接入前端登录权限底座

client/src/tests/authService.spec.ts

@@ -0,0 +1,125 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { fetchCurrentAuth, loginAuth, logoutAuth } from '@/services/authService'
+
+const jsonHeaders = {
+  headers: {
+    get: (name: string) => (name.toLowerCase() === 'content-type' ? 'application/json' : null),
+  },
+}
+
+function mockJsonResponse(payload: unknown, status = 200): Response {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: async () => payload,
+    text: async () => JSON.stringify(payload),
+    ...jsonHeaders,
+  } as Response
+}
+
+function createAuthPayload() {
+  return {
+    access_token: 'session-token',
+    token_type: 'Bearer',
+    expires_at: '2026-07-09T12:00:00Z',
+    user: {
+      id: '1900000000000000001',
+      username: 'admin',
+      display_name: '系统管理员',
+      super_admin: true,
+    },
+    default_hotel_id: 'HOTEL-TEST',
+    hotels: [
+      {
+        hotel_id: 'HOTEL-TEST',
+        hotel_name: '测试酒店',
+        time_zone: 'Asia/Bangkok',
+        default_hotel: true,
+      },
+    ],
+    permissions: ['RESERVATION_ORDER_READ'],
+    menus: [
+      {
+        menu_code: 'RESERVATION_ORDERS',
+        menu_name: '订单列表',
+        route_path: '/reservation/orders',
+        component_key: 'ReservationOrders',
+        icon_key: 'pi pi-list',
+        permission_code: 'RESERVATION_ORDER_READ',
+        sort_order: 10,
+      },
+    ],
+  }
+}
+
+describe('authService', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks()
+    sessionStorage.clear()
+  })
+
+  it('logs in with username, password, and optional preferred hotel id', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(mockJsonResponse(createAuthPayload()))
+
+    const result = await loginAuth({
+      username: 'admin',
+      password: 'Admin@123456',
+      preferred_hotel_id: 'HOTEL-TEST',
+    })
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/api/auth/login',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          'Content-Type': 'application/json',
+        }),
+        body: JSON.stringify({
+          username: 'admin',
+          password: 'Admin@123456',
+          preferred_hotel_id: 'HOTEL-TEST',
+        }),
+      }),
+    )
+    expect(result.access_token).toBe('session-token')
+    expect(result.default_hotel_id).toBe('HOTEL-TEST')
+  })
+
+  it('restores the current user through auth me', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(mockJsonResponse(createAuthPayload()))
+    sessionStorage.setItem('th_hotel_access_token', 'session-token')
+
+    const result = await fetchCurrentAuth()
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/api/auth/me',
+      expect.objectContaining({
+        method: 'GET',
+        headers: expect.objectContaining({
+          Authorization: 'Bearer session-token',
+        }),
+      }),
+    )
+    expect(result.user.username).toBe('admin')
+  })
+
+  it('logs out the current token without persisting secrets outside sessionStorage', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(mockJsonResponse({ success: true }))
+    sessionStorage.setItem('th_hotel_access_token', 'session-token')
+
+    const result = await logoutAuth()
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      '/api/auth/logout',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          Authorization: 'Bearer session-token',
+        }),
+      }),
+    )
+    expect(result.success).toBe(true)
+    expect(localStorage.getItem('th_hotel_access_token')).toBeNull()
+  })
+})