feat(api): management photo list and account lookup
P1b Task 4: listAlbumPhotos (GET /albums/{albumId}/photos, tag
[photos]) + lookupUsersByAccount (GET /admin/users, tag [admin]).
- management list: all visibility states visible (unpublished/
published/hidden/deleted) for owner/admin; collaborator 403,
outsider/ghost album 404 (canView -> canManage ordering, same
anti-enumeration as members). Items = PhotoRecord + uploader
{userId, account, displayName} (flat-FK second query, redacted).
Keyset (uploadedAt,id) DESC via shared/cursor; visibility filter
validated against PhotoVisibility enum (400 otherwise), categoryId
must belong to the album (ghost/cross-album same-code 400).
pending_upload rows (uploadedAt NULL) excluded: the sort key is
both the contract-required field and the keyset predicate - NULL
can neither be shaped as PhotoRecord nor compared; in-flight
uploads are covered by the uploads history endpoint.
- account lookup (new src/admin module): prefix search over active
users only (credentialStatus=active, sourceStatus!=disabled,
!localLocked - same eligibility as SessionGuard/members.add),
account ASC, no cursor (small cap). $queryRaw LIKE prefix% with
explicit ESCAPE '!': !/%/_/\ escaped to literal matching (Prisma
startsWith escaping is not contractual); utf8mb4_0900_bin makes
the prefix match case-sensitive ('AL' misses 'alice'), documented
in contract + tests. Access policy per contract: any authenticated
staff (deviation from plan's admin/owner), unauthenticated 401.
- e2e: photos-admin (6) + users-lookup (6) cases; api e2e 136 -> 148.
Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
浅念
@@ -0,0 +1,485 @@
|
||||
// services/api/test/photos-admin.e2e-spec.ts —— P1b Task 4 管理照片列表 e2e
|
||||
// （先写后实现）。真实 app + MySQL。覆盖：
|
||||
// ① owner GET /albums/{albumId}/photos：全部可见性状态可见（unpublished/
|
||||
// published/hidden/deleted，含 uploaded/processing/processing_failed 处理
|
||||
// 态），(uploadedAt,id) DESC 稳定倒序（同 uploadedAt 以 id DESC 决胜），
|
||||
// 条目 = PhotoRecord + uploader{userId,account,displayName} 脱敏内嵌
|
||||
// （无邮箱/密码/状态字段；契约 PhotoRecord 不含 errorCode——管理侧对失败
|
||||
// 的可见性经 processingState=processing_failed 表达）；未完成上传
|
||||
// （pending_upload、uploadedAt NULL）不入列表（排序键未就绪，见服务注释）；
|
||||
// 他册照片不入列表；
|
||||
// ② visibility 过滤（四态逐一 + 非法值 400）；categoryId 过滤（含与
|
||||
// visibility 组合；幽灵/跨册分类 400）；
|
||||
// ③ 游标分页：limit=3 三页跨页无重复、尾页 hasMore=false；非法 cursor /
|
||||
// limit 越界 → 400；
|
||||
// ④ 权限：协作者（非 owner 成员）403 AUTH_FORBIDDEN；外人员工 404
|
||||
// ALBUM_NOT_FOUND；公司 admin 200；幽灵相册 404；未认证 401。
|
||||
import { randomBytes } from 'node:crypto';
|
||||
import { type INestApplication } from '@nestjs/common';
|
||||
import { Test } from '@nestjs/testing';
|
||||
import request from 'supertest';
|
||||
import { PrismaClient } from '@photo/db-cn';
|
||||
import { ErrorCodes } from '@photo/contracts';
|
||||
import { AppCnModule } from '../src/app-cn.module';
|
||||
import { hashSessionToken } from '../src/auth/session.guard';
|
||||
import { API_PREFIX } from '../src/shared/constants';
|
||||
import { resetDb } from './reset';
|
||||
|
||||
jest.setTimeout(120_000);
|
||||
|
||||
/** 契约 pattern ^[0-9a-z]{20,32}$：24 字符 [0-9a-z]（同 albums.service 生成式）。 */
|
||||
function makePublicToken(): string {
|
||||
const alphabet = '0123456789abcdefghijklmnopqrstuvwxyz';
|
||||
let token = '';
|
||||
const bytes = randomBytes(24);
|
||||
for (let i = 0; i < 24; i++) {
|
||||
token += alphabet[bytes[i] % alphabet.length];
|
||||
}
|
||||
return token;
|
||||
}
|
||||
|
||||
