yaoyao/tests/client/credentialVaultPanel.test.ts

import { flushPromises, mount, type VueWrapper } from '@vue/test-utils'
import { afterEach, beforeEach, expect, it, vi } from 'vitest'
import CredentialVaultPanel from '@/components/app/CredentialVaultPanel.vue'
const api=vi.hoisted(()=>vi.fn())
vi.mock('@/api/client',()=>({apiRequest:api}))
let wrapper:VueWrapper|undefined
const initial={protocol:1,online:true,initialized:true,unlocked:false,execution:'disabled',entries:[],leases:[],tasks:[],requests:[]}
let state:any
function deferred(){let resolve!:(value:any)=>void;const promise=new Promise<any>(r=>{resolve=r});return {resolve,promise}}
beforeEach(()=>{state=structuredClone(initial);api.mockImplementation(async(_path,options)=>options?.method==='POST'?{}:structuredClone(state))})
afterEach(()=>{wrapper?.unmount();wrapper=undefined;vi.useRealTimers();vi.restoreAllMocks();api.mockReset()})
async function setup(){wrapper=mount(CredentialVaultPanel);await flushPromises();return wrapper}
it('shows an offline state without offering secret entry and explicitly keeps real login disabled',async()=>{
  state.online=false;const w=await setup()
  expect(w.find('input[type=password]').exists()).toBe(false);expect(w.text()).toContain('尚未启用');expect(w.text()).toContain('不会自动安装或启动服务')
})
it('offers local credential management and task approval without requiring an independent service',async()=>{
  state.initialized=false;state.storageMode='local';state.execution='local-adapters';const w=await setup()
  expect(w.text()).toContain('需要你授权具体任务');expect(w.text()).toContain('创建密码库')
  state.initialized=true;state.unlocked=true
  await w.findAll('button').find(b=>b.text()==='刷新状态')!.trigger('click');await flushPromises()
  await w.findAll('button').find(b=>b.text()==='添加凭据')!.trigger('click')
  const editor=w.findAll('form')[0]!,label=(text:string)=>editor.findAll('label').find(l=>l.text().startsWith(text))!
  await label('名称').get('input').setValue('Dummy site');await label('用户名').get('input').setValue('dummy')
  await label('准确网站').get('input').setValue('https://example.test');await label('密码').get('input').setValue('DUMMY-new-secret')
  await editor.trigger('submit');await flushPromises()
  expect(api).toHaveBeenCalledWith('/api/app/vault/entries',expect.objectContaining({method:'POST',body:{name:'Dummy site',username:'dummy',target:{kind:'website',origin:'https://example.test'},secret:'DUMMY-new-secret'}}))
  expect(w.findAll('button').find(b=>b.text().startsWith('授予本任务'))!.attributes('disabled')).toBeDefined()
  expect(w.text()).not.toContain('DUMMY-new-secret');expect(w.find('input[type=password]').exists()).toBe(true)
})
it('reports a wrong vault master password without expiring the application login or echoing errors',async()=>{
  const w=await setup();await w.get('input[type=password]').setValue('DUMMY-wrong-master')
  api.mockImplementation(async(path)=>{if(path.endsWith('/unlock'))throw Object.assign(new Error('DUMMY-private-error-DUMMY-wrong-master'),{code:'vault_unlock_failed'});return structuredClone(state)})
  await w.get('form').trigger('submit');await flushPromises()
  expect(api).toHaveBeenCalledWith('/api/app/vault/unlock',expect.objectContaining({notifyUnauthorized:false}))
  expect(w.get('[role=alert]').text()).toContain('主密码错误');expect(w.text()).not.toContain('DUMMY-private-error');expect(w.text()).not.toContain('DUMMY-wrong-master')
  expect(w.get<HTMLInputElement>('input[type=password]').element.value).toBe('')
})
it('preserves a master password draft while locked status is polled, then clears it after manual unlock',async()=>{
