weichen
dc18d6c747
Why: entering the forced-change gate with an API-key credential always fails 401 (passwords are session-owned), and the gate mapped every 401 to "Incorrect username or password", masking the real reason and hiding the self-service exit; admins got locked out before reaching user management. Evidence: npx vitest run green (20 files / 93 tests incl. new test/loginpage.test.ts); tsc -b and check-knip green. Impact: App boot routes key+mustChange to the login page (key cleared); the API-key tab advises password login for must-change accounts; the gate maps backend error strings to distinct actionable messages; api.me type gains authVia. Refs: Dev task feature/admin-auth-gate-fix.
33 lines
2.0 KiB
TypeScript
33 lines
2.0 KiB
TypeScript
// 登录/改密门错误文案：登录与改密的 401 语义不同，映射分开锁定
|
|
// （后端错误串是现行 HTTP 契约的一部分，这里逐字对拍防漂移）。
|
|
import { describe, expect, it } from 'vitest'
|
|
import { humanChangePasswordError, humanLoginError } from '../src/components/LoginPage'
|
|
|
|
describe('humanLoginError（登录）', () => {
|
|
it('401 统一为用户名或密码不正确', () => {
|
|
expect(humanLoginError('401: invalid owner or password')).toBe('用户名或密码不正确')
|
|
})
|
|
it('429/412 各有文案，其余剥状态码前缀', () => {
|
|
expect(humanLoginError('429: too many failed attempts; retry later')).toBe('失败次数过多，请稍后再试')
|
|
expect(humanLoginError('412: auth disabled (embedded single-tenant mode)')).toBe('本服务未开启登录（嵌入式单租户档）')
|
|
expect(humanLoginError('400: bad')).toBe('bad')
|
|
})
|
|
})
|
|
|
|
describe('humanChangePasswordError（改密门）', () => {
|
|
it('当前密码错误不再伪装成登录失败', () => {
|
|
expect(humanChangePasswordError('401: current password incorrect')).toBe('当前密码不正确')
|
|
})
|
|
it('无会话（API key 凭证）给出可行动指引', () => {
|
|
expect(humanChangePasswordError('401: session login required (API keys do not own passwords)')).toBe('请先用账号密码登录再改密（API 密钥不能修改密码）')
|
|
})
|
|
it('会话过期与失效 key 各有文案', () => {
|
|
expect(humanChangePasswordError('401: session expired')).toBe('会话已过期，请重新登录')
|
|
expect(humanChangePasswordError('401: unauthorized: invalid or revoked API key')).toBe('本地残留的 API 密钥已失效，请退出登录后重试')
|
|
})
|
|
it('未知 401 回落通用文案，其余错误剥前缀透传', () => {
|
|
expect(humanChangePasswordError('401: whatever')).toBe('认证失败，请重新登录')
|
|
expect(humanChangePasswordError('400: password must be 8-256 characters')).toBe('password must be 8-256 characters')
|
|
})
|
|
})
|