/** 契约 PhotoRecord 必返字段 + 管理列表内嵌 uploader（形状精确断言用）。 */
|
||||
const ADMIN_PHOTO_KEYS = [
|
||||
'albumId',
|
||||
'bytes',
|
||||
'categoryId',
|
||||
'height',
|
||||
'likeCount',
|
||||
'photoId',
|
||||
'processingState',
|
||||
'publishedAt',
|
||||
'shotAt',
|
||||
'uploadedAt',
|
||||
'uploader',
|
||||
'uploaderId',
|
||||
'visibility',
|
||||
'width',
|
||||
].sort();
|
||||
|
||||
/** 固定时间基（分钟偏移构造确定性 uploadedAt 序列）。 */
|
||||
const T0 = Date.UTC(2026, 8, 12, 8, 0, 0);
|
||||
const atMinute = (m: number): Date => new Date(T0 + m * 60_000);
|
||||
|
||||
describe('管理照片列表 GET /albums/{albumId}/photos (e2e)', () => {
|
||||
let app: INestApplication;
|
||||
let prisma: PrismaClient;
|
||||
|
||||
let albumId: string;
|
||||
let catAId: string;
|
||||
let catBId: string;
|
||||
let catOtherId: string;
|
||||
|
||||
let ownerId: string;
|
||||
let collabId: string;
|
||||
let ownerToken: string;
|
||||
let collabToken: string;
|
||||
let adminToken: string;
|
||||
let outsiderToken: string;
|
||||
|
||||
// 种子照片（显式 ID + 显式 uploadedAt，期望序可静态推出）。
|
||||
let p1: string; // published / collab / catA / t+50
|
||||
let p2: string; // published / owner / 无分类 / t+40
|
||||
let p3: string; // hidden / collab / catA / t+30
|
||||
let p4: string; // deleted / owner / t+20
|
||||
let p5: string; // unpublished processing_failed / collab / catB / t+10
|
||||
let tieA: string; // unpublished processing / owner / t+0（与 tieB 同刻）
|
||||
let tieB: string; // unpublished uploaded / collab / catB / t+0（同刻 id 决胜）
|
||||
|
||||
/** 全量无过滤期望序（uploadedAt DESC, id DESC；tie-b > tie-a）。 */
|
||||
const FULL_ORDER = () => [p1, p2, p3, p4, p5, tieB, tieA];
|
||||
|
||||
beforeAll(async () => {
|
||||
await resetDb();
|
||||
const moduleRef = await Test.createTestingModule({
|
||||
imports: [AppCnModule],
|
||||
}).compile();
|
||||
app = moduleRef.createNestApplication();
|
||||
app.setGlobalPrefix(API_PREFIX);
|
||||
await app.init();
|
||||
|
||||
prisma = new PrismaClient();
|
||||
|
||||
// 账号：owner / collab（上传协作者）/ admin / outsider（外人员工）。
|
||||
// displayName 与 account 不同值，验证 uploader 映射取的是资料字段。
|
||||
const mkUser = (
|
||||
account: string,
|
||||
displayName: string,
|
||||
role = 'staff',
|
||||
) =>
|
||||
prisma.users.create({
|
||||
data: { account, role, passwordHash: 'x', displayName },
|
||||
select: { id: true },
|
||||
});
|
||||
ownerId = (await mkUser('pa-owner', '潘欧文')).id;
|
||||
collabId = (await mkUser('pa-collab', '程澜')).id;
|
||||
const adminId = (await mkUser('pa-admin', '艾管', 'admin')).id;
|
||||
const outsiderId = (await mkUser('pa-outsider', '韦外')).id;
|
||||
|
||||
const mkToken = async (userId: string): Promise<string> => {
|
||||
const token = randomBytes(32).toString('hex');
|
||||
await prisma.sessions.create({
|
||||
data: {
|
||||
userId,
|
||||
tokenHash: hashSessionToken(token),
|
||||
expiresAt: new Date(Date.now() + 3_600_000),
|
||||
},
|
||||
});
|
||||
return token;
|
||||
};
|
||||
ownerToken = await mkToken(ownerId);
|
||||
collabToken = await mkToken(collabId);
|
||||
adminToken = await mkToken(adminId);
|
||||
outsiderToken = await mkToken(outsiderId);
|
||||
|
||||
// 主相册：owner + collab 成员行；分类 catA/catB。
|
||||
const album = await prisma.albums.create({
|
||||
data: {
|
||||
publicToken: makePublicToken(),
|
||||
ownerId,
|
||||
startAt: new Date(),
|
||||
defaultLocale: 'zh-CN',
|
||||
},
|
||||
select: { id: true },
|
||||
});
|
||||
albumId = album.id;
|
||||
await prisma.album_translations.create({
|
||||
data: { albumId, locale: 'zh-CN', title: '管理列表相册' },
|
||||
});
|
||||