  vi.useFakeTimers();const storage=vi.spyOn(Storage.prototype,'setItem'),w=await setup(),input=w.get<HTMLInputElement>('input[type=password]')
  await input.setValue('DUMMY-ONLY-master');await vi.advanceTimersByTimeAsync(3000);await flushPromises();expect(input.element.value).toBe('DUMMY-ONLY-master')
  await w.get('form').trigger('submit');await flushPromises()
  expect(api).toHaveBeenCalledWith('/api/app/vault/unlock',expect.objectContaining({method:'POST',body:{password:'DUMMY-ONLY-master',seconds:300}}))
  expect(input.element.value).toBe('');expect(storage).not.toHaveBeenCalled()
})
it('checks confirmation before initialization and leaves no draft in unmounted UI',async()=>{
  state.initialized=false;const w=await setup(),inputs=w.findAll('input[type=password]')
  await inputs[0]!.setValue('dummy-master-A');await inputs[1]!.setValue('dummy-master-B');await w.get('form').trigger('submit')
  expect(w.get('[role=alert]').text()).toContain('不一致');expect(api.mock.calls.filter(([,o])=>o?.method==='POST')).toHaveLength(0)
  w.unmount();wrapper=undefined
})
it('editing exposes no saved secret and omits a blank replacement in the request',async()=>{
  state.unlocked=true;state.entries=[{id:'dummy-id',name:'dummy',username:'fixture',target:{kind:'website',origin:'https://example.test'},revision:3,updatedAt:1}]
  const w=await setup();await w.findAll('button').find(b=>b.text()==='编辑')!.trigger('click')
  const password=w.get<HTMLInputElement>('input[type=password]');expect(password.element.value).toBe('')
  await w.findAll('form')[0]!.trigger('submit');await flushPromises()
  const call=api.mock.calls.find(([p,o])=>p==='/api/app/vault/entries/dummy-id'&&o.method==='PUT')!
  expect(call[1].body).not.toHaveProperty('secret');expect(call[1].body.revision).toBe(3)
  expect(api.mock.calls.some(([p])=>p.includes('read-secret'))).toBe(false)
})
it('unmount aborts an in-flight unlock and sends an explicit lock without a password',async()=>{
  const w=await setup();await w.get('input[type=password]').setValue('dummy-master-only')
  const pending=deferred();api.mockImplementation((p)=>p.endsWith('/unlock')?pending.promise:Promise.resolve({}))
  await w.get('form').trigger('submit');const call=api.mock.calls.find(([p])=>p.endsWith('/unlock'))!
  w.unmount();wrapper=undefined;expect(call[1].signal.aborted).toBe(true)
  expect(api).toHaveBeenCalledWith('/api/app/vault/lock',expect.objectContaining({body:{}}));pending.resolve({});await flushPromises()
})
it('hiding the page locks even while unlock is still pending',async()=>{
  const w=await setup();await w.get('input[type=password]').setValue('dummy-master-only')
  const pending=deferred();api.mockImplementation(p=>p.endsWith('/unlock')?pending.promise:Promise.resolve({}))
  await w.get('form').trigger('submit');const call=api.mock.calls.find(([p])=>p.endsWith('/unlock'))!
  vi.spyOn(document,'hidden','get').mockReturnValue(true);document.dispatchEvent(new Event('visibilitychange'))
  await w.vm.$nextTick()
  expect(call[1].signal.aborted).toBe(true);expect(api).toHaveBeenCalledWith('/api/app/vault/lock',expect.objectContaining({body:{}}))
  expect(w.get<HTMLInputElement>('input[type=password]').element.value).toBe('');pending.resolve({});await flushPromises()
})
it('configures an encrypted fixed SFTP body in the dedicated UI, clears it after save and never reads it back',async()=>{
  state.unlocked=true;state.execution='protected-adapters';const w=await setup()
  await w.findAll('button').find(b=>b.text()==='添加凭据')!.trigger('click')
  const editor=w.findAll('form')[0]!
