完善桌面端回归与安全边界复审

2026-07-02 10:43:30 +08:00
parent 0d03e1656a
commit a17fa618cd
14 changed files with 275 additions and 14 deletions
@@ -86,6 +86,21 @@ describe("admin project route permissions", () => {
    expect(source).toContain('          : studyStore.currentStudy\n            ? "/project/overview"\n            : "/admin/projects",');
  });

+  it("validates restored session tokens through /me before entering protected routes", () => {
+    const source = readRouter();
+    const restoreGuardIndex = source.indexOf("if (!auth.user && getToken())");
+    const fetchMeIndex = source.indexOf("await auth.fetchMe()", restoreGuardIndex);
+    const logoutIndex = source.indexOf("await auth.logout()", fetchMeIndex);
+    const loginRedirectIndex = source.indexOf('next({ path: "/login" })', logoutIndex);
+    const projectFallbackIndex = source.indexOf("if (token && !studyStore.currentStudy)", restoreGuardIndex);
+
+    expect(restoreGuardIndex).toBeGreaterThan(-1);
+    expect(fetchMeIndex).toBeGreaterThan(restoreGuardIndex);
+    expect(logoutIndex).toBeGreaterThan(fetchMeIndex);
+    expect(loginRedirectIndex).toBeGreaterThan(logoutIndex);
+    expect(fetchMeIndex).toBeLessThan(projectFallbackIndex);
+  });
+
  it("does not register the removed non-admin personal dashboard route", () => {
    const source = readRouter();
    const removedComponent = ["My", "Work", "bench"].join("");