await prisma.album_members.createMany({
|
||||
data: [
|
||||
{ albumId, userId: ownerId, role: 'owner', status: 'active' },
|
||||
{ albumId, userId: collabId, role: 'collaborator', status: 'active' },
|
||||
],
|
||||
});
|
||||
const catA = await prisma.categories.create({
|
||||
data: { albumId, sortOrder: 1 },
|
||||
select: { id: true },
|
||||
});
|
||||
const catB = await prisma.categories.create({
|
||||
data: { albumId, sortOrder: 2 },
|
||||
select: { id: true },
|
||||
});
|
||||
catAId = catA.id;
|
||||
catBId = catB.id;
|
||||
await prisma.category_translations.createMany({
|
||||
data: [
|
||||
{ categoryId: catAId, locale: 'zh-CN', name: '晚宴' },
|
||||
{ categoryId: catBId, locale: 'zh-CN', name: '后台' },
|
||||
],
|
||||
});
|
||||
|
||||
// 他册（跨册分类/照片排除用）：owner 名下独立相册 + 分类 + 一张 published。
|
||||
const otherAlbum = await prisma.albums.create({
|
||||
data: {
|
||||
publicToken: makePublicToken(),
|
||||
ownerId,
|
||||
startAt: new Date(),
|
||||
defaultLocale: 'zh-CN',
|
||||
},
|
||||
select: { id: true },
|
||||
});
|
||||
const catOther = await prisma.categories.create({
|
||||
data: { albumId: otherAlbum.id, sortOrder: 1 },
|
||||
select: { id: true },
|
||||
});
|
||||
catOtherId = catOther.id;
|
||||
await seedPhoto({
|
||||
id: 'pa-photo-other',
|
||||
targetAlbumId: otherAlbum.id,
|
||||
uploaderId: ownerId,
|
||||
visibility: 'published',
|
||||
processingState: 'ready',
|
||||
uploadedAt: atMinute(45),
|
||||
});
|
||||
|
||||
// 主册种子：两上传人 × 全可见性状态 × 处理态变体；tie 对同 uploadedAt。
|
||||
p1 = await seedPhoto({
|
||||
id: 'pa-photo-p1',
|
||||
targetAlbumId: albumId,
|
||||
uploaderId: collabId,
|
||||
visibility: 'published',
|
||||
processingState: 'ready',
|
||||
categoryId: catAId,
|
||||
uploadedAt: atMinute(50),
|
||||
});
|
||||
p2 = await seedPhoto({
|
||||
id: 'pa-photo-p2',
|
||||
targetAlbumId: albumId,
|
||||
uploaderId: ownerId,
|
||||
visibility: 'published',
|
||||
processingState: 'ready',
|
||||
uploadedAt: atMinute(40),
|
||||
});
|
||||
p3 = await seedPhoto({
|
||||
id: 'pa-photo-p3',
|
||||
targetAlbumId: albumId,
|
||||
uploaderId: collabId,
|
||||
visibility: 'hidden',
|
||||
processingState: 'ready',
|
||||
categoryId: catAId,
|
||||
uploadedAt: atMinute(30),
|
||||
});
|
||||
p4 = await seedPhoto({
|
||||
id: 'pa-photo-p4',
|
||||
targetAlbumId: albumId,
|
||||
uploaderId: ownerId,
|
||||
visibility: 'deleted',
|
||||
processingState: 'ready',
|
||||
uploadedAt: atMinute(20),
|
||||
});
|
||||
p5 = await seedPhoto({
|
||||
id: 'pa-photo-p5',
|
||||
targetAlbumId: albumId,
|
||||
uploaderId: collabId,
|
||||
visibility: 'unpublished',
|
||||
processingState: 'processing_failed',
|
||||
categoryId: catBId,
|
||||
uploadedAt: atMinute(10),
|
||||
});
|
||||
tieA = await seedPhoto({
|
||||
id: 'pa-photo-tie-a',
|
||||
targetAlbumId: albumId,
|
||||
uploaderId: ownerId,
|
||||
visibility: 'unpublished',
|
||||
processingState: 'processing',
|
||||
uploadedAt: atMinute(0),
|
||||
});
|
||||
tieB = await seedPhoto({
|
||||
id: 'pa-photo-tie-b',
|
||||
targetAlbumId: albumId,
|
||||
uploaderId: collabId,
|
||||
visibility: 'unpublished',
|
||||
processingState: 'uploaded',
|
||||
categoryId: catBId,
|
||||
uploadedAt: atMinute(0),
|
||||
});
|
||||
|
||||
// 未完成上传（init 后未 complete 的会话占位行）：uploadedAt NULL → 不入列表。
|
||||
await prisma.photos.create({
|
||||
data: {
|
||||
id: 'pa-photo-pending',
|
||||
albumId,
|
||||
uploaderId: collabId,
|
||||
objectKey: `photo-live/dev/albums/${albumId}/originals/pa-photo-pending.jpg`,
|
||||
visibility: 'unpublished',