  await editor.get('select').setValue('ssh');await editor.get('input[type=checkbox]').setValue(true)
  await editor.findAll('label').find(l=>l.text().startsWith('SSH 认证方式'))!.get('select').setValue('privateKey')
  await editor.findAll('label').find(l=>l.text().startsWith('允许操作'))!.get('select').setValue('sftp.write')
  const label=(text:string)=>editor.findAll('label').find(l=>l.text().startsWith(text))!
  await label('名称').get('input').setValue('dummy transfer');await label('用户名').get('input').setValue('dummy')
  await label('SSH 主机').get('input').setValue('127.0.0.1');await label('服务器指纹').get('input').setValue('SHA256:'+'A'.repeat(43))
  await label('私钥').get('textarea').setValue('DUMMY-private-key');await label('批准的远端').get('input').setValue('/approved/new.txt')
  await label('固定写入正文').get('textarea').setValue('DUMMY-private-write-body')
  await editor.trigger('submit');await flushPromises()
  expect(api).toHaveBeenCalledWith('/api/app/vault/entries',expect.objectContaining({method:'POST',body:expect.objectContaining({usage:{kind:'sftp.write',remotePath:'/approved/new.txt',contents:'DUMMY-private-write-body'}})}))
  expect(w.find('textarea').exists()).toBe(false);expect(w.text()).not.toContain('DUMMY-private-write-body')
})

it('defaults to a masked SSH password and saves it without a host fingerprint or opening advanced settings',async()=>{
  state.unlocked=true;state.storageMode='local';const w=await setup()
  await w.findAll('button').find(b=>b.text()==='添加凭据')!.trigger('click')
  const editor=w.get('form'),label=(text:string)=>editor.findAll('label').find(l=>l.text().startsWith(text))!
  await label('用途').get('select').setValue('ssh');expect(label('SSH 认证方式').get('select').element.value).toBe('password')
  expect(editor.get('details').attributes('open')).toBeUndefined();expect(label('服务器指纹').get('input').attributes('required')).toBeUndefined()
  await label('名称').get('input').setValue('Dummy password SSH');await label('用户名').get('input').setValue('dummy')
  await label('SSH 主机').get('input').setValue('ssh.example.test')
  const field=label('SSH 登录密码').get<HTMLInputElement>('input');expect(field.attributes('type')).toBe('password')
  await field.setValue('DUMMY-ssh-login-password')
  expect(editor.text()).not.toContain('私钥口令');expect(editor.find('textarea').exists()).toBe(false)
  await editor.trigger('submit');await flushPromises()
  expect(api).toHaveBeenCalledWith('/api/app/vault/entries',expect.objectContaining({method:'POST',body:{name:'Dummy password SSH',username:'dummy',target:{kind:'ssh',host:'ssh.example.test',port:22,auth:'password'},secret:'DUMMY-ssh-login-password'}}))
  expect(w.text()).not.toContain('DUMMY-ssh-login-password');expect(w.text()).toContain('本次任务授权')
})

it('clears SSH secret drafts on authentication changes and requires a new secret when editing a legacy key entry',async()=>{
  state.unlocked=true;state.storageMode='local';state.entries=[{id:'legacy-id',name:'legacy SSH',username:'dummy',target:{kind:'ssh',host:'ssh.example.test',port:22,hostKey:'SHA256:'+'A'.repeat(43)},revision:2,updatedAt:1}]
  const w=await setup();await w.findAll('button').find(b=>b.text()==='编辑')!.trigger('click')
  const editor=w.get('form'),label=(text:string)=>editor.findAll('label').find(l=>l.text().startsWith(text))!
