), 'utf-8');
|
||
const login = fs.readFileSync(path.join(root, 'pwuniapp/pages/auth/login.vue'), 'utf-8');
|
||
|
||
it('completeLogin 只接受服务端签发的 token，缺失时拒绝登录', () => {
|
||
expect(login).toContain('const completeLogin = (userId, customData = {}, sessionToken = \'\')');
|
||
expect(login).toContain('if (!sessionToken)');
|
||
expect(login).toContain('uni.setStorageSync(\'userToken\', sessionToken)');
|
||
// 不再存在"无 token 只写 userId"的体验登录路径
|
||
expect(login).not.toContain('uni.removeStorageSync(\'userToken\')');
|
||
});
|
||
|
||
it('微信登录把 token 交给 completeLogin 统一落库', () => {
|
||
expect(login).toContain('completeLogin(userObj.id, userObj, sessionToken)');
|
||
});
|
||
|
||
it('normalizeUserId 不再做 101→2006 映射；有 token 时缺失 userId 传 0', () => {
|
||
expect(api).not.toContain('if (n === 101) return 2006;');
|
||
expect(api).toContain('if (token) return valid ? n : 0;');
|
||
});
|
||
|
||
it('1001 演示默认值不作为真实身份（登录态下回退 token 识别）', () => {
|
||
expect(api).toContain('Number(target) === 1001');
|
||
expect(api).toContain('n !== 1001');
|
||
expect(api).not.toContain('getUserWithdrawals(userId = 1001)');
|
||
expect(api).not.toContain('getUserFinanceRecords(userId = 1001)');
|
||
expect(api).not.toContain('getUserProfile(userId = 1001)');
|
||
});
|
||
|
||
it('提现/财务页面不再硬编码 1001 查询本人数据', () => {
|
||
for (const rel of [
|
||
'pwuniapp/pages/user/withdraw.vue',
|
||
'pwuniapp/pages/user/withdraw-records.vue',
|
||
'pwuniapp/pages/expert/workspace.vue',
|
||
]) {
|
||
const src = fs.readFileSync(path.join(root, rel), 'utf-8');
|
||
expect(src).not.toContain('getUserWithdrawals(1001)');
|
||
expect(src).not.toContain('getUserProfile(1001)');
|
||
}
|
||
});
|
||
|
||
it('请求层遇身份校验失败 403 时清理错配登录态并提示重新登录', () => {
|
||
const request = fs.readFileSync(path.join(root, 'pwuniapp/common/request.js'), 'utf-8');
|
||
expect(request).toContain('40300 && /身份校验失败|无权以他人身份/');
|
||
expect(request).toContain('res.statusCode === 403 && /身份校验失败|无权以他人身份/');
|
||
});
|
||
});
|