|
||||
processingState: 'pending_upload',
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await app.close();
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
/**
|
||||
* 直种照片行（管理列表不触及对象存储/变体——契约 PhotoRecord 无 URL 字段，
|
||||
* 故无需 MinIO 对象与 photo_variants 行）。
|
||||
*/
|
||||
async function seedPhoto(spec: {
|
||||
id: string;
|
||||
targetAlbumId: string;
|
||||
uploaderId: string;
|
||||
visibility: string;
|
||||
processingState: string;
|
||||
categoryId?: string;
|
||||
uploadedAt: Date;
|
||||
}): Promise<string> {
|
||||
await prisma.photos.create({
|
||||
data: {
|
||||
id: spec.id,
|
||||
albumId: spec.targetAlbumId,
|
||||
uploaderId: spec.uploaderId,
|
||||
categoryId: spec.categoryId ?? null,
|
||||
objectKey: `photo-live/dev/albums/${spec.targetAlbumId}/originals/${spec.id}.jpg`,
|
||||
bytes: 12345,
|
||||
width: 800,
|
||||
height: 500,
|
||||
uploadedAt: spec.uploadedAt,
|
||||
publishedAt:
|
||||
spec.visibility === 'unpublished' ? null : new Date(spec.uploadedAt),
|
||||
processingState: spec.processingState,
|
||||
visibility: spec.visibility,
|
||||
entityVersion: 2,
|
||||
},
|
||||
});
|
||||
return spec.id;
|
||||
}
|
||||
|
||||
function listMgmt(
|
||||
token: string,
|
||||
query?: Record<string, string | number>,
|
||||
) {
|
||||
return request(app.getHttpServer())
|
||||
.get(`/${API_PREFIX}/albums/${albumId}/photos`)
|
||||
.set('Authorization', `Bearer ${token}`)
|
||||
.query(query ?? {});
|
||||
}
|
||||
|
||||
function idsOf(body: { items: { photoId: string }[] }): string[] {
|
||||
return body.items.map((item) => item.photoId);
|
||||
}
|
||||
|
||||
it('owner → 200：全状态可见、(uploadedAt,id) DESC、uploader 脱敏内嵌正确', async () => {
|
||||
const res = await listMgmt(ownerToken);
|
||||
expect(res.status).toBe(200);
|
||||
expect(Object.keys(res.body).sort()).toEqual([
|
||||
'hasMore',
|
||||
'items',
|
||||
'nextCursor',
|
||||
]);
|
||||
expect(res.body.hasMore).toBe(false);
|
||||
expect(res.body.nextCursor).toBeNull();
|
||||
|
||||
// 全状态 + 处理态变体全部可见；未完成上传（NULL uploadedAt）与他册照片排除。
|
||||
expect(idsOf(res.body)).toEqual(FULL_ORDER());
|
||||
expect(idsOf(res.body)).not.toContain('pa-photo-pending');
|
||||
expect(idsOf(res.body)).not.toContain('pa-photo-other');
|
||||
|
||||
// 条目形状 = PhotoRecord 全字段 + uploader（无任何凭据/状态冗余字段）。
|
||||
expect(Object.keys(res.body.items[0]).sort()).toEqual(ADMIN_PHOTO_KEYS);
|
||||
|
||||
// uploader 内嵌：两上传人各自映射到 account/displayName（脱敏资料字段）。
|
||||
const byId = new Map(
|
||||
(res.body.items as {
|
||||
photoId: string;
|
||||
uploader: { userId: string; account: string; displayName: string };
|
||||
processingState: string;
|
||||
publishedAt: string | null;
|
||||
categoryId: string | null;
|
||||
}[]).map((item) => [item.photoId, item]),
|
||||
);
|
||||
for (const item of byId.values()) {
|
||||
expect(item.uploader).toEqual(
|
||||
item.uploader.userId === ownerId
|
||||
? { userId: ownerId, account: 'pa-owner', displayName: '潘欧文' }
|
||||
: { userId: collabId, account: 'pa-collab', displayName: '程澜' },
|
||||
);
|
||||
}
|
||||
// 处理态可见性（管理侧失败洞察）：processing_failed / processing / uploaded。
|
||||
expect(byId.get(p5)?.processingState).toBe('processing_failed');
|
||||
expect(byId.get(tieA)?.processingState).toBe('processing');
|
||||
expect(byId.get(tieB)?.processingState).toBe('uploaded');
|
||||
// 未发布 publishedAt=null（与 published 行对照）；分类映射。
|
||||
expect(byId.get(p5)?.publishedAt).toBeNull();
|
||||
expect(byId.get(p1)?.publishedAt).not.toBeNull();
|
||||
expect(byId.get(p1)?.categoryId).toBe(catAId);
|