  expect(label('SSH 认证方式').get('select').element.value).toBe('privateKey')
  await label('私钥').get('textarea').setValue('DUMMY-private-key-draft');await label('私钥口令').get('input').setValue('DUMMY-passphrase-draft')
  await label('SSH 认证方式').get('select').setValue('password')
  const field=label('SSH 登录密码').get<HTMLInputElement>('input')
  expect(field.element.value).toBe('');expect(field.attributes('required')).toBeDefined()
  await editor.trigger('submit');await flushPromises()
  expect(w.get('[role=alert]').text()).toContain('重新填写');expect(api.mock.calls.some(([,o])=>o?.method==='PUT')).toBe(false)
  await field.setValue('DUMMY-replacement-password');await editor.trigger('submit');await flushPromises()
  const body=api.mock.calls.find(([p,o])=>p.endsWith('/legacy-id')&&o.method==='PUT')![1].body
  expect(body).toMatchObject({target:{auth:'password'},secret:'DUMMY-replacement-password',revision:2});expect(body).not.toHaveProperty('passphrase')
  expect(JSON.stringify(body)).not.toContain('DUMMY-private-key-draft')
})

it('keeps an existing SSH password when its masked replacement field is left blank',async()=>{
  state.unlocked=true;state.storageMode='local';state.entries=[{id:'password-id',name:'password SSH',username:'dummy',target:{kind:'ssh',host:'ssh.example.test',port:22,hostKey:'SHA256:'+'A'.repeat(43),auth:'password'},revision:3,updatedAt:1}]
  const w=await setup();await w.findAll('button').find(b=>b.text()==='编辑')!.trigger('click')
  const field=w.get<HTMLInputElement>('input[type=password]');expect(field.element.value).toBe('');expect(field.attributes('required')).toBeUndefined()
  await w.get('form').trigger('submit');await flushPromises()
  const body=api.mock.calls.find(([p,o])=>p.endsWith('/password-id')&&o.method==='PUT')![1].body
  expect(body.target.auth).toBe('password');expect(body).not.toHaveProperty('secret');expect(body).not.toHaveProperty('passphrase')
})

it.each(['pinned','first-use'])('grants a %s local Bot task only its selected configured operation without sending secrets',async trust=>{
  state.unlocked=true;state.storageMode='local';state.execution='local-adapters'
  state.entries=[{id:'credential-id',name:'SSH test',username:'dummy',target:{kind:'ssh',host:'ssh.example.test',port:22,...(trust==='pinned'?{hostKey:'SHA256:'+'A'.repeat(43)}:{}),auth:'password'},usage:{kind:'ssh.exec',command:'/usr/bin/uptime'},revision:1,updatedAt:1}]
  state.tasks=[{workId:'work-id',agentId:'bot-id',name:'Current Bot task'}]
  state.requests=[{workId:'work-id',agentId:'bot-id',credentialRef:'credential-id',operation:'ssh.exec'}]
  const w=await setup(),button=w.findAll('button').find(b=>b.text().startsWith('授予本任务'))!
  expect(button.attributes('disabled')).toBeDefined()
  const label=(text:string)=>w.findAll('label').find(l=>l.text().startsWith(text))!
  await label('凭据').get('select').setValue('credential-id')
  if(trust==='first-use'){expect(button.text()).toBe('确认服务器并授权本任务 60 秒');expect(w.text()).toContain('之后身份变化会停止连接')}
  expect(label('操作').get('select').element.value).toBe('ssh.exec')
  await w.findAll('button').find(b=>b.text()==='选择此请求，核对后授权')!.trigger('click')
  expect(button.attributes('disabled')).toBeUndefined()
  await w.findAll('form')[0]!.trigger('submit');await flushPromises()
  expect(api).toHaveBeenCalledWith('/api/app/vault/leases',expect.objectContaining({method:'POST',body:{credentialRef:'credential-id',agentId:'bot-id',workId:'work-id',operation:'ssh.exec',seconds:60}}))
  expect(w.text()).toContain('已授予此任务');expect(w.text()).not.toContain('需要连接独立')
})