接入前端登录权限底座

client/src/tests/reservationRouter.spec.ts

@@ -1,9 +1,40 @@
 import { describe, expect, it } from 'vitest'
+import type { RouteLocationNormalized } from 'vue-router'
 
-import { router } from '@/router'
+import { createAuthGuard, router } from '@/router'
+import type { useAuthStore } from '@/stores/authStore'
+
+type AuthStoreForGuard = ReturnType<typeof useAuthStore>
+
+function createRoute(path: string, meta: Record<string, unknown> = {}): RouteLocationNormalized {
+  return {
+    fullPath: path,
+    path,
+    name: undefined,
+    params: {},
+    query: {},
+    hash: '',
+    matched: [],
+    meta,
+    redirectedFrom: undefined,
+  } as RouteLocationNormalized
+}
+
+function createAuthStoreForGuard(overrides: Partial<AuthStoreForGuard> = {}): AuthStoreForGuard {
+  return {
+    restoreAttempted: true,
+    isAuthenticated: true,
+    firstMenuPath: '/reservation/orders',
+    hasStoredToken: () => false,
+    restoreFromSession: async () => true,
+    hasPermission: () => true,
+    ...overrides,
+  } as unknown as AuthStoreForGuard
+}
 
 describe('reservation router', () => {
   it('exposes the P0 frontend routes', () => {
+    expect(router.resolve('/login').name).toBe('login')
     expect(router.resolve('/reservation/orders').name).toBe('reservation-order-list')
     expect(router.resolve('/reservation/tasks').name).toBe('reservation-task-list')
     expect(router.resolve('/reservation/orders/20001').name).toBe('reservation-order-detail')
@@ -16,4 +47,42 @@ describe('reservation router', () => {
   it('exposes the Debug EML route', () => {
     expect(router.resolve('/debug/eml-superagent').name).toBe('debug-eml-superagent')
   })
+
+  it('declares permissions for protected P0 routes', () => {
+    expect(router.resolve('/reservation/orders').meta.permission).toBe('RESERVATION_ORDER_READ')
+    expect(router.resolve('/reservation/orders/20001').meta.permission).toBe('RESERVATION_ORDER_READ')
+    expect(router.resolve('/reservation/tasks').meta.permission).toBe('RESERVATION_TASK_READ')
+    expect(router.resolve('/reservation/tasks/10001').meta.permission).toBe('RESERVATION_TASK_READ')
+    expect(router.resolve('/reservation/source-messages/30001/conversation').meta.permission).toBe(
+      'SOURCE_MESSAGE_ORIGINAL_READ',
+    )
+    expect(router.resolve('/debug/eml-superagent').meta.permission).toBe('SYSTEM_DEBUG_EML_RUN')
+  })
+
+  it('redirects anonymous users to login with the protected target as redirect', async () => {
+    const guard = createAuthGuard(() =>
+      createAuthStoreForGuard({
+        isAuthenticated: false,
+      }),
+    )
+
+    await expect(guard(createRoute('/reservation/orders', { permission: 'RESERVATION_ORDER_READ' }))).resolves.toEqual({
+      path: '/login',
+      query: {
+        redirect: '/reservation/orders',
+      },
+    })
+  })
+
+  it('redirects authenticated users without route permission to the unauthorized page', async () => {
+    const guard = createAuthGuard(() =>
+      createAuthStoreForGuard({
+        hasPermission: () => false,
+      }),
+    )
+
+    await expect(guard(createRoute('/debug/eml-superagent', { permission: 'SYSTEM_DEBUG_EML_RUN' }))).resolves.toEqual({
+      name: 'unauthorized',
+    })
+  })
 })