||||
expect(byId.get(p2)?.categoryId).toBeNull();
|
||||
});
|
||||
|
||||
it('visibility 过滤：published/unpublished/hidden/deleted 逐一命中；非法值 → 400', async () => {
|
||||
const published = await listMgmt(ownerToken, { visibility: 'published' });
|
||||
expect(published.status).toBe(200);
|
||||
expect(idsOf(published.body)).toEqual([p1, p2]);
|
||||
|
||||
const unpublished = await listMgmt(ownerToken, {
|
||||
visibility: 'unpublished',
|
||||
});
|
||||
expect(unpublished.status).toBe(200);
|
||||
expect(idsOf(unpublished.body)).toEqual([p5, tieB, tieA]);
|
||||
|
||||
const hidden = await listMgmt(ownerToken, { visibility: 'hidden' });
|
||||
expect(hidden.status).toBe(200);
|
||||
expect(idsOf(hidden.body)).toEqual([p3]);
|
||||
|
||||
const deleted = await listMgmt(ownerToken, { visibility: 'deleted' });
|
||||
expect(deleted.status).toBe(200);
|
||||
expect(idsOf(deleted.body)).toEqual([p4]);
|
||||
|
||||
for (const garbage of ['public', 'PUBLISHED', '42']) {
|
||||
const res = await listMgmt(ownerToken, { visibility: garbage });
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
}
|
||||
});
|
||||
|
||||
it('categoryId 过滤与组合；幽灵/跨册 categoryId → 400', async () => {
|
||||
const catA = await listMgmt(ownerToken, { categoryId: catAId });
|
||||
expect(catA.status).toBe(200);
|
||||
expect(idsOf(catA.body)).toEqual([p1, p3]);
|
||||
|
||||
const catB = await listMgmt(ownerToken, { categoryId: catBId });
|
||||
expect(catB.status).toBe(200);
|
||||
expect(idsOf(catB.body)).toEqual([p5, tieB]);
|
||||
|
||||
const combined = await listMgmt(ownerToken, {
|
||||
visibility: 'published',
|
||||
categoryId: catAId,
|
||||
});
|
||||
expect(combined.status).toBe(200);
|
||||
expect(idsOf(combined.body)).toEqual([p1]);
|
||||
|
||||
const ghost = await listMgmt(ownerToken, { categoryId: 'no-such-cat' });
|
||||
expect(ghost.status).toBe(400);
|
||||
expect(ghost.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
|
||||
// 跨册分类：真实存在但不属于本相册——同码 400（不区分两种失败，防探测）。
|
||||
const cross = await listMgmt(ownerToken, { categoryId: catOtherId });
|
||||
expect(cross.status).toBe(400);
|
||||
expect(cross.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
});
|
||||
|
||||
it('游标分页：limit=3 三页跨页无重复，尾页 hasMore=false / nextCursor=null', async () => {
|
||||
const seen: string[] = [];
|
||||
let cursor: string | undefined;
|
||||
let pages = 0;
|
||||
for (;;) {
|
||||
const res = await listMgmt(
|
||||
ownerToken,
|
||||
cursor === undefined ? { limit: 3 } : { limit: 3, cursor },
|
||||
);
|
||||
expect(res.status).toBe(200);
|
||||
pages += 1;
|
||||
seen.push(...idsOf(res.body));
|
||||
if (res.body.hasMore === false) {
|
||||
expect(res.body.nextCursor).toBeNull();
|
||||
expect(pages).toBe(3);
|
||||
break;
|
||||
}
|
||||
expect(res.body.nextCursor).toEqual(expect.any(String));
|
||||
cursor = res.body.nextCursor as string;
|
||||
}
|
||||
expect(seen).toEqual(FULL_ORDER());
|
||||
expect(new Set(seen).size).toBe(seen.length); // 无重复
|
||||
});
|
||||
|
||||
it('非法 cursor / limit 越界 → 400 VALIDATION_FAILED', async () => {
|
||||
const badCursor = await listMgmt(ownerToken, { cursor: 'not-a-cursor!' });
|
||||
expect(badCursor.status).toBe(400);
|
||||
expect(badCursor.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
|
||||
for (const limit of [0, 101, 'abc']) {
|
||||
const res = await listMgmt(ownerToken, { limit });
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
}
|
||||
// 合法界内：1 与 100 均 200。
|
||||
expect((await listMgmt(ownerToken, { limit: 1 })).status).toBe(200);
|
||||
expect((await listMgmt(ownerToken, { limit: 100 })).status).toBe(200);
|
||||
});
|
||||
|
||||
it('权限：collab 403 / outsider 404 / admin 200 / 幽灵相册 404 / 未认证 401', async () => {
|
||||
const collabRes = await listMgmt(collabToken);
|
||||
expect(collabRes.status).toBe(403);
|
||||
expect(collabRes.body.code).toBe(ErrorCodes.AUTH_FORBIDDEN);
|
||||
|
||||
const outsiderRes = await listMgmt(outsiderToken);
|
||||
expect(outsiderRes.status).toBe(404);
|
||||
expect(outsiderRes.body.code).toBe(ErrorCodes.ALBUM_NOT_FOUND);
|
||||
|
||||
const adminRes = await listMgmt(adminToken, { visibility: 'deleted' });
|
||||
expect(adminRes.status).toBe(200);
|
||||
expect(idsOf(adminRes.body)).toEqual([p4]);
|
||||
|
||||
const ghost = await request(app.getHttpServer())
|
||||
.get(`/${API_PREFIX}/albums/no-such-album/photos`)
|
||||
.set('Authorization', `Bearer ${ownerToken}`);
|
||||
expect(ghost.status).toBe(404);
|
||||
expect(ghost.body.code).toBe(ErrorCodes.ALBUM_NOT_FOUND);
|
||||
|
||||
const anon = await request(app.getHttpServer())
|
||||
.get(`/${API_PREFIX}/albums/${albumId}/photos`);
|
||||
expect(anon.status).toBe(401);
|
||||
expect(anon.body.code).toBe(ErrorCodes.AUTH_TOKEN_EXPIRED);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,247 @@
|
||||
// services/api/test/users-lookup.e2e-spec.ts —— P1b Task 4 账号前缀查询 e2e
|
||||
// （先写后实现）。真实 app + MySQL。覆盖：
|
||||
// ① 前缀命中：prefix 'al' → albert+alice（account 升序）；条目仅
|
||||
// id/account/displayName（脱敏，无邮箱/手机/状态/凭据字段）；响应仅 items
|
||||
// （无游标——前缀搜索 + 小上限即取即用）；
|
||||
// ② 账号资格过滤：credentialStatus=pending / sourceStatus=disabled /
|
||||
// localLocked=true 均排除（只留「激活」用户）；
|
||||
// ③ 大小写敏感（库级 utf8mb4_0900_bin 二进制校对，契约已注明）：'AL' → 空、
|
||||
// 'carol' → 空、'Carol' → 命中；
|
||||
// ④ LIKE 通配符转义（ESCAPE 子句）：前缀中的 _ / % 按字面匹配，不作单字符/
|
||||
// 任意串通配（esc_ 仅命中字面下划线账号；al% 空）；
|
||||
// ⑤ 参数边界：accountPrefix 缺失/1 字符/65 字符 → 400；2 与 64 字符合法；
|
||||
// limit 缺省 10、1..20 界内、0/21/非整数 → 400；
|
||||
// ⑥ 访问策略（P1b 决策，契约描述）：未认证 401；任何已认证工作人员（含非
|
||||
// admin 的 staff）200；admin 200。
|
||||
import { randomBytes } from 'node:crypto';
|
||||
import { type INestApplication } from '@nestjs/common';
|
||||
import { Test } from '@nestjs/testing';
|
||||
import request from 'supertest';
|
||||
import { PrismaClient } from '@photo/db-cn';
|
||||
import { ErrorCodes } from '@photo/contracts';
|
||||
import { AppCnModule } from '../src/app-cn.module';
|
||||
import { hashSessionToken } from '../src/auth/session.guard';
|
||||
import { API_PREFIX } from '../src/shared/constants';
|
||||
import { resetDb } from './reset';
|
||||
|
||||
jest.setTimeout(120_000);
|
||||
|
||||
describe('账号查询 GET /admin/users (e2e)', () => {
|
||||
let app: INestApplication;
|
||||
let prisma: PrismaClient;
|
||||
|
||||
let staffToken: string; // 非 admin 工作人员（访问策略断言用）
|
||||
let adminToken: string;
|
||||
|
||||
let aliceId: string;
|
||||
let albertId: string;
|
||||
let carolId: string;
|
||||
let escUnderscoreId: string;
|
||||
|
||||
beforeAll(async () => {
|
||||
await resetDb();
|
||||
const moduleRef = await Test.createTestingModule({
|
||||
imports: [AppCnModule],
|
||||
}).compile();
|
||||
app = moduleRef.createNestApplication();
|
||||
app.setGlobalPrefix(API_PREFIX);
|
||||
await app.init();
|
||||
|
||||
prisma = new PrismaClient();
|
||||
|
||||
const mkUser = (
|
||||
account: string,
|
||||
displayName: string,
|
||||
extra: {
|
||||
role?: string;
|
||||
sourceStatus?: string;
|
||||
credentialStatus?: string;
|
||||
localLocked?: boolean;
|
||||
} = {},
|
||||
) =>
|
||||
prisma.users.create({
|
||||
data: {
|
||||
account,
|
||||
passwordHash: 'x',
|
||||
displayName,
|
||||
...extra,
|
||||
},
|
||||
select: { id: true },
|
||||
});
|
||||
|
||||
aliceId = (await mkUser('alice', '爱丽')).id;
|
||||
albertId = (await mkUser('albert', '艾伯')).id;
|
||||
await mkUser('bob', '博伟');
|
||||
carolId = (await mkUser('Carol', '卡萝')).id; // 大写 C——大小写敏感断言
|
||||
// 资格排除组（前缀均 'al' 命中域，但不应出现在结果里）。
|
||||
await mkUser('aldis', '停用者', { sourceStatus: 'disabled' });
|
||||
await mkUser('alpend', '待激活', { credentialStatus: 'pending' });
|
||||
await mkUser('allock', '锁定者', { localLocked: true });
|
||||
// LIKE 通配符转义断言组：esc_ 前缀若未转义 _，会同时命中 escshape。
|
||||
escUnderscoreId = (await mkUser('esc_ape', '下划线')).id;
|
||||
await mkUser('escshape', '形状');
|
||||
// 默认 limit=10 截断断言组：12 个 zz-look-* 账号（升序 01..12）。
|
||||
for (let i = 1; i <= 12; i++) {
|
||||
await mkUser(`zz-look-${String(i).padStart(2, '0')}`, `批量${i}`);
|
||||
}
|
||||
// 请求方：staff（非 admin）与 admin。
|
||||
const staffId = (await mkUser('ul-staff', '陆石')).id;
|
||||
const adminId = (await mkUser('ul-admin', '路安', { role: 'admin' })).id;
|
||||
|
||||
const mkToken = async (userId: string): Promise<string> => {
|
||||
const token = randomBytes(32).toString('hex');
|
||||
await prisma.sessions.create({
|
||||
data: {
|
||||
userId,
|
||||
tokenHash: hashSessionToken(token),
|
||||
expiresAt: new Date(Date.now() + 3_600_000),
|
||||
},
|
||||
});
|
||||
return token;
|
||||
};
|
||||
staffToken = await mkToken(staffId);
|
||||
adminToken = await mkToken(adminId);
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await app.close();
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
function lookup(
|
||||
token: string | null,
|
||||
query?: Record<string, string | number>,
|
||||
) {
|
||||
const req = request(app
|
||||
.getHttpServer())
|
||||
.get(`/${API_PREFIX}/admin/users`);
|
||||
if (token !== null) {
|
||||
req.set('Authorization', `Bearer ${token}`);
|
||||
}
|
||||
return req.query(query ?? {});
|
||||
}
|
||||
|
||||
it("前缀 'al' → albert+alice 升序；禁用/待激活/锁定排除；条目与响应形状脱敏", async () => {
|
||||
const res = await lookup(staffToken, { accountPrefix: 'al' });
|
||||
expect(res.status).toBe(200);
|
||||
// 响应仅 items（契约 AdminUserLookupList：无游标元信息）。
|
||||
expect(Object.keys(res.body).sort()).toEqual(['items']);
|
||||
const items = res.body.items as {
|
||||
id: string;
|
||||
account: string;
|
||||
displayName: string;
|
||||
}[];
|
||||
// account 升序：albert < alice；恰好两条（排除组全不出现在结果）。
|
||||
expect(items.map((item) => item.account)).toEqual(['albert', 'alice']);
|
||||
expect(items.map((item) => item.id)).toEqual([albertId, aliceId]);
|
||||
expect(items.map((item) => item.displayName)).toEqual(['艾伯', '爱丽']);
|
||||
// 条目形状：仅三个脱敏字段（无密码哈希/状态/角色等）。
|
||||
for (const item of items) {
|
||||
expect(Object.keys(item).sort()).toEqual([
|
||||
'account',
|
||||
'displayName',
|
||||
'id',
|
||||
]);
|
||||
}
|
||||
});
|
||||
|
||||
it('大小写敏感（bin 校对）：“AL”/“carol” → 空；“Carol” → 命中', async () => {
|
||||
const upper = await lookup(staffToken, { accountPrefix: 'AL' });
|
||||
expect(upper.status).toBe(200);
|
||||
expect(upper.body.items).toEqual([]);
|
||||
|
||||
const lowerCarol = await lookup(staffToken, { accountPrefix: 'carol' });
|
||||
expect(lowerCarol.status).toBe(200);
|
||||
expect(lowerCarol.body.items).toEqual([]);
|
||||
|
||||
const exact = await lookup(staffToken, { accountPrefix: 'Carol' });
|
||||
expect(exact.status).toBe(200);
|
||||
expect(exact.body.items).toEqual([
|
||||
{ id: carolId, account: 'Carol', displayName: '卡萝' },
|
||||
]);
|
||||
});
|
||||
|
||||
it('LIKE 通配符按字面匹配（ESCAPE）：“esc_” 仅命中字面下划线账号；“al%” 空', async () => {
|
||||
// 未转义时 _ 作单字符通配会同时命中 escshape——转义后只命中 esc_ape。
|
||||
const underscore = await lookup(staffToken, { accountPrefix: 'esc_' });
|
||||
expect(underscore.status).toBe(200);
|
||||
expect(underscore.body.items).toEqual([
|
||||
{ id: escUnderscoreId, account: 'esc_ape', displayName: '下划线' },
|
||||
]);
|
||||
|
||||
// 未转义时 al% 作任意串通配会命中 albert/alice 等——转义后按字面前缀匹配。
|
||||
const percent = await lookup(staffToken, { accountPrefix: 'al%' });
|
||||
expect(percent.status).toBe(200);
|
||||
expect(percent.body.items).toEqual([]);
|
||||
});
|
||||
|
||||
it('accountPrefix 边界：缺失/空串/1 字符/65 字符 → 400；64 字符 → 200 空', async () => {
|
||||
const missing = await lookup(staffToken, {});
|
||||
expect(missing.status).toBe(400);
|
||||
expect(missing.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
|
||||
const empty = await lookup(staffToken, { accountPrefix: '' });
|
||||
expect(empty.status).toBe(400);
|
||||
expect(empty.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
|
||||
const short = await lookup(staffToken, { accountPrefix: 'a' });
|
||||
expect(short.status).toBe(400);
|
||||
expect(short.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
|
||||
const long = await lookup(staffToken, { accountPrefix: 'a'.repeat(65) });
|
||||
expect(long.status).toBe(400);
|
||||
expect(long.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
|
||||
const max = await lookup(staffToken, { accountPrefix: 'a'.repeat(64) });
|
||||
expect(max.status).toBe(200);
|
||||
expect(max.body.items).toEqual([]);
|
||||
});
|
||||
|
||||
it('limit：缺省 10 且升序截断；5 合法；0/21/非整数 → 400；20 合法', async () => {
|
||||
// zz-look-* 共 12 个激活账号：缺省 limit=10 → 恰前 10 个（01..10 升序）。
|
||||
const def = await lookup(staffToken, { accountPrefix: 'zz-look-' });
|
||||
expect(def.status).toBe(200);
|
||||
expect(
|
||||
(def.body.items as { account: string }[]).map((item) => item.account),
|
||||
).toEqual(Array.from({ length: 10 }, (_, i) => `zz-look-${String(i + 1).padStart(2, '0')}`));
|
||||
|
||||
const five = await lookup(staffToken, {
|
||||
accountPrefix: 'zz-look-',
|
||||
limit: 5,
|
||||
});
|
||||
expect(five.status).toBe(200);
|
||||
expect(five.body.items).toHaveLength(5);
|
||||
|
||||
const top = await lookup(staffToken, {
|
||||
accountPrefix: 'zz-look-',
|
||||
limit: 20,
|
||||
});
|
||||
expect(top.status).toBe(200);
|
||||
expect(top.body.items).toHaveLength(12); // 上限 20 > 存量 12，全量返回
|
||||
|
||||
for (const limit of [0, 21, 'abc']) {
|
||||
const res = await lookup(staffToken, {
|
||||
accountPrefix: 'zz-look-',
|
||||
limit,
|
||||
});
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.code).toBe(ErrorCodes.VALIDATION_FAILED);
|
||||
}
|
||||
});
|
||||
|
||||
it('访问策略：未认证 401；已认证 staff（非 admin）200；admin 200', async () => {
|
||||
const anon = await lookup(null, { accountPrefix: 'al' });
|
||||
expect(anon.status).toBe(401);
|
||||
expect(anon.body.code).toBe(ErrorCodes.AUTH_TOKEN_EXPIRED);
|
||||
|
||||
// P1b 决策（契约描述）：邀请发起方不限于 admin/owner，任何已认证工作人员
|
||||
// 可用——此处显式断言非 admin 的 staff 可 200。
|
||||
const staff = await lookup(staffToken, { accountPrefix: 'al' });
|
||||
expect(staff.status).toBe(200);
|
||||
expect(staff.body.items).toHaveLength(2);
|
||||
|
||||
const admin = await lookup(adminToken, { accountPrefix: 'al' });
|
||||
expect(admin.status).toBe(200);
|
||||
expect(admin.body.items).toHaveLength(